How to Get ISO 9001 Certification: The Process From Decision to Certificate

Most small businesses go for ISO 9001 because a customer or a tender asks for it. That is a perfectly good reason, and it shapes everything that follows: you need a certificate that the customer will accept, from a body they recognise, within a timescale that does not lose you the contract. This guide covers the whole process from that decision to holding the certificate, written from having built and run a certified system myself and from auditing other people’s.

If you want the short version: build a system that reflects how you already work, run it for long enough to have records, get it audited internally, then go through a stage 1 and a stage 2 audit with a UKAS-accredited certification body. For an established business with adequate resourcing, three to six months is realistic.

Step 1: decide what you actually need

Not all ISO 9001 certificates are equal, and the first mistake is not asking the customer what they will accept. Most businesses are doing this to satisfy tenders, and most tenders mean a certificate from a UKAS-accredited certification body. There is a market in cheaper certificates from non-accredited bodies, and a lot of people do not realise how little regulation sits behind them. If the certificate is for a tender, a bank, a regulator or a large customer, check their requirement before you spend anything. The cost difference is covered in our ISO 9001 certification cost guide.

The second decision is scope: which parts of the business and which locations the certificate will cover. For most small businesses it is the whole company, which is simpler to audit and simpler to explain to customers.

Step 2: understand what the standard asks for

ISO 9001 has seven requirement clauses (4 to 10), and our ISO 9001 clauses guide walks through each. The one thing to hold onto from the start is the principle the whole standard rests on: say what you are going to do (the documents), do it (the activities), and prove you have done it (the records). Businesses that treat ISO 9001 as a documentation exercise produce a shelf of policies and no evidence that anything runs; I am seeing a lot of that at the moment, with AI making it easy to generate vast amounts of paperwork without once looking at the standard.

The standard is also deliberately written to be applied, not copied. The mistake I see most in first-time certifications is people doing what they think the standard needs rather than adapting it to their organisation. Lack of familiarity leads to overwhelm, and overwhelm leads to a system that describes a business that does not exist.

Step 3: build the system around how you already work

You are already running a successful business, so you are almost certainly doing many of the right things. My role, and the job of the system, is to make those activities visible, controlled and repeatable where it matters. Good governance is not about creating bureaucracy; it is about providing enough structure to support the business and demonstrate that it remains effective over time.

In practice that means:

1. Scope, context and interested parties (clause 4): a page or two on what the business does, what affects it, and who needs what from it.
2. A quality policy and objectives (clauses 5 and 6): short, specific, signed by whoever runs the business. Our quality policy and quality objectives guides have examples.
3. The operational processes (clause 8): how you win work, confirm what the customer wants, deliver it, check it and handle it when something goes wrong. This is where the real effort goes, because it has to describe your business as it actually runs.
4. The supporting records: competence and training, suppliers, customer requirements and reviews, non-conformances and corrective actions. Most already exist somewhere; the work is bringing them into one visible system.
5. A quality manual, which I recommend even though the standard no longer requires it: it mirrors the clauses, captures things like interested parties that have to be recorded somewhere, and links out to your main documents so an auditor can step through the standard with it. Our quality manual guide explains how to keep it short.

If you are starting from nothing, I would usually say skip the gap analysis and build directly from the standard; it will not tell you anything you do not already know. If you have an existing system or pockets of maturity in different parts of the business, a gap analysis earns its place; our gap analysis guide explains when and how. The free ISO 9001 gap analysis tool and the requirements checklist are the two places to start either way.

Step 4: run it long enough to have evidence

A certification body will not certify a system that has only just been switched on. You need records that show the processes running: orders reviewed, suppliers evaluated, a complaint handled, training recorded, objectives measured. For an established business this is mostly a matter of capturing what already happens. For a new business it is harder, because there is no track record: the standard has to be introduced and evolve with the business as it is built, and that takes longer than any timeline a consultant will quote you.

Step 5: internal audit and management review

Before a certification body will audit you, you must have completed at least one internal audit and one management review. These are the two requirements first-time systems most often fall short on.

