ISO 9001 certification can provide independent evidence that an organization has established and implemented a Quality Management System that meets the requirements of ISO 9001.
For many companies, certification is also a commercial requirement.
Clients may ask for it during supplier approval, tenders may require it and larger contractors may expect their subcontractors to hold a valid certificate.
However, certification is often misunderstood.
ISO does not visit companies, carry out audits or issue ISO 9001 certificates. Certification is completed by an independent certification body.
It is also important to understand that implementing ISO 9001 and becoming certified are not the same thing.
Implementation is the work involved in building and operating the Quality Management System.
Certification is the independent audit used to determine whether that system meets the requirements of the Standard.
In this guide, I will explain the ISO 9001 certification process, the likely costs and timescales, what happens during the audits and how to avoid the most common mistakes.
ISO 9001 revision update: ISO 9001:2015 remains the current published edition. A revised edition is expected in September 2026. Organizations certified to ISO 9001:2015 will be given a transition period after the revised edition is published. Until then, companies should continue implementing and maintaining their systems against the current published requirements.
What is ISO 9001 certification?
ISO 9001 certification is written assurance from an independent certification body that an organization’s Quality Management System conforms to the applicable requirements of ISO 9001.
The certification body reviews the company’s system, audits its processes and examines evidence of implementation.
If the applicable requirements have been met and any necessary nonconformities have been addressed, the certification body can issue a certificate.
The certificate normally identifies:
- The certified organization
- The applicable Standard
- The scope of certification
- Certified locations
- The certification body
- The certificate number
- Issue and expiry dates
- Relevant accreditation marks
The wording of the scope is important.
A certificate does not necessarily cover every activity, product, office or legal entity connected with the business.
For example, a company may be certified for:
The provision of design, installation and maintenance services from its London office.
That certificate would not automatically demonstrate that an unrelated subsidiary, another office or an excluded activity is covered.
Whenever you review a supplier’s certificate, check the scope and locations rather than simply looking for the ISO 9001 logo.
Does ISO issue ISO 9001 certificates?
No.
ISO develops and publishes International Standards, but it does not certify organizations.
Independent certification bodies carry out certification audits and issue certificates.
An organization should therefore say:
Certified to ISO 9001:2015
It should not say:
Certified by ISO
Companies should also not use ISO’s official logo to advertise certification. ISO’s logo is a protected trademark and is not a certification mark.
The certification body will normally provide rules explaining which marks can be used and how certification may be described.
Is ISO 9001 certification mandatory?
ISO 9001 certification is generally voluntary.
An organization can implement an ISO 9001-compliant Quality Management System without applying for certification.
Certification may nevertheless become necessary when it is required by:
- A customer
- A contract
- A framework agreement
- A tender
- A supplier-approval process
- A regulator
- A parent company
- An industry scheme
This is common in construction, engineering, manufacturing, defence, energy and other sectors where customers want independent evidence that suppliers have controlled management systems.
Before applying, understand why the business wants certification.
If the only objective is to obtain a certificate as quickly as possible, the organization may build a system that looks acceptable during an audit but provides very little operational value.
The better objective is to create a useful QMS and use certification to verify it independently.
Certification, accreditation and registration
These terms are often confused.
Certification
Certification is the independent assessment of the organization’s Quality Management System.
A certification body audits the organization and, where the requirements have been met, issues the ISO 9001 certificate.
Accreditation
Accreditation concerns the certification body.
An accreditation body evaluates whether the certification body is competent, impartial and capable of carrying out management-system certification.
In the UK, the national accreditation body is UKAS.
In the United States, accreditation bodies operating in this area include ANAB.
Other countries have their own national accreditation arrangements.
A simple way to understand the relationship is:
- ISO develops the Standard.
- The organization implements the Standard.
- The certification body audits the organization.
- The accreditation body checks the certification body.
UKAS describes this as “checking the checkers.”
Registration
The term registration is commonly used in the United States and some other markets.
