ISO 9001 Certification: Process, Duration and Requirements
ISO 9001 certification for manufacturing SMEs: requirements, the two-stage audit process, duration and the role of internal audit and management review.
In this article9
ISO 9001 certification is the audit of a quality management system (QMS) by an independent certification body, which at the end issues a certificate designed to run for three years. For the managing director of a manufacturing SME, this means: most of the work lies before the audit, in building a system that is genuinely applied in day-to-day operations. This article puts terms, process, duration and requirements into context. What certification costs in detail, and what changes with the revision of the standard, are covered in separate articles.
What does ISO 9001 mean?
ISO 9001 is the international standard setting out the requirements for a quality management system; in Germany it applies as DIN EN ISO 9001 in both German and English versions. DIN Media lists DIN EN ISO 9001:2015-11 as the current edition; it was amended by DIN EN ISO 9001/A1:2024-11.[1] Its requirements are generic and apply to organizations of any type and size, regardless of product or service. Methodologically, the standard requires a process-oriented approach following the Plan-Do-Check-Act (PDCA) cycle, combined with risk-based thinking.
For a contract manufacturer or a machine builder, this means in concrete terms: the standard does not prescribe how a turned part is to be inspected. It requires that processes, responsibilities, customer requirements, risks and objectives are defined, controlled and evaluated — and that this can be demonstrated.
The 2026 revision
A new edition of the standard is on the way. DIN Media lists the 2015-11 edition as current, but with the note that it will be replaced by DIN EN ISO 9001:2026-11; a draft standard (ISO/DIS 9001:2025) has been available since September 2025.[2] According to the draft, additions include the harmonized structure for management system standards, the climate aspects from Amendment A1:2024, and extended requirements on risks and opportunities. Anyone starting a project now should clarify with the certification body which edition the audit will be based on.
What is a management review?
The management review is the periodic evaluation of the QMS by top management — in an SME, usually by the executive management — asking whether the system remains suitable, adequate and effective. ISO 9001 regulates it in the chapter on performance evaluation. The standard does not specify a fixed frequency; in practice, an annual review is common, as an explanation by the compliance provider Secjur notes.[3]
According to this explanation, the inputs include the results of internal and external audits, customer satisfaction and customer feedback, the performance of key processes, and the status of previous actions. The outputs are decisions: on improvements, on the need for staff, budget or infrastructure, on changes to the QMS, and on quality objectives. The review is documented with date, participants and inputs, because the record is presented during the certification audit.
The difference from the internal audit lies in the direction of view. The audit checks whether processes run as defined. The management review decides whether what has been defined is still right for the company — for example, when a new major customer arrives with its own supplier requirements.
What is an internal audit?
An internal audit is a planned, systematic examination carried out by the company itself to determine whether the QMS meets the company's own definitions and the requirements of ISO 9001 and is effectively implemented. The standard requires, in the same clause: internal audits take place at planned intervals, according to an audit programme covering frequency, methods, responsibilities and reporting, with defined criteria and a defined scope. The results go to the relevant management, deviations lead to corrections and corrective actions, and both are retained as documented information.
Two points determine the practical value:
- Objectivity: auditors do not audit their own work. In a smaller company this can mean that the head of production planning audits the incoming goods inspection and vice versa, or that an external auditor is commissioned.
- Risk orientation: the programme sets the frequency according to significance and previous results. A process with recurring complaints is audited more often than the maintenance of document templates.
For certification, the internal audit is not a formality. The certification body already assesses in Stage 1 whether internal audits and management reviews are planned and carried out.[4]
What does an ISO 9001 certificate cost?
What an ISO 9001 certificate costs depends primarily on the audit time set by the certification body and on the internal effort for building and maintaining the system; there is no flat-rate price. The certification body determines the audit time according to the binding document IAF MD 5 of the International Accreditation Forum. The basis is the number of effectively employed staff within the scope, adjusted for factors such as complexity, sites and shift operation. According to IAF MD 5:2019, an audit day is, in the original wording, "Audit Day – normally 8 hours".[5]
| Audit in the cycle | Audit time according to IAF MD 5:2019 |
|---|---|
| Initial certification (Stage 1 and 2) | Base value according to headcount, adjusted for complexity and sites |
| Surveillance audit, years 1 and 2 | roughly one third of the initial certification, usually not less than one audit day |
| Recertification, year 3 | roughly two thirds of the initial certification calculated for the current state, not less than one audit day |
For an SME's budget this means: a quotation can only be compared if the number of audit days is stated for the entire three-year cycle, not just for the initial audit. Travel costs, possibly consultancy and above all internal working hours come on top. A separate article puts the price ranges for SMEs into context.
Can I carry out the ISO 9001 certification myself?
A company can build its quality management system itself, but only a certification body can issue the certificate. The standard does not require a consultant. An SME can build the QMS with its own staff — for example with a quality management representative coordinating — and buy in support only for training or an external internal audit.
