To get ISO 9001 certification, an organization builds a quality management system that meets ISO 9001:2015, operates it until internal audit and management review records exist, and then applies to an independent certification body, which audits in Stage 1 and Stage 2 before making its decision. ISO sets the requirements but does not prescribe how you implement them, and certification itself is a choice rather than an obligation. Kalite Pusulası is a quality management consultancy and training firm: we prepare organizations and train their teams, while the certification decision rests with the certification body alone.
To learn how to get ISO 9001 certification, read the path in the right order: build a quality management system that meets ISO 9001:2015, run it until it produces real records, then apply to an independent certification body that audits in 2 stages. According to ISO (undated), ISO 9001:2015 defines the globally agreed requirements for a quality management system but does not prescribe how an organization implements them. The certification decision belongs to the certification body; a consultant prepares the organization and trains its people.
Buyers ask for the certificate for concrete reasons. According to the International Accreditation Forum (IAF, undated), ISO 9001 certification is frequently used to increase confidence in an organization’s products and services, in the selection of suppliers in supply chains, and in the right to tender for procurement contracts.
Who this guide is for
This guide is written for the four people who usually carry an ISO 9001 project, in the words they use.
- The SME owner starting from scratch. A customer or a tender asked for ISO 9001, and you need the steps, the order, and who does what.
- The quality manager preparing the system. You need to know what the auditor examines in Stage 1 and Stage 2, and which records must exist before you apply.
- The already-certified firm with a paper system. Internal audit, root cause and corrective action happen in a scramble before each surveillance audit. You want them inside daily work.
- The HR or training lead. You are buying in-house internal auditor training and need its scope, and what participants receive.
What ISO 9001 requires before you apply
ISO 9001 is a requirements standard, not a document template. It says what must be in place; you decide how it works in your business. That division is exactly what ISO (undated) states: the requirements are agreed globally, the implementation is yours.
Scope, context and interested parties
Start with the scope of the quality management system: which activities, products, services and sites it covers. Then assess your internal and external context. Record the needs and expectations of interested parties, such as customers, regulators and key suppliers. From there set a quality policy and measurable quality objectives, define your processes, and name who owns each one. Risks and opportunities are then assessed against those processes, not in the abstract.
Documented information, in proportion
Documented information is a control, not the goal. Its extent follows your size, your processes, how complex your activities are, and how competent your people already are. A small firm does not need a thick manual to be auditable. ISO publishes guidance for this case. The 4th edition of the handbook ISO 9001:2015 for Small Enterprises — What to do? was produced to guide small organizations developing a quality management system based on ISO 9001:2015 (ISO/TC 176/SC 2, undated).
Because the standard does not prescribe how you implement it, a separate quality department is not implied. Responsibilities and authorities can sit with existing staff, as long as the duties are actually carried out.
Internal audit and management review
Internal audit checks the system against the standard’s requirements and against your own arrangements. Management review is top management’s periodic judgment of whether the system is adequate and effective. Both are requirements, and both leave records an auditor will ask for. Running them on a rolling plan across the year is good practice rather than a requirement — but it is what turns an external audit into a confirmation of what you already know.
How to get ISO 9001 certification, step by step
The sequence below is the practical order of work: 7 steps, each producing something the next one needs.
Steps 1 to 3: current-state analysis, planning, documented information
First, a current-state analysis. Compare what you do today against what ISO 9001 requires, and list the gaps. Second, plan the system: scope, policy, objectives, processes, responsibilities, risks and opportunities, and performance indicators. Third, write only the documented information those processes need — process descriptions, work instructions, forms and records, supplier evaluation, risk assessments, and nonconformity and corrective action records.
Steps 4 and 5: implementation, competence, internal audit
Fourth, put the system into daily use. Make people aware of the purpose, their own duties and the objectives. A system owned only by the quality department rarely survives its first busy month. Fifth, run internal audits, raise nonconformities honestly, and investigate root cause before closing anything.
Steps 6 and 7: management review and the certification audit
Sixth, hold the management review: customer satisfaction, objectives, process performance, audit results, nonconformities, corrective actions, risks and improvement opportunities. Seventh, apply to a certification body for the initial certification audit. Certification remains a choice: “Organizations implementing ISO 9001 can choose whether or not to seek certification” (ISO, undated).
