A big client wants your ISO certificate. Or perhaps a tender lists it as a must. Either way, you now need a clear plan.
The good news? Getting certified follows the same basic steps in every country.
Maybe you run a factory in Kenya or a service firm in Dubai. Either way, this guide shows you how to get ISO certification, step by step.
What Does It Take to Get ISO Certification?
To get ISO certification, you choose a standard and build a system around it. Then you pass an outside audit. In practice, that means eight clear steps. First, you plan and prepare. Then you train your team and test your system. Finally, an accredited body audits you and issues your certificate.
Here’s the full journey at a glance:
| Step | What you do |
|---|---|
| 1 | Choose the right standard |
| 2 | Run a gap analysis |
| 3 | Build your management system |
| 4 | Train your team |
| 5 | Run an internal audit and review |
| 6 | Pick an accredited audit body |
| 7 | Pass the two-stage audit |
| 8 | Keep your system alive |
Most small and mid-sized firms finish in a few weeks to a few months. Of course, your timeline depends on your size and starting point.
Now let’s walk through each step.
Step 1: How Do You Choose the Right ISO Standard?
Start with what your clients and tenders ask for. Next, think about your industry’s normal standards and your biggest risks. Most firms begin with ISO 9001 for quality. After that, they add standards for safety, environment, data or their specific sector.
For most firms, ISO 9001 certification is the natural first step. It sets up clear processes and puts your clients at the centre.
If you work on sites or in factories, safety comes next. In that case, ISO 45001 certification helps you protect workers and prevent accidents.
Many buyers also want green proof today. So ISO 14001 certification shows you control waste, emissions and legal duties.
Data-heavy firms, on the other hand, start somewhere else. For them, ISO 27001 certification protects client information from leaks and attacks.
Likewise, food firms often need ISO 22000 certification to prove safe food handling.
Medical device firms follow their own path, too. That’s why ISO 13485 certification is the core standard for device makers and traders.
Beyond these, some firms need more specialised options.
Which Specialist Standards Might You Need?
For instance, IT service firms often add ISO 20000 certification. It proves steady service quality.
Similarly, energy-heavy sites can save money with ISO 50001 certification. It helps you track and cut energy use month by month.
Meanwhile, firms that run plants and equipment can add ISO 55001 certification. It covers asset management across the whole life of each asset.
Schools and training centres have their own standard as well. In their case, ISO 21001 certification focuses on learners and teaching quality.
Facility managers, too, can choose ISO 41001 certification to prove well-run buildings and services.
Finally, firms that build or use AI now look at ISO 42001 certification. It shows you use AI in a safe, fair and open way.
Still unsure? Browse our full list of ISO certification standards to compare options.
Step 2: What Is a Gap Analysis?
A gap analysis compares how you work today with what the standard requires. It shows what you already do well and what’s missing. As a result, you know exactly how much work lies ahead. It also helps you plan your budget, timeline and team roles before you start.
Think of it as a health check for your business systems. A consultant reviews your processes, records and habits.
Then you get a clear list of gaps. Some gaps take an hour to fix, while others take weeks.
For example, a Nairobi printing firm already tracked orders and complaints well. But it had no formal risk process or internal audits. So its gap list was short, and it moved quickly.
Step 3: How Do You Build Your Management System?
You build your management system by filling each gap with simple, practical processes. That means writing key policies, setting clear roles and keeping useful records. However, it shouldn’t create piles of paperwork. Instead, a good system describes how you already work, then improves the weak spots.
Start with a few core pieces:
- A clear policy that sets your goals and direction
- Defined roles so everyone knows who does what
- Simple processes for key activities, like sales or production
- Risk controls to spot and handle problems early
- Records that prove your system works in practice
Above all, keep it real and simple. Use plain words your staff already use. In fact, auditors spot copy-paste templates very quickly, so build around your actual work.
What Documents Do You Need for ISO Certification?
You need a small set of core documents for ISO certification. These include a policy, your scope, key processes, risk records and proof of training. You also need internal audit and management review records. However, you don’t need a mountain of paper. Clear, useful documents work far better.
Here’s a simple starter list:
| Document | Why you need it |
|---|---|
| Policy | Sets your goals and direction |
| Scope | Shows what the certificate covers |
| Key processes | Explains how core work gets done |
| Risk register | Shows how you spot and handle risks |
| Training records | Proves staff know their roles |
| Internal audit report | Shows you checked your own system |
| Management review notes | Proves leaders review results |
Of course, each standard adds a few of its own. For example, ISO 45001 needs hazard records. Meanwhile, ISO 27001 needs a list of security controls.
Still, the rule stays the same. Write down what you actually do, then keep proof that you do it.