In practice, “ISO 9001 registered” and “ISO 9001 certified” are often used to describe the same third-party certification process.
Should you choose an accredited certification body?
In most cases, yes.
Accreditation provides an additional level of confidence that the certification body has been independently evaluated for competence and impartiality.
Using an accredited certification body may also be required by customers, contracts or tender conditions.
Non-accredited certification is not automatically illegal or worthless. However, it may not be accepted by the organizations that asked you to become certified.
Before appointing a certification body:
- Check whether it is accredited.
- Check the accreditation body.
- Confirm that its accreditation covers ISO 9001.
- Confirm that it covers your technical sector.
- Ask whether the certificate will be internationally recognised.
- Check customer or tender requirements.
- Verify the certification body through an official accreditation directory.
Do this before signing a contract.
A cheap certificate provides very little value if an important customer refuses to accept it.
Who can become ISO 9001 certified?
ISO 9001 can be applied to organizations of any size and in any industry.
Examples include:
- Construction companies
- Manufacturers
- Engineering consultancies
- Technology businesses
- Training providers
- Professional services
- Healthcare organizations
- Charities
- Public-sector bodies
- Small specialist subcontractors
- Large multinational organizations
Certification applies to an organization’s management system.
Individuals cannot become personally certified to ISO 9001.
People can complete ISO 9001 internal-auditor or lead-auditor training, but that is different from organizational certification.
What needs to be in place before certification?
The organization needs more than a collection of procedures.
Before applying for certification, the QMS should be established, implemented and operating.
The company should normally have:
- A defined QMS scope
- Identified processes
- A Quality Policy
- Measurable quality objectives
- Defined responsibilities
- Risk and opportunity controls
- Competent personnel
- Controlled documented information
- Operational controls
- Supplier controls
- Monitoring and measurement
- Customer satisfaction information
- Nonconformity and corrective-action processes
- Completed internal audits
- A completed management review
- Evidence that the system is operating
An auditor will not only review what the documentation says.
They will look for records demonstrating that the processes are being followed.
A procedure for supplier evaluation has little value if no suppliers have actually been evaluated.
The same applies to internal audits, objectives, training, inspections and corrective actions.
The ISO 9001 certification process
The exact process varies slightly between certification bodies, but it normally follows the same general sequence.
Step 1: Define the certification scope
The organization should decide:
- Which legal entity will be certified
- Which products and services are included
- Which locations are included
- Whether design and development applies
- Whether any requirements are not applicable
- Which outsourced processes affect the QMS
The certification scope should accurately reflect the organization’s activities.
A scope that is too narrow may provide little commercial value.
A scope that is too broad may increase audit time, cost and implementation difficulty.
The scope should not be worded to mislead customers about the activities covered by the certificate.
Step 2: Implement the Quality Management System
The company needs to establish the processes and controls required by ISO 9001.
A practical implementation sequence may include:
- Understanding the organization and interested parties.
- Defining the scope.
- Identifying processes and responsibilities.
- Completing a gap analysis.
- Addressing risks and opportunities.
- Establishing the necessary documented information.
- Training employees.
- Implementing operational controls.
- Collecting records.
- Monitoring performance.
- Completing internal audits.
- Completing management review.
- Correcting identified gaps.
Do not write all the procedures before understanding the business.
The system should be built around the organization’s actual processes.
Step 3: Select a certification body
Obtain quotations from several suitable certification bodies.
Provide the same information to each body so the quotations can be compared properly.
They will normally ask for:
- Number of employees
- Number of locations
- Shift arrangements
- Activities and technical sector
- Proposed scope
- Design responsibility
- Outsourced processes
- Existing certifications
- Integrated management systems
- Use of consultants
- Desired certification date
Do not select a certification body on price alone.
