In This Guide
- Certification involves Stage 1 (documentation review) and Stage 2 (implementation audit) conducted by an accredited certification body.
- The full process typically takes 6-12 months from initial engagement to certificate issuance.
- Surveillance audits occur annually, with full recertification every 3 years.
- Choosing an accredited certification body (IAF MLA member) is critical for certificate credibility.
- Nonconformities must be closed within 90 days of Stage 2 completion.
Certification Overview
ISO 9001 certification is the process by which an independent, accredited certification body (CB) evaluates your Quality Management System against the requirements of ISO 9001:2015 and, upon satisfactory assessment, issues a certificate confirming conformity.
The certification process follows a well-defined lifecycle governed by ISO/IEC 17021-1 (requirements for bodies providing audit and certification of management systems). Understanding this lifecycle helps organizations plan effectively, set realistic expectations, and avoid delays.
ISO 9001 certification operates on a three-year cycle: initial certification audit (Stage 1 + Stage 2), followed by annual surveillance audits in years two and three, and then a recertification audit before the certificate expires. This cycle repeats indefinitely as long as the organization maintains its QMS.
Selecting a Certification Body
The certification body you choose directly affects the credibility and market acceptance of your certificate. Key selection criteria include:
Accreditation
- Accredited by a national accreditation body: Look for accreditation by bodies that are signatories to the IAF Multilateral Recognition Arrangement (MLA). Examples include UKAS (UK), ANAB (US), JAS-ANZ (Australia/NZ), DAkkS (Germany), and NABCB (India).
- IAF MLA significance: Certificates issued by CBs accredited under the IAF MLA are recognized worldwide. Certificates from non-accredited bodies may not be accepted by customers or regulators.
- Scope of accreditation: Verify the CB is accredited to audit your specific industry sector (defined by IAF/EA codes).
Other Selection Factors
- Industry expertise: Auditors with experience in your sector provide more meaningful audits
- Geographic coverage: For multi-site organizations, the CB should have auditors available in all relevant locations
- Pricing transparency: Obtain detailed quotes including audit days, travel costs, surveillance fees, and any hidden charges
- Reputation: Check references from organizations of similar size and sector
- Scheduling flexibility: The CB should be able to schedule audits within your preferred timeframe
Stage 1 Audit (Documentation Review)
The Stage 1 audit is the first formal step in the certification process. Its primary purpose is to evaluate the organization's readiness for the Stage 2 audit.
What Stage 1 Covers
- QMS documentation review: The auditor reviews your quality manual (if applicable), quality policy, quality objectives, documented procedures, and process documentation for adequacy against ISO 9001 requirements
- Scope verification: Confirms that the defined scope is appropriate, covers the relevant products/services, and is achievable
- Process approach assessment: Evaluates whether processes have been identified, their interactions defined, and the process approach is embedded in the QMS design
- Internal audit review: Verifies that at least one cycle of internal audits has been completed and that findings have been addressed
- Management review: Confirms that at least one management review has been conducted with appropriate inputs and outputs
- Legal and regulatory awareness: Checks that the organization has identified applicable legal and regulatory requirements
- Site conditions: If conducted on-site, the auditor gains an understanding of the organization's physical environment and operations
Stage 1 Outcomes
- Confirmation of readiness for Stage 2 (or identification of gaps that must be addressed first)
- Agreed Stage 2 audit plan, including schedule, scope coverage, and audit team composition
- Identification of any areas of concern or potential nonconformities
Stage 1 typically takes 1-2 audit days depending on organization size and scope complexity. It can be conducted on-site or remotely (document review). The gap between Stage 1 and Stage 2 should be sufficient to address any identified issues but should not exceed 6 months.
Stage 2 Audit (Implementation Audit)
The Stage 2 audit is the main certification assessment. It evaluates whether your QMS is effectively implemented and operating in conformity with ISO 9001:2015.
