How to Get ISO 9001:2015 Certification: Seven Steps from Application to Certificate

ISO 9001 is the most widely used management system standard in the world and is often the first certificate asked for in public tenders, exports or when entering a large company's supplier list. So where should you start? Here are the seven steps to a certificate.

1. Clarify the scope and objective

Which products, services and locations will the certificate cover? Saying "the whole company" is not always right; a newly built line or a separate site can be left out of scope. As the scope is written on the certificate, it must match the wording your customer expects.

2. Assess where you stand (gap analysis)

Compare the requirements of the standard with your current practices. Most organisations already do things they do not record. A gap analysis sets realistically how much work and what timetable are needed.

3. Build the system

The quality policy, measurable objectives, process map, risk and opportunity assessment, procedures and records are prepared. ISO 9001:2015 reduced the number of mandatory procedures; what matters is that records are actually used. You may take help from a consultancy, but certification bodies cannot consult.

4. Implement and accumulate at least three months of records

After the system is in operation, internal audits and a management review must be held at least once. The auditor looks at records to see that the system is alive; a system that stays on paper creates nonconformities.

5. Choose a certification body and apply

Make sure the body is accredited for management system certification and that its certificate is valid for your sector. The application asks for headcount, locations and scope; the quote must state the audit duration (man-days) clearly.

6. Stage 1 and stage 2 audits

At stage 1 documentation and readiness are assessed; at stage 2 the system is audited on site. A certificate is not issued until major nonconformities are closed; for minor nonconformities a corrective action plan is submitted.

7. Certification decision and surveillance

A committee independent of the audit decides; the certificate is valid for three years. A surveillance audit is held every year and a recertification audit at the end of year three.

The most common mistakes

• Copying ready-made templates without putting them into practice
• Doing the internal audit "on paper"
• Top management staying remote from the system
• Writing the scope wider than necessary and failing to keep up at the on-site audit

The typical time from application to certificate is three to six months. You can estimate your audit duration from your headcount with the calculator on our site.

What does the cost consist of?

The total cost consists of consultancy (optional), internal auditor training, certification audits and the internal time spent by the organisation. The certification fee is proportional to the audit duration; you can see your estimated budget with the calculator on our site.