Also consider:
- Accreditation
- Industry experience
- Auditor availability
- Geographic coverage
- Communication
- Audit-report quality
- Contract terms
- Cancellation charges
- Surveillance costs
- Recertification costs
- Rules governing certification marks
An auditor should understand your industry well enough to recognise how the requirements apply, but should not tell the organization exactly how to design its management system.
Step 4: Application and contract review
The certification body reviews the application and confirms whether it can provide the service.
It will determine:
- Audit duration
- Required auditor competence
- Locations to be visited
- Scope wording
- Audit dates
- Certification cycle
- Fees
Audit time is not chosen randomly.
It is normally influenced by employee numbers, complexity, risk, shift arrangements, number of sites and applicable processes.
A multi-site construction or engineering company will normally require more audit time than a small single-office consultancy.
Step 5: Optional gap assessment or pre-assessment
Some certification bodies offer an optional pre-assessment.
This is not the formal certification audit.
It can help identify obvious gaps before Stage 1 and Stage 2, but it should not become consultancy provided by the certification body.
A pre-assessment can be useful when:
- The organization is new to management systems.
- The scope is complex.
- Several locations are involved.
- Management wants an independent readiness check.
- The target certification date is commercially important.
However, a proper internal audit and gap analysis may provide enough assurance without paying for another external visit.
Step 6: Stage 1 audit
Stage 1 is sometimes described as the readiness review.
The auditor evaluates whether the organization appears ready for the main certification audit.
The review normally considers:
- QMS scope
- Organizational context
- Processes
- Key documented information
- Locations and site conditions
- Applicable legal and customer requirements
- Quality objectives
- Internal-audit programme
- Management review
- Understanding of ISO 9001 requirements
- Readiness for Stage 2
Stage 1 may be completed on site, remotely or through a combination, depending on the organization and certification-body arrangements.
It is not simply a document check.
The auditor needs enough information to plan Stage 2 and determine whether the QMS is sufficiently developed.
What can happen after Stage 1?
The auditor may identify areas of concern that need to be addressed before Stage 2.
These are not always raised using the same formal classifications as Stage 2 findings, but they should be taken seriously.
Common Stage 1 problems include:
- Scope not clearly defined
- Internal audits incomplete
- Management review not completed
- Processes not understood
- Insufficient implementation records
- Quality objectives not measurable
- Sites not included in planning
- Major activities not addressed
- Design applicability unclear
If the system is not ready, Stage 2 may need to be postponed.
Step 7: Stage 2 certification audit
Stage 2 is the main certification audit.
The auditor evaluates whether the QMS has been effectively implemented and conforms to the applicable ISO 9001 requirements.
The auditor may:
- Interview employees
- Observe activities
- Review documents
- Examine records
- Follow processes from beginning to end
- Sample customer orders or projects
- Review supplier controls
- Examine complaints and NCRs
- Check objectives and performance data
- Review internal audits
- Review management-review outputs
- Visit operational locations
Auditors normally use sampling.
They do not examine every document, order, project or employee.
The organization is still responsible for the conformity of its entire system, not only the sample selected during the audit.
What will the ISO 9001 auditor ask?
Auditors are not supposed to rely only on a fixed list of questions.
They normally follow processes and evidence.
Typical questions include:
- How do you understand customer requirements?
- How do you review contracts?
- What can go wrong in this process?
- How are responsibilities assigned?
- How do employees access current information?
- How is competence evaluated?
- How are suppliers selected and monitored?
- How do you know this output meets requirements?
- What happens when something goes wrong?
- How is customer satisfaction monitored?
- What performance data is reviewed?
- How are audit findings addressed?
- What improvements have been made?
The best answer is not a memorised statement from the Quality Manual.
The best answer explains the real process and is supported by objective evidence.
What records may be sampled?