What Stage 2 Covers
- Implementation verification: The auditor verifies that documented processes are being followed in practice, not just on paper
- Interviews: Staff at various levels are interviewed to assess understanding of the quality policy, objectives, their roles, and QMS processes
- Process observation: Auditors observe processes in action, examining how work is actually performed versus how it is documented
- Evidence sampling: Records and evidence are sampled to verify that processes are producing the expected outputs and that documentation is maintained
- Customer focus: Evaluation of how customer requirements are determined, communicated, and fulfilled
- Performance data: Review of quality objectives, KPIs, customer satisfaction data, and trend analysis
- Nonconformity management: Assessment of how nonconformities are identified, corrective actions implemented, and effectiveness verified
- Internal audit effectiveness: Evaluation of whether internal audits are adding value and driving improvement
- Management review effectiveness: Assessment of whether management review is driving strategic quality decisions
Stage 2 Duration
Stage 2 audit duration is calculated based on the organization's effective number of personnel, complexity of processes, and number of sites. Typical durations:
- Small organizations (1-25 employees): 2-3 audit days
- Medium organizations (26-125 employees): 4-6 audit days
- Large organizations (126-500 employees): 6-10 audit days
- Very large organizations (500+ employees): 10+ audit days
Stage 1 vs Stage 2: Key Differences
| Aspect | Stage 1 | Stage 2 |
|---|---|---|
| Primary Purpose | Readiness assessment | Implementation verification |
| Focus | Documentation adequacy, scope, readiness | Implementation effectiveness, records, evidence |
| Approach | Document review, limited interviews | On-site observation, interviews, sampling |
| Duration | 1-2 days | 2-10+ days depending on size |
| Location | Can be remote or on-site | Primarily on-site |
| Outcome | Readiness confirmation, Stage 2 plan | Certification recommendation (or not) |
| Findings | Areas of concern (not formal NCs) | Formal nonconformities and observations |
Managing Findings
Understanding audit finding categories and the corrective action process is critical for a smooth certification experience.
Finding Categories
- Major Nonconformity: The absence of, or total breakdown in, a required process, or a situation that raises significant doubt about the ability of the QMS to achieve its intended outcomes. A major NC will prevent certification until resolved. Examples include: no internal audit conducted, complete absence of management review, systematic failure to meet a clause requirement.
- Minor Nonconformity: A single observed lapse or isolated failure that does not represent a systemic breakdown. Minor NCs do not individually prevent certification but must be addressed with corrective action. Examples include: a single record not maintained, an isolated process deviation, a minor documentation gap.
- Opportunity for Improvement (OFI): A suggestion by the auditor for improving the QMS, but not a failure to meet a requirement. OFIs are not mandatory but represent good practice. The organization may choose to act on them or not.
Corrective Action Process
- Correction: Immediately address the specific instance identified (fix the symptom)
- Root Cause Analysis: Determine why the nonconformity occurred (not just what happened, but why)
- Corrective Action: Implement actions to eliminate the root cause and prevent recurrence
- Evidence Submission: Provide the CB with evidence of correction and corrective action
- Verification: The CB reviews evidence and verifies effectiveness (may be desk-based or on-site)
For initial certification, all nonconformities identified during Stage 2 must be corrected, and corrective actions submitted and accepted by the CB within 90 days of the last day of the Stage 2 audit. If this deadline is not met, a partial or full re-audit may be required.
Surveillance Audits
Surveillance audits occur annually (typically at 12-month intervals) after initial certification. Their purpose is to confirm that the QMS continues to operate effectively.
Surveillance Scope
- Each surveillance audit covers approximately 30-40% of the initial certification audit scope
- Over the three-year cycle, all clauses and processes should be covered
- Certain elements are reviewed at every surveillance: internal audit, management review, corrective actions, customer complaints, and the quality policy/objectives
- The CB determines focus areas based on previous audit results, organizational changes, and risk
Surveillance Duration
Surveillance audits are typically one-third of the initial Stage 2 duration. For a 6-day initial audit, expect 2 surveillance days annually.
Treat surveillance audits as opportunities for improvement, not just compliance checks. Auditors bring external perspective that can help identify blind spots in your QMS performance.
