Guides · Certification
The ISO 9001 certification timeline
Certification is not an exam you cram for. It is an audit of a system that has already been running. That single fact shapes the whole timeline: a two-stage initial assessment, a mandatory gap between building and being assessed, and then a three-year cycle of surveillance that never really lets the system go idle. Here is how it unfolds for a small business.
The short version
Plan for four to twelve months from start to certificate, most of it set not by paperwork speed but by the operating history an auditor needs to see. The certificate then lasts three years, held open by annual surveillance audits. An accredited certification body decides, never JumpStart and never ISO itself.
The cycle · at a glance
The path
From decision to certificate
The route nearly every small business takes, in order.
Build and gap analysis
Implement the system against clauses 4–10 and compare where you are against what the standard asks. For a small business with some quality practices already in place, this is commonly a few months of work. This is the phase JumpStart ISO compresses.
Operate the system
The step that cannot be rushed. The management system should run for roughly three to six months, generating real records, before certification is realistic, and you must complete at least one full internal audit and one management review in that window. An auditor is looking for a system with a history, not a system switched on last week.
Stage 1 audit · readiness review
The certification body reviews your documented system and judges whether you are ready for full assessment. For most small and medium businesses this is about a day, often partly on site. Any gaps found here are yours to close before Stage 2.
Stage 2 audit · the real assessment
Usually one to two months after Stage 1, the certification body returns to assess whether the system is genuinely implemented and effective, on site, against evidence, across your processes. This is the audit that decides certification.
Findings, then the certificate
Nonconformities raised at Stage 2 must be addressed: minor ones with a corrective-action plan, major ones typically closed before the certificate issues. Clear them and the accredited certification body issues your ISO 9001 certificate, valid for three years.
After the certificate
The three-year cycle
Certification is not a finish line; it is the start of a maintained state. The certificate runs for three years, and the certification body confirms you are holding the line with annual surveillance audits in the two years between. These are lighter than the full assessment, sampling parts of the system rather than auditing all of it, but they expect to see the system still operating: internal audits still happening, management reviews still held, improvements still made.
Before the three years are up, a full recertification audit renews the certificate for another cycle. It is broader than a surveillance visit, though usually lighter than the original Stage 2 because your system is now established. The rhythm is deliberate: ISO 9001 rewards a system that is genuinely run, and quietly exposes one that was assembled for a single audit and then left to drift.
That is why readiness and maintenance are the same discipline, not two projects. A system built to operate, with the audit and review cadence already running (covered in the internal audit and management review guide), sails through surveillance. One built only to pass has to be revived every year.
Straight answers
Asked and answered
How long does it take?
Commonly four to twelve months for a small business, depending on your starting point. The gating factor is operating history, not documentation speed, because the system has to run before it can be audited.
Stage 1 vs. Stage 2?
Stage 1 is a readiness review of your documented system. Stage 2, a month or two later, is the full on-site assessment of whether it actually works. Stage 2 decides certification.
Does the certificate expire?
It runs three years, held open by annual surveillance audits, then renewed by a recertification audit. Let the surveillance lapse and the certificate can be suspended or withdrawn.
Who actually certifies us?
An accredited, independent certification body, never ISO, and never a preparation program like JumpStart. We get you ready; the certification body decides.
Sources
- ISO: ISO 9001 and certification (ISO does not perform certification; accredited bodies do)
- ISO/IEC 17021-1 (requirements for bodies auditing and certifying management systems: the two-stage audit and surveillance model)
- ASQ: ISO 9001 certification overview
Next up
JumpStart ISO compresses the part you can compress, building the system, so the operating months start sooner and the certificate arrives faster.
Request early access