ISO 9001 to CSA N299 Gap Checklist for Nuclear Suppliers

ISO 9001 is a general quality standard for any industry. CSA N299 is written for suppliers to Canadian nuclear power plants, and a purchaser will qualify you against it, usually by their own audit. Your ISO 9001 system gives you much of the structure already: document control, purchasing, calibration, nonconforming output, corrective action and internal audit. This checklist goes element by element through what to check, change or add on top of it. It doesn’t reproduce either standard, so check every answer against the N299 edition and category on your purchase order.

An ISO 9001 certificate is not N299 qualification. The purchaser sets the N299 category (N299.1, N299.2, N299.3 or N299.4) and decides how to qualify you. Find out the category first; it decides how much of this list applies. The N299 audit checklist quotes what each category covers.

Which editions

CSA N299: the current editions are the 2019 editions, reaffirmed in 2025. They replaced the 2016 editions.

ISO 9001: ISO 9001:2026 replaced the 2015 edition on 16 September 2026. Your certificate may still be to 2015 while it transitions. The gaps on this page are about N299, so they apply either way.

Before you start

You know the N299 category and edition your purchaser wants, and you have a copy of that edition.
You know whether design, special processes or commercial-grade items are in your nuclear scope.
You have asked the purchaser how they will qualify you, and roughly when.
You have picked one ISO job similar to the nuclear work and traced it from purchase order to shipment, noting every record an N299 auditor would also want.
Open ISO nonconformances and corrective actions are closed, or have a dated plan.

If you only have time for one of these, do the job trace. Following one real order through your ISO system shows you, step by step, where an N299 record would be missing.

The gaps, element by element

Management and organization

Start from your ISO 9001 organization chart, quality policy and management review records.

Gap questions

Can the person responsible for quality stop work or hold product without approval from production or sales, and is that written down?
Does the organization chart show who is responsible for nuclear work specifically, not just quality in general?
Does management review cover nuclear orders, findings from purchaser audits and open nuclear nonconformances?
Does the quality policy commit to the nuclear requirements your customers place on you?

Records to add or check

Written stop-work authority for the quality manager
Organization chart showing nuclear responsibilities
Management review minutes covering nuclear work

A gap to look for

A quality manager who reports to the production manager, with nothing written down giving them authority to stop work.

Quality program and N299 category

Start from your ISO 9001 quality manual and procedure list.

Gap questions

Does your quality manual say which N299 category and edition it is written to?
Is there a cross-reference from each requirement of that category to the procedure that covers it?
Do your procedures cover nuclear work separately where it differs from commercial work, or say how nuclear orders are identified?
Have you considered the guidance on risk evaluation the 2019 editions added (Annex F), and decided how it applies to you?

Records to add or check

Quality manual stating the N299 category and edition
Requirements cross-reference
Procedure for identifying nuclear orders at contract review

A gap to look for

A quality manual still written to ISO 9001 alone, with no mention of N299 or of how a nuclear order is handled differently.

Training and qualification of personnel

Start from your ISO 9001 competence and training records.

Gap questions

Are inspectors, NDE technicians and welders qualified to the codes and standards your nuclear orders name, not just trained in-house?
Are those qualifications checked as current on the date the work is done?
Has everyone working on nuclear orders been trained on the nuclear-specific procedures, including CFSI awareness?
Are qualification records kept as quality records for the period your customers require?

Records to add or check

Inspector, NDE and welder qualification records with expiry dates
Training records for nuclear procedures
CFSI awareness training records

A gap to look for

Training records that show attendance at a course, with no record of the qualification the purchase order requires.

Document control

Start from your ISO 9001 document control procedure.

Gap questions

Does it control purchaser-supplied drawings and specifications at the revision named on the order?
Are changes to nuclear documents approved by the same function that approved the original?
Can you show which revision was in use on the date a nuclear job was done?
Are superseded copies removed from the shop floor or clearly marked?

Records to add or check

Document master list including purchaser documents
Change and approval history for a nuclear document

A gap to look for

A purchaser drawing used at a revision older than the one on the purchase order, because the order revision was never checked.

Design control

Only if design is in your scope

Start from your ISO 9001 design and development procedure, if you have one.

Gap questions

Is each design verified by someone other than the person who did it, and is that recorded?
Are design inputs, including the codes and purchaser requirements for the nuclear order, recorded and approved?
Do design changes, including field changes, get the same review as the original design?
Do changes that affect the purchaser’s requirements go to the purchaser for approval?

Records to add or check

Design verification records
Design input records for nuclear orders
Design change approvals

A gap to look for

Design verification done by the designer’s own self-check, signed in both boxes.

Procurement and sub-suppliers

Start from your ISO 9001 purchasing procedure and approved supplier list.

Gap questions

Do purchase orders for nuclear work pass down the N299 category, the technical requirements and the records you need from the sub-supplier?
Does your approved supplier list show what each supplier is approved for on nuclear work, separately from commercial work?
Were nuclear sub-suppliers evaluated by audit, survey or history before you used them?
Do purchase orders require sub-suppliers to report nonconformances and CFSI concerns to you?

