Six steps, and for a small business starting from nothing it takes about eight to twelve weeks. The certificate then lasts three years, with a visit each year to keep it.
1. Pick the standard and read the wording
Usually a customer or a tender has driven this, so read their wording before you do anything else. ISO 9001 for quality is the most common. ISO 14001 for environment and ISO 45001 for health and safety often turn up together in construction and facilities work. ISO 27001 comes up wherever data is involved.
Check whether they have asked for accredited certification, and whether they have named UKAS specifically. That single answer changes the cost significantly, and plenty of tenders do not require accreditation at all.
2. Gap analysis
Compare what the standard asks for against what you already do. Most businesses are further along than they expect, because a company that has been trading for years already has processes. They are just not written down or measured.
The output is a list of what is missing. That list is your project plan.
3. Build the management system
This is the bulk of the work: the documented processes, the policy, the registers, the records. The thing that determines whether it is painful or not is whether the system describes how you actually work or how a template says you should.
Keep it as small as it can be. Every procedure you write is a promise you will be audited against, so a business with fifteen tight documents has an easier life than one with sixty thorough ones.
4. Run it, and generate evidence
This is the step people try to skip and cannot. An assessor needs to see the system operating, not just written. That means a full internal audit cycle, a management review, objectives with real measurements, and evidence of a problem being found and fixed properly.
You need a period of operation before an audit is worth booking. For accredited certification a certification body will generally want three months or so of records. There is no way to pay to make this shorter.
5. Choose a certification body and book the audit
Get three quotes, compare the number of audit days rather than the headline price, and ask when they can actually do the audit. Lead times of several weeks to a few months are normal and some bodies cannot get an assessor to you in a workable timescale at all.
Our guide to choosing a certification body covers what to check.
6. Stage 1 and stage 2
Stage 1 is a readiness review of your documented system, often remote and often half a day. Stage 2 is the real assessment, where the assessor samples your processes and talks to your staff. A couple of minor findings is a normal outcome and does not stop certification. See preparing for a certification audit for what to have ready.
How long does it take
Eight to twelve weeks is typical for a business under fifty people, on one site, going for one standard from a standing start. Longer if you have multiple sites, more standards, or nobody internally who can give it time. Faster if you already have documented processes that work.
The two things that stretch it are the operating period before the audit, and certification body availability. Neither can be bought down, which is why the realistic answer is months rather than weeks.
How long does the certificate last
Three years. During that time the certification body visits annually for surveillance audits, usually shorter than the original. At the end of three years you recertify, which is a fuller audit again.
The certificate can be suspended or withdrawn in between if surveillance finds serious problems that do not get closed out, so it is not three years of being left alone.
What it costs
Certification body fees start around £1,500 for ISO 9001 in a small business going the accredited route, and non-accredited certification starts lower. Add consultancy on top if you want help building it. Our ISO consultancy costs page has the figures.
If you want the whole thing handled at a fixed price, that is our ISO consultancy service, and certification is guaranteed.
‹ Back to all articles