ISO 9001 certification takes eight steps: a gap assessment, a scope definition, documentation, about three months of running the system and keeping records, an internal audit plus a management review, registrar selection, a Stage 1 audit, and a Stage 2 audit. For a 10 to 100 person manufacturer, plan on four to eight months from a standing start to a certificate on the wall.
The order matters. You cannot pass a Stage 2 audit without operating records, and you cannot generate records until the system is documented and in daily use. Companies that try to skip ahead pay for it in failed audits and rescheduling fees.
This guide walks through each step, explains the three-year certificate cycle that follows, shows how to compare registrars, and lists the mistakes first-timers make most often.
The 8 Steps
Do the steps in order. Each one feeds the next.
Step 1: Gap assessment
Compare what you do today against what the standard requires. ISO 9001:2015 has 10 clauses; the requirements live in clauses 4 through 10. Walk each requirement and sort it into three buckets: we do this and can prove it, we do this but nothing is written down, or we do not do this at all. Most small manufacturers already meet more requirements than they expect. Purchasing controls (clause 8.4), calibration (7.1.5), and operator training (7.2) usually exist in some form. The common gaps are internal audits (9.2), management review (9.3), and a formal corrective action process (10.2). Write every gap down. That list is your project plan for the next few months.
Step 2: Define your scope
Scope is a short statement of what your certificate will cover: which site, which products, which processes. Something like "precision CNC machining of aluminum and steel components" plus your address. Scope also settles which requirements apply. You can mark a requirement not applicable only when it truly does not apply to your work, and you must justify the call. The classic example is a build-to-print shop that does no product design: it can exclude clause 8.3 (design and development). You cannot exclude a clause because it looks like work.
Step 3: Build the documentation
The standard calls this documented information. A small manufacturer needs a quality policy, measurable quality objectives, a map of its processes, procedures that keep work consistent, work instructions where detail matters, and forms that capture records. You have three ways to get it: write it yourself over several weeks, hire a consultant, or buy a fixed-price documentation package. As one example of the third option, ISO Delivered sells a flat $8,000 Full Documentation package of about 44 documents — 4 manuals and policies, 15 procedures, 10 work instructions, and 15 forms — delivered 2 to 4 weeks after you complete a questionnaire. Note that no documentation provider can sell you certification itself — none of them are accredited certification bodies, and neither is any consultant. Whatever route you take, the documents must describe your shop, not a generic one.
Step 4: Run the system for about 3 months
Documentation on a shelf proves nothing. Your registrar wants evidence the system runs in daily use, so plan on about three months of operating records before Stage 2. Real records, generated as work happens: nonconforming material reports under clause 8.7, calibration records (7.1.5), training and competence records (7.2), supplier evaluations (8.4), and a few corrective actions (10.2) taken all the way to closure. Auditors sample these records at Stage 2 and follow the trail. Records written the week before the audit look like records written the week before the audit.
Step 5: Internal audit and management review
Before Stage 2 you must complete at least one full internal audit (clause 9.2) and one management review (clause 9.3). The internal audit covers every process in your scope and asks the same questions a registrar will. One rule: nobody audits their own work. In a 15-person shop that can mean the office manager audits the floor and the production lead audits purchasing. That is fine. Management review is a working meeting where leadership examines audit results, customer feedback, process performance, nonconformities, and resource needs, then records decisions. Keep the minutes. The Stage 1 auditor will ask for both.
Step 6: Choose a registrar
A registrar — also called a certification body — audits you and issues the certificate. Choose one accredited under ISO/IEC 17021-1 by a recognized accreditation body; for US manufacturers that is usually ANAB. Get at least three quotes. Audit duration is set by IAF MD 5 based on your headcount, so three honest quotes should show similar audit days. When one quote is far cheaper, the difference is usually day rate, travel, or a registrar cutting days it should not cut.
Step 7: Stage 1 audit
Stage 1 is a readiness review, not the full exam. The auditor reads your documentation, confirms the scope makes sense, verifies your internal audit and management review happened, and checks conditions specific to your site. Findings at Stage 1 are called areas of concern rather than nonconformities. Treat them as a free preview and fix every one. Stage 1 and Stage 2 are typically scheduled a few weeks to a couple of months apart, and that window is your time to close the gaps.
Step 8: Stage 2 audit and certificate
Stage 2 is the full audit. The auditor walks the floor, interviews operators, and samples records against every applicable clause. Expect findings; a first audit with zero is unusual. Minor nonconformities are normal: you submit a corrective action plan under clause 10.2 and the certificate still issues. A major nonconformity — a required process missing entirely, or a system-level breakdown — must be closed before certification, sometimes with a follow-up visit. Once the auditor recommends certification, the registrar runs an internal technical review and issues the certificate, usually within a few weeks.