Depending on the organization, the auditor may review:
- Contracts
- Quotations
- Purchase orders
- Design records
- Supplier evaluations
- Training records
- Inspection records
- Test results
- Calibration records
- Complaints
- NCRs
- Corrective actions
- Performance reports
- Internal-audit reports
- Management-review minutes
- Customer feedback
- Change records
For a construction company, the sample could also include:
- Project Quality Plans
- Method Statements
- Inspection and Test Plans
- Material approvals
- Drawing registers
- RFIs
- Site inspections
- Handover records
- Subcontractor audits
ISO 9001 audit findings explained
Certification bodies may use slightly different terminology, but findings normally include nonconformities and opportunities for improvement.
Major nonconformity
A major nonconformity indicates a significant failure of the management system.
Examples could include:
- A required process has not been implemented.
- Internal audits have not been completed.
- Management review has not taken place.
- There is a systemic failure to control nonconforming outputs.
- The organization cannot demonstrate control of an important operational process.
- Several related minor failures indicate a broader system breakdown.
A major nonconformity will normally prevent certification until it has been satisfactorily addressed and verified.
Minor nonconformity
A minor nonconformity is a failure that does not indicate the complete breakdown of a process or the QMS.
Examples might include:
- An isolated missing record
- One overdue supplier review
- An incomplete competence record
- A local failure to follow a documented process
- An objective without sufficient evidence of monitoring
Minor does not mean unimportant.
Repeated minor failures can become evidence of a systemic problem.
Observation or opportunity for improvement
An auditor may identify something that currently meets requirements but could become a problem or could be improved.
The organization does not necessarily need to treat an opportunity for improvement like a nonconformity.
However, it should consider the issue and decide whether action is appropriate.
The certification auditor should not design the solution for the company.
That would compromise the independence of the audit.
Step 8: Corrective action and certification decision
If nonconformities are raised, the organization normally needs to provide:
- Correction or containment
- Root-cause analysis where appropriate
- Proposed corrective action
- Evidence of implementation
- Evidence that the action is effective, where required
The auditor reviews the response.
A follow-up visit may be required for a major nonconformity or when implementation cannot be verified through submitted evidence.
The auditor does not usually make the final certification decision alone.
The audit report and recommendation are reviewed independently by authorised personnel within the certification body.
If the certification decision is positive, the certificate is issued.
How long is an ISO 9001 certificate valid?
ISO 9001 certificates are commonly issued within a three-year certification cycle, subject to continued satisfactory surveillance.
Certification is not a one-off audit followed by three years without review.
The certification body normally carries out:
- Initial certification audit
- First surveillance audit
- Second surveillance audit
- Recertification audit before the cycle expires
The precise certificate dates and audit programme will be established by the certification body.
If surveillance audits are not completed or serious issues remain unresolved, certification may be suspended or withdrawn.
What happens during surveillance audits?
Surveillance audits are normally shorter than the initial certification audit.
The auditor samples parts of the QMS and checks that the system continues to operate.
Surveillance commonly covers:
- Internal audits
- Management review
- Customer complaints
- Objectives and performance
- Corrective actions
- Previous audit findings
- Changes to the organization
- Use of certification marks
- Selected operational processes
Not every process needs to be reviewed at every surveillance visit, but the programme should cover the system across the certification cycle.
The company should maintain its QMS continuously.
Trying to rebuild missing records a few weeks before the surveillance audit is not an effective approach.
What is recertification?
Recertification takes place before the end of the certification cycle.
It is a more comprehensive audit than routine surveillance and evaluates the continuing suitability and effectiveness of the QMS.
The certification body considers:
- Overall system performance
- Changes
- Previous audit results
- Achievement of objectives
- Continued relevance of the scope
- Ongoing conformity
- Continued commitment to improvement
If recertification is not completed in time, the organization may lose continuity of certification.
Plan it early rather than waiting for the certificate expiry date.
How long does ISO 9001 certification take?
There is no standard implementation timescale.