When choosing a certification body, accreditation matters. In Germany, the Deutsche Akkreditierungsstelle (DAkkS) accredits certification bodies for management systems according to DIN EN ISO/IEC 17021-1:2015.[6] Which accreditation is currently valid is shown by the DAkkS in its database of accredited bodies; a certificate only reflects the status of its issue date.[6] The difference has practical consequences: according to its own procedure description (vendor statement), TÜV NORD CERT only accepts certificates from accredited bodies whose accreditation body is a signatory of the multilateral agreements of the European co-operation for Accreditation (EA) when transferring certification; companies with certificates from non-accredited bodies are treated as new customers.[4]
| Route | What you do yourself | What stays external |
|---|---|---|
| Entirely in-house | Building the QMS, documentation, internal audits, management review | Certification audit by an accredited certification body |
| With occasional support | Build-up and operation, training or internal audit purchased in | Certification audit |
| Consulting project | Participation, approvals, operation after handover | Build-up by consultants, certification audit |
A self-declaration without a certification body is not a certificate. If a customer demands an ISO 9001 certificate in a supplier audit, it takes an audit by a certification body.
How long does ISO 9001 certification take?
ISO 9001 certification takes as long as it takes for the QMS to be implemented, demonstrably running, and for both audit stages to be completed without open nonconformities; the audits themselves are the shorter part. The standard sets no fixed deadline. According to TÜV NORD CERT, the certification procedure consists of initial certification, surveillance and recertification[4]; the deadlines at a glance (vendor information):
| Step | What happens | Deadline |
|---|---|---|
| Stage 1 | Assessment of documentation, site and readiness; check of whether internal audits and management reviews have been carried out | Weak points must be resolved by stage 2 |
| Stage 2 | On-site effectiveness check: interviews, documents, records, walk-through | Report corrective actions within 6 weeks of the last audit day |
| Certificate | Issued once all nonconformities are resolved and the certification decision has been made | after acceptance of the corrective actions |
| Surveillance audit | annually, except in the year of recertification | first one no later than 12 months after the certification decision |
| Recertification | audit of all standard requirements, methodology as in stage 2 | completed before the certificate expires |
Three things drive the total duration: how much of the system already exists (work instructions, inspection plans, complaint process), how quickly a complete cycle of internal audit and management review can be completed, and how many nonconformities turn up in stage 2. If the corrective actions are not reported on time, the audit is deemed failed according to TÜV NORD CERT, and no certificate can be issued.[4]
What do you need for ISO 9001 certification?
For ISO 9001 certification you need an implemented QMS with a defined scope, processes that are lived and documented, at least one internal audit and one management review, and a contract with an accredited certification body. As a checklist before registering for the initial audit:
- Scope: which sites, products and processes the QMS covers, defined in writing.
- Context and risks: interested parties, risks and opportunities identified and backed by measures.
- Quality policy and quality objectives: measurable, with owners and deadlines.
- Processes: core processes such as quotation, order clarification, production planning, manufacturing, inspection, shipping and complaints are described, with responsibilities and metrics.
- Documented information: instructions and records are findable, current and controlled, from monitoring equipment to training records.
- Internal audit: an audit programme and at least one complete cycle with report and corrective actions.
- Management review: carried out and minuted, with decisions.
- Certification body: accredited, with a quotation covering the entire three-year cycle.
If you already operate another management system, much can be reused. The logic of a two-stage initial audit, surveillance and recertification is the same for ISO 50001 certification, and monitoring equipment ties directly into topics such as the coordinate measuring machine or machine vision in quality control.
Start certification when a customer requires it or when you are building the QMS anyway; in that case, plan the first complete cycle of internal audit and management review first, and only then schedule the audit date. Further context on quality topics can be found in the Quality section and in the Industry section on GoMaschine.
Frequently asked questions
How long is an ISO 9001 certificate valid?
The certificate is designed around a three-year cycle. Surveillance audits take place in the two years in between, with a recertification audit before expiry.
Who issues an ISO 9001 certificate?
A certification body — in Germany, usually one accredited by DAkkS under ISO/IEC 17021-1. DAkkS accredits these bodies but does not itself issue QMS certificates to companies.
Do you have to write a manual for ISO 9001?
The 2015 edition does not require a quality management manual as a fixed document, but rather documented information to the extent the company needs for effective processes. A manual remains permitted if it is useful in operation.
What happens in the event of nonconformities during the audit?
Every nonconformity requires a root cause analysis and corrective actions. Only once the audit team has accepted them can the certificate be issued.
Sources
Related reading
All Quality →Coordinate Measuring Machine: Designs, Accuracy and Costs
Independent overview of machine designs, ISO accuracy and costs of coordinate measuring machines. Key facts for buyers and production managers in SMEs.
