ISO 9001 certification is carried out by an independent certification body, not by ISO itself.
Achieving ISO 9001 certification demonstrates an organisation’s commitment to quality, customer satisfaction and continual improvement.
Once your Quality Management System has been implemented and is operating effectively, an independent certification body assesses whether it meets the requirements of ISO 9001.
The certification journey follows a structured process, including certification readiness, selection of a certification body, Stage 1 and Stage 2 audits, closure of any applicable findings and the formal certification decision.
Understanding each stage helps organisations prepare with confidence, reduce unnecessary stress and avoid preventable delays.
Certification should confirm that your QMS already works in practice — not be the first time the organisation seriously tests it.
ISO 9001 certification is carried out by an independent certification body, not by ISO itself.
Certification confirms that your Quality Management System conforms to the requirements of ISO 9001 at the time of the audit.
The certification process normally includes a Stage 1 Audit, Stage 2 Audit, annual surveillance audits and recertification every three years.
Organisations should complete internal audits and a management review before inviting a certification body to conduct the certification audit.
Successful certification is based on demonstrating that the Quality Management System is effectively implemented and consistently followed, not on producing excessive documentation.
Although every organisation is unique, the certification journey generally follows the same sequence.
Stage 1: Implement a Quality Management System that meets the requirements of ISO 9001
Stage 2: Complete internal audits and a management review
Stage 3: Select an accredited certification body
Stage 4: Stage 1 Audit (Readiness Review)
Stage 5: Address any issues identified during Stage 1
Stage 6: Stage 2 Certification Audit
Stage 7: Certification decision and certificate issued, if successful
Stage 8: Annual surveillance audits
Stage 9: Recertification every three years
Although these stages appear straightforward, each one plays an important role in ensuring that the Quality Management System is effective, consistently implemented and capable of supporting continual improvement.
ISO 9001 certification is an independent assessment that confirms an organisation's Quality Management System conforms to the requirements of ISO 9001:2015, the world's most widely recognised quality management standard.
Rather than evaluating the quality of a specific product or service, certification focuses on the management system that supports the organisation's ability to consistently deliver products and services that meet customer and applicable statutory or regulatory requirements.
Certification provides independent assurance to customers, suppliers and other interested parties that the organisation has implemented a structured approach to managing quality and is committed to continual improvement.
For many organisations, certification also supports:
The real value comes from developing and maintaining an effective Quality Management System that improves the way the organisation operates. Certification simply provides independent confirmation that the system meets the requirements of the standard.
New to ISO 9001? Our What Is ISO 9001? guide explains the purpose of the standard, the Quality Management Principles and how a Quality Management System supports business success.
One of the most common misconceptions is that organisations are "certified by ISO."
This is not how the certification process works.
Several independent organisations play different roles throughout the certification journey.
Your organisation is responsible for designing, implementing and maintaining the Quality Management System.
This includes:
Ultimately, the Quality Management System belongs to your organisation and should reflect the way your business operates.
ISO Specialist South Africa provides professional consulting and implementation support to help organisations prepare for certification.
Depending on your requirements, support may include:
While consultants help organisations prepare for certification, they do not issue ISO certificates or make certification decisions.
Maintaining this separation preserves the independence and credibility of the certification process.
Once your organisation is ready, an independent certification body conducts the external audit.
The certification body's role is to:
Because certification bodies operate independently, they cannot provide implementation consultancy for the organisations they certify.
This impartiality helps ensure the integrity of the certification process.
In South Africa, many organisations choose a certification body that is accredited by the South African National Accreditation System (SANAS).
Instead, it accredits certification bodies, confirming that they are competent to perform certification audits in accordance with internationally recognised accreditation requirements.
Choosing a SANAS-accredited certification body gives organisations confidence that their certificate has been issued through a credible and internationally recognised certification process.
For organisations whose customers, regulators or tender requirements specify accredited certification, selecting a SANAS-accredited certification body is often an important consideration.