How Much Time Will Your Team Need to Give?
Your team will need to give some time each week. But it’s less than most owners fear. A named project owner usually spends a few hours a week. Other staff join short training and help with records. So with good planning, ISO fits around your normal work instead of stopping it.
Here’s how the effort usually splits:
- Project owner: a few hours a week to drive the plan
- Senior leaders: a short policy session and a management review
- Team leads: help map processes and keep records
- All staff: one short awareness session
- Internal auditors: a few days for training and audits
As a result, most firms keep working normally during the project. In fact, many find daily work gets easier once clear steps are in place.
Take a Dubai trading firm with 25 staff. Its office manager led the project for about four hours a week. Three months later, the firm passed its audit without hiring anyone new.
Step 4: Why Does Team Training Matter?
Team training matters because ISO only works when people follow the system every day. Staff need to know the policy and their roles. They should also see how their work links to quality or safety. Otherwise, the system lives on paper only. Trained teams also answer audit questions with far more confidence.
Training doesn’t need to be long or complex. A few focused hours often do the job. Usually, a short awareness session covers the basics for most staff.
Key people, though, need deeper skills. For example, the staff who run internal audits should learn audit methods properly.
As a result, your team feels ready rather than nervous when the auditor arrives.
Step 5: What Happens in the Internal Audit and Management Review?
In the internal audit, your own trained staff check that the system works. Then, in the management review, leaders look at the results and decide on actions. Together, these two steps catch problems early. They also prove to the outside auditor that your system is active and improving.
The internal audit is your dress rehearsal. So treat it seriously, and record what you find.
Next, hold the management review. Leaders look at audit results, client feedback, risks and goals.
After that, fix any gaps you found. That way, you walk into the real audit with fewer surprises.
Step 6: How Do You Pick the Right Certification Body?
Pick a certification body with proper accreditation. It should also be known in your target markets and your industry. Accreditation shows an independent authority has checked the body itself. Also, compare audit days, travel costs and timing. A well-chosen body makes your certificate more trusted by buyers worldwide.
Here’s a quick checklist to compare bodies:
- It holds accreditation for your standard and scope
- Your target buyers recognise its certificates
- It has auditors who know your industry
- It can audit all your sites and countries
- Its fees and audit days are clear upfront
- It lists certificates in an online register
Keep in mind that a consultant and a certification body play different roles. The consultant helps you prepare, while the certification body audits you independently.
Step 7: What Happens in the Two-Stage Certification Audit?
The certification audit usually runs in two stages. In Stage 1, the auditor reviews your documents and checks that you’re ready. In Stage 2, the auditor visits your site and talks to staff. They also check real records. If you pass Stage 2, the certification body issues your certificate.
| Stage | What the auditor does | What you should prepare |
|---|---|---|
| Stage 1 | Reviews documents and readiness | Policy, processes, risk records, internal audit results |
| Stage 2 | Checks the system in action | Staff ready to explain their roles, live records, site access |
Sometimes the auditor finds issues, called nonconformities. Don’t panic, because this is normal.
Instead, you fix each issue within an agreed time. Then the certification body reviews your fixes and issues the certificate.
Step 8: How Do You Keep Your ISO Certificate?
You keep your ISO certificate by running your system daily and passing yearly audits. Most certificates last three years. During that time, the audit body returns once a year for a lighter check. At the end of year three, a full recertification audit renews your certificate.
| Year | Audit |
|---|---|
| Year 1 | Initial certification audit |
| Year 2 | Surveillance audit |
| Year 3 | Surveillance audit |
| End of year 3 | Recertification audit |
So ISO isn’t a one-time project. Rather, it becomes part of how your business runs.
At renewal time, our ISO certification renewal worldwide service keeps you on track.
How Long Does It Take to Get ISO Certification?
Most small firms earn ISO certification in a few weeks to two months. Mid-sized firms often need two to four months. Large groups with several sites or standards may need longer. Your timeline mainly depends on your size, your systems and your team’s pace.
| Firm size | Typical timeline |
|---|---|
| Small, one site, one standard | A few weeks to 2 months |
| Mid-sized, one or two standards | 2 to 4 months |
| Large, several sites or standards | 4 to 6 months or more |
Want to move faster? Then name one project owner and keep good records from day one. Also, book your audit dates early, because audit bodies often get busy.
How Does the Process Change by Industry?
The basic steps stay the same in every industry, but the focus changes. Builders focus on safety and site controls. Food firms focus on hygiene and hazards. Medical device makers focus on product risk. So your industry shapes which standards you choose and what auditors look at most.
Construction firms, for example, often combine three standards into one system. Our page on ISO certification for construction companies explains how.