The total period depends on:
- Organization size
- Number of locations
- Process complexity
- Existing controls
- Available resources
- Management commitment
- Employee competence
- Documentation condition
- Certification-body availability
- Audit findings
Indicative implementation periods might be:
| Organization | Possible implementation period |
|---|---|
| Small organization with established processes | 3–6 months |
| Small organization starting from very little | 4–9 months |
| Medium organization | 6–12 months |
| Large or multi-site organization | 9–18 months or more |
These are planning estimates, not rules.
A small company can take longer than a large company if responsibilities are unclear or management is not involved.
A larger organization may move quickly if it already has mature, well-controlled processes.
How long does the certification audit take?
Audit duration depends on the number of effective personnel, complexity, risk, locations, shifts and scope.
A small single-site organization may require only a few auditor days across Stage 1 and Stage 2.
A larger company may require a team of auditors visiting several sites.
The certification body should explain the proposed audit duration in its quotation.
Be cautious if one quotation offers dramatically fewer audit days than all the others without a clear reason.
The cheapest proposal may not represent a credible certification process.
How much does ISO 9001 certification cost?
There is no universal ISO 9001 price.
The cost normally has several components:
- Purchasing the Standard
- Staff time
- Implementation support
- Training
- Certification-body fees
- Travel expenses
- Surveillance audits
- Recertification
- Corrective-action costs
Indicative certification-body costs
For initial budgeting only, a small single-site organization might expect initial accredited certification-body fees in the low thousands rather than hundreds.
A very broad indicative range could be:
| Organization | Indicative initial certification-body cost |
|---|---|
| Small, simple, single-site business | £1,500–£4,000 / $2,000–$5,000 |
| Medium organization or more complex scope | £4,000–£10,000 / $5,000–$13,000 |
| Large, multi-site or complex organization | Individually quoted and potentially substantially higher |
These figures are not official fees and should not be treated as quotations.
Prices vary by country, certification body, employee count, audit duration, travel, sector and scope.
Annual surveillance costs should also be included in the budget.
Consultant costs
A consultant may help with:
- Gap analysis
- Process mapping
- Documentation
- Implementation planning
- Training
- Internal audits
- Certification preparation
Consultancy can range from a few focused days to a major implementation project.
A small organization may spend approximately £2,000–£10,000 or more, depending on how much work is outsourced.
Larger implementations can cost considerably more.
The company does not need to use a consultant.
However, it still needs competent people and enough time to interpret and implement the requirements.
A consultant should help the organization build its system—not provide a generic manual and disappear.
Internal implementation costs
The largest cost is often internal time.
Employees may need to:
- Map processes
- Attend meetings
- Write or review documentation
- Complete training
- Implement controls
- Collect records
- Conduct audits
- Complete corrective actions
- Attend certification audits
These hours have a real cost even though they do not appear on the certification body’s invoice.
On the other hand, an effective QMS may reduce:
- Rework
- Complaints
- Delays
- Waste
- Repeated errors
- Supplier failures
- Lost information
- Inefficient approvals
Certification should be evaluated as part of a wider business case rather than treated as a simple audit expense.
What affects the price?
The quotation may increase when the organization has:
- More employees
- Several locations
- Shift work
- Complex processes
- High-risk activities
- Design responsibility
- Multiple legal entities
- Remote project sites
- Temporary sites
- Significant outsourced processes
- International operations
Integrated audits may provide efficiencies when the organization operates ISO 9001 alongside ISO 14001 or ISO 45001.
However, integration does not mean that three standards can be audited for the price of one.
Can you get ISO 9001 certification quickly?
Yes, in some circumstances, but there are limits.
A company with established processes, good records and strong management involvement may become ready relatively quickly.
A business starting with little process control will need enough time to:
- Implement the QMS
- Train employees
- Generate records
- Complete internal audits
- Hold management review
- Address identified problems
Be cautious about offers promising certification within a few days without a proper audit.
A credible certification body needs to examine evidence that the system has been implemented.
A certificate issued without meaningful assessment may not be accepted by customers and could damage the company’s credibility.
Do you need a consultant?
No.
Organizations can implement ISO 9001 using their own employees.
