ISO 9001 timeline: how long certification really takes, stage by stage

How long ISO 9001 certification takes

Three to six months is the realistic span for most single-site organisations, from the first day of the gap analysis to the certification body's decision. The short end belongs to organisations whose processes already run under control and leave records. Multi-site scopes, in-house design, complex production and managers with little spare time sit at the long end or beyond it.

Two constraints fix the calendar. Your processes must run long enough to leave genuine records for an auditor to sample, and the certification body must fit two audit stages and a decision into its diary. Extra consultant hours speed up drafting and training, but neither constraint.

Stage by stage: durations and what moves them

The stages follow the phases on the ISO 9001 hub, for one site with reasonably stable processes. They overlap, so the ranges do not simply add up.

The operating period before Stage 2

Neither ISO 9001 nor ISO/IEC 17021-1, the standard certification bodies work to, sets a minimum number of weeks. They set a test instead. At Stage 1 the certification body checks that internal audits and management reviews are planned and being carried out, and that implementation justifies moving to Stage 2; at Stage 2 it evaluates whether the system is implemented and effective. Only records can answer those questions.

Plan on about three months of records for most processes, and rarely less than two: order and contract reviews, supplier evaluations, performance measures over more than one period, complaints and corrective actions, and a completed internal audit and management review.

Long cycles need care. An annual supplier re-evaluation, a design project or a seasonal operation may not complete a cycle in time, so show one completed instance or the current one under way, and hold Stage 2 while the work in scope is running. Records written after the event are easy to spot, and they cost more credibility than a short history.

What runs in parallel, and what has to wait

Time is saved by overlapping tasks that do not depend on each other:

• Records start as each process is agreed, not when the full document set is finished.
• The certification body is quoted, contracted and booked during the build.
• Training runs alongside: awareness as processes change, internal auditors before the audit programme starts. ISO 9001 training: who needs what, and the evidence of competence covers who needs what.
• The internal audit can be spread over several weeks, provided the whole scope is covered before Stage 1.

The rest is a chain. The internal audit needs operating records, the management review needs the audit results, the certification body's audits need both, and the decision waits until nonconformities are answered. ISO 9001 implementation plan: phases, owners and deliverables turns that chain into phases and owners.

The certification body's lead times

Quotation. The body quotes from your application: scope, site, effective number of personnel, shifts and outsourced processes. It confirms it has auditors competent in your sector and calculates the auditor-days under international accreditation rules, which require the calculation and its justification to form part of the contract. Allow one to two weeks; Choosing an ISO 9001 certification body: accreditation, sector codes and quotes explains how to compare quotes.

Booking. Four to eight weeks from application to the first available Stage 1 date is common, and longer at busy times of year or where few auditors cover your sector or language.

Between and after the stages. Three to six weeks between Stage 1 and Stage 2 leaves room to close Stage 1 concerns; many bodies also set a maximum interval, beyond which Stage 1 work is repeated. After Stage 2, allow two to six weeks for your responses, the body's technical review and a decision by people outside the audit team. A major nonconformity adds more: its closure must be verified, and ISO/IEC 17021-1 requires another Stage 2 if that cannot be done within six months of the last day of Stage 2. ISO 9001 Stage 1 and Stage 2 audits: what auditors check covers the audits themselves.

A worked calendar: 60 people, one site

The example company has 60 people on one site, established ways of working, a few written procedures, complaints tracked by e-mail, no in-house design and a coordinator with about two days a week for the project. Weeks count from kick-off.

The decision lands five to five and a half months after kick-off. A later first Stage 1 date, a major nonconformity or a second site would move it. Drive™, where our consultants take on the agreed consulting and documentation work, can shorten weeks 3 to 9 when managers' time is the constraint; it cannot shorten the operating period.

ISO 9001 timeline: questions buyers ask