Records to add or check

Purchase orders with nuclear flow-down clauses
Approved supplier list with nuclear scope
Sub-supplier evaluation records

A gap to look for

A commercial purchase order template used for a nuclear part, so none of the purchaser’s requirements reached the sub-supplier.

Receiving inspection and commercial-grade dedication

Dedication applies if you use commercial-grade items in nuclear work

Start from your ISO 9001 receiving inspection procedure.

Gap questions

Is incoming material for nuclear orders inspected against the purchase order, including certificates and material test reports?
Is nuclear material held until receiving inspection is complete?
If you use commercial-grade items in nuclear work, do you have a written dedication process, as the 2019 editions now require?
For each dedicated item, are the critical characteristics identified and verified, with records?

Records to add or check

Receiving inspection records for nuclear material
Commercial-grade dedication procedure
Dedication plans and records

A gap to look for

Commercial-grade fasteners used on a nuclear order with no dedication record, because they were bought the same way as for commercial jobs.

Counterfeit, fraudulent and suspect items (CFSI)

Start from your ISO 9001 purchasing and receiving procedures. If they say nothing about counterfeit or suspect items, this element is new work.

Gap questions

Is there a written process for preventing, detecting and reporting counterfeit, fraudulent and suspect items?
Do you buy from original manufacturers or authorized distributors where you can?
Are receiving inspectors trained to recognize suspect items and suspect paperwork?
Are suspect items quarantined and reported to the purchaser?

Records to add or check

CFSI procedure
CFSI training records
Records of suspect items found and reported

A gap to look for

No CFSI requirement in purchase orders to distributors, and no one trained to spot suspect certificates.

Identification and traceability

Start from your ISO 9001 identification and traceability procedure.

Gap questions

Can every nuclear part be traced to its heat, lot or serial number?
Is identification transferred when material is cut or split?
Do your records link each nuclear item to its inspection and test results?
Is the marking method acceptable to the purchaser and harmless to the item?

Records to add or check

Heat and lot traceability records
Traveler for a nuclear job
Marking procedure

A gap to look for

Traceability kept at batch level for commercial work and applied the same way to nuclear parts that need it item by item.

Process control and special processes

Start from your ISO 9001 production control procedure, travelers and work instructions.

Gap questions

Are welding, heat treatment and NDE done to qualified procedures with qualification records on file?
Are those procedures qualified to the codes your nuclear orders name?
Are travelers signed off step by step as work is done?
Are process parameters recorded where the procedure requires it?

Records to add or check

Welding procedure specifications and qualification records
Special process procedures
Travelers for a nuclear job

A gap to look for

A weld procedure qualified for commercial work used on a nuclear order whose code it was never qualified to.

Inspection and test

Start from your ISO 9001 inspection and release procedures.

Gap questions

Is there an inspection and test plan for each nuclear order, showing purchaser hold and witness points?
Does work stop at hold points until the purchaser releases it?
Are inspections done by someone other than the person who did the work?
Are acceptance criteria written down before the inspection?

Records to add or check

Inspection and test plans with hold points
Hold point release records
Purchaser notification records

A gap to look for

Work that went past a purchaser hold point because the shop’s ISO process had no concept of a hold point.

Inspection, measuring and test equipment (IMTE)

Start from your ISO 9001 calibration procedure and equipment list.

Gap questions

Is every instrument used on nuclear acceptance on the calibration register?
When an instrument is found out of tolerance, do you trace and evaluate the nuclear items it accepted?
Can you show which instrument was used for each nuclear acceptance measurement?
Are calibrations traceable to national standards?

Records to add or check

Calibration register
Calibration certificates
Out-of-tolerance evaluations covering nuclear items

A gap to look for

An out-of-tolerance gauge with no record of which nuclear parts it had accepted.

Handling, storage and shelf life

Start from your ISO 9001 preservation and storage procedures.

Gap questions

Are nuclear items stored separately, or clearly identified, where the purchaser requires it?
Are shelf-life items tracked and removed when they expire?
Do packaging and shipping meet the purchaser’s nuclear requirements?
Is shelf-life data sent with items where the purchaser asks for it?

Records to add or check

Shelf-life log
Storage area records
Packaging and shipping records for nuclear orders

A gap to look for

Shelf-life material shipped without the shelf-life data the purchaser asked for.

Nonconforming items

Start from your ISO 9001 nonconforming output procedure.

Gap questions

Are use-as-is and repair dispositions on nuclear items sent to the purchaser for approval where the contract requires it?
Are nonconforming nuclear items tagged and segregated so they cannot be used by mistake?
Is each disposition approved by someone with the authority to approve it?
Are repaired and reworked items re-inspected?

Records to add or check

Nonconformance log
Purchaser approvals of dispositions
Hold tags and segregation area

A gap to look for

A use-as-is disposition made in-house, as the ISO process allowed, without the purchaser approval the nuclear contract required.

Corrective action

Start from your ISO 9001 corrective action procedure.