Internal implementation can work well when the company has:
- Someone who understands ISO 9001
- Strong process knowledge
- Time to manage implementation
- Support from management
- Competent internal auditors
A consultant may be useful when:
- There is no internal ISO knowledge.
- The certification deadline is important.
- The organization is complex.
- Several sites are involved.
- The existing system needs major restructuring.
- Independent challenge would be useful.
The consultant should not become the only person who understands the QMS.
The organization needs to own the system after certification.
How to choose an ISO 9001 consultant
Ask potential consultants about:
- Relevant industry experience
- Previous implementation projects
- Auditor qualifications
- Approach to documentation
- Time expected from employees
- Deliverables
- Internal-audit support
- Post-certification support
- References
- Fees and expenses
Avoid consultants who promise guaranteed certification.
A consultant cannot control the certification body’s independent decision.
Also avoid solutions based entirely on generic templates.
Templates can save time, but they need to be adapted to the organization’s processes.
Common certification mistakes
Choosing the cheapest certification body
Price matters, but accreditation, competence and customer acceptance matter more.
Writing too much documentation
Large manuals do not automatically create a stronger QMS.
Documentation should support the work.
Copying generic procedures
Auditors will compare the documented system with what people actually do.
Leaving implementation too late
The company needs records demonstrating that processes have operated.
Treating internal audits as a formality
Internal audits should identify gaps before the certification body does.
Holding management review immediately before Stage 1
Management review should evaluate meaningful information, not merely satisfy a checklist.
Hiding problems
A mature QMS identifies and controls problems.
An organization with no NCRs, complaints or corrective actions may appear less credible than one that manages them effectively.
Training employees to recite answers
Auditors want to understand the real process.
Employees should explain their work naturally and show relevant evidence.
Stopping after certification
Certification creates an ongoing commitment to maintain the system.
How to prepare employees for the audit
Employees do not need to memorise the Standard.
They should understand:
- Their responsibilities
- Applicable procedures
- Customer or technical requirements
- Where to find current information
- What records they complete
- What to do when something goes wrong
- How their work contributes to quality objectives
Before the audit:
- Explain the audit purpose.
- Confirm the schedule.
- Make responsible people available.
- Check access to locations and systems.
- Make records easy to retrieve.
- Review open actions.
- Avoid coaching people to provide artificial answers.
If an employee does not know something, it is better to explain where they would find the information or who they would ask than to guess.
What should you expect on audit day?
The audit normally begins with an opening meeting.
The auditor explains:
- Scope
- Audit objectives
- Schedule
- Reporting arrangements
- Confidentiality
- Finding classifications
The auditor then follows the audit plan, interviews people and samples evidence.
At the end, a closing meeting is held.
The auditor presents:
- Audit conclusions
- Nonconformities
- Opportunities for improvement
- Next steps
- Required response dates
There should be no major surprises at the closing meeting.
Potential nonconformities are normally discussed with the relevant people during the audit so that facts can be confirmed.
You do not have to agree blindly with every finding.
If the objective evidence or requirement is unclear, ask the auditor to explain it.
The discussion should remain professional and evidence-based.
What happens after certification?
After receiving the certificate, the organization should:
- Communicate the achievement
- Follow the certification-mark rules
- Maintain the QMS
- Continue internal audits
- Continue management review
- Monitor objectives
- Complete corrective actions
- Inform the certification body of significant changes
- Prepare for surveillance audits
- Keep the certificate scope accurate
Significant changes might include:
- Relocation
- Acquisition
- Major restructuring
- New activities
- Closure of a site
- Major reduction in employees
- Change in legal entity
- Serious customer or regulatory issues
Ask the certification body what changes need to be reported.
Can certification be suspended or withdrawn?
Yes.
Certification may be suspended when:
- Serious nonconformities are not resolved.
- Surveillance audits are not completed.
- The certification mark is misused.
- Fees are not paid.
- The organization prevents required audit activities.
