Most organisations pursue ISO 9001 certification for a practical reason: a customer requires it, a tender asks for it, or the business has grown to the point where informal ways of working are starting to fail. Whatever the trigger, the route to certification follows a well-defined path. This guide explains each step as it works in the UK, and where organisations most often lose time.
The short version
Certification is granted by an independent certification body, not by ISO and not by your consultant.
The certification audit has two stages. Stage 1 checks you are ready. Stage 2 checks your system is implemented and effective.
Certificates last three years, with surveillance audits in between and a recertification audit before expiry.
Step 1: Define your scope and target edition
Decide which sites, activities, products and services the certificate will cover. A scope that is too narrow may not satisfy your customers. One that is too broad adds cost and complexity. New systems should now be built to ISO 9001:2026, the current edition. See our summary of what changed in ISO 9001:2026.
Step 2: Carry out a gap analysis
Compare what you already do against each requirement of the standard. Most established businesses already have much of what ISO 9001 asks for, but it is rarely documented consistently or measured. A good gap analysis produces a prioritised action plan rather than a long list of missing documents.
Step 3: Build or adapt your quality management system
Close the gaps in a way that fits how you actually operate. The standard requires certain documented information, including your scope, quality policy, quality objectives and the records that show processes are controlled. Beyond that, document only what you need to work consistently. A lean system that people use will always perform better at audit than a thick manual nobody reads.
Step 4: Run the system and build evidence
This is the step organisations most often try to shortcut. Before the certification audit, your system needs to have been operating long enough to produce real records. You will need to have completed a full cycle of internal audits covering the scope, and at least one management review. Auditors certify what you do, not what you intend to do.
Step 5: Choose an accredited certification body
In the UK, choose a certification body accredited by UKAS for ISO 9001 and for your industry sector. You can check accreditation on the UKAS website. Certificates from unaccredited bodies are cheaper, but many customers and public-sector buyers will not accept them. The number of audit days is set using international accreditation rules based on your headcount and complexity, so be wary of quotes that look unusually low.
Step 6: The Stage 1 audit
Stage 1 is a readiness review. The auditor examines your documented system, scope and understanding of the standard, checks that internal audit and management review have taken place, and plans the Stage 2 audit. Any concerns raised here should be addressed before Stage 2.
Step 7: The Stage 2 audit
Stage 2 is the main assessment. The auditor interviews people across the organisation, observes work and samples records to confirm that the system is implemented and effective. Expect questions to be put to operational staff, not just the quality team.
Step 8: Nonconformities and the certification decision
Findings are graded as major or minor nonconformities. A major nonconformity, such as a requirement not addressed at all or a system failure, must be resolved before certification can be granted. Minor nonconformities need an accepted corrective action plan. Once the findings are dealt with, the certification body reviews the audit and issues the certificate.
Step 9: Surveillance and recertification
Certification is not a one-off event. Surveillance audits take place at least once a year, with the first within twelve months of the certification decision. In the third year, a recertification audit renews the certificate for a further three years. Keeping the system genuinely active between audits is what makes surveillance straightforward.
How long does it take?
In our experience, a smaller organisation with sound existing practices can typically be audit-ready in three to six months. Multi-site or more complex organisations, or those starting with very little in place, should plan for longer. The biggest variable is not documentation. It is how quickly the system starts producing evidence.
Where organisations most often struggle
The most common problems we see are an internal audit programme started too late to complete before Stage 2, management review treated as a formality, objectives that are not measurable, and staff who cannot explain how their work links to the system. All of these are avoidable with realistic planning.
How Hillscom can help
Hillscom supports organisations through every step, from gap analysis and implementation to internal audits, mock assessments and support on audit day. Find out more about our ISO 9001 consultancy, or contact us to discuss a certification readiness review.
