How long does ISO certification take?
Many organizations interested in ISO certification want to know how much time the certification process will take. How long does the process with a certification body take before an ISO certificate can be issued? There is no fixed timeframe. The total lead time depends on factors such as the organization’s preparation, audit planning and any required follow-up of audit findings. The audit time itself is determined using a fixed method. In this article, we explain how the required audit time is established.
Initial audit #
To obtain ISO certification, an organization goes through an initial audit. An initial audit usually consists of a stage 1 audit and a stage 2 audit. During the stage 1 audit, the auditor assesses whether the organization is ready for stage 2. This is done, among other things, by reviewing documented information within the management system and the organization’s understanding of the requirements of the standard. During the stage 2 audit, the implementation and effectiveness of the management system are assessed. Are processes carried out as described? Is the policy followed? Are employees aware of their contribution to the management system?
Determining audit time #
The audit time for an initial audit is determined on the basis of applicable accreditation and scheme requirements. These requirements specify the principles that certification bodies, such as Brand Compliance, must apply when determining audit time. For management system certification, ISO/IEC 17021-1 is an important accreditation standard. For ISO 27001 certification, additional requirements from ISO/IEC 27006-1 apply. These standards specify requirements for bodies providing audit and certification of management systems and, in the case of ISO/IEC 27006-1, information security management systems.
Example #
As an example, consider ISO 27001 certification. For ISO 27001, audit time is determined on the basis of the applicable requirements for information security management systems. For a small organization, this results in a minimum audit time for the initial audit. Part of this time is spent on audit activities with the organization, either on site or by using remote audit techniques. Another part is spent on audit-related activities, such as preparing the audit, drawing up the audit plan and writing the audit report.
Factors that affect audit time #
In addition to the number of FTEs, other factors may affect the audit time. Examples include:
- the extent to which processes or services have been outsourced;
- the number of locations within the scope of certification;
- the complexity of the management system;
- the nature of the organization’s activities, processes and risks;
- any changes within the organization or management system.
These factors may lead to an increase or reduction in audit time. The relevant time factors are discussed during the application process.
Surveillance audits and recertification #
Once the certificate has been issued, periodic surveillance audits take place within the certification cycle. During these audits, the auditor assesses whether the management system continues to meet the requirements of the standard and remains effective. For surveillance audits and recertification, it is also assessed whether any factors affect the audit time. For example, if many nonconformities were identified during previous audits, or if significant changes have been made to the management system, the auditor may need more time to perform the audit.
Would you like to know more about what happens after certification? Read the article What is a certification cycle?.
Conclusion #
There is no standard answer to the question of how long ISO certification takes. The total lead time depends on your organization’s preparation, audit planning, the size and complexity of the organization and any follow-up of audit findings.
The audit time itself is determined using a fixed method. This ensures that the required time is established in a consistent and substantiated way.
