A first ISO 9001 certificate for a small US manufacturer is three clocks, not one project plan. You size documented information to the shop you run today. You operate that system long enough to produce records. You then sit a two-stage audit with a certification body accredited by an IAF MLA signatory such as ANAB. Six to nine months is typical for a first certification.
This page is for shops that have never held ISO 9001:2015. It does not size the QMS for a 20-person job shop — that work lives in ISO 9001 for Small Manufacturers. It does not walk the eight mechanical steps — that work lives in the certification process guide. It names the order that first-timers get wrong: documents, then the record clock, then the registrar.
Customer flow-down is the usual reason. An OEM, a prime, or a buyer’s approved-vendor list asked for a certificate. That pressure is real. It does not mean you need a plant-sized quality department, and it does not mean a documentation vendor can sell you certification.
The three clocks on a first certificate
Clock one is documentation. ISO 9001:2015 requires documented information: a defined scope, a quality policy, quality objectives, process criteria, and the records that prove processes ran. A working small-shop system also needs procedures and forms because records only exist when a process produces them. You can write this yourself, hire a consultant, or buy a fixed-price packet. As one example of the third option, ISO Delivered sells a flat $8,000 Full documentation package — manuals and policies, procedures, work instructions, and forms, sized to how your company runs — typically 2–4 weeks after a complete intake. A $500 Readiness Report maps applicable shall-statements first. No documentation provider is an accredited certification body.
Clock two is the record clock. Stage 2 certifies a system in use. Dated evidence of internal audit (clause 9.2), management review (clause 9.3), and corrective action (clause 10.2) is what registrars sample. Roughly three months of operation is the common minimum. You cannot backfill a quarter of management-review minutes the week before Stage 2. Start those two processes as soon as the documents describe them.
Clock three is the registrar. An accredited certification body quotes audit days from IAF MD 5, schedules Stage 1 and Stage 2, and issues the certificate if the system meets ISO 9001:2015 and matches what you run. Booking often needs four to eight weeks of notice. Companies that wait until the record file looks complete add a hidden month. The buying guide for ANAB-accredited bodies is a separate article; this page only places that choice on the calendar.
Who this path is for
US manufacturers with roughly 10 to 300 people, one or two sites, and a customer that named ISO 9001:2015. Build-to-print job shops, contract manufacturers, equipment makers, and component suppliers all fit if ISO 9001 is the primary standard. If AS9100, IATF 16949, or ISO 13485 is the contract, ISO 9001 is the wrong first certificate — use the comparison article and tell the buyer in writing before you spend.
The path also fits a shop that already “does quality” in the informal sense: calibrated gauges, trained operators, purchasing that watches a few key suppliers. Those practices are the raw material. The first-certificate work is to write them so an outsider can sample them, then run them on a calendar so the samples exist.
- You have never held ISO 9001:2015 (or you let a prior certificate lapse and are starting over).
- A customer, RFQ, or approved-vendor list named ISO 9001, not a sector scheme as the primary standard.
- Someone on staff can own the system without becoming a full-time quality department.
- Leadership will sit management review and fund the registrar. A certificate without those two is fiction.
Write the shop you run, then stop writing
First-timers fail Stage 2 against their own documents more often than against the standard. A template pack copied from a 500-person plant promises a materials review board, monthly cross-functional meetings, and a supplier scorecard program. The auditor audits those promises. Every sentence you copy in becomes a requirement you created.
Size first. If you build to customer drawings and never design product, state that clause 8.3 does not apply, with a short justification in the scope. If one person owns purchasing, shipping, and training records, write the procedures that way. Internal audit (clause 9.2) still needs independence: people should not audit their own work. Trade areas, or hire an outside internal auditor for a day or two.
The record clock: why three months is not padding
A binder of procedures is not a QMS. Stage 1 will read the binder and look for an internal audit and a management review that already happened. Stage 2 will sample records from production, purchasing, calibration, nonconforming output, and improvement. Missing records in clause 9.3 or 10.2 at Stage 1 are a common reason a registrar will not proceed.
Plan the calendar backward from the certificate date the customer named. Subtract registrar lead time. Subtract Stage 1 to Stage 2 spacing (often a few weeks to a couple of months). Subtract about three months of operation. What remains is the documentation window. If that remainder is negative, the honest conversation with the buyer is the date, not a faster binder.
- Stand up document control so the current revision is the one people use.
- Run the first internal audit against the processes you named, with independence.
- Hold management review with the inputs clause 9.3 lists — not a hallway chat labeled as minutes.
- Open and close at least a few corrective actions so clause 10.2 has a trail.
- Keep calibration, training, and release records as the work happens, not as a pre-audit scramble.
Those five items are the record clock. The eight-step process article explains how they sit among gap assessment, scope, and the two audit stages. This page only insists they are not optional and not last.
Place the registrar on the calendar before the file looks finished
Pick a certification body accredited for ISO 9001 under ISO/IEC 17021-1 by an IAF MLA signatory. In the United States that is commonly ANAB. Get three quotes. Audit days come from IAF MD 5 based on effective headcount, sites, and risk — registrars cannot honestly promise a shorter audit than the tables allow. They also cannot write your system and then audit it. Impartiality is the point of accreditation.
How to compare CBs, how a consultant differs from a registrar, and which red flags to walk away from belong in the ANAB registrar guide. The first-time mistake is waiting. A registrar with a free auditor near your plant in six weeks is a different project than one flying someone in next quarter.
