An ISO certification runs on a three-year cycle. An outside certification body does a Stage 1 audit to check readiness, a Stage 2 audit to check the system works in practice, then decides on certification. After that come surveillance audits, normally every year, and a recertification audit before the certificate expires.
Last reviewed: 17 October 2026. Facts checked. This guide follows the general structure of certification audits for management systems as set by ISO/IEC 17021-1, which sets requirements for bodies that audit and certify them. These standards are paid documents and we have not reproduced their text. We have not stated audit durations or fees, since they vary by body, scope and size. Check your certification body's contract and the current standards.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
Internal audit and certification audit are different
An internal audit is done by your own people (or a consultant you appoint) to find problems early. A certification audit, also called a third-party audit, is done by a certification body, an independent organisation that decides whether to issue a certificate. Both are needed. Most standards, such as ISO 9001:2015, require internal audits and management review to be done before the certification audit. See the ISO 9001 internal audit checklist.
Choosing a certification body
A certificate is only as credible as the body that issues it. Certification bodies are normally accredited by a national accreditation body. In India, that is the National Accreditation Board for Certification Bodies (NABCB), which works under the Quality Council of India. Ask the body which accreditation covers your standard and your industry scope, and check it on the accreditation body's website. A certificate from an unaccredited body may not be accepted by your customers or tender authorities.
Stage 1 audit: is the system ready?
Stage 1 is a readiness review. The auditor typically:
- checks your documented information and scope;
- reviews your site and understanding of the standard;
- checks that internal audit and management review have been done;
- plans Stage 2 and flags any area likely to fail.
Stage 1 may find concerns that must be fixed before Stage 2. It can be done partly off-site.
Stage 2 audit: does it work in practice?
Stage 2 happens at your site(s) and tests whether the system is implemented and effective. The audit team interviews staff, watches processes and samples records against the standard and your own procedures. They record nonconformities (see major vs minor nonconformities).
Certification decision
After Stage 2, you respond to any nonconformities with corrections and corrective action. The certification body reviews the audit file and your responses. A person who was not on the audit team usually makes the decision. If it is positive, the certificate is issued, normally for three years.
Surveillance audits
During the certificate cycle, the body returns to check you still meet the standard. Surveillance audits are normally yearly, with the first usually within a year of the certification decision. They are smaller than the initial audit and do not cover everything. Over the cycle, the body aims to cover all requirements and keep sampling operations.
Typical items: internal audits, management review, complaints, corrective actions, changes since last visit, and use of the certificate and marks.
Recertification audit
Before the three years end, a recertification audit checks the whole system again, including whether it has been effective over the cycle. If it is completed and the body decides in time, the certificate continues for another cycle. If you leave it late, you may face a gap or a fresh initial audit, so book early.
Special audits and changes
Certification bodies can also carry out short-notice audits, for example after serious complaints, or extend the scope, or suspend or withdraw a certificate if requirements are not met. Tell your body about major changes such as new sites, processes or ownership.
Timeline at a glance
| Step | Purpose | Usual timing |
|---|---|---|
| Stage 1 | Readiness | Before Stage 2 |
| Stage 2 | Effectiveness in practice | After Stage 1 |
| Certification decision | Issue the certificate | After responses to findings |
| Surveillance | Ongoing conformity | Normally yearly |
| Recertification | Full re-check | Before the end of three years |
Preparation tips
- Run a full internal audit cycle and a management review first.
- Close out open corrective actions with proof.
- Make sure staff can explain the policy and their role.
- Keep records ready and easy to find.
- Do not cram. Auditors sample, and gaps show.
Frequently Asked Questions
How long is an ISO certificate valid?
Normally three years, with surveillance audits during the cycle and a recertification audit at the end.
Can Stage 1 and Stage 2 happen back to back?
That depends on the certification body and your readiness. The purpose of each stage stays the same, so ask your body about its approach.
What happens if I fail Stage 2?
Major nonconformities usually must be closed before certification is recommended. The body may require a follow-up visit. Ask for the process in writing.
Does an internal audit replace surveillance?
No. Surveillance is performed by the certification body. Your internal audit feeds it, and auditors look at your internal audit results.
Is NABCB accreditation compulsory?
Not by law for every certificate, but it is the national accreditation route in India, and many buyers prefer certificates from accredited bodies. Check what your customers require.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error