- The QMS no longer meets requirements.
Suspension is normally temporary and subject to defined conditions.
Certification may be withdrawn if the problems are not resolved.
The organization would then need to stop claiming valid certification according to the certification body’s rules.
ISO 9001:2015 and the forthcoming revision
ISO 9001:2015 remains the current published and certifiable edition.
The next edition is expected in September 2026.
Organizations should not delay worthwhile implementation work while waiting for the new edition.
A company with:
- Controlled processes
- Active leadership
- Reliable performance information
- Effective audits
- Strong corrective action
- Useful documented information
will be in a much better position to transition when the revised requirements are published.
Organizations already certified to ISO 9001:2015 will be given a transition period.
The exact arrangements should be confirmed through official ISO, accreditation and certification-body communications.
Practical ISO 9001 certification checklist
Before booking Stage 1, confirm that:
- The certification scope is defined.
- The certification body is suitable and accepted.
- Accreditation has been verified.
- Processes are identified.
- Responsibilities are assigned.
- The Quality Policy is communicated.
- Objectives are measurable and monitored.
- Risks and opportunities are addressed.
- Employees are competent.
- Documents are controlled.
- Operational controls are implemented.
- Supplier performance is monitored.
- Customer satisfaction is evaluated.
- Internal audits are complete.
- Management review is complete.
- NCRs and corrective actions are controlled.
- Implementation records are available.
- Employees understand their responsibilities.
- Stage 1 concerns can be addressed before Stage 2.
If several of these items are incomplete, postponing the audit may cost less than proceeding before the system is ready.
Final thoughts
ISO 9001 certification should not be treated as the purchase of a certificate.
It is an independent assessment of a management system that the organization needs to build, operate and maintain.
The certification body does not create the system.
The auditor does not manage it.
And the Quality Manager cannot maintain it alone.
Successful certification depends on processes that reflect the business, evidence that those processes operate and management that takes the system seriously.
The cost of certification matters.
But the cheapest audit is not necessarily the best value, and the most expensive QMS is not necessarily the most effective.
The goal is to create a system that helps the organization meet requirements consistently—and then obtain a credible certificate that customers can trust.
Frequently asked questions
How much does ISO 9001 certification cost?
A small single-site organization may pay approximately £1,500–£4,000 or $2,000–$5,000 in initial certification-body fees. Consultancy, training, internal time, travel and annual surveillance are additional. Every organization should obtain an individual quotation.
How long does ISO 9001 certification take?
A small organization with established processes may become ready within three to six months. Medium, complex or multi-site organizations may require six to eighteen months or longer.
Can a small business become ISO 9001 certified?
Yes. ISO 9001 applies to organizations of any size. The QMS should be proportionate to the company’s processes, risks and complexity.
Can an individual become ISO 9001 certified?
No. ISO 9001 certification applies to an organization’s Quality Management System. Individuals may complete auditor or lead-auditor training.
Does ISO provide certification?
No. ISO publishes the Standard. Independent certification bodies conduct audits and issue certificates.
Do I need an accredited certification body?
Accreditation is not always legally mandatory, but accredited certification normally provides greater confidence and may be required by customers or tenders.
Do I need a consultant?
No. A company can implement ISO 9001 internally if it has suitable knowledge, resources and management support.
What is the difference between Stage 1 and Stage 2?
Stage 1 evaluates readiness and supports audit planning. Stage 2 evaluates whether the QMS has been effectively implemented and conforms to the applicable requirements.
Can you fail an ISO 9001 audit?
The auditor may raise nonconformities that prevent immediate certification. Certification can normally proceed after the problems have been satisfactorily corrected and verified.
How long is an ISO 9001 certificate valid?
Certificates normally operate within a three-year certification cycle, subject to surveillance audits and successful recertification.
Should we wait for ISO 9001:2026?
No. ISO 9001:2015 remains the current published edition. Implementing a strong QMS now will make the eventual transition easier.