What Happens After: The 3-Year Cycle
Certification is not one audit. It is a cycle. The certificate lasts three years, and the registrar comes back every year.
| Year | Audit | What it covers |
|---|---|---|
| Year 1 | Stage 1 + Stage 2 | The full system. Certificate issued after Stage 2 findings close. |
| Year 2 | Surveillance audit | A shorter audit: part of the system, plus internal audits, management review, complaints, and corrective actions. |
| Year 3 | Surveillance audit | Another partial audit, usually covering the processes year 2 skipped. |
| End of year 3 | Recertification audit | A fuller audit before the certificate expires. Passing starts a new 3-year cycle. |
Surveillance audits are shorter and cheaper than the initial audit, but they are not optional. Skip one and the registrar can suspend the certificate, then withdraw it — and your customer's supplier portal will notice.
How to Compare Registrars
Three quotes that look similar on price can differ a lot in practice. Compare them line by line.
| What to compare | What to look for |
|---|---|
| Accreditation | ISO/IEC 17021-1 accreditation from a recognized body (ANAB for most US shops). Verify it in the public directory. |
| Industry experience | Auditors who have audited shops like yours. Ask who would be assigned, not just whether they "do manufacturing." |
| Audit days | Day counts follow IAF MD 5 for your headcount. A quote with fewer days than the other two is a red flag, not a bargain. |
| Day rate | Registrars typically quote roughly $1,000 to $1,800 per auditor day. Compare the 3-year total, not just year one. |
| Extra fees | Application fees, certificate fees, annual program fees, and travel at cost. Ask for all of them in writing. |
| Scheduling | Lead times of two to three months are common. Book Stage 1 while you are still building records. |
Common First-Timer Mistakes
- Documenting an imaginary shop. If the procedure says you inspect every incoming lot and you do not, you have written a nonconformity into your own system. Describe what you really do, then improve it.
- Booking Stage 2 before the records exist. About three months of operating records is the pacing item in the whole project. No documentation package, consultant, or rush fee shortens it.
- Auditing your own work. The internal audit fails its purpose when the person who runs a process grades it. Cross-train a second person, or bring in outside help for a day.
- Treating management review as an email thread. Clause 9.3 lists specific inputs and outputs, and auditors check the minutes against that list. Hold the meeting and write down the decisions.
- Ignoring Stage 1 findings. An area of concern left open tends to come back at Stage 2 as a nonconformity. The auditor told you where they will look.
- Over-documenting. Every extra procedure is one more thing to keep current and one more question at audit time. Small shops pass audits with lean systems every week.
Frequently asked questions
How long does it take to get ISO 9001 certified?
Most 10 to 100 person manufacturers take four to eight months from a standing start. Documentation takes weeks, the operating-records period takes about three months, and registrar scheduling adds lead time on top. Shops with existing quality habits and someone giving the project real attention land near the short end.
How much does ISO 9001 certification cost?
For a small manufacturer, registrars typically quote in the range of $4,000 to $10,000 for the initial Stage 1 and Stage 2 audits, with audit days driven by headcount under IAF MD 5, plus annual surveillance fees after that. Documentation help, internal labor, and any new calibration or training costs are separate. Budget for the full three-year cycle, not just year one.
Can you fail a Stage 2 audit?
Yes, but outright failure is rare for a prepared company. Minor nonconformities are normal; you submit a corrective action plan under clause 10.2 and the certificate still issues. A major nonconformity blocks the certificate until you close it, which can mean a follow-up audit and extra fees.
What is the difference between Stage 1 and Stage 2?
Stage 1 is a readiness review: the auditor checks your documented system, your scope, and whether your internal audit and management review happened. Its findings are areas of concern, not nonconformities. Stage 2 is the full audit of the working system, and its findings decide certification. The two are usually a few weeks to a couple of months apart.
Do I need a consultant to get ISO 9001 certified?
No. The standard does not require one, and many small manufacturers certify without a consultant. What you cannot skip: documentation that matches how you work, about three months of records, an internal audit, and a management review. Buy help where you are short on time, not because anyone requires it.
How long is an ISO 9001 certificate valid?
Three years. The registrar performs a surveillance audit in each of the two years after certification, then a recertification audit before the certificate expires. Missing a surveillance audit can get the certificate suspended.