_1762866128417-DS2_OO1j.png)
The process at a glance
- 1
Build the QMS
Describe processes, create documents, assign responsibilities.
- 2
Run the system
Gain a few months of experience and generate records.
- 3
Internal audit and management review
Check your own system and have management review it.
- 4
Choose a certification body
Get quotes, sign the contract, schedule dates.
- 5
Stage 1 audit
Review of documentation and readiness for stage 2.
- 6
Stage 2 audit
Review of implementation on site.
- 7
Close nonconformities
Plan and evidence corrective actions.
- 8
Certificate
Valid for three years with annual surveillance audits.
Preparation
Most of the work happens before the first audit. An ISO 9001 QMS must not only be documented but also lived. Certification bodies expect you to have been running the system for some time – at least three months is common – and that records such as trainings, supplier evaluations, complaint handling, an internal audit and a management review exist.
- Define scope, quality policy and quality objectives.
- Describe processes and their interactions, for example with a process map.
- Create and control the necessary documents – see ISO 9001 mandatory documents.
- Train employees and demonstrate competence.
- Assess risks and opportunities and define actions.
- Complete at least one full internal audit cycle.
- Hold and document a management review.
A gap analysis shows early where evidence is still missing. The certification readiness checklist helps with the final check before the audit.
Choosing a certification body
Certificates are issued by certification bodies, not by ISO itself. Make sure the body is accredited for ISO 9001 and your industry sector – for example by UKAS in the UK, ANAB in the US or DAkkS in Germany. Only accredited certificates are recognised internationally.
| Criterion | What to look for |
|---|---|
| Accreditation | For ISO 9001 and your sector code (EA/IAF code) |
| Industry experience | Do the auditors know your industry and processes? |
| Auditor continuity | Does the same auditor stay for the cycle where possible? |
| Quote | Audit duration, travel costs, certificate fees, cost of surveillance audits |
| Combined audits | Option to audit other standards such as ISO 14001 together |
| Dates | Availability in your desired time frame |
The stage 1 audit
In the stage 1 audit, the auditor checks whether your QMS is ready for certification. Depending on the certification body it takes place on site or remotely and usually lasts half a day to a day.
- Review of documentation: scope, policy, objectives, processes, mandatory documents.
- Understanding of the site, processes and specifics of your company.
- Check that the internal audit and management review have taken place.
- Assessment of readiness for stage 2 and planning of the stage 2 audit.
The result is a report with points to clarify before stage 2. There are typically a few weeks between the two stages.
The stage 2 audit
In the stage 2 audit, the certification body checks on site whether the QMS is effectively implemented. Auditors talk to managers and employees, observe workflows and sample records. The duration depends on size and complexity – usually one to three days for smaller companies.
| Typical audit point | What should be shown |
|---|---|
| Leadership | Management knows policy, objectives and results and makes decisions |
| Processes | Workflows match requirements, KPIs are used |
| Document control | Valid versions are available at the workplace |
| Competence | Qualifications and trainings are evidenced |
| Customers | Requirements are reviewed, complaints handled |
| Improvement | Nonconformities lead to effective corrective actions |
Tips for the audit days
- Assign contacts: for each area, someone is available who can explain workflows and show records.
- Prepare employees: explain how an audit works and encourage honest answers. "I don't know, but I'll show you where it's written" is a good answer.
- Keep evidence at hand: documents, reports and records should be quick to find – ideally in one system rather than binders.
- Don't gloss over things: auditors recognise staging. Openly named weaknesses with ongoing actions are more convincing than a perfect picture.
- Use the closing meeting: ask if a finding is unclear and agree deadlines for actions.
Handling nonconformities
| Grading | Meaning | Consequence |
|---|---|---|
| Major nonconformity | A requirement is not met, affecting the effectiveness of the system | Certificate only after evidenced correction, possibly a follow-up audit |
| Minor nonconformity | Isolated weakness without systemic character | Action plan within a deadline, checked at the next audit |
| Opportunity for improvement | Note without nonconformity | Not mandatory but worth evaluating |
Treat audit nonconformities like any other: analyse the cause, define a corrective action, check effectiveness. More in the guide CAPA process.
