Certification is a sequence of assessments and decisions
The ISO 9001 certification process normally moves from application and planning to Stage 1, Stage 2, findings resolution and a certification decision. Continuing surveillance and recertification follow an initial positive decision. The certification body performs this work; ISO does not issue the organisation’s certificate.
The sequence is broadly recognisable across accredited management-system certification, but forms, deadlines, audit methods and commercial arrangements vary. Obtain your body’s process and contract rather than relying on another organisation’s experience. This article describes the handovers; the certification guide covers the wider purchasing and business considerations.
Step 1: Establish the intended scope and acceptance conditions
Identify the legal entity, activities and locations to be covered. Read any customer requirement for accredited certification and establish the expected standard edition. ISO 9001:2026 is the current published edition, but the proposed body’s accreditation coverage needs a separate check.
Create a short scope brief that operational managers recognise. Include activities performed at customer premises and significant outsourced processes. Explain relationships with group companies. A shared brand or finance department does not automatically place every subsidiary within the same certificate.
The output of this step is an agreed basis for discussion, not a certificate scope written solely by marketing. The body must be able to understand and assess what the organisation actually does.
Step 2: Apply and agree the audit programme
Provide accurate information requested by the certification body, including personnel, sites, shifts and activities. The body reviews the application and determines whether it can undertake the work. Resolve unclear boundaries before accepting a proposal that may be based on incorrect assumptions.
Review fees, audit effort, access arrangements and the continuing programme. Ask who will coordinate the visits and how changes are communicated. Agree what information must be available for planning and identify any operating windows the auditor needs to consider.
For a fictional field-service company, engineers may be dispersed across customer locations. Explain that arrangement early so the audit plan can address relevant work rather than assuming every service activity occurs at head office.
Step 3: Demonstrate that the QMS is operating
Implement the arrangements needed to meet applicable ISO 9001 requirements. People should know their responsibilities and have access to necessary information and resources. Evidence should arise from normal work, not from retrospective form completion for the auditor.
Complete meaningful internal audits and management review. Investigate identified weaknesses and check the effects of actions. If order changes are repeatedly missed, management should understand the cause and the response before presenting the system as ready.
An optional pre-assessment may help some organisations identify weaknesses. It is not a replacement for the formal stages and should not be purchased on the assumption that it guarantees certification.
Step 4: Complete Stage 1 and act on readiness conclusions
Stage 1 helps the body understand the system and establish readiness for Stage 2. Documentation, scope, operating conditions and internal evaluation may all inform that assessment. The Stage 1 article explains why it should not be reduced to a simple document inspection.
Read the conclusions and discuss the implications for the next stage. Record concerns, owners, actions and evidence. If an issue affects readiness, do not treat the next audit booking as immovable regardless of the result. Agree a defensible path with the body.
A useful handover records what is ready, what remains open and what information is needed for Stage 2 planning. Keep commercial pressure separate from the evidence on which the readiness judgement rests.
Step 5: Complete Stage 2 using representative evidence
Stage 2 evaluates implementation and effectiveness within the agreed scope. Auditors sample records, observe activities and discuss work with relevant personnel. Help them follow evidence across process interfaces rather than steering every question back to the quality coordinator.
A sampled service job might lead from the customer’s specification to planning, staff competence, delivery checks and complaint handling. The evidence does not have to occupy a single folder, but it should be traceable and consistent. The Stage 2 article provides practical preparation examples.
At the closing meeting, make sure findings are understood. Ask for clarification where the requirement or evidence is unclear. Agreement about wording helps a focused response; it does not require pretending that an observed weakness does not exist.
Step 6: Respond to findings under the body’s procedure
Address immediate consequences and investigate causes as appropriate. Submit the response and evidence the body requests within the agreed arrangements. A revised form may show a change was designed; later completed records may be needed to demonstrate that it operates.
Keep a clear link between the finding, action and verification. If the proposed response is not accepted, clarify the remaining evidence needed. Do not assume every finding has the same deadline or can be closed through a written promise.
Step 7: Wait for the decision and check the certificate
The certification decision is separate from the audit recommendation. The body reviews the relevant information and decides whether to grant certification. DNV describes this as a decision by authorised people different from the audit team; ask your provider to explain its arrangements.
Following a positive decision, check the certificate’s entity, standard edition, scope, sites and dates. Confirm accreditation and mark-use conditions. Correct errors before using the certificate in tenders or public claims.
Step 8: Move responsibility into ordinary management
Maintain the system, support surveillance and plan recertification. Notify relevant changes under the contract and keep certification claims accurate. Assign continuing responsibilities before the implementation team disbands so the certificate remains connected to an operating system.