Learn more: Visit the South African National Accreditation System (SANAS) website for information about accreditation and accredited certification bodies.
Many organisations view certification as the starting point of their ISO journey.
In reality, certification is the outcome of the work completed beforehand.
By the time an external auditor arrives, your Quality Management System should already be operating, employees should understand their responsibilities, internal audits should have been completed and management should have reviewed the system's effectiveness.
Before applying for ISO 9001 certification, your organisation should have a fully implemented and operational Quality Management System (QMS).
Certification bodies do not expect organisations to be perfect. However, they do expect the management system to have been implemented, used in practice and reviewed for effectiveness.
Before inviting a certification body to conduct the audit, you should have:
Need help preparing? Our ISO 9001 Implementation Process guide explains the activities organisations should complete before applying for certification.
Selecting the right certification body is an important decision.
While all accredited certification bodies assess organisations against the same ISO 9001 requirements, they may differ in their industry experience, audit planning, customer service and international recognition.
When evaluating certification bodies, consider:
The certification body should be selected independently of any implementation consultant to maintain the integrity of the certification process.
Remember that the certification body's role is not to help implement your Quality Management System. It is to independently assess whether your organisation conforms to ISO 9001.
Once you have selected a certification body, the process usually begins with an application.
The certification body will typically request information such as:
This information enables the certification body to determine the audit duration, assign a suitably qualified audit team and prepare a quotation.
Once the application has been accepted, the certification body will schedule the Stage 1 Audit.
The Stage 1 Audit is often referred to as the readiness review.
Its purpose is not to determine whether your organisation will be certified. Instead, it confirms whether your organisation is adequately prepared to proceed to the Stage 2 Certification Audit.
During this stage, the auditor develops an understanding of your organisation, reviews your Quality Management System and identifies any areas that may need attention before the certification audit.
Rather than looking for perfection, the auditor is asking a simple question:
Although the exact approach varies between certification bodies, the auditor will generally evaluate whether:
The auditor may also discuss the organisation's activities, locations and processes to plan the Stage 2 Audit effectively.
Many organisations believe the Stage 1 Audit is primarily about reviewing documents.
While documentation is important, the auditor is looking for something much broader.
At this stage, they want to establish whether your organisation has laid the foundations for an effective Quality Management System.
Typical questions include:
In other words, the auditor is assessing your organisation's readiness, not making the final certification decision.
At the conclusion of the Stage 1 Audit, the certification body will provide feedback on its findings.
There are generally three possible outcomes.
If the auditor concludes that the Quality Management System has been implemented effectively and there are no significant concerns, the Stage 2 Certification Audit can be scheduled.
The auditor may identify areas requiring clarification or improvement before Stage 2.
These are typically addressed by the organisation before the certification audit takes place.
If substantial weaknesses are identified, such as an incomplete Quality Management System, missing internal audits or the absence of a management review, the organisation may need additional implementation work before progressing to Stage 2.
This should not be viewed as a failure. Identifying these issues early helps avoid more significant problems during the certification audit.
The period between Stage 1 and Stage 2 is an opportunity to strengthen your Quality Management System and address any findings raised during the readiness review.
Before the certification audit, organisations should ensure that:
The better prepared your organisation is, the smoother the Stage 2 Audit is likely to be.
Tip: A certification readiness assessment conducted before the external audit can help identify any remaining gaps and provide confidence that your organisation is ready for certification.
The Stage 2 Audit is the formal certification assessment where the certification body evaluates whether your Quality Management System (QMS) conforms to the requirements of ISO 9001 and is being effectively implemented throughout the organisation.
Unlike the Stage 1 Audit, which focuses on readiness, the Stage 2 Audit examines how your management system operates in practice.
The auditor is not there to redesign your processes or provide consultancy. Their role is to independently determine whether your organisation has implemented an effective Quality Management System that meets the requirements of ISO 9001.
Rather than asking whether documentation exists, the auditor wants to answer questions such as:
The Stage 2 Audit typically involves interviews with employees, reviews of documented information and records, observation of operational activities and verification that processes are working as planned.
