The unsatisfying honest answer: for a small or mid-size company starting from working-but-informal, the road to an ISO 9001 certificate most commonly runs somewhere between six months and a year and a half. The satisfying honest answer is why — because once you see where the time actually goes, you can compress the parts that compress and stop being lied to about the parts that don't.
Anyone promising you a certificate in four weeks is selling you either a template binder your auditor will see through, or a certificate from an unaccredited mill that your customer's supplier-quality team will bounce on sight. (Quick vocabulary: your certificate is only worth what the accreditation behind the certification body is worth — in North America look for ANAB-accredited CBs, in the UK UKAS, and so on. Your customer's questionnaire often says this explicitly, in small print nobody reads.)
Here are the phases, with the clock running.
Phase 1: Find the gap — weeks, not months
You need an honest inventory of the distance between what your company does and what ISO 9001 requires. A competent consultant does this in a few days on site; a capable internal person with the standard and determination can do it in a few weeks around their real job. Either way the output is the same: a findings list that becomes your build plan.
This phase is fast. The mistake isn't spending too long here — it's skipping it and building from a template, which produces a paper system describing a company that doesn't exist. Auditors read those the way you'd read a resume with someone else's name left in from the template.
Phase 2: Build the system — the part everyone overestimates
Writing the procedures, setting up document control, defining who approves what, building the training matrix, formalizing supplier evaluation — this is the phase people picture when they picture "getting certified," and it's genuinely less work than its reputation. ISO 9001:2015 killed the mandatory-quality-manual, document-everything era; the standard now asks for documented information where it's needed for the system to work, not a binder per clause.
For a company that already runs well informally, this is typically two to four months of part-time effort. The work isn't inventing processes — you have processes — it's writing down the real ones and closing the genuine gaps (usually: corrective action, internal audit, management review, and supplier evaluation, the four things informal companies do least formally).
The compression lever here is real: good tooling and good help genuinely speed this phase up. This is also the phase where the template-binder shortcut is most tempting. Resist. Every hour saved writing someone else's procedures is repaid with interest at audit time, when your people get asked to describe processes they've never read.
Phase 3: Operate and generate records — the part that will not compress
Here is the physics of the timeline. A certification audit doesn't check whether your system is well-written; it checks whether your system operates. Evidence of operation means records with real dates on them: completed corrective actions, calibrations performed on schedule, training conducted and verified, supplier evaluations done, nonconformances dispositioned.
And two records in particular gate everything, because the standard requires them and a certification body will not grant a certificate without evidence of them:
- A full internal audit covering your processes, and
- A management review, conducted with real inputs from a system that has actually been running.
You cannot audit a system that hasn't operated, and you can't review the performance of a system with no performance to review. In practice, certification bodies want to see roughly three months of genuine operating records before the main audit. This is the incompressible core of every honest timeline — and the origin of every dishonest one. The four-week miracle certificate skips this phase the only way it can be skipped: by writing records for things that didn't happen. In this profession that's not a shortcut, it's the cardinal sin, and it's the first thing experienced auditors go looking for.
Phase 4: The certification body — book early, audit twice
The audit itself comes in two stages. Stage 1 is a readiness review — the auditor checks your documented system and confirms you're prepared for the real thing, leaving you a list of any concerns. Stage 2, typically a few weeks later, is the full conformity audit: interviews, floor walks, records sampling. Clear it (closing out any nonconformities they raise) and the certificate follows a few weeks after that, once technical review is done.
The scheduling trap: good CBs book out. Get quotes and reserve dates during Phase 2, not after Phase 3 — auditor availability adds a silent month or two to more timelines than any technical gap does.
After certification, surveillance audits come annually and the full cycle repeats every three years. The certificate isn't a trophy; it's a subscription.
The realistic ranges
| Starting point | Typical road to certificate |
|---|---|
| Well-run shop, informal system, someone dedicated to the build | ~6–9 months |
| Well-run shop, quality is a part-time hat | ~9–15 months |
| Processes genuinely chaotic, or nobody owns the build | 18 months+, and the calendar isn't the problem |
A deadline from a customer — we need you certified by next Q3 — is, honestly, the best accelerant there is, because it forces the one decision that actually controls the timeline: someone senior owning it as a project instead of a someday.
If you just became that someone, we have a field guide for you. And when you get to Phase 2 and start building in earnest: the tooling matters more than it used to. Spreadsheets can hold a quality system the way a shoebox can hold receipts — right up until someone asks you to prove something. Building the system in software that keeps the records as you go is how Phase 3 becomes something you live through instead of assemble afterward. That's the product we're building.