Oil and gas suppliers, by contrast, face very strict buyer checks. That’s why ISO certification for the oil and gas industry often adds sector standards.
Hotels and restaurants, meanwhile, care most about food safety and guest service. See ISO certification for hotels and restaurants for their usual path.
Medical device firms need tight product controls. Therefore, ISO certification for medical devices centres on ISO 13485.
Logistics firms move goods across borders every day. As a result, ISO certification for transport and logistics focuses on secure delivery.
Electronics makers, in turn, face close buyer checks on product quality. Our page on ISO certification for electrical and electronics industries covers their needs.
Chemical plants handle hazardous materials daily. So ISO certification for the chemical industry puts safety and environment first.
Similarly, schools and colleges want to prove teaching quality. For them, see ISO certification for the education sector.
Lastly, car parts makers follow strict automotive rules. That’s where ISO certification for the automotive industry comes in.
Can You Get ISO Certified From Any Country?
Yes. ISO standards are the same everywhere. So you can certify in almost any country. Many audits now mix site visits with remote reviews. In addition, firms with sites in several countries can often use one multi-site certificate. That saves time, travel and cost for growing businesses.
In the Gulf, demand stays strong across many sectors. For instance, see our guide to ISO certification in UAE for local tips.
Saudi Arabia, meanwhile, keeps growing fast under Vision 2030. Our page on ISO certification in Saudi Arabia covers the Kingdom’s needs.
Africa is another growth region for ISO. So firms in East Africa can start with ISO certification in Kenya.
West African firms, likewise, use ISO to win export and oil sector work. See ISO certification in Nigeria for details.
In Asia, manufacturing and food exports drive demand. That’s why many firms read our page on ISO certification in Thailand.
Oman, too, sees rising demand from logistics, oil and building firms. For local guidance, read our page on ISO certification in Oman.
For the full list, visit our countries we serve page.
Why Do Some Firms Fail Their First Audit?
Firms often fail their first audit because their system exists only on paper. Other common reasons include missing records, untrained staff and skipped internal audits. Some firms also rush the process to meet a deadline. Fortunately, good planning prevents almost all of these problems.
Watch out for these common causes:
- Copy-paste documents that don’t match real work
- Missing records that can’t prove the system works
- Untrained staff who can’t explain their roles
- No internal audit before the real one
- No management review by senior leaders
- A rushed timeline that skips key steps
So give yourself enough time. Then test everything before the auditor arrives.
In short, learning how to get ISO certification is mostly about good habits. Plan early, keep honest records and involve your whole team. Do that, and your first audit feels like a check-up, not an exam.
How GCS Helps You Get ISO Certified
Global Certification Services shows firms worldwide how to get ISO certification without stress. GCS has served over 3,000 clients, from builders to IT firms. We handle gap analysis, system building, training and audit support. As a result, you get a working system, not just a wall certificate.
First, we learn about your business, your sites and your clients. Then we suggest only the standards you need.
After that, we guide your team through every step until your certificate arrives. To learn more, visit the GCS home page.
Frequently Asked Questions
How do I get ISO certification for my company?
To get ISO certification, choose the right standard and run a gap analysis. Then build your system, train your team and run an internal audit. Finally, an accredited certification body audits you in two stages. If you pass, it issues your certificate, which usually lasts three years.
How long does it take to get ISO certified?
Most small firms earn ISO certification in a few weeks to two months. Mid-sized firms often need two to four months. Larger groups with many sites or standards may need longer. Your timeline depends on your size, your systems and your team’s pace.
What is the difference between Stage 1 and Stage 2 audits?
In a Stage 1 audit, the auditor reviews your files and checks you’re ready. In a Stage 2 audit, the auditor visits your site and checks real records. You must pass Stage 2 before the certification body issues your certificate.
Can I get ISO certification without a consultant?
Yes, you can. However, many firms use a consultant to save time and avoid mistakes. A consultant runs the gap analysis, builds the system and prepares your team. The certification body then audits you independently. So the consultant prepares you, while the auditor checks you.
What happens if I fail an ISO audit?
Failing a single point isn’t the end. The auditor records each issue as a nonconformity. You then fix it within an agreed time and send proof. Once the certification body accepts your fixes, it issues your certificate. Serious gaps may need a follow-up visit first.
How do I keep my ISO certificate valid?
Keep running your system every day and pass a surveillance audit each year. Most certificates last three years. At the end of year three, you pass a full recertification audit. Missing a surveillance audit can put your certificate at risk. So plan each date early.
Ready to Get ISO Certified?
Now you know how to get ISO certification, step by step. The next move is a simple conversation about your goals.
GCS makes the journey clear and simple. Contact our team today and start your certification plan.