During the certification audit, the auditor gathers objective evidence to determine whether your organisation conforms to ISO 9001.
The audit generally includes an assessment of:
The auditor will also evaluate how these elements work together as a management system rather than as isolated processes.
Many employees become nervous when they hear an external auditor is visiting.
In reality, certification audits are professional conversations rather than formal examinations.
Auditors typically speak with employees to understand:
Employees are not expected to memorise the ISO 9001 standard.
Instead, auditors are looking for evidence that people understand their responsibilities, follow established processes and contribute to the effectiveness of the Quality Management System.
During any certification audit, the auditor may identify findings that require attention.
These findings are known as nonconformities.
A nonconformity does not necessarily mean that certification will be denied. Instead, it indicates that a requirement of ISO 9001 has not been fully met or that the organisation has not consistently followed its own Quality Management System.
The purpose of identifying nonconformities is to support improvement by ensuring that issues are investigated, corrected and prevented from recurring.
Certification bodies generally classify nonconformities according to their significance.
A minor nonconformity usually relates to an isolated issue that does not undermine the overall effectiveness of the Quality Management System.
Examples may include:
Minor nonconformities are common during certification audits and are typically resolved through corrective action within an agreed timeframe.
A major nonconformity indicates a more significant issue that could affect the ability of the Quality Management System to achieve its intended outcomes.
Examples might include:
Major nonconformities usually require corrective action and verification before certification can be granted.
Receiving a nonconformity should not be viewed as a failure.
Even mature organisations receive audit findings from time to time.
When a nonconformity is identified, the organisation is normally expected to:
Depending on the significance of the finding, the certification body may review submitted evidence remotely or conduct a follow-up visit before making a certification decision.
Once the Stage 2 Audit has been completed and any required corrective actions have been reviewed, the certification body makes an independent certification decision.
This decision is based on:
Importantly, the certification decision is not normally made by the auditor alone.
Most certification bodies have an independent technical review process to ensure that certification decisions are impartial, consistent and based on objective evidence.
If the certification body concludes that your organisation meets the requirements of ISO 9001, it will issue an ISO 9001 certificate.
The certificate typically confirms:
For most organisations, certification is valid for three years, provided that surveillance audits are successfully completed during the certification cycle.
Achieving certification is an important milestone, but it is not the end of the journey.
The real value of ISO 9001 comes from continually improving the Quality Management System to support better business performance, stronger customer relationships and sustainable growth.
Many organisations celebrate receiving their ISO 9001 certificate, and rightly so. It represents the successful implementation of a management system that has been independently assessed against an internationally recognised standard.
However, ISO 9001 is built on the principle of continual improvement.
Maintaining certification requires organisations to keep their Quality Management System active, review performance regularly and respond proactively to changing risks, opportunities and customer expectations.
Organisations that embrace this mindset often find that the greatest benefits of ISO 9001 emerge long after the initial certification audit has been completed.
Achieving ISO 9001 certification is a significant accomplishment, but it is not the end of the certification journey.
ISO 9001 is built on the principle of continual improvement, which means organisations are expected to maintain and improve their Quality Management System (QMS) throughout the certification cycle.
Rather than waiting three years until recertification, certification bodies conduct periodic surveillance audits to verify that the management system remains effective and continues to conform to the requirements of ISO 9001.
Maintaining certification involves:
Organisations that integrate these activities into their normal business operations generally find that maintaining certification becomes far easier than achieving it for the first time.
Following initial certification, organisations typically undergo annual surveillance audits during the three-year certification cycle.
These audits are shorter than the initial certification audit and focus on confirming that the Quality Management System continues to operate effectively.
During a surveillance audit, the certification body may review:
Surveillance audits are not intended to repeat the entire certification audit. Instead, they provide ongoing confidence that the management system remains effective and continues to support the organisation's objectives.
Regular surveillance also helps identify opportunities for improvement before they develop into more significant issues.
