How does ISO 9001 certification work?

How does ISO 9001 certification work?

ISO 9001 certification is divided into preparation (gap analysis, implementation, internal audit and management review) and the external certification audit by an accredited certification body. The audit has two stages: in stage 1, the auditor checks whether your QMS is ready; in stage 2, how it works in practice. After the certification decision, the certificate is valid for three years and is monitored annually. As of November 2026.

For many quality managers, the external audit initially feels like a black box. Knowing the process and the audit logic removes the uncertainty: certification systematically checks whether your quality management system (QMS) works in practice the way it is documented.

What do you need before the certification audit?

Before the main audit (stage 2) can take place, these building blocks must be in place:

• Implemented QMS: processes, quality policy and quality objectives are defined and applied. The standard does not set a minimum period, but many certification bodies expect the system to have been running for a few months so that evidence is available.
• Internal audit: at least one internal audit covering the entire scope has been carried out (clause 9.2).
• Management review: top management has reviewed the QMS and documented the result (clause 9.3).
• Documented information: scope, quality policy, quality objectives and the evidence required by the standard are available.

Our article ISO 9001 requirements for companies explains the requirements in detail.

Which edition will you be certified to: ISO 9001:2015 or 2026?

ISO 9001:2026 was published on 16 September 2026. Certification bodies may only certify to the new edition once their accreditation has been extended to it. Under the transition rules of the international accreditation organisation, accredited initial certifications may only be issued to ISO 9001:2026 from 31 March 2028; certificates to ISO 9001:2015 remain valid until 30 September 2029. So clarify early with your certification body which edition you will be certified to.

You can read what changes with the new edition in ISO 9001:2026: What changes with the new version?.

What are the phases of the certification process?

The path to the certificate can be divided into four phases:

*Typical values for smaller companies with one site. The certification body sets the actual number of audit days based on accreditation rules, mainly according to the number of employees, sites and the complexity of the processes. Preparation depends heavily on how far your QMS has already progressed.

What happens in the stage 1 audit?

In the stage 1 audit, the auditor checks whether your QMS is ready for the main audit. Depending on the certification body, it takes place on site or remotely. Typical content:

• Review of documented information, such as quality policy, process descriptions, KPIs and organisation chart.
• Checking whether the internal audit and management review have been planned and carried out.
• Agreeing on scope, sites and processes.
• Planning the stage 2 audit.

If the auditor identifies gaps, they are recorded in the report and you close them before the stage 2 audit. The auditor may not advise you on how to do this: certification bodies must remain impartial (ISO/IEC 17021-1).

What happens in the stage 2 audit?

The stage 2 audit is the main audit. Here you demonstrate that the documented processes are applied in practice. It usually runs in four steps:

1. Opening meeting: the auditor presents the audit plan and clarifies the schedule and contacts.
2. Sampling and interviews: conversations with managers and employees from departments such as sales, development, HR or operations. Using concrete cases, the auditor checks whether requirements are met.
3. Evaluation of findings: nonconformities are graded (see below).
4. Closing meeting: the auditor summarises the results and states the recommendation.

How are nonconformities graded?

The auditor recommends certification, but the decision is made by the certification body itself, by a person who was not involved in the audit.

Who may issue ISO 9001 certificates?

In B2B sales, an ISO 9001 certificate carries the most weight when it comes from an accredited certification body. In Germany, these include TÜV companies, DEKRA and DQS. They are accredited by the German accreditation body (DAkkS) or another accreditation body that is part of the international recognition arrangement. Look for the accreditation mark on the certificate: non-accredited certificates are often not recognised in supplier assessments by large customers.

What happens after certification?

An ISO 9001 certificate is valid for three years, but tied to fixed reviews:

• Surveillance audits: at least once per calendar year, the first no later than twelve months after the certification decision. They have a smaller scope than the initial certification.
• Recertification: before the three years expire, with a renewed assessment of the entire system.

How do you keep the effort for follow-up audits low?

If you maintain your QMS only for the auditor, every surveillance audit becomes a special project. It gets easier when evidence is created in daily work:

• Capture evidence continuously: training records, approvals and changes are documented directly in the systems you use.
• Use synergies: if you also implement ISO 27001 or GDPR requirements, parts can be reused, such as document control, training records, internal audits and management review.
• No audit sprint: when processes are part of daily work, the status on audit day matches normal operations.

Conclusion: with good preparation, the certification audit is predictable

ISO 9001 certification follows a fixed sequence: preparation with internal audit and management review, stage 1 and stage 2 audits, the certification body’s decision and annual surveillance. Clarify early whether you will be certified to the 2015 or 2026 edition, and make sure evidence is created in daily work.

With the heyData compliance platform, you manage all ISO 9001-relevant policies and documented information digitally, get support with the management review and preparation for the external certification audit, and help finding the right internal and external auditor.

Take the first step: Book a free demo now