In short
The overall time is the sum of preparation, which depends on you, and audit, which the certification body calculates using public rules.
For quality, environment and occupational health and safety, audit time follows IAF MD 5 and starts from the effective number of personnel.
Sites, shifts, outsourced processes and high-risk sectors increase the time; system maturity and other certifications can reduce it.
The most common bottleneck is the internal coordinator's time: planning slots and approvals shortens the journey.
A major nonconformity not verified within six months of Stage 2 means Stage 2 must be repeated.
Size, scope, starting point and the time your internal team can commit: these are the variables that lengthen or shorten the journey. Anyone asking "how long does it take to get ISO certified?" is usually looking for a number of months. The honest answer is that no single number fits everyone: two companies with the same standard and the same turnover can take very different amounts of time, because they start from different places and put different levels of effort into the project.
In this guide we explain what really drives the timeline. We separate the two "clocks" of the journey: preparation time, which depends mostly on you, and audit time, which the certification body calculates using public international rules. We look at how headcount, sites and shifts, outsourced processes, system maturity, sector and the chosen standard all weigh in. At the end you will find a practical example, the mistakes that cost weeks and a checklist to estimate your own journey before asking for a quote. If you need the basics first on what certification is and how it works, start with our guide on what ISO certifications are.
What determines how long ISO certification takes?
The overall time is the sum of two different durations: preparation and audit. You control the first; the certification body sets the second according to defined criteria.
Mixing them up is the source of many wrong expectations. To estimate realistically, it pays to think about the two parts separately and then add the waiting time between them.
Preparation time: it depends on you
Preparation runs from the first analysis of your situation to the point where the management system is operational and demonstrable. It covers the gap analysis, defining processes, roles and documents, training people, collecting the first records, the internal audit and the management review.
This phase has no standard duration because it depends on entirely internal variables: how many people and activities fall within the system, how much of what the standard requires already exists, and how much time key people can give each week.
Audit time: the certification body calculates it using public rules
Audit duration is not a free commercial choice. ISO/IEC 17021-1, the standard governing bodies that certify management systems, requires documented procedures for determining audit time and a recorded justification. Among the aspects to consider, it lists the complexity of the organisation and its system, the technological and regulatory context, outsourced activities, the results of previous audits, the size and number of sites, the risks linked to products and processes, and whether several standards are audited together.
For quality, environment and occupational health and safety, the calculation follows the mandatory document IAF MD 5, published by the IAF, the international forum of accreditation bodies. Other schemes have specific criteria: for ISO 27001, for example, 17021-1 itself refers to ISO/IEC 27006. For schemes covered by IAF MD 5, the certification body must give you the audit time it has set and its justification as part of the contract.
How much does company size matter?
Size is the starting point of the calculation, but it is not the same as the number of employees on the payroll. IAF MD 5 talks about the "effective number of personnel" and defines it with precise rules.
The effective number includes everyone involved within the scope of certification: permanent, temporary and part-time staff, including those working shifts. If non-permanent workers such as contractors' staff are within the scope, they count too. For occupational health and safety the boundary is wider still and includes contractors' and subcontractors' personnel working under the organisation's control or influence.
Part-time staff, shifts and seasonality
The effective number reflects how you are organised. Part-time staff can be converted into full-time equivalents: the document gives the example of 30 people working 4 hours a day, counted as 15. For seasonal operations, such as agriculture or tourist facilities, the count is instead based on the staff present in the peak season.
When a high proportion of staff perform repetitive activities, such as cleaning, security, transport or call centres, a consistent and documented reduction is allowed for quality and environment. The same logic applies to shifts: the certification body must decide how to cover them, and at least one shift must be audited. That is why a company running three production shifts should expect a different audit plan from an office with standard hours, even with the same headcount.
When you ask for a quote, provide accurate headcount data, broken down by site, shift and type of contract. An approximate figure leads to a wrong estimate of audit days, which then has to be corrected.
Why does the scope of certification change the timeline?
The scope of certification decides which sites, processes and activities are part of the system. The broader it is, the more work it takes to prepare and the more time the certification body needs to audit it.