The internal audit matters more than most people think. Minor non-conformances are quick to fix, but it is the number of them that catches people out: when they start to mount up and the system looks like Swiss cheese, a certification auditor can say “there are so many issues in this area that I am raising a major”. Get the internal audit done by someone who knows the standard and what they are doing before the external auditor arrives and the whole thing starts to unravel. Our internal audit guide covers how to plan and run one; if there is nobody independent enough in a small business, we run internal audits for exactly that reason.

The management review is where the leadership looks at how the system is performing and decides what to do about it. Our management review guide covers the agenda; the point for certification is that it has to have happened, with minutes and decisions, before stage 2.

Step 6: choose a certification body

Three things I tell every client:

• Ask your customers first. If they need UKAS-accredited, that narrows the field immediately and rules out the cheap offers.
• It is harder to move than you think. Once you have chosen a provider, the natural point to change is the end of the three-year cycle at recertification. You can move at any time, but you will go through stage 1 and stage 2 again with the new body.
• Auditors vary. Some work collaboratively, take the time to understand your business and relate the standard to its size. Others arrive wanting to prove how much they know, are fixed on what the documents should look like, and would rather review paperwork than interview people and understand how things actually work. Ask the body how they audit small businesses and who they would send.

Step 7: the stage 1 audit

If you have never had an audit before, it can feel daunting. Stage 1 is normally a document review: the auditor checks that you have everything in place to meet the standard, looks at your scope, policy, objectives, process documentation, internal audit and management review, and tells you whether you are ready for stage 2. Treat it as an opportunity to get a feel for where your documentation is and how you are doing; findings at stage 1 are things to fix before stage 2, not failures.

Step 8: the stage 2 audit

Stage 2 is the full audit of the system in operation. The auditor samples real work: they follow orders or projects through the business, interview the people doing the work, and check records against what the documents say happens. They will want to talk to staff, not just the quality manager, and the question they are really asking is whether the system runs or whether it was built for the audit.

Some practical advice I give for the night before:

• Set up your documentation and evidence so it relates to the clauses. Links in your manual that take the auditor straight to the evidence help both of you navigate quickly.
• Have a copy of all the documents in a structured zip file ready to share, either in advance or at the start of the audit, so you are not hunting for files while the auditor waits. Be careful of commercially or GDPR-sensitive data when you do.
• Do not be afraid to ask the auditor for one thing at a time.
• Remember that if you get non-conformities, you get time to correct them and have the correction verified. It is not something that cannot be put right.

Step 9: after the certificate

The certificate runs for three years, with surveillance audits (usually annual) in between and a recertification audit at the end. The system has to keep running: internal audits on a programme, management review at least annually (quarterly is better for the cadence of a small business), objectives tracked, non-conformances recorded and closed. The businesses that find year two hard are the ones that built the system for the audit; the ones that find it easy are the ones whose system is simply how they work.

The timeline, honestly

For an established business that has been running for a few years, with someone given the time to do it, three to six months from decision to certificate is realistic. The time goes on describing the operational processes properly, running the system long enough to generate records, and the certification body’s own scheduling, which can add a month or two. For a new business it is harder and slower, for the reasons above.

What changed in ISO 9001:2026

The certification process itself is unchanged. The 2026 edition adds emphasis on quality culture and ethical behaviour, treats risks and opportunities separately, and expands the organisational knowledge requirement; our ISO 9001:2026 changes article covers the detail. Certificates to the 2015 edition remain valid until the transition deadline in 2029, and certification bodies will audit to 2026 progressively; if you are starting now, build to 2026 and avoid a transition later.

Where to go next

The ISO 9001 certification cost guide puts numbers on the audit days and the internal effort. If you also need ISO 27001, which many of our clients do, see running both standards together. And if you would rather have someone take you through the whole process, our ISO 9001 consultancy programme is built around teaching you to run the system yourself rather than making you dependent on us for every audit.

Frequently asked questions