How Long ISO Certification Really Takes, and Which Parts You Control

The honest framing

Why nobody can give you one number

The question sounds like it should have an answer, in the way that a visa processing time has an answer. It does not, because ISO certification is not a queue you join. It is a judgement someone makes about whether your organisation is doing what the standard requires, and the time it takes is mostly the time it takes you to start doing it.

That said, the vagueness is often overdone. Three things about the timeline are genuinely fixed by the certification rules and are the same for everybody. A fourth is set by arithmetic, not opinion. Only the rest is open, and once you can see where the boundary falls you can plan around it honestly.

The rules

What the rules fix, and what they leave to you

These come from ISO/IEC 17021-1, the standard that certification bodies themselves are audited against, and from the accreditation rules on audit duration. They are not one body’s policy. They apply to every accredited certificate.

Read that table again with one thing in mind: not one of those rules makes the process slow. The six month limit is a deadline on you, not a wait. The twelve month surveillance rule only bites after you already hold the certificate. Nothing in the certification rules adds months to a first certificate. The months come from the preparation, which is the one part nobody else controls.

Your own numbers

Estimate your own timeline

Three things move the answer more than anything else: how many people are in scope, what you are starting from, and how much of someone’s week you can actually protect for this. Set them and see a realistic range.

If the number surprised you, it is almost always the third question doing the work. The same organisation that takes five months with one person at a day a week will take closer to three with a small team that has been told this is part of their job rather than an extra.

Where the time goes

The four phases, and what each really costs you

Gap analysis

One to two weeks. Someone compares what the standard requires against what you actually do, and writes down the difference. This is the only phase with a predictable length, because it is a fixed piece of work. Skipping it does not save time, it moves the discovery to stage one where it costs more.

Building the system

Six to sixteen weeks, and this is the whole ball game. Policy, scope, risk work, the processes the standard asks for, and the records that prove they run. Writing the documents is the fast half. Getting people to actually follow them long enough to generate evidence is the slow half, and it cannot be done the week before the audit.

Internal audit and management review

Two to four weeks. Both are mandatory and both have to have genuinely happened before stage two. This is the phase organisations most often try to fake, and it is the phase auditors are best at detecting. An internal audit report dated three days before the external audit tells its own story.

Certification audit

Two to eight weeks elapsed, a few days on site. Stage one, then a gap you mostly control, then stage two, then closing whatever came out of it, then the certification decision. The on site days are few. The elapsed time depends on how much stage one found.

Audit duration itself comes from a table, not from negotiation. For a quality management system the starting point runs from about one and a half days for an organisation of up to five people, to four days at twenty six to forty five people, five days at forty six to sixty five, and ten days at a few hundred. Surveillance is about a third of the initial figure and recertification about two thirds. We go through what moves those numbers in what ISO certification costs in Pakistan.

The real delays

What actually makes it take longer

In our experience the overruns almost never come from the certification body. They come from five places, and four of them are avoidable.

• Nobody owns it. The single biggest cause. The project is assigned to someone already fully booked, and it moves whenever their real job allows. Six weeks of work spreads across five months.
• The scope keeps changing. A site gets added, then a second entity, then a service line. Every change reopens the risk work and the documentation. Decide the scope once, in writing, before anyone starts.
• Evidence was never generated. You cannot audit a month of records into existence. If the standard expects monitoring, the monitoring has to have been running. This is the delay that genuinely cannot be bought back.
• Internal audit and management review get postponed. They are mandatory, they need preparing, and they are always the first thing to slip. Schedule them at the start of the project, not when you feel ready.
• The certification body is booked. The one you cannot control. Accredited auditors in a given sector are not infinite, and a date four to eight weeks out is normal. Book provisionally early rather than waiting until you feel ready.

After the certificate

What happens after the certificate

Certification is a three year cycle, not an event, and the deadlines after the certificate are firmer than the ones before it.

Year one

First surveillance audit, within twelve months of the certification decision. Not twelve months from the audit, from the decision. Miss it and the certificate is at risk, not merely overdue.

Year two

Second surveillance audit. Surveillance runs at least once a calendar year outside recertification years. Shorter than the original audit, about a third of the initial duration, and not a formality.

Year three

Recertification, before the certificate expires. Planned in time for renewal to happen before the expiry date, not after it. A fuller audit than surveillance, about two thirds of the initial duration.

If you let it lapse

Six months to recover, then you start again. A body can restore certification within six months of expiry if the outstanding recertification work is completed. Past that, at least a full stage two is required.

Build the surveillance dates into whoever owns the management system calendar on the day the certificate arrives. The most common way a Pakistani organisation loses a certificate is not failing an audit, it is quietly missing a surveillance window.

Locally

A realistic timeline in Pakistan

Three local factors shift the planning, and none of them is about the standard.

• Auditor availability is the real constraint, not demand. Accredited auditors for some sectors are thin on the ground, and the gap between asking for a date and getting one is frequently the longest single wait in the project. Approach a body early, before your system is finished.
• A buyer deadline changes the order of work, not the length. If an export customer has given you a date, the honest response is to fix the scope narrowly, resource it properly and start the certification body conversation in week one. It is not to compress the evidence period, because that is the one thing an auditor will see through.
• Doing two standards together is faster than doing them one after another. The shared clauses are written once, and an integrated audit costs less than two separate ones. If you expect to hold more than one standard within a year, start them together. We cover how that works in one integrated management system, three deadlines.

We work with organisations in Lahore, Karachi and Islamabad and on sites across the country, and the honest planning answer for a first certificate at a small or medium organisation is one quarter if it is resourced and two if it is not.

Questions

Frequently asked questions