Gap questions

Are findings from purchaser audits and surveillance raised as corrective actions?
Is a cause identified before the action is chosen, for significant problems?
Is each action checked for effectiveness before it is closed?
Are purchaser-reported problems answered within the time the purchaser sets?

Records to add or check

Corrective action log including purchaser findings
Cause analyses
Effectiveness checks

A gap to look for

Purchaser audit findings tracked in email instead of the corrective action system, so nobody checked that the fixes worked.

Quality records

Start from your ISO 9001 control of documented information and records retention list.

Gap questions

Do you keep nuclear records for the period your purchasers require, which may be longer than your commercial retention?
Can you assemble the full record package for a nuclear order?
Does the record package you deliver match what the purchase order asks for?
Have you read the guidance on records the 2019 editions added (Annex G)?

Records to add or check

Records retention schedule with nuclear periods
A complete record package for a nuclear order

A gap to look for

Nuclear records scheduled for disposal after the commercial retention period, years before the purchaser’s period ends.

Internal audits and management review

Start from your ISO 9001 internal audit program.

Gap questions

Does the audit schedule cover every element of the N299 category you work to?
Are your auditors trained on N299, not just ISO 9001?
Are auditors independent of the area they audit?
Have you audited your nuclear procedures at least once before the purchaser does?

Records to add or check

Internal audit schedule mapped to N299
Auditor training records
Audit reports and finding closures

A gap to look for

An internal audit program that still follows the ISO 9001 clause list and has never looked at dedication, CFSI or hold points.

What the 2019 editions added

If you looked at N299 before 2019, or your purchaser’s older documents name the 2016 edition, these changes are the ones to check. The Preface of each 2019 edition, published on the CSA store, lists them under “The most significant updates to this edition include”:

a) the addition of requirements on dedication in Clause 8;
b) the revision of Annex E to provide guidance on counterfeit, fraudulent, and suspect items (CFSIs);
c) the addition of Annex F to provide guidance on risk evaluation; and
d) the addition of Annex G to provide guidance on records.

Each links to the element on this page that deals with it. If your ISO system says nothing about dedication or CFSI, start those two early. They are new processes, not changes to existing ones.

Questions about moving from ISO 9001 to N299

Does ISO 9001 certification meet CSA N299?

No. An ISO 9001 system is a useful starting point, but the purchaser qualifies you against the N299 category and edition they specify, usually by their own audit. An ISO 9001 certificate does not replace that. Compare your system with the specified category and close the gaps first.

What does CSA N299 add to an ISO 9001 system?

N299 is written for suppliers to nuclear power plants. Areas to check in an ISO 9001 system include: the N299 category the purchaser sets, purchaser hold and witness points, purchaser approval of use-as-is and repair dispositions, flow-down to sub-suppliers, commercial-grade dedication (the 2019 editions added requirements on dedication in Clause 8), counterfeit, fraudulent and suspect items, and nuclear record retention.

Which N299 category should I prepare for?

The one your purchaser specifies on the purchase order or procurement specification. N299.1 asks the most of a supplier and N299.4 the least. The CSA N299 audit checklist quotes each category’s scope sentence.

Does ISO 9001:2026 change anything for N299?

No. ISO 9001:2026 replaced the 2015 edition on 16 September 2026, but CSA N299 is a separate standard. The current N299 editions are the 2019 editions, reaffirmed in 2025. Your ISO certificate may still be to the 2015 edition during the transition; the gaps on this page apply either way.

How long does it take to move from ISO 9001 to CSA N299?

It depends on the category, your scope of supply, how much of your ISO system already covers the gaps, and when the purchaser can audit. Agree the qualification process and timing with the purchaser early.

Who audits a supplier against CSA N299?

Usually the purchaser, before awarding safety-related work, followed by surveillance and periodic audits. Third-party certification can be part of the evidence but does not automatically replace purchaser qualification.

What should I do after closing the gaps?

Run an internal audit against the N299 category, then work through the CSA N299 audit checklist as if you were the purchaser’s auditor. Trace one completed nuclear job from purchase order to shipment and check every record on the way.

Doing this with an ISO system and a QA manager already in place? The free readiness assessment scores your program against CSA N299 and lists the gaps. Forged’s self-serve program is built for this move: a template library and lewis for gap analysis and first drafts, with your QA manager holding the pen.

Check your N299 readiness Book a demo →

References

CSA Group. CSA N299.1:19 (R2025), Quality assurance program requirements for the supply of items and services for nuclear power plants, Category 1. Toronto, Ontario: CSA Group, 2019, reaffirmed 2025. Preface read on the CSA store, 4 October 2026.
International Organization for Standardization. ISO 9001:2026: Quality management systems, Requirements. Geneva: ISO, 2026.

Forged Operations builds quality management software for nuclear suppliers and operators. Score your program against CSA N299 for free at forgedops.com/assessment, or email [email protected].

This checklist is a preparation aid. It does not reproduce or replace CSA N299 or ISO 9001. Check each item against the N299 edition and category named in your purchase order. Latest version: forgedops.com/iso-9001-to-csa-n299-gap-checklist/