Stage 1 and Stage 2: what the certification body looks at
An initial certification audit consists of Stage 1 plus Stage 2, as set out in IAF MD 5 by the International Accreditation Forum (IAF, undated).
Stage 1 — scoping, planning and readiness
Stage 1 is primarily for scoping and planning the Stage 2 audit. It also lets the auditor evaluate whether the organization is ready for certification, according to the ISO 9001 Auditing Practices Group (2016). Expect questions about your scope, your documented information, and your internal audit and management review records.
Stage 2 — implementation and effectiveness
Stage 2 examines the system in use: how processes actually run, what the records show, and whether the requirements are met in practice. Nonconformities raised there need correction and corrective action. Audit time is not arbitrary either. IAF MD 5 states that audit time must take account of the outcome of the review of system performance under ISO/IEC 17021-1 (IAF, undated).
Who does what — and who decides
Keeping the roles straight saves both money and disappointment.
Roles in ISO 9001 certification
| Who | What they do | Cited source |
|---|---|---|
| ISO | Develops International Standards such as ISO 9001. Its Committee on Conformity Assessment (CASCO) has produced standards related to the certification process, which are used by certification bodies. | ISO, undated |
| Your organization | Implements the quality management system. ISO 9001:2015 gives the requirements but does not prescribe how you meet them, and you choose whether or not to seek certification. | ISO, undated |
| Certification body | Audits and certifies the management system. ISO/IEC 17021-1:2015 contains principles and requirements for the competence, consistency and impartiality of such bodies. | ISO, 2015 |
| Accreditation body (in Türkiye, TÜRKAK) | Accredits certification bodies. Accreditation independently confirms the certification body’s competence, which is why an accredited certificate adds confidence. | ISO, undated |
| Consultant (Kalite Pusulası) | Prepares and trains: current-state analysis and a roadmap, system set-up and improvement with your team, internal audit, management review and audit preparation, and tailored training. Takes no part in the certification decision. | — |
ISO does not certify companies. It develops the standards, and CASCO has produced standards related to the certification process that certification bodies use (ISO, undated). An accredited certificate carries more weight because accreditation independently confirms the certification body’s competence (ISO, undated). Certificates can also be checked. IAF CertSearch (undated) describes itself as the only official global certificate database by IAF, and lets users verify accredited ISO certificates and spot invalid or counterfeit certificates that are not in the database.
How long it takes, what it costs, and where systems go wrong
Time and cost
There is no fixed duration and no fixed price, and we will not invent either. Both follow your headcount, sector, number of sites and process complexity. They also follow the state of your existing system and documented information, and the scope of consultancy and training you buy. Audit duration is decided separately by the certification body, under the rules above. The honest route to a realistic plan is a current-state analysis first, then a roadmap and a proposal.
Scale is not a barrier. ISO publishes small-enterprise guidance, and the ISO Survey (undated) reports each year the number of valid certificates to standards such as ISO 9001 for each country, if you want the market context.
Common mistakes in ISO 9001 certification readiness
- Building the system to obtain a certificate rather than to run the business.
- Writing documented information that does not match how the work is really done.
- Leaving employees out, so the system belongs to one department.
- Treating risks and opportunities as a form filled in once.
- Not following process performance between audits.
- Running internal audits only just before an external audit.
- Closing nonconformities without investigating root cause.
If your certificate is already on the wall and the system lives in a folder, these are the repairs that make a surveillance audit uneventful.
What to check before you order
- Ask whether the certification body is accredited for your scope — accreditation independently confirms its competence (ISO, undated).
- Check that the body works to ISO/IEC 17021-1:2015 (ISO, 2015), which sets requirements for competence, consistency and impartiality.
- Confirm the quotation covers an initial certification audit of Stage 1 plus Stage 2, not a single visit.
- Ask how the audit time was determined, and whether the review of system performance was taken into account.
- Read the proposed scope wording against the activities and sites you actually operate.
- Verify any certificate you are shown — a supplier’s or your own — in IAF CertSearch.
- Keep consultancy and certification as separate purchases; impartiality requirements for certification bodies sit in ISO/IEC 17021-1:2015.