An ISO 9001 certificate is typically valid for three years, provided surveillance audits are successfully completed.
Before the certificate expires, the organisation must undergo a recertification audit to renew its certification.
The recertification audit is more comprehensive than a surveillance audit because it evaluates the effectiveness of the Quality Management System over the entire certification cycle.
The certification body will typically assess:
A successful recertification audit results in the renewal of the organisation's ISO 9001 certificate for a further three-year cycle.
Many certification challenges can be avoided through good preparation and a practical approach to implementing ISO 9001.
Organisations that focus solely on obtaining a certificate often overlook the real purpose of ISO 9001: improving business performance through an effective Quality Management System.
More documentation does not necessarily result in a better management system.
The most effective Quality Management Systems include only the documented information needed to support consistent and effective operations.
Certification should never be approached as a rush to prepare for an audit.
Internal audits, management reviews and corrective actions should form part of normal business operations rather than last-minute activities.
Top management plays a central role in the success of ISO 9001.
Without visible leadership commitment, organisations often struggle to maintain employee engagement and continual improvement.
Nonconformities should be investigated thoroughly to identify and address the root cause, not simply the immediate issue.
Effective corrective action strengthens the Quality Management System and reduces the likelihood of similar issues recurring.
The timeframe varies depending on the size and complexity of the organisation, the maturity of its existing management systems and the resources available for implementation.
Many organisations complete the process within three to twelve months, although this can vary significantly depending on the starting point.
If significant nonconformities are identified, certification may be delayed until appropriate corrective actions have been implemented and verified.
This should not be viewed as a failure. The certification process is designed to identify opportunities for improvement and ensure organisations achieve certification with an effective Quality Management System in place.
Certification audits are conducted while the organisation continues its normal operations.
Auditors assess how the Quality Management System functions in day-to-day practice, so continuing with normal business activities provides the most accurate picture of how the system operates.
Organisations are expected to keep their Quality Management System up to date as the business evolves.
Significant changes, such as expanding the scope of certification, opening new sites or introducing major new processes, may need to be communicated to the certification body.
Organisations can transfer their certification to another accredited certification body, provided the transfer requirements are met and the existing certification remains valid.
ISO 9001 is an internationally recognised standard, and certificates issued by appropriately accredited certification bodies are widely accepted by customers, regulators and organisations around the world.
Achieving ISO 9001 certification is about more than successfully completing an external audit. It's about developing a Quality Management System that delivers measurable improvements to the way your organisation operates.
At ISO Specialist South Africa, we help organisations prepare for certification by providing practical, business-focused support tailored to their size, industry and objectives.
Our ISO 9001 services include:
We work alongside your team to build a Quality Management System that supports operational excellence, customer confidence and long-term business success, while ensuring you're well prepared for independent certification.
Whether you're implementing ISO 9001 for the first time or preparing for your certification audit, expert guidance can make the process more efficient and less stressful.
Our consultants can help you:
CTA: Request an ISO 9001 Gap Analysis
or
CTA: Speak to an ISO 9001 Consultant
The ISO 9001 certification process is a structured journey that demonstrates an organisation's commitment to quality, consistency and continual improvement.
From implementing a Quality Management System and completing internal audits to successfully passing independent certification and maintaining compliance through surveillance audits, each stage contributes to building a stronger and more resilient organisation.
Understanding what happens before, during and after certification allows businesses to prepare effectively, reduce unnecessary delays and approach the certification audit with confidence.
While achieving ISO 9001 certification is an important milestone, the greatest value lies in the management system behind the certificate. Organisations that use ISO 9001 as a framework for continual improvement often experience stronger operational performance, improved customer satisfaction and greater confidence from clients, suppliers and other stakeholders.
:::
Not sure whether your organisation is ready for ISO 9001 certification?
Our ISO 9001 Readiness Checklist helps you assess the key areas of your Quality Management System before starting implementation or preparing for certification.
It provides a practical way to identify strengths, highlight potential gaps and understand the steps needed to become certification-ready.