What six to nine months is made of
Six to nine months is typical for a first certification. The spread is not marketing. Shops that already run informal calibration, training, and purchasing controls, and that write documents that match the floor, land toward six. Shops that buy a generic binder, skip management review, or book the registrar after the customer’s date is already close land toward nine or miss the date.
| Clock | What fills it | Typical range |
|---|---|---|
| Documentation | Scope, policy, objectives, procedures, forms; human review of a generated packet if you buy one | Several weeks after a complete intake, or longer if you write at night |
| Record clock | Operate the system: audit, management review, CAPA, training, calibration, release | About three months of dated evidence |
| Registrar | Quote, Stage 1, Stage 2, close findings | Lead time plus audit days; surveillance in years two and three |
Documentation is typically 2–4 weeks after a complete intake. That window is the draft, not the certificate.
What the record file looks like in a small shop
First-timers imagine a vault. What a Stage 2 auditor samples is smaller and more ordinary: a calibration log that matches the gauges on the floor, a training matrix that names who can release product, purchase orders that show how a new supplier was evaluated, nonconforming-output tags with a disposition, internal-audit notes with a date and an auditor who did not audit their own work, management-review minutes with the clause 9.3 inputs, and a handful of corrective actions that went past “we told them to be careful.”
If those files are empty, the documents do not matter yet. If those files describe a company you are not — a document-control board, a weekly quality council, a supplier scorecard program you do not run — the auditor will write findings against the fiction. Write the small version. Run it long enough that last month’s dates exist.
Competence (clause 7.2) is the record shops forget because “everyone has been here for years.” Years on the job is evidence only if you wrote the requirement and recorded the decision that the person is competent for this role. Calibration (clause 7.1.5) is the other quiet killer: a sticker on a micrometer without a record of the standard it was checked against is a story, not a sample.
When the customer already named a date
Flow-down often arrives with a date attached: “certificate required to bid,” “approved-vendor list refresh in Q2,” “first article next spring.” Work backward. Registrar lead time is commonly four to eight weeks. Stage 1 to Stage 2 is a few weeks to a couple of months. The record clock is about three months. Documentation is typically 2–4 weeks after a complete intake if you buy a packet after a complete intake, or longer if you write at night. Add those and you will know whether the customer’s date is a plan or a wish.
If the date does not fit, say so in writing. Offer a public-surface scan and a gap list so the buyer sees you are moving. Do not promise a Stage 2 date the clocks cannot hit. A missed Stage 2 and a reschedule fee cost more than an honest delay, and a certificate issued against an empty record file will not survive the first surveillance visit.
Who owns the three clocks
Someone has to own the binder, the calendar, and the registrar relationship. In a 20-person shop that is often the operations manager or a quality engineer who also runs shipping. That is allowed. What is not allowed is an owner who cannot get leadership into management review, or who cannot stop a bad part. Clause 5 is leadership. If the owner of the company will not sit the review, stop the project until they will.
Internal audit independence still applies. The owner of production should not be the only person auditing production. Trade areas with another supervisor, or budget a day or two for an outside internal auditor. Put that cost on the plan next to the CB quote. It is smaller than a Stage 2 finding that 9.2 was a self-audit.
The CB is a vendor you selected, not a partner who will finish your homework. Send them the scope, the headcount, and the site list. Show up to Stage 1 with documents that match the floor and with audit plus management-review records that already happened. Stage 2 is sampling, not a tutorial.
A gap assessment is the project plan, not a score
Before you write, walk clauses 4 through 10 and sort each requirement: we do this and can prove it, we do this but nothing is written down, or we do not do this. Most small manufacturers already meet more of the standard than they expect. Purchasing controls, calibration, and operator competence usually exist in some form. Internal audit, management review, and formal corrective action usually do not.
A public-surface scan of your website is not that walk. It only reads public pages. It cannot open controlled files, training records, or CAPA logs. Use it to see the public surface. Use a clause walk — the gap-assessment article — to build the plan.
What this page will not do
- It will not size your QMS for headcount and design-exemption details. That is the small-manufacturers article.
- It will not list eight mechanical steps. That is the certification-process article.
- It will not teach you to pick among ANAB-accredited bodies. That is the registrar guide.
- It will not fold DFARS cybersecurity, ISO 13485, or water-equipment sector rules into a first ISO 9001 certificate. Those are satellites. Keep them off this path until ISO 9001 is the contract you signed.
When the honest move is to wait
If the customer named AS9100 or IATF 16949 as the primary standard, ISO 9001 will not tick the box. If leadership will not sit management review, the certificate is a prop. If the customer’s date is inside the record clock plus registrar lead time, say so in writing and negotiate the date. A failed Stage 2 and a reschedule fee cost more than an honest delay.
Sources
- ISO 9001:2015 — Quality management systems — Requirements, International Organization for Standardization.
Frequently asked questions
How long does first-time ISO 9001 certification take for a small US manufacturer?
Six to nine months is typical for a first certification. Documentation can be weeks. The rest is the record clock and the registrar’s schedule. Stage 2 samples evidence that only exists after the system has been operating.
Can a documentation vendor get us certified?
No. Certification bodies are accredited under ISO/IEC 17021-1 and cannot build your system and then audit it. A documentation packet, a consultant, or a DIY binder is preparation. The certificate comes from an accredited CB after Stage 1 and Stage 2.
Do we need ANAB specifically?
You need a certification body accredited by an IAF MLA signatory for ISO 9001. ANAB is the usual US choice. UKAS, DAkkS, and JAB are peer signatories. Ask the customer if they named a specific accreditation body in the purchase order.
What should we start this week?
Walk clauses 4–10 into three buckets, write a one-paragraph scope, and put management review and internal audit on a calendar. Request registrar quotes in parallel. Do not wait for a finished binder to start the record clock or the booking.