You can certify the whole company or a product line, a site or a service, as long as the scope is coherent and does not artificially exclude relevant activities. Narrowing it to "get there faster" can prove a false economy if the customer asking for the certificate expects to see precisely the excluded activity covered.
Multiple sites, temporary sites and complex logistics
Among the factors IAF MD 5 lists as reasons to increase audit time are complex logistics across several buildings, staff speaking more than one language, very large sites relative to headcount and activities that require visits to temporary sites.
For multi-site organisations there is a dedicated document, IAF MD 1, which sets the conditions under which a sample of sites can be audited instead of all of them. Sampling is not automatic: the certification body must establish case by case whether it is permitted. During preparation, therefore, having common rules across sites saves time twice over.
Design, outsourcing and excluded activities
Some features of the scope reduce the audit workload. IAF MD 5 mentions the organisation that is not responsible for design (for quality), sites that are small relative to headcount, a high level of automation and staff working off location, such as sales agents or technicians, when their activities can be checked through records.
Other features increase it. For quality, outsourced processes and activities considered high risk require more time. Outsourcing does not take a process out of the system: the certification body must verify that the organisation effectively controls what it entrusts to third parties. A company that outsources production, logistics or software development therefore needs concrete supplier evaluation criteria, not just a list of names.
How much does your starting point weigh?
The starting point is often the most underestimated variable. Two companies identical in size and scope can have very different journeys if one already has documented processes and the other still works "from memory".
A gap analysis measures that distance: it compares what you do today with what the standard requires, requirement by requirement, and produces a list of activities to complete. Without this step, every time estimate is a guess. If your standard is ISO 9001, you will find the main requirements explained in our guide to the ISO 9001 quality management system.
What shortens preparation
Anything that already exists and works shortens the journey: operating procedures actually applied, clear roles, records of checks and training, an up-to-date risk analysis. Other certifications count too. IAF MD 5 allows a reduction in audit time linked to the maturity of the management system and the certification body's prior knowledge, for example when the organisation is already certified to another standard.
A company certified to ISO 9001 that is aiming for ISO 27001 starts with familiar processes: internal audit, management review, handling nonconformities, document control. ISO management system standards share the same harmonised structure, and when several standards are integrated the certification body applies IAF MD 11 to calculate the duration according to the level of integration. We cover this in our guide to the integrated management system.
Records cannot be written in a day
A management system is demonstrated by evidence that it works, not by documents. Procedures and policies can be written in a few weeks, but the auditor wants to see that they are applied: recorded checks, training delivered, suppliers evaluated, objectives measured.
This is why the system needs a minimum period of "life" before the audit. ISO/IEC 17021-1 lists among the objectives of Stage 1 checking that internal audits and management reviews are planned and performed, and that the level of implementation shows the organisation is ready for Stage 2. An internal audit carried out the day before, with no follow-up actions, is a weak signal. So plan your calendar backwards: first the certification audit, then the management review, before that the internal audit, and before everything a few cycles of real records.
How much time does the internal team need to commit?
Internal time is the factor that sets the pace of the project. No external support can replace the people who know the processes, take the decisions and produce the evidence.
At least three contributions are needed. Top management must define policy, objectives and resources and take part in the management review: the standard requires explicit leadership commitment, and the auditor checks it by talking to the people who run the company. An internal coordinator must organise the work, gather information and track deadlines. Department heads must describe how they work, apply the agreed rules and record what they do.
The most common bottleneck
In most journeys that drag on, the problem is not the standard but the internal coordinator's availability. This is someone who already has another full-time job and gives the system whatever time is left over. Every week they cannot do so, the project stops.
The solution is not heroics but planning. Set a protected weekly slot, spread activities across area managers instead of concentrating them on one person, and decide in advance who approves what, so that documents are not left waiting for a signature.
This is where Complaion's model works in practice. The dedicated Lead Auditor sets up the plan, writes and validates procedures based on your real processes and tells you clearly what is needed and what is not. The platform collects evidence and manages documents with version control, assigns each activity to an owner and keeps the compliance calendar, so the coordinator always knows what is missing instead of reconstructing it at the end of the month. The internal audit does not fall on the coordinator either: your Complaion Lead Auditor carries it out, to the standard of a certification audit, and schedules it early enough to close actions before Stage 1.
