The ISO 9001 Certification Process, Step by Step
Step 1Define Certification Scope
Decide which sites, products, or services the certificate will cover.
Step 2Perform Gap Analysis
Compare current practices against ISO 9001 requirements to see what's missing (see our gap analysis guide).
Step 3Build or Update QMS
Design the processes and documentation needed to close the identified gaps.
Step 4Implement the System
Put the QMS into actual daily use — not just on paper.
Step 5Train Relevant Personnel
Make sure staff understand the processes and their role in the QMS.
Step 6Internal Audit
Check the system against your own procedures and the standard, before an external auditor does.
Step 7Management Review
Leadership formally reviews QMS performance and decides on any changes needed.
Step 8Select Certification Body
Choose an accredited certification body suited to your industry and markets (see our consultant guide for how a consultant differs from a certification body).
Step 9Stage 1 Audit
The certification body reviews your documentation and readiness for the full audit.
Step 10Stage 2 Audit
An in-depth audit of the QMS in actual operation.
Step 11Correct Nonconformities
Address any issues the auditor identifies within the required timeframe.
Step 12Certification Decision
The certification body issues (or confirms) the certificate once requirements are met.
How Long Does ISO 9001 Certification Take?
We deliberately avoid quoting a single fixed timeline here, because the honest answer depends on a few specific factors:
- How mature your current processes and documentation already are
- How many sites and how much scope the certificate needs to cover
- How quickly your team can implement changes identified in the gap analysis
- The certification body's own audit scheduling and availability
- How quickly any nonconformities from the audit are resolved
A company with an already-solid QMS and a single site moves through these steps much faster than one starting from zero across multiple locations. If you want a realistic estimate for your specific situation rather than a generic number, that's exactly the kind of question our Quick Check is built to answer.
Can ISO 9001 Certification Be Done Remotely?
Parts of the process — particularly documentation review and some interviews — are commonly and legitimately conducted remotely, and this has become widely accepted practice. Whether your full Stage 1 and Stage 2 audits can be entirely remote depends on your certification body's own policy, your industry, and the nature of your operations (a physical production line, for instance, may still need an on-site component). Confirm this directly with your chosen certification body rather than assuming either way.
A Common Issue We See
The step companies most often underestimate isn't the external audit — it's Step 4, actually running the system long enough to generate real records before the audit. A QMS implemented the week before Stage 1 rarely has enough evidence of consistent use.
Not Sure Where to Start?
Tell us which step you think you're on, and get a focused professional read on what to do next — US$19, one-time.
Start a $19 Quick CheckFrequently Asked Questions
How long does ISO 9001 certification take?
A: It varies by how mature your current processes are and how much documentation already exists. Companies with an established QMS move faster than those starting from scratch; certification body scheduling also affects the timeline.
Can ISO 9001 certification be done remotely?
A: Many parts of the process — document review, some interviews, evidence review — can be done remotely and are widely accepted. Whether a full audit can be entirely remote depends on the certification body's own policy and your industry, so confirm this with your chosen certification body.
What is the difference between Stage 1 and Stage 2 audits?
A: Stage 1 reviews your documentation and readiness to confirm you're prepared for a full audit. Stage 2 is the in-depth audit of your QMS in operation, which leads to the certification decision.
What happens if the auditor finds a nonconformity?
A: Nonconformities are common and not automatically disqualifying. You typically have a defined period to investigate the root cause and submit corrective action evidence before certification is granted or confirmed.