ISO 9001 certification: process, timeline and costs

What ISO 9001 certification is and who issues it

ISO 9001 is the international standard for a quality management system. The certificate is a document in which an independent certification body confirms that your system conforms to the standard. Certificates are issued by certification bodies accredited to certify management systems; in Slovenia accreditation is granted by Slovenian Accreditation (SA). The ISO organisation only develops and publishes the standard and does not issue certificates.

The roles are separate: a consultant helps you build the system, the certification body audits it. The same body must not do both, otherwise the audit would not be impartial. When choosing a certification body, check that it is accredited for your sector; customers and tenders often do not recognise certificates from non-accredited bodies.

Steps to the certificate

1. Gap assessment. A comparison of current practice with the requirements of the standard: what you already have (instructions, records, complaint handling) and what is missing. The result is a plan with deadlines and owners.
2. Documentation. The scope of the system, quality policy and objectives, process descriptions and the documented information the standard requires or you need yourself. The standard does not require a quality manual; it requires documents to be controlled (clause 7.5).
3. Implementation. The system starts running: people work to the agreed processes, records are produced, KPIs are monitored, nonconformities and risks are handled. This period is the evidence the auditor will look for.
4. Internal audit (clause 9.2). A systematic check of whether the system works as documented and meets the requirements of the standard. Findings lead to corrective actions.
5. Management review (clause 9.3). Top management reviews audit results, KPIs, complaints, risks and the effectiveness of actions and takes decisions. Without a management review record a stage 2 audit is normally not possible.
6. Stage 1 certification audit. The auditor reviews the documentation, scope and readiness and points out gaps to close before continuing.
7. Stage 2 certification audit. A check of how the system works in practice: interviews with employees, review of records and processes. You correct any nonconformities within the agreed deadline, and the certification body then decides on certification.
8. Surveillance audits. The certificate is valid for three years, with annual surveillance audits and recertification in the third year. The system has to keep running, not just before the audit.

How long it takes

The realistic range is 3 to 9 months, depending on company size, the number of sites and processes and how much of the system already exists. A smaller company with orderly records can reach the audit in a few months; a company with several sites and production needs more time for implementation and records.

The step that most often holds things up is the one that cannot be rushed: the system has to run for a while so that evidence exists. It therefore makes sense for documents, the internal audit and actions to be created from the start where they will stay, not in temporary folders.

What the cost is made of

Prices vary a lot between providers and companies, so it is more useful to understand the structure of the cost:

• Consulting: gap assessment, documentation, training and support through to the certificate. The scope depends on how much you do yourself.
• Certification body: stage 1 and stage 2 audits and annual surveillance audits. The certification body sets the number of audit days mainly by the number of employees, sites and the complexity of your activities; ask for a written quote covering the whole three-year cycle.
• Internal time: time spent by the quality manager, management and employees on workshops, documents, the internal audit and the management review. This cost is often underestimated.
• Tools: optional, but important for maintaining the system — where documents, records, audits and actions will live after certification.

Slovenian companies can obtain a subsidy for implementing management systems, which significantly lowers the initial cost. Why implementation pays off and how much a subsidy can cover is summarised in our guide to ISO standards and subsidies; we check eligibility together in a free consultation.

Common mistakes

• Documentation from a template. A copied manual that does not describe your work is quickly spotted by the auditor and ignored by employees.
• The certificate as the goal. A system built for the audit stalls after it; the first surveillance audit shows it.
• Management on the sidelines. Clause 5 of ISO 9001 requires leadership and commitment; policy, objectives and the management review are not the quality manager’s job alone.
• An internal audit just before certification. Without time for actions and checking their effectiveness, findings stay open.
• Objectives without measurement. A quality objective must be measurable and monitored; a KPI nobody calculates is not evidence.
• Actions without verification. A corrective action is closed only when its effectiveness has been reviewed (clause 10.2).

How the E-kakovost QMS platform helps

The E-kakovost QMS platform is built on consulting experience: the requirements an auditor checks are built into everyday work.

• Documents: one valid version, approval along the organisational structure and acknowledgement with evidence — the Documents module.
• Audits: a plan, a questionnaire by clause, findings with a photo and the report in one click — the Audits module.
• Actions: root cause analysis, deadline, owner and effectiveness check — the Actions module.
• Measuring equipment: calibration and maintenance with reminders — the Equipment module.
• KPIs and management review: KPIs and management review inputs in one place — all modules on the QMS platform page.

If certification is still a plan, start with the basics: what a QMS is and what it makes easier. Consulting for ISO 9001, 14001 and 45001 is described on the ISO consulting page, and the environmental standard on the ISO 14001 consulting page.