How Long Does ISO Certification Take? Timelines by Standard

The honest answer to "how long does ISO certification take" is that it depends far more on your starting point than on the standard you pick. A small company with documented processes and a functioning corrective action habit can reach ISO 9001 certification in three to four months. A mid-sized manufacturer starting from scratch with a part-time project owner can easily need twelve. Most of the frustration people feel about timelines comes from planning around the audit calendar when the real constraint is how quickly the organization can change what it actually does.

This guide gives realistic ranges for the major standards, explains what drives each phase, and shows where schedules typically slip. The ranges below are my own planning estimates from consulting work, not figures published by any standards body or drawn from a formal sample. Each assumes a single-site organization of roughly 20 to 100 employees, so treat them as starting points for your own gap analysis.

What Are the Phases of ISO Certification?

Every management system certification follows roughly the same path, regardless of the standard. What changes is how long each phase takes.

1. Scoping and gap analysis. You decide what the management system covers and compare current practice to the requirements.
2. Implementation. You build or revise processes, documentation, training, and records.
3. Operating period. The system has to run long enough to produce evidence, including internal audit and management review records.
4. Stage 1 audit. The certification body reviews your documented readiness.
5. Stage 2 audit. The certification body audits implementation and effectiveness on site or remotely.
6. Nonconformity closure and certification decision.
7. Surveillance and recertification. Certificates run on a three-year cycle with surveillance audits in between.

The two-stage structure comes from ISO/IEC 17021-1:2015, the standard that governs certification bodies for management systems. It is also why you cannot compress the process to a single week no matter how much you spend. The certification body needs a documentation review first, then evidence that the system is actually being used.

The Part Nobody Can Skip: Running the System

ISO 9001:2015 requires an internal audit programme (clause 9.2) and management review (clause 9.3). Certification bodies working under ISO/IEC 17021-1:2015 normally expect both to have happened at least once before Stage 2, so they can judge whether the system is effective. That expectation is certification practice rather than wording in clauses 9.2 or 9.3, and it applies equally to other standards built on the harmonized structure (the common clause layout and core text ISO uses across its management system standards). A realistic minimum for most organizations is a few months of genuine operation after implementation. You can write a quality manual in a weekend, but you cannot fake a quarter's worth of records without it showing.

Realistic Timelines by Standard

The table below shows typical ranges from the decision to certify through the certificate being issued, assuming a small to mid-sized organization (roughly 20 to 100 employees, one site) with a dedicated internal owner and a reasonable level of existing process maturity. Larger, multi-site, or less mature organizations should expect to sit toward the right-hand columns. The ranges are my estimates, not published data.

These are not guarantees. A company that already holds ISO 9001 will usually land at the fast end for any second standard, because shared elements such as document control, internal audit, and management review already exist.

Timelines by Standard

The sections below explain what drives the timeline for each standard.

ISO 9001 Timeline

ISO 9001 is the baseline most people have in mind. For a company of 20 to 100 employees with reasonably consistent operations, five to eight months is a typical plan. The work is front-loaded in process mapping and in deciding what to document, and many organizations discover that the standard asks for far less paperwork than they feared. ISO 9001:2015 requires documented information in specific places, such as the quality policy (clause 5.2) and the results of management review (clause 9.3.3), but it leaves much of the rest to you.

The usual delays are mundane. Management review gets postponed because leadership calendars are full, or the internal audit is scheduled but assigned to someone who has never done one. If you want help structuring that work, our ISO consultant services are built around exactly this phase.

ISO 14001 and ISO 45001 Timelines

Both standards follow the same high-level structure as ISO 9001, so the management system pieces feel familiar. The extra time comes from technical content that has to be right before the system means anything.

For ISO 14001:2015, the clock is driven by clause 6.1.2 (environmental aspects) and clause 6.1.3 (compliance obligations). If you do not know which permits and regulations apply to your site, you cannot finish the compliance evaluation required by clause 9.1.2. Sites with air permits, wastewater discharge, or hazardous waste generation need more time than an office-based service company.

