The 2026 ISO Certification Plan: 10 Steps from Zero to Certificate

What certification is, and who issues it

An ISO standard sets out requirements for a management system, such as quality (ISO 9001), environment (ISO 14001) or information security (ISO/IEC 27001). Certification is an independent confirmation that your organisation meets those requirements. It is carried out by a certification body, and a credible certification body is itself accredited by a national accreditation body. If that accreditation is missing, the certificate may not be accepted by the customers you wanted it for.

The cycle is the same in almost every country. A Stage 1 audit reviews your documented system and readiness. A Stage 2 audit tests whether you actually operate it. If the audit succeeds, a certificate is issued for three years, and surveillance audits take place every year to confirm the system is still working. Costs and local practice differ by country, which is why this guide carries no prices and points you to local pages at the end.

Three decisions before you start

Most delays are decided in the first week, before a single document is written. Settle these points first.

• The reason for certifying. A tender condition, a customer request, a regulator or an internal goal each lead to a different scope and a different deadline.
• The standard. Choose the one your customer or regulator actually names. If several apply, plan them as one integrated system rather than separate projects.
• The owner. Someone with authority must lead the project and report to top management. Certification run entirely by one junior person rarely survives the audit.

The ten steps from zero to certificate

Step 1: Define the scope and the standard

Write down which sites, products, services and processes the system will cover, and which it will not. Auditors test the scope you declare, so a scope that is too wide creates work, and one that is too narrow may fail the customer who asked for the certificate.

Step 2: Run a gap assessment

Compare what you do today with what the standard requires. The output is a short list of gaps, an effort estimate and a realistic timeline. This is the step that turns a vague ambition into a plan.

Step 3: Secure management commitment

Top management must set the policy, agree objectives and provide people and time. Auditors interview senior leaders, and they can tell quickly whether the commitment is real.

Step 4: Design the system around how you work

Document only what the standard requires and what your people need to do the job well. Copying a generic manual produces paperwork that nobody follows, and it is the most common reason first audits go badly.

Step 5: Train your people

Staff need to understand the policy, their own role and how their work affects the system. Awareness training for everyone and internal auditor training for a smaller group are both worth planning early.

Step 6: Operate the system and keep records

Run the processes for long enough to generate evidence: records, measurements, corrective actions and customer feedback. A system that exists only on paper cannot pass Stage 2.

Step 7: Carry out an internal audit

Audit your own system against the standard, with auditors who are independent of the area they audit. Record findings, fix them and show the evidence. The standard requires this before certification.

Step 8: Hold a management review

Top management reviews performance, audit results, risks and resources, and records decisions. Do this after the internal audit so that the review has real material to discuss.

Step 9: Select an accredited certification body and pass Stage 1 and Stage 2

Ask for the body's accreditation, its scope of accreditation for your sector, and a written quotation. Stage 1 checks readiness; Stage 2 tests operation. Findings are raised as nonconformities, and you correct them within the period the certification body sets.

Step 10: Receive the certificate and plan for surveillance

Once the certification body decides in your favour, it issues the certificate. From that day the work shifts to keeping the system alive: annual surveillance audits, ongoing internal audits and a management review each year, followed by recertification at the end of the three-year cycle.

What is different about certifying in 2026

Two of the most widely used standards have new editions. ISO 14001:2026 was published on 15 April 2026, and ISO 9001:2026 on 16 September 2026. Existing certificates to the 2015 editions remain valid until 30 April 2029 for ISO 14001 and September 2029 for ISO 9001. ISO/IEC 27001:2022 is the current edition for information security.

If you are starting from zero on ISO 9001 or ISO 14001, ask your certification body which edition it will audit you against, and from what date. Building to the edition you will be audited against avoids rewriting documents a year later. A Sterling consultant can help you decide, and our separate transition calendar article covers organisations that already hold a certificate.

The evidence an auditor will look for

Whatever the standard, certification auditors work from evidence rather than from statements. Before Stage 1, check that you can show the following without a search.

• A defined scope and a policy approved by top management.
• Objectives with owners, measures and recent results.
• A risk and opportunity register, or the equivalent for your standard, with actions that have actually been followed up.
• Training and competence records for the people whose work affects the system.
• Records of the internal audit, the management review and corrective actions raised from them.
• Customer feedback, supplier evaluation and any legal or regulatory requirements that apply to you.

The aim is not a thick manual. A short, accurate system that people follow is far easier to defend in an audit than a long one they have never read.

Budget and timeline: what to ask before you commit

Prices and durations vary widely between countries, sectors and certification bodies, so any single figure quoted for all readers would mislead. Instead, ask each supplier the same questions and compare the answers in writing.

• 1. What is included: gap assessment, documentation, training, internal audit and support during the certification audit?
• 2. Who from the supplier will do the work, and what experience do they have in your sector?
• 3. Which certification bodies are acceptable to your customers, and is their accreditation current?
• 4. What are the audit days, and how are they calculated for your headcount and sites?
• 5. What will the surveillance audits cost in years two and three?

A transparent quotation answers all five without you having to chase. If a quote leaves out the certification body's fees or the surveillance years, treat the total as incomplete.

Where organisations lose time

• Choosing a certification body on price alone and discovering later that it is not accredited for the sector.
• Writing documents before the gap assessment, then rewriting them.
• Leaving the internal audit and management review until the week before Stage 2.
• Starting the system with no records, so there is no evidence of operation.
• Treating certification as a one-off event rather than a three-year cycle.

What support you can expect from Sterling

Sterling has been helping organisations prepare for certification for more than 20 years, and our experts have 30+ years of experience behind them. Across 8,100+ client engagements in 60+ countries, we have seen where first projects go wrong. Each engagement comes with a five-user Effivity subscription to manage the system, plus complimentary awareness e-learning through Sterling Academy. The audit and the certificate belong to the accredited certification body you choose.

Read the guide for your country

Fees, typical timelines, accreditation bodies and regulator expectations differ from one country to another, so the detail sits in local guides written by teams who work in those markets.

• India: the 2026 ISO certification plan
• Philippines: ISO certification requirements, step by step
• UAE: ways to get ISO certification

Frequently asked questions

Next step

Book a free gap assessment

Talk to a Sterling consultant