ISO 9001 Certification

ISO 9001 certification is independent confirmation that your quality management system meets the requirements of the standard. It is issued by a certification body after an audit, not by ISO, which writes the standards but does not certify anyone. For many small businesses the certificate is what opens the door to tenders, larger customers and supplier approval lists. The system behind it is what makes the business more consistent.

Who certifies you

Choose a certification body that is accredited for ISO 9001 in your sector. In Ireland accreditation is provided by INAB, in the UK by UKAS and in the United States by ANAB, and accreditation bodies in other countries recognise one another. A certificate from an unaccredited body is cheaper but often isn't accepted by the customers and tenders that asked for ISO 9001 in the first place. Ask for quotes from two or three accredited bodies and compare the audit days they propose, not just the day rate.

The steps to certification

1. Decide the scope: which sites, products and services the system covers. Everything else depends on it.
2. Run a gap analysis against the standard to see what you already have and what is missing. Our gap analysis guides explain how.
3. Build the system. Put in place the processes and documented information the standard requires, fitted to how your business actually works.
4. Operate it. Auditors need evidence that the system works, not just that it exists. Run it for long enough to produce real records: training, supplier evaluations, customer feedback, nonconformities and corrective actions. For a small business this usually takes a few months.
5. Complete internal audits and a management review. Certification bodies expect both before the certification audit. See our management review guides.
6. Stage 1 audit. The auditor reviews your documentation and checks that you are ready, and may raise areas of concern to fix before stage 2.
7. Stage 2 audit. The auditor checks on site, or remotely where that is allowed, that the system is implemented and effective, by sampling records and talking to your people.
8. Close any nonconformities. Major nonconformities have to be resolved before the certificate is issued. Minor ones need an accepted corrective action plan.

What the auditor expects to see

ISO 9001 requires some documented information outright. This includes the scope of the system, the quality policy, quality objectives, and records such as competence, the results of monitoring and measurement, internal audit results, management review results, and nonconformities with the actions taken. Beyond that you decide how much documentation you need. The test is whether your processes run consistently and whether you can show that they do.

After the certificate

A certificate is normally valid for three years. The certification body carries out surveillance audits, usually once a year, to check that the system is still maintained and improving, and a recertification audit before the three years are up. The system has to keep running between audits. Surveillance auditors look at what has happened since their last visit.

Which edition

ISO 9001:2026 is now the current edition. If you are starting out, ask your certification body which edition it will certify you against and from when. Certifying to an edition that is being replaced means a transition soon after. Our ISO 9001:2026 guide covers what the change involves.

Templates

Our ISO 9001 pack gives you the documentation a certification-ready system needs: a quality manual, procedures, policies, forms, registers, audit checklists and a gap analysis. Every document is editable, so it can be made to match how your business works. The pack page states the edition its documents follow. Download the pack overview and a real management review minutes form in our free ISO templates to see the level of detail.

The guides below walk through the route to certification.