Sector, risk and standard: why doesn't the same headcount mean the same timeline?
With the same number of people, the sector and the chosen standard change both preparation and audit duration. IAF MD 5 provides for this explicitly through risk and complexity categories.
For quality, the document uses three risk categories, linked to the consequences of a product or service failure. High-risk activities, such as nuclear, medical, pharmaceutical, food and construction, normally require more audit time; medium-risk activities, such as simple manufacturing, sit around the average; low-risk activities require less time.
Environment, health and safety, information security
For environment, IAF MD 5 uses five complexity categories, based on the nature, number and severity of environmental aspects. Time can also increase with the sensitivity of the surrounding environment, the views of interested parties and the risk of environmental accidents.
For occupational health and safety there are three complexity categories, depending on the risks of the sector. Factors such as an accident rate above the sector average, members of the public on site or many contractors also weigh in. For information security, audit time follows ISO/IEC 27006, and preparation depends heavily on how many systems, IT suppliers and data sets fall within the scope: we cover this in our complete guide to ISO 27001.
The table summarises how each factor affects the two durations.
Factor | Effect on preparation | Effect on audit time (IAF MD 5) |
|---|---|---|
Effective number of personnel | More people to train and involve | It is the starting point of the calculation |
Sites, shifts and temporary sites | Common rules to build and check | May increase due to logistics and temporary sites |
Outsourced processes | Supplier control criteria to define | Increase for quality and environment |
Regulated or high-risk sector | More requirements and controls to document | Increase |
System maturity and other certifications | Less to build from scratch | Possible reduction |
Systems integrated across several standards | A single documentation framework | Calculated under IAF MD 11 |
What happens between Stage 1, Stage 2 and the issue of the certificate?
Even after preparation there are timings that depend on outcomes. The initial audit always takes place in two stages, and moving from one to the other is not automatic.
Stage 1 reviews documentation, site-specific conditions and readiness for Stage 2. According to ISO/IEC 17021-1, when setting the interval between the two stages the certification body considers the time you need to resolve the areas of concern identified in Stage 1, and the results of Stage 1 may lead to Stage 2 being postponed or cancelled. Stage 2 evaluates the implementation and effectiveness of the system at the organisation's site. You will find the detail in our guide to Stage 1 and Stage 2 audits.
Nonconformities and the certification decision
The certificate is not issued when Stage 2 closes. The certification body must first take the certification decision, and to do so it must have verified corrections and corrective actions for every major nonconformity and accepted the action plan for minor ones. If it cannot verify the actions on major nonconformities within six months of the last day of Stage 2, 17021-1 requires Stage 2 to be repeated.
That is why arriving at the audit well prepared matters more than arriving early. The difference between major and minor findings is explained in our guide to major and minor nonconformities.
The three-year cycle starts from the certification decision. 17021-1 requires surveillance audits at least once a calendar year, the first within 12 months of the decision, and a recertification audit in the third year. According to IAF MD 5, annual surveillance takes about one third of the initial audit and recertification about two thirds of the initial audit recalculated on the updated situation. Time, therefore, does not end with the certificate: it has to be planned for the following years too.
How to estimate your own timeline: a practical example
The most reliable way to estimate timelines is to start from your own variables, not from a market average. Let us try with a typical company.
Picture a machine shop with 45 people, a single site, production on two shifts and some machining outsourced to subcontractors. It is aiming for ISO 9001 because a major customer has asked for it. It has technical drawings and incoming inspections, but records checks inconsistently, has never run an internal audit, and the person appointed as coordinator is also the purchasing manager.
Two scenarios for the same company
In the first scenario the coordinator works on the system when they can, documents circulate by email and management keeps postponing the definition of objectives. The weeks pile up in waiting and rework. When Stage 1 finally comes, issues emerge on subcontractor evaluation and on second-shift inspection records, and Stage 2 slips.
In the second scenario the company runs the gap analysis straight away, sets aside half a day a week for the coordinator, assigns inspections to shift supervisors and defines how to evaluate subcontractors. The internal audit takes place a few weeks ahead and leaves time to close actions. The journey becomes predictable and manageable, because every activity has an owner and a deadline.