- Before buying either, get a current-state analysis, so the gaps, the roadmap and the budget rest on evidence rather than assumption.
Working with Kalite Pusulası
We are a quality management consultancy and training firm. We do not audit, certify or accredit. A certification body audits and certifies a management system, and in Türkiye the accreditation body TÜRKAK accredits laboratories, inspection bodies and certification bodies. Our work is preparation and training, within the scopes of ISO 9001, ISO 13485, ISO/IEC 17025, ISO/IEC 17020, ISO/IEC 17065 and FSC.
- Current-state analysis and a roadmap.
- Setting up or improving the system with your own team.
- Internal audit, management review and audit preparation.
- Training tailored to your organization, on site or online; participants receive a certificate of attendance.
For HR and training leads: iç tetkik eğitimi, internal auditor training, is delivered in house or online and shaped around your processes and records. The only certificate in our offer is the certificate of attendance that participants receive.
Establish. Improve. Make it sustainable. If you want to know where you stand against ISO 9001, request a current-state analysis: we review your organization against the standard and give you a roadmap and a proposal. If your team needs internal auditor training, ask us for a tailored training proposal.
Sources
- International Organization for Standardization (ISO) — ISO 9001 explained (undated).
- International Organization for Standardization (ISO) — ISO 9001 — Quality management systems (undated).
- International Organization for Standardization (ISO) — Certification (undated).
- International Organization for Standardization (ISO) — ISO/IEC 17021-1:2015 Conformity assessment — Requirements for bodies providing audit and certification of management systems, Part 1 (2015).
- ISO/TC 176/SC 2 and International Accreditation Forum (ISO 9001 Auditing Practices Group) — Guidance on: Two stage initial certification audit (2016).
- International Accreditation Forum (IAF) — IAF MD 5 — Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems (undated).
- International Accreditation Forum (IAF) — FAQ (undated).
- IAF CertSearch — Verify ISO Certificates Instantly (undated).
- ISO/TC 176/SC 2 — ISO 9001:2015 for Small Enterprises — What to do?, 4th edition (undated).
- International Organization for Standardization (ISO) — The ISO Survey (undated).
Frequently asked questions
Who issues the ISO 9001 certificate?
ISO does not certify organizations. It develops International Standards such as ISO 9001, and its Committee on Conformity Assessment (CASCO) has produced standards related to the certification process that certification bodies use (ISO, undated). An independent certification body audits and certifies the management system; ISO/IEC 17021-1:2015 contains principles and requirements for the competence, consistency and impartiality of those bodies (ISO, 2015). The accreditation body — in Türkiye, TÜRKAK — accredits certification bodies, and that accreditation independently confirms their competence (ISO, undated). A consultancy such as Kalite Pusulası prepares the organization and trains its people, and takes no part in the certification decision.
How long does it take to get ISO 9001 certification?
There is no single answer, and no responsible consultant will give you a date. Preparation time depends on your headcount, sector, number of sites, process complexity, and the state of any existing quality management system and documented information. The external audit itself is an initial certification audit of Stage 1 plus Stage 2, and IAF MD 5 states that audit time must take account of the outcome of the review of system performance under ISO/IEC 17021-1 (IAF, undated). Start with a current-state analysis; it is what makes a realistic schedule possible.
Do we need a consultant to get ISO 9001 certification?
No. An organization can build and run its quality management system with its own resources, and ISO publishes guidance for small organizations doing exactly that — the 4th edition of the handbook ISO 9001:2015 for Small Enterprises — What to do? (ISO/TC 176/SC 2, undated). Consultancy is a choice that tends to make the work more systematic and better matched to how you already operate. Our scope is current-state analysis and a roadmap, setting up or improving the system with your team, internal audit, management review and audit preparation, and training tailored to your organization.
How can we check whether an ISO 9001 certificate is valid?
Use IAF CertSearch, which describes itself as the only official global certificate database by IAF; it lets users verify accredited ISO certificates and spot invalid or counterfeit certificates that are not in the database (IAF CertSearch, undated). This matters in supplier selection, because ISO 9001 certification is frequently used to increase confidence in an organization’s products and services, in the selection of suppliers in supply chains, and in the right to tender for procurement contracts (IAF, undated). Also read the scope wording on the certificate: it tells you which activities and sites were covered.