# The ISO 9001 Certification Process

## Steps (ISO/IEC 17021-1)

| Step | What happens | Typical timing |
|------|--------------|----------------|
| Application and quote | CB asks for headcount, sites, shifts, scope, design responsibility, outsourced processes; calculates audit days | 2-8 weeks before stage 1 |
| Stage 1 (readiness) | Documents, scope, process map, internal audit and management review evidence, site conditions; often partly remote | 1-2 days |
| Gap to stage 2 | Close stage 1 concerns | Usually 2-8 weeks; long gaps may require stage 1 to be repeated |
| Stage 2 (certification) | Implementation and effectiveness on site: interviews, records, process sampling across shifts | Most of the audit days |
| Nonconformity closure | Majors: correction and corrective action verified (often a follow-up visit) before certification. Minors: accepted plan | Typically within 90 days of stage 2 |
| Certification decision | Independent review by the CB; certificate valid 3 years | 2-6 weeks after closure |
| Surveillance 1 | First surveillance within 12 months of the certification decision | ~1/3 of initial days |
| Surveillance 2 | Yearly | ~1/3 of initial days |
| Recertification | Before the certificate expires; reviews 3-year performance | ~2/3 of initial days |

## What must exist before stage 1

- Scope and process map; policy and objectives; mandatory documented information (see the gap analyzer).
- About **3 months of records** for every process.
- **A complete internal audit** covering all processes and clauses, with corrective actions in progress.
- **A management review** covering every 9.3.2 input, with decisions recorded.

Missing internal audit or management review is the most common reason stage 1 fails.

## Choosing a certification body

| Check | Why |
|-------|-----|
| Accredited by a national body that is an IAF MLA signatory (UKAS, ANAB, DAkkS, COFRAC, JAS-ANZ...) | Unaccredited certificates are not accepted by many customers |
| Accredited for your sector's IAF code | The scope must cover your industry |
| Auditor availability in your region and language | Cost and scheduling |
| Day rate x audit days, plus travel and certificate fees | Compare the 3-year total, not the first-year quote |
| Customer acceptance | Some customers or sectors list approved CBs |

Avoid "certificate mills" that promise certification without audits or in a few days: their certificates are
not accredited and can harm customer relationships.

## Speeding up safely

- Use existing systems (ISO 14001, ISO 45001, customer approvals) and integrate rather than duplicate.
- Run phases in parallel: train auditors while writing procedures; select the CB during implementation.
- Keep documentation lean: write only what the processes need.
- Do not compress the records period below about 3 months; auditors need evidence of a working system.