How long does it take to get ISO 9001 certified?

What to do now

Work backwards from the two fixed points, not forwards from today.

The first fixed point is your customer's date, if there is one. The second is the registrar's calendar, which you do not control. Accredited bodies book weeks to months out, and the gap between Stage 1 and Stage 2 adds more. Call two or three registrars in week one and ask for their earliest realistic Stage 2, before you plan anything else.

Then count backwards through the evidence requirement. An auditor at Stage 2 samples records. A system switched on three weeks ago has three weeks of records, and there is no way to manufacture the rest. Roughly three months of operating evidence is the practical floor, and it has to include at least one full internal audit cycle across your scope and one management review.

That arithmetic is the whole answer. Everything else is how fast you can write.

What it costs

Time is the currency here, so here is where it goes for a manufacturer of about 100 people.

Weeks 1 to 4: assessment and planning. A gap assessment, a scope decision, a remediation list in priority order, and registrar quotes in hand.

Weeks 3 to 12: closing gaps. Documentation that matches the floor, process definitions, competence and calibration records brought current, supplier controls, and the nonconforming product process. This is the bulk of the writing, and it runs in parallel with production, which is why it stretches.

Weeks 8 to 16: running the system. Internal audits across the scope, findings raised and closed, one management review held with real inputs. This period cannot be compressed, because its purpose is to generate the evidence.

Weeks 14 to 20: Stage 1. The readiness review. Expect concerns, and treat them as the preview of Stage 2 that they are.

Weeks 18 to 28: Stage 2 and the certification decision. Minor findings close through a corrective action plan reviewed remotely. A major triggers a follow-up audit before the certificate issues.

Compressing that to under four months means paying for parallel effort and accepting risk at Stage 2. Stretching it past nine usually means the project lost its owner.

What good looks like

Three to six months from a standing start, with a registrar booked early and evidence accumulating while the documentation is being written, rather than after.

The signs it is going well: the internal audit program starts before the documentation is perfect, because audits against an imperfect system find the gaps faster than reviewing the documents does. Your general manager attends the management review. Stage 1 produces a short list of concerns rather than a long one. And nobody is backdating anything.

The signs it is not: a consultant writing procedures nobody on the floor has read, an internal audit program that exists as a schedule with no completed reports, and a Stage 2 date booked before anyone checked the evidence would be there.

When to bring in outside help

Bring it in early if the date is fixed by a customer. The value of help is highest at the start, when sequencing decisions are made, and lowest three weeks before Stage 2 when the remaining options are all bad.

Bring it in for the internal audit cycle if you cannot staff impartial auditors. That single constraint delays more projects than any other, because clause 9.2 does not allow people to audit their own processes and small plants run out of candidates fast.

Do it yourself if your timeline is a year or more, your processes are already disciplined, and you have a quality manager with genuine hours rather than nominal ones.

How ARG does it

We start by asking for your customer's date and your registrar's earliest Stage 2, then build the plan between those two points instead of presenting a generic timeline.

The gap assessment comes first because it is the only honest basis for a schedule. From there the sequence is deliberate: get the internal audit program running early so the evidence clock starts, close documentation gaps in the order that affects the audit rather than the order they appear in the standard, and hold a real management review well before Stage 1 rather than the week after it.

Before Stage 2 we run a mock audit under the conditions the registrar will use. The purpose is that your team answers the hard questions once before it counts.

Noah Brown, a certified ISO 9001 lead auditor, runs that work. We prepare you for the audit. Your registrar decides the outcome, and that separation is the point.

FAQ

Can it be done in 90 days?

Rarely, and not at 100 employees. The evidence floor and the registrar's own scheduling make it implausible. There is a separate page on why the fast-certification offers you have seen are worth a second look.

What is the single biggest delay?

Internal audits. They require impartial auditors, they take real hours, and they cannot be backdated. Projects that start the audit program in month one finish on time far more often.

Does Stage 1 have to be on site?

Often not. It is largely a readiness and document review and many bodies do it remotely or partly so. Stage 2 is on site.

What if we get a major finding at Stage 2?

The certificate waits. A major must close within the registrar's window, typically 60 to 90 days, and normally triggers a follow-up audit at the registrar's cost to you. Past six months, a full new Stage 2 can be required.

Does a smaller scope go faster?

Yes, modestly. Fewer processes mean fewer procedures and fewer audits. The evidence floor does not move.

Sources

• IAF MD5:2023 audit-time tables and surveillance and recertification proportions.
• ARG market research 2026, section 7.2 for the roughly three-month implementation-evidence floor and the three-to-six-month consultant-assisted norm; section 1.2 for the four-month standard program published by a national provider; section 7.6 for major-nonconformity closure windows.