Yes, a small manufacturer can get ISO 9001 certified, and a realistic timeline is four to six months. The path has three parts: build a quality management system (QMS) sized to the company you run today, operate it long enough to produce about three months of records, and then pass a two-stage audit from an accredited certification body.
Most shops your size start this for one reason: a customer said so. A prime contractor or OEM flowed the requirement down, an RFQ had a checkbox you could not tick, or a buyer's approved-vendor list would not take you without a certificate. That pressure is normal. It does not mean you need a big-company quality system.
This guide covers why customers demand the certificate, how to size a QMS for 10 to 50 people, the three mistakes that sink small shops, a month-by-month plan, and the cases where the honest answer is to skip certification.
Why customers demand ISO 9001
Large OEMs and prime contractors carry quality obligations to their own customers, including government buyers. They pass those obligations down the supply chain. This is called flow-down, and it usually lands in your contract as a quality clause that names ISO 9001.
The demand shows up in three places. RFQs ask a yes-or-no question about certification, and a "no" can filter you out before anyone reads your price. Approved-vendor lists often require a certificate before purchasing can add you at all. And contract quality clauses can require you to hold certification for the life of a program.
The buyer's logic is simple. A certificate from a body accredited under ISO/IEC 17021-1 means an outside auditor checks your system every year. That lets the buyer skip some of their own supplier audits. Your certificate saves them work, which is why they push so hard for it.
A QMS sized for 10 to 50 people
ISO 9001:2015 was written to fit any size of company. It has 10 clauses and requires a fairly short list of documented information. It never requires a quality department, a document control board, or a full-time quality manager. It requires that the work gets done and that you can show it.
In a 20-person shop, one person often wears four hats: quality, purchasing, shipping, and training records. Write the system that way. A procedure should say "the operations manager approves suppliers," not "the purchasing department maintains a supplier qualification program." Auditors accept small. They do not accept fiction.
One real constraint: internal audits (clause 9.2) must be objective, so a person should not audit their own work. Small shops handle this by having people trade areas, or by hiring an outside internal auditor for a day or two each year.
You can also shrink the standard's reach. If you build to customer drawings and never design products, you can state that clause 8.3 (design and development) does not apply, with a short justification in your scope statement. Auditors see this in most small job shops and accept it when it is true.
The three failure modes that sink small shops
Certification audits at small manufacturers go wrong in the same few ways. All three are self-inflicted, and all three are avoidable.
1. Documentation written for a company you are not
A 200-page manual bought as a template pack, or copied from a 500-person plant, promises things you do not do: a materials review board, monthly cross-functional quality meetings, a supplier scorecard program. Here is the trap. The auditor audits you against your own documents. Every promise you copy in becomes a requirement you created, and the finding reads "the company did not follow its own procedure."
2. Records that only exist before audits
Two weeks before the audit, someone back-fills training logs, inspection sheets, and calibration records. Auditors have seen every version of this: the same pen across six months of entries, sign-offs dated on Sundays, a calibration sticker (clause 7.1.5) that does not match the certificate behind it. Records must come from work as it happens. If a form is not being filled out during normal production, either the form is wrong for your process or the process is not running. Fix that now, not in the week before Stage 2.
3. Management review as theater
Clause 9.3 requires top management to review the QMS using specific inputs — audit results, customer feedback, process performance, nonconformities and corrective actions — and to produce decisions about improvement and resources. The small-shop version is often a 20-minute meeting the week before the audit, with minutes that decide nothing. Auditors flag it, and worse, the owner learns nothing. The fix is cheap: fold the 9.3 inputs into a management meeting you already hold, keep it under an hour, and record real decisions with names and dates.
A realistic 4-to-6 month plan
This timeline assumes 10 to 50 people, no design activity, and one person driving the project part-time. The certification body sets your audit length from your headcount under IAF MD 5, so get quotes early — good registrars book out two to three months.
| Month | Focus | What exists at the end |
|---|---|---|
| 1 | Gap check, scope, registrar quotes | Scope statement, applicability decisions (for example, excluding 8.3), a gap list, two or three registrar quotes |
| 2 | Write or adapt documentation to your real roles | Quality policy, procedures, work instructions, and blank forms that match how work happens |
| 3 | Launch and train | System running; records starting: nonconformance reports (8.7), calibration (7.1.5), competence and training (7.2), supplier evaluations (8.4) |
| 4 | Operate and collect records | Four to six weeks of live records; first corrective actions (10.2) opened on real problems |
| 5 | Internal audit, management review, Stage 1 | Full internal audit (9.2), a management review (9.3) with real decisions, findings closed or in progress |
| 6 | Stage 2 audit | Certification audit run against roughly three months of operating records; clear any findings |
Stage 1 is a documentation and readiness review. Stage 2 is the full audit of your running system. If your records start in month 3, the earliest honest Stage 2 date is around month 6. Anyone promising "certified in 90 days" either has a system already running or is set up for the back-filled-records failure above.