For ISO 45001:2018, clause 5.4 requires consultation and participation of workers, and you cannot rush that. Hazard identification under clause 6.1.2 needs input from the people doing the work, and organizations with a history of recordable incidents will need time to show that investigation and corrective action are functioning. ISO 45001 also replaced OHSAS 18001, and the migration period ended in March 2021, so any new certification today is to ISO 45001 only.

ISO 27001 Timeline

ISO/IEC 27001:2022 is where timelines vary the most, because the effort depends on how mature your security controls already are. The standard requires a risk assessment process (clause 6.1.2), a risk treatment plan (clause 6.1.3), and a Statement of Applicability, the document that lists which Annex A controls apply to you and justifies any you exclude.

A software company with existing access control, logging, and vendor management might need six months. A company that has never formally assessed information security risk will usually need closer to a year, because writing policies is quick but deploying controls such as multi-factor authentication, backup testing, and supplier assessments is not. If you are starting a new certification now, you will be audited against the 2022 version, since the transition period for the 2013 edition ended on 31 October 2025 (the deadline set in IAF MD 26, three years after publication of the 2022 edition). You can read more about the standard on our ISO 27001 page.

ISO 13485 Timeline

ISO 13485:2016 takes longer than the general management system standards because it is far more prescriptive. Clause 7.3 on design and development and clause 7.5.6 on validation of processes for production and service provision both require evidence that takes time to produce. Regulatory reporting under clause 8.2.3 must also be in place, but it is rarely what sets the schedule.

Design history files that were never maintained, software that was never validated, and supplier controls that exist only informally can each add months. If your device is already on the market, remediation of legacy documentation is usually the longest task. If you are still in development, building the system alongside the product is easier than retrofitting, and that is the better path.

ISO 22000 Timeline

ISO 22000:2018 combines management system requirements with HACCP principles, and the technical hazard analysis is where the time goes. Clause 8.5 covers hazard control, including prerequisite programs and the hazard analysis itself. A facility with mature prerequisite programs and a working HACCP plan can move quickly. A facility that has been running on habit and tribal knowledge needs time to document, validate, and verify its controls.

If your customers are asking for a GFSI-benchmarked scheme such as FSSC 22000, expect additional time for the scheme's own requirements on top of the ISO standard.

ISO 42001 Timeline

ISO/IEC 42001:2023, published by ISO in December 2023 (see the ISO catalogue entry), is the first international AI management system standard against which organizations can be certified. Because it is new, the biggest time variable is often certification body availability rather than your own readiness. Accredited certification bodies for this standard have been building capacity, and scheduling can add weeks.

On your side, the longest-lead tasks are the AI system inventory, the AI impact assessment process (clause 6.1.4), and risk treatment against the Annex A controls. Organizations that do not currently know every place AI is used in their business, including embedded vendor tools, should expect the inventory alone to take a month or more. A structured ISO 42001 gap assessment is a fast way to size the work before committing to a date.

How Long Do the Audits Themselves Take?

Audit duration is a different question from project duration, and it's easy to mix them up. The number of audit days is set by the certification body using ISO/IEC 17021-1:2015 clause 9.1.4 (determining audit time). It also uses the IAF mandatory documents for each discipline: IAF MD 5 for quality and environmental systems, IAF MD 22 for occupational health and safety, and ISO/IEC 27006 for information security. Audit time is driven by headcount, process complexity, number of sites, and risk.

In my experience, a small single-site company may see a Stage 1 of one to two days and a Stage 2 of two to four days. These are my estimates, not values from the IAF tables, and multi-site manufacturers can see considerably more. Your certification body will give you a quote with specific day counts, and that quote is the number to plan around.

Once Stage 2 is done, there is usually a window to close any nonconformities. Minor nonconformities typically need a corrective action plan, while major nonconformities usually require evidence of implemented correction before the certificate is issued. A clean Stage 2 can lead to a certificate within a few weeks, but a major finding can add one to three months in my experience, depending on how long the fix and its evidence take.

What Speeds Up and Slows Down ISO Certification?

What Speeds It Up

The same few things consistently shorten the timeline.