Before asking for a quote, gather this information: you will need it for a serious estimate of preparation and for the certification body's calculation.
Number of people by site, shift and type of contract, including part-time and seasonal staff.
Sites, temporary sites or project sites and the activities carried out at each.
Outsourced processes and critical suppliers.
Standard or standards to certify and any external deadline.
Procedures, records and certifications already in place.
Name of the internal coordinator and the time they can give each week.
Which mistakes make the certification journey longer?
The mistakes that waste the most time are planning mistakes, not misreadings of the standard.
The first is starting from the deadline rather than the gap analysis: setting an audit date because a customer asked for it, without knowing how much work is left. The second is writing generic documents copied from templates, which then have to be rewritten because they do not describe the real organisation. The third is concentrating everything on a single person, who becomes the bottleneck for every decision.
Running the internal audit and management review right before Stage 1 leaves evidence that is too weak and no time to correct. Giving the certification body incomplete headcount or scope data leads to an audit plan that has to be redone. Finally, treating the certificate as the finish line means arriving unprepared at the first surveillance audit, when the system should be stronger, not more fragile.
How Complaion helps you manage the timeline
Complaion does not promise the same timeline for everyone: it builds a plan around your reality. With more than 1,000 clients, we know that size, scope, starting point and internal time must be assessed before setting a date.
A dedicated Lead Auditor supports you from the gap analysis to the certification body's audit: they propose the route best suited to your company's needs, define the scope, write and validate procedures, carry out the internal audit and prepare you for the auditor's questions. The platform collects evidence, manages documents, keeps the compliance calendar and prepares the audit, so the internal coordinator's work is organised and visible. The same method applies to surveillance and recertification audits and to all the certifications and regulations we cover. Certification always remains with an independent, accredited certification body.
Want to know how much work your case requires? Talk to a Lead Auditor and receive a proposal built around your company.
Frequently asked questions about ISO certification timelines
Is there a standard time to get ISO certified?
No. No standard or official document sets a standard duration for the preparation journey, because it depends on size, scope, starting point and the time your internal team commits. There are, however, rules for calculating the certification body's audit time, such as IAF MD 5 for quality, environment and occupational health and safety. A reliable estimate requires a gap analysis of your company.
Who decides how many days the certification audit lasts?
The certification body decides, and under ISO/IEC 17021-1 it must have documented procedures and record the justification for the duration. For quality, environment and occupational health and safety, the starting point is the effective number of personnel, adjusted by the increasing or decreasing factors set out in IAF MD 5. The duration and its justification are given to you as part of the contract.
Can I shorten the audit by declaring fewer employees?
No, and it is not in your interest. The effective number of personnel includes permanent, temporary and part-time staff and shift workers within the scope, and the certification body must be able to justify its calculation to the accreditation body. A wrong figure surfaces during the audit and forces the plan to be revised. Provide accurate data: the permitted reductions already exist and are applied under documented rules.
Does holding one ISO certification shorten the time for a second?
Usually yes, both in preparation and in the audit. Processes such as internal audit, management review and nonconformity handling are common to ISO management system standards thanks to the harmonised structure. IAF MD 5 counts system maturity and prior knowledge among the possible reduction factors, and IAF MD 11 applies to integrated audits. What remains to be built is the part specific to the new standard.
How much time passes between Stage 1 and Stage 2?
It depends on the issues found in Stage 1. ISO/IEC 17021-1 requires the certification body to consider the time the organisation needs to resolve the areas of concern before scheduling Stage 2. If the system changes significantly in the meantime, the certification body may need to repeat all or part of Stage 1.
What happens if a major nonconformity is found in Stage 2?
The certificate cannot be issued until the certification body has verified corrections and corrective actions. If verification does not take place within six months of the last day of Stage 2, ISO/IEC 17021-1 requires Stage 2 to be repeated. That is why it pays to arrive at the audit with an internal audit already done and actions closed.
How much time does maintenance take after certification?
The cycle lasts three years from the certification decision, with surveillance audits at least once a calendar year and recertification in the third year. According to IAF MD 5, annual surveillance amounts to about one third of the initial audit. The internal time depends on how far the system is built into everyday work: if evidence is collected throughout the year, preparing for surveillance is much lighter.