What to budget
| Item | Typical range | Notes |
|---|---|---|
| Registrar: Stage 1 + Stage 2 | $5,000-$15,000 | Audit days are set by headcount under IAF MD 5 |
| Registrar: surveillance audits | $3,000-$6,000 per year | Held in years 2 and 3, then recertification |
| Documentation help | $300 templates to $40,000 consultants | Fixed-fee services sit in between |
| Internal time | 8-12 hours per week for the project lead | The largest real cost for most shops |
The documentation line has the widest spread, and you have three options: adapt templates yourself, hire a consultant, or buy a fixed-fee documentation package. As one example of the middle path, ISO Delivered writes a flat-fee $8,000 set of about 44 documents (4 manuals and policies, 15 procedures, 10 work instructions, 15 forms) from a questionnaire, delivered in two to four weeks, with a $500 readiness report available first if you want a gap picture. Note that no documentation provider sells certification itself — only an accredited certification body can grant that, and you still need about three months of operating records before Stage 2.
When to say no
Certification is a business decision, not a virtue. Run the math before you commit. Over a three-year certificate cycle you will spend roughly $15,000 to $40,000 in outside costs, plus a real slice of one person's time every week. If the customer demanding the certificate represents less business than that, say so — to them.
Ask the buyer two questions first. Will they accept a documented, ISO 9001-compliant system without the certificate, backed by their right to audit you? Many will. And is the requirement firm for this program, or a preference on a form? Purchasing people fill in checkboxes; the buyer's quality engineers can often grant waivers.
Say no, or not yet, when one small customer is the only driver, when your margins cannot carry the yearly surveillance costs, or when your shop floor is in real chaos. In that last case, fix the chaos first. A certification deadline stacked on disorder is exactly what produces back-filled records and theater reviews. Say yes when the certificate keeps showing up in your RFQs — that is the market telling you it has become the price of bidding.
Frequently asked questions
How long does ISO 9001 certification take for a small manufacturer?
Plan on four to six months from start to Stage 2 audit for a shop of 10 to 50 people. The floor is set by records: certification bodies want to see roughly three months of operating evidence before Stage 2. Documentation can be finished in weeks, but the operating time cannot be compressed.
How much does ISO 9001 certification cost for a 20-person shop?
Registrars typically quote $5,000 to $15,000 for the initial Stage 1 and Stage 2 audits, with audit length set by headcount under IAF MD 5. Add $3,000 to $6,000 per year for surveillance audits, plus whatever you spend on documentation help. The largest hidden cost is your project lead's time — budget 8 to 12 hours per week during the project.
Can one person run the whole quality system?
Mostly, yes. One person can own the documents, the records, supplier evaluations, and corrective actions, and the standard never requires a quality department. The one limit is internal audits under clause 9.2: people should not audit their own work, so trade audit areas between employees or bring in an outside internal auditor for a day or two.
Do we still need a quality manual under ISO 9001:2015?
No. The 2015 revision dropped the required quality manual. Many small shops keep a short one anyway — 10 to 20 pages — because customers ask for it and it gives auditors a map of the system. If you keep one, keep it thin, and never let it promise things you do not do.
Can we exclude design (clause 8.3) if we build to customer drawings?
Yes, if you truly do no product design. A job shop that machines or fabricates to customer prints can state that clause 8.3 does not apply, with a short justification in its scope statement. The test is whether the activity exists in your business, not whether the clause is convenient.
What happens if we fail the Stage 2 audit?
You rarely fail outright. The auditor writes nonconformities: minor ones need a corrective action plan under clause 10.2, and major ones must be closed — sometimes with a follow-up visit — before the certificate is issued. Findings at Stage 2 are normal, and a small shop with honest records usually certifies within a few weeks of clearing them.