• A named internal owner with real time. Treating certification as a ten-percent-of-someone's-week project is the most reliable way to double the schedule.
• Existing certifications. The harmonized structure used by ISO 9001, 14001, 45001, 27001, and 42001 means that shared elements such as document control, internal audit, management review, and corrective action can be built once.
• Leadership that shows up. Clause 5.1 of each of these standards requires top management to demonstrate leadership and commitment. When leaders attend the kickoff and the first management review, everything downstream moves faster.
• Scoping honestly. A narrower scope gets you certified sooner, though it must still be credible to customers. You can expand the scope at a later surveillance audit.
• Booking the certification body early. Auditor calendars fill up, and waiting until you are ready to ask for dates can cost weeks.

What Slows It Down

The most common delays are not technical.

• Over-documentation. Teams write procedures nobody will follow, then have to rewrite them after the first internal audit.
• Buying a template kit and stopping there. Templates save drafting time but do not create a system that reflects how you actually work, and auditors can tell.
• Skipping the operating period. Rushing to Stage 2 without records of internal audit, management review, and corrective action nearly always produces nonconformities that add time back.
• Staff turnover on the project. When the person who understands the system leaves, the schedule often resets.
• Waiting on technical inputs. Legal registers, risk assessments, validation protocols, and supplier evaluations depend on other departments, and those departments have their own priorities.

Can You Get ISO Certified in 30 Days?

You will see claims of certification in a few weeks. The claim is only plausible in a narrow situation: a small organization whose practices already meet the standard and that needs mainly to document them. Even then, the two-stage audit and the operating-period records described above usually push the minimum beyond a month. A certificate obtained that fast also leaves little time to embed the system before the first surveillance audit, which must take place within 12 months of the certification decision date, with later surveillance audits at least annually.

What Happens After You Are Certified?

Certification does not end the work. The certificate is valid for three years, with surveillance audits in between and a recertification audit before expiry. If you built the system as a one-time project for the audit, the first surveillance will hurt. If you built it as the way you run the business, surveillance is a routine check.

Budget for this ongoing effort from the start. The cost is mostly internal time for internal audits, management reviews, and corrective actions, plus the certification body's fees.

How to Build Your Own Timeline

Here is the approach I suggest to clients who want a number they can defend.

1. Run a gap analysis against the clauses of your target standard.
2. Sort the gaps into documentation work, process change work, and technical work (risk, legal, validation).
3. Estimate the process change and technical work first, since they drive the schedule.
4. Add at least two to three months of operating time before Stage 2, so that you have an internal audit and a management review on record.
5. Get a written quote from your certification body with proposed audit dates and day counts.
6. Add a buffer of 15 to 25 percent for nonconformity closure and calendar slippage.

If a consultant or software vendor promises a firm date before doing step one, be cautious. The 15 to 25 percent buffer in step six is my rule of thumb, not a published figure. The gap analysis is where the real timeline gets discovered.

Where Does That Leave You?

A more useful question than "how long does it take" is "how long will it take us to be doing what the standard describes?" Once you answer that honestly, the audit dates mostly take care of themselves.

Ready to put a number on it? Tell us which standard you are pursuing and describe your current system through our ISO consultant services page, and we will help you scope a timeline.

Last updated: 2026-10-22

Frequently Asked Questions

How long does ISO 9001 certification take?

Most small to mid-sized organizations need about five to eight months from kickoff to certificate. Organizations with mature processes can finish in three to four months, while those starting from scratch may need nine to twelve. These are planning estimates, not figures set by any standards body.

Which ISO standard takes the longest to certify?

ISO 13485 for medical devices and ISO/IEC 27001 for information security generally take longest, because they require substantial technical work such as design controls, validation, risk assessment, and control implementation, beyond the management system itself.

Why are there two audit stages in ISO certification?

ISO/IEC 17021-1:2015, which governs management system certification bodies, structures the initial audit in two stages. Stage 1 reviews documented readiness, and Stage 2 evaluates whether the system is implemented and effective.

Can I get ISO certified in a month?

It is unlikely. The two-stage audit and the need for records such as internal audit and management review make a month unrealistic for most organizations. Very small companies with practices already aligned to the standard may come closest.

How long is an ISO certificate valid?

A management system certificate runs on a three-year cycle. Surveillance audits take place in between, and a recertification audit is needed before the certificate expires.