Recertification
Recertification occurs at the end of the three-year certification cycle. The recertification audit is more comprehensive than surveillance and evaluates the overall effectiveness of the QMS over the complete cycle.
Recertification Scope
- Covers all ISO 9001 clauses and all processes within the QMS scope
- Reviews performance over the entire three-year certification period
- Evaluates effectiveness of the QMS as a whole system, not just individual requirements
- Assesses continued relevance of the scope
- Reviews changes to the organization, its context, and interested parties
Planning for Recertification
- Schedule the recertification audit well before the certificate expiry date (at least 3 months prior)
- Allow time for corrective action closure if nonconformities are raised
- If the recertification audit is not completed before the certificate expires, the organization loses certification and must restart with Stage 1
Complete Certification Timeline
| Phase | Timing | Activities |
|---|---|---|
| CB Selection and Contract | Weeks 1-3 | Request quotes, evaluate CBs, sign contract, schedule audits |
| Stage 1 Audit | Week 4-5 | Documentation review, readiness assessment, Stage 2 planning |
| Gap Closure | Weeks 6-10 | Address Stage 1 findings, finalize documentation, gather evidence |
| Stage 2 Audit | Weeks 11-13 | On-site implementation audit, interviews, evidence review |
| Corrective Actions | Weeks 14-18 | Address NCs, submit evidence, CB verification (within 90 days) |
| Certification Decision | Weeks 19-21 | CB technical review, certification decision, certificate issuance |
| Surveillance 1 | Month 12 | Annual surveillance audit (30-40% coverage) |
| Surveillance 2 | Month 24 | Annual surveillance audit (30-40% coverage) |
| Recertification | Month 33-36 | Full recertification audit before certificate expiry |
From the point of engaging a certification body, the typical time to certificate issuance is 12-20 weeks for a well-prepared organization. Allow additional time if Stage 1 reveals significant gaps that require remediation before proceeding to Stage 2.
Frequently Asked Questions
What happens in an ISO 9001 Stage 1 audit?
The Stage 1 audit is a documentation review and readiness assessment. The auditor reviews your QMS documentation, verifies the scope, checks that internal audits and management review have been completed, and assesses whether the organization is ready for the Stage 2 implementation audit. Stage 1 can be conducted on-site or remotely and typically takes 1-2 days.
What happens in an ISO 9001 Stage 2 audit?
The Stage 2 audit is the main on-site implementation assessment. Auditors verify that documented processes are being followed in practice through interviews, process observation, and evidence sampling. They evaluate process performance data, customer satisfaction, nonconformity management, and the effectiveness of internal audits and management review. Stage 2 results in a certification recommendation.
How long is an ISO 9001 certificate valid?
An ISO 9001 certificate is valid for 3 years from the date of issue. During this period, the certification body conducts annual surveillance audits (typically at 12-month intervals) to verify continued conformity. At the end of the 3-year cycle, a recertification audit must be completed before the certificate expires to maintain continuous certification.
What is the difference between a major and minor nonconformity?
A major nonconformity indicates the absence of, or total breakdown in, a required process, or a situation that raises significant doubt about the QMS's ability to achieve its intended outcomes. A minor nonconformity is a single observed lapse or isolated failure that does not represent a systemic breakdown. Major NCs prevent certification until resolved, while minor NCs require corrective action but do not individually block certification.
How do I choose an ISO 9001 certification body?
Look for certification bodies accredited by a national accreditation body that is a signatory to the IAF Multilateral Recognition Arrangement (MLA). Verify the CB is accredited for your industry sector, check their auditor expertise in your field, compare pricing transparency, and ask for references from organizations of similar size and type. IAF MLA-accredited certificates are recognized worldwide.
Can ISO 9001 certification be suspended or withdrawn?
Yes. Certification can be suspended if major nonconformities remain unresolved, surveillance audits are overdue, or the organization fails to maintain its QMS. Suspension gives the organization a defined period to resolve issues. If issues are not resolved within that period, or if fraudulent claims are discovered, the certificate can be withdrawn entirely, requiring the organization to restart the certification process.