Our biggest customer says we need ISO 9001 certification. What does that actually involve?

What to do now

Find the clause. Before anything else, get the actual language your customer used, from the purchase order, the supplier agreement, or the quality requirements document it references.

The wording matters because it tells you three things: which standard, whether third-party registration is required, and whether the certificate has to come from an accredited body. Northrop Grumman's supplier quality document is typical. One clause code requires a quality system conforming to ISO 9001 as documented by a third-party registrar, with the right to request a copy of the registration certificate annually. Other codes require AS9100 or AS9120 instead. Which code appears on your order decides what you buy.

Then ask your customer two questions while the relationship is fresh: is there a date, and will an accredited certificate from any recognized body satisfy them. The answers set your schedule and your shortlist.

Then look at what you already have. Every manufacturer already runs a quality management system. Yours may be undocumented and held by three long-tenured people, but it exists. Certification is mostly describing the system you run, closing the places where it is silent, and generating the evidence that it runs. Companies that understand this from the start spend far less than companies that believe they are building from nothing.

What it costs

Three separate buckets, and conflating them is how people arrive at wrong numbers.

Your own people's time. The largest cost and the one nobody invoices. Somebody has to write procedures, run internal audits, chase records, and sit with the auditor for a week.

Help from outside, if you use it. Published benchmarks put consultant-led implementation at roughly $8,000 to $13,000 at 50 employees, $15,000 to $25,000 at 150, and $25,000 to $41,000 at 300. A gap assessment on its own clusters at $2,500 to $5,000. Independent day rates run about $800 to $1,250.

The registrar. Separate, non-negotiable, and recurring. Audit time is set by the IAF MD5 tables from your headcount: seven auditor days for an initial audit at 86 to 125 people. At a single site of about 100, that puts the initial audit near $9,500 to $11,200 plus travel, with surveillance around $3,100 to $3,700 each of the next two years.

Honest mid-market sources put the all-in consultant-led total at $20,000 to $40,000 for a 50 to 500 person manufacturer. If you have read figures of $1,000 to $8,000 online, those are real only below roughly 25 employees, and the gap between those two numbers is the single most common source of surprise in this process.

What good looks like

A certificate that your customer accepts, on a system your people actually use, obtained on a schedule nobody had to lie about.

Concretely, that means: a documented system organized around your processes rather than around clause numbers; an internal audit program that has run a full cycle and found real things; a management review with your general manager in the room; three or more months of operating records an auditor can sample; and an accredited registrar booked at a date the evidence supports.

It also means a scope decision made on purpose. Certifying one product line or one building rather than the whole company lowers the headcount inside the scope and therefore the audit days. Check with your customer first that the narrower scope covers the work they buy.

When to bring in outside help

You probably do not need help to run your processes. You may need it for three specific things.

Knowing what a registrar will write up. This is pattern recognition from having sat through audits, and it is hard to acquire in one cycle.

The first internal audit cycle. Clause 9.2 requires objective, impartial auditors. In a 60-person plant, finding someone who did not design the process they are auditing is a real constraint.

Speed, when the date is fixed. A customer deadline compresses everything, and the compression is where companies buy templates that do not fit and then get written up for the mismatch.

If your deadline is more than a year out and you have a capable quality manager with time, doing it yourself is reasonable.

How ARG does it

We start with a gap assessment: on site, clause by clause, evidence first, run the way a registrar runs it. We interview the people doing the work and read the records they actually keep. You get findings with clause references and a prioritized remediation plan, in the order that matters to your certification date.

From there the work splits into fixed-scope projects against named gaps: documentation that matches the floor, process design, an internal audit program that runs without you chasing it, and corrective action discipline that survives the next visit. Before your Stage 2, we run a mock audit under the conditions the auditor will use, so your team has already answered the hard questions once.

Noah Brown leads that work. He is a certified ISO 9001 lead auditor who runs the internal audit program and hosts the customer and third-party audits inside a working manufacturer. We prepare you for certification. We never issue it: your registrar's independence is what makes the certificate worth having.

FAQ

Can we get certified without a consultant?

Yes. Below about 25 employees it is the normal path. Above that the cost of doing it alone is mostly your quality manager's year, spent adapting generic material while doing their day job.

How long will this take?

Three to six months is typical with help, and the floor is set by the roughly three months of operating evidence an auditor expects to sample. Any promise materially shorter than that deserves a hard look.

Does the certificate cover our whole company?

Only what is inside the scope on the certificate. Scope is your decision, within reason, and it drives audit days and cost. Confirm with your customer that your intended scope covers what they buy.

Is ISO 9001 what our customer actually wants?

Check the clause. Aerospace primes usually want AS9100, automotive wants IATF 16949, medical devices want ISO 13485. Each contains ISO 9001 and adds to it, and buying the wrong one is expensive.

How common is this?

Roughly 28,800 ISO 9001 certificates are held in the United States. In the 2020 global user survey, 72.4 percent of user organizations were third-party certified and 36 percent had 50 to 500 employees, which is the band most manufacturers reading this sit in.

Sources

• Northrop Grumman FQA-0500 supplier quality flowdown, clause QQS5 and the AS9100 and AS9120 equivalents.
• IAF MD5:2023 audit-time tables. Registrar totals are derived from those day counts and published day-rate ranges; treat them as estimates, not quotes.
• ARG market research 2026, sections 7.1, 7.2, 4.3 and 2.3 for consulting benchmarks, registrar arithmetic, the low-anchor problem, and the ISO 9001 user survey figures.