After the certificate: the three-year cycle
| Time | Audit | Scope |
|---|---|---|
| Year 0 | Certification audit (stage 1 and 2) | Whole system |
| Year 1 | First surveillance audit | Sample, about a third of the certification duration |
| Year 2 | Second surveillance audit | Sample |
| Year 3 | Recertification audit | Whole system, about two thirds of the initial certification |
The certificate remains valid as long as surveillance audits take place on time and nonconformities are closed.
How long does ISO 9001 certification take?
| Starting point | Typical time to certificate |
|---|---|
| Processes lived but little documentation | 4 to 6 months |
| Partially existing QMS | 6 to 9 months |
| Starting from scratch, several sites | 9 to 12 months or more |
Decisive factors are the time available to those involved, management support and whether templates and tools are used. The largest time factor is usually the operating phase in which records must be produced – it cannot be shortened at will.
What does ISO 9001 certification cost?
Costs consist of several blocks. Specific amounts depend heavily on size, sites, industry and certification body – get several quotes.
| Cost block | Influencing factors |
|---|---|
| Certification body | Audit duration by headcount and complexity, day rate, travel, certificate fee |
| Surveillance audits | Annual, shorter than initial certification |
| Internal effort | Time of quality manager, managers and employees |
| Consulting (optional) | Days of external support during setup |
| Software and training | QMS software, auditor training, standards |
Audit duration follows international rules (IAF MD 5) that are scaled by headcount and complexity. For small companies it starts at a few audit days.
Typical stumbling blocks
- Documentation without practice: a nice manual, but day-to-day work is different.
- No internal audit before certification: almost certainly leads to a nonconformity.
- Management not involved: management cannot explain policy and objectives in the audit.
- Starting too late: there is no time between setup and audit to produce records.
- Too much at once: an overloaded system with too many documents is not lived.
Certification preparation with docxpert
docxpert supports the entire preparation: 23 templates mapped to ISO 9001, a gap analysis against the requirements, controlled documents with approval and read acknowledgement, trainings with a training matrix, and CAPA and deviations. In the audit you show evidence directly in the system; the audit trail documents every change.
Frequently asked questions
How long is an ISO 9001 certificate valid?
Three years, provided the annual surveillance audits are passed. A recertification audit follows.
Can you get certified without a consultant?
Yes. Many small and mid-sized companies build their QMS themselves – with templates, software and, if needed, targeted support. Time, management support and a structured approach matter most.
How many audit days do I need?
That depends on headcount, sites and complexity and is calculated by the certification body according to international rules. Small companies often need only a few days for stage 1 and 2 combined.
What happens with a major nonconformity?
The certificate is only issued once the nonconformity is closed and the corrective action evidenced – possibly with a follow-up audit.
Must ISO 9001 cover the whole company?
No. The scope can be limited to certain sites, products or services, but it must be justifiable and is stated on the certificate.
Can the audit be remote?
Partly. The stage 1 audit and individual parts can be remote. Production and on-site workflows usually require a visit. The certification body sets the rules.
What is the difference between certification and accreditation?
Companies are certified by certification bodies. Certification bodies are accredited by national accreditation bodies such as UKAS, which confirm their competence.
What happens when a new edition of ISO 9001 is published?
A transition period of three years usually follows publication of a new edition. During that time the system is moved to the new edition, typically as part of a regular audit.
How can I prepare employees for certification without teaching rehearsed answers?
Explain the purpose of the audit and make clear that employees should describe their real work, not recite standard wording. Each person should know which approved instruction applies to their task, where to find it and how to respond to a deviation or uncertainty. Practise typical handoffs and show how records are created during normal work. Ask teams to open documents and records themselves rather than displaying them only in a presentation. Avoid last-minute rules that do not match the actual process; close real gaps before the audit and document the actions. If a question is outside someone's role, referring it to the responsible person is appropriate. Authentic routine is more credible than memorised answers.