ISO 9001 Certification Timeline: A Month-by-Month Guide

One of the most common questions from businesses starting the ISO 9001 journey is: how long will this actually take? The honest answer is that it depends on several factors within your control, but a realistic range for most SMEs is three to nine months from starting implementation to holding a certificate.

This guide gives you a month-by-month breakdown of what a typical certification journey looks like, what happens in each phase, and how to avoid the delays that most commonly push timelines out.

What Determines Your Timeline?

Before looking at the month-by-month plan, it is worth understanding the variables that have the greatest impact on how long your certification takes.

Factors that compress the timeline

• Using an experienced ISO consultant who can drive the implementation and avoid common pitfalls
• Having an internal project lead with dedicated time allocated to the project
• Existing documented processes that can be adapted rather than written from scratch
• Strong management engagement, enabling prompt sign-off and management review scheduling
• Early contact with certification bodies to understand their availability and scheduling lead times

Factors that extend the timeline

• Competing business priorities pulling the project lead away from implementation
• Difficulty scheduling a management review meeting with senior leadership
• Significant gaps identified at Stage 1 audit requiring remediation before Stage 2 can proceed
• Certification body scheduling backlogs, which can add four to eight weeks to the process
• Staff resistance or limited engagement during process documentation and briefing

Timeline Overview by Business Size

The month-by-month plan below is calibrated for a business in the 10 to 50 employee range, targeting a six-month certification journey. Smaller businesses can compress this; larger ones should allow more time, particularly for the implementation phase.

We have used a fictitious company (Hartley Precision Engineering) to bring the process to life.

Month-by-Month Certification Plan

Month 1: Gap Analysis and Project Setup

• Commission or conduct a gap analysis against ISO 9001:2015 requirements
• Identify what processes and documentation already exist that can be formalized
• Prioritize gaps by severity and effort required to close them
• Appoint an internal project lead with allocated time (suggest at least one day per week)
• Research and shortlist certification bodies; request quotes from two or three
• If using a consultant, engage them now and agree scope and deliverables
• Purchase the official ISO 9001:2015 standard document

Hartley: Hartley's quality coordinator spent three days with their consultant conducting the gap analysis. The output was a 12-point action plan with responsibilities and target dates assigned. Their biggest gap was the absence of a formalized risk register.

Month 2: Building the Management System Framework

• Draft your quality policy and have it approved by top management
• Define the scope of your QMS (which parts of the business it covers)
• Identify interested parties and their relevant requirements (Clause 4)
• Begin documenting key processes, starting with customer-facing and production processes
• Establish your document control framework (how documents are created, approved and updated)
• Set up your nonconformity and corrective action process
• Begin building your risk register, identifying key risks and opportunities

Hartley: Hartley drafted their quality policy in a single leadership team meeting. Their consultant produced process map templates which the quality coordinator then completed with input from each department head over the following two weeks.

Month 3: Documentation and Objectives

• Complete documentation of remaining core processes
• Establish quality objectives at relevant functions, with measurable targets and named owners
• Document your management of resources: competence records, infrastructure, work environment
• Put in place your customer satisfaction monitoring approach
• Ensure all staff have been briefed on the quality policy and their role in the QMS
• Begin capturing records that will serve as evidence for the certification audit
• Confirm your certification body and book Stage 1 audit (allow six to eight weeks lead time)

Hartley: Hartley set four quality objectives: on-time delivery rate, customer complaint rate, internal defect rate, and supplier on-time delivery. Each had a baseline measurement, a target, and a named owner at department level.

Month 4: Internal Audit and Management Review

• Conduct your internal audit: a systematic review of your QMS against the standard's requirements
• Raise nonconformities for any gaps identified and begin corrective action
• Hold your management review meeting with top management: review performance data, audit findings, objectives progress, and resource needs
• Produce and retain records of both the internal audit and management review
• Close out corrective actions raised during the internal audit where possible
• Final gap-check: walk through each clause of the standard to confirm evidence is in place

Hartley: Hartley's internal audit was conducted by their quality coordinator, who had completed a two-day lead auditor course. Three minor nonconformities were raised, all relating to incomplete records in the production area. All were closed within two weeks.

Month 5: Stage 1 Audit

• Stage 1 audit conducted by your chosen certification body (typically half a day to one day)
• Auditor reviews your documented management system and confirms you are ready to proceed to Stage 2
• Any observations or concerns raised at Stage 1 must be addressed before Stage 2 can be scheduled
• Confirm Stage 2 audit date (typically two to six weeks after Stage 1)
• Use the time between Stage 1 and Stage 2 to address any Stage 1 findings and brief staff on what to expect
• Ensure records from the past three to six months are organized and readily accessible

Hartley: Hartley's Stage 1 audit lasted one day and was conducted on-site. The auditor raised two observations: the management review minutes did not clearly link objectives to resource allocation, and the calibration records for one piece of measuring equipment were incomplete. Both were addressed within two weeks.

Month 6: Stage 2 Audit and Certification

• Stage 2 audit conducted: typically one to two days on-site for a business of this size
• Auditor interviews staff, reviews records, observes processes, and assesses whether the QMS is effectively implemented
• Any nonconformities raised must be addressed and evidence provided before the certificate is issued
• Certificate issued following successful completion and close-out of any nonconformities
• Confirm surveillance audit schedule for years one and two of the three-year cycle
• Brief the team on the outcome and embed ongoing management system habits

Hartley: Hartley's Stage 2 audit took one and a half days. One minor nonconformity was raised regarding the supplier evaluation process. They submitted corrective action evidence within ten days and received their certificate three weeks after the audit.

What Happens After Certification?

Achieving certification is the beginning of the ongoing cycle, not the end of the project. The three-year certificate cycle works as follows.

• Year 1 surveillance audit: typically six to twelve months after the initial certification audit, covering a sample of your QMS
• Year 2 surveillance audit: a further sample audit, often focusing on areas not covered in depth during year one
• Year 3 recertification audit: a full reassessment of the entire management system, comparable in scope to the original Stage 2 audit

Between audits, the system needs active maintenance: conducting internal audits at planned intervals, holding at least one management review per year, capturing and closing out nonconformities, and keeping documented information up to date. The businesses that get the most from ISO 9001 are those that treat it as a live management tool rather than a certificate to be renewed every three years.

Common Timeline Pitfalls and How to Avoid Them

The management review bottleneck

The management review meeting is a formal requirement of the standard and must have taken place before the certification audit. Getting the right people in a room at the right time is surprisingly often the single biggest delay. Book it at the start of the project, not after the internal audit is complete.

Underestimating the internal audit

An internal audit conducted by someone with no auditing experience or training frequently misses nonconformities that an external auditor will find. If the person conducting your internal audit has not done this before, invest in a two-day lead auditor course before the internal audit takes place. It will pay back many times over.

Leaving Stage 2 booking too late

Certification bodies are often booked four to eight weeks in advance for Stage 2 audits. If you wait until after your Stage 1 to book Stage 2, you will add six to eight weeks to your timeline unnecessarily. Agree your target Stage 2 date at the point of booking Stage 1.

Documentation that describes the ideal rather than reality

Auditors assess your management system against what actually happens, not against what your documents describe. Procedures written to satisfy the auditor rather than reflect real practice are one of the most common causes of major nonconformities. Involve the people who actually do the work in writing the procedures for their area and do not over-commit. Following the mantra, "say what you do and do what you say", is a good way to help keep yourself in check.