The ISO Certification Process Explained: From Gap Analysis to Stage 2

If you’ve never been through it, the ISO certification process can look like a maze of audits, stages and jargon. It’s simpler than it looks. You decide what you’re certifying, find the gaps, build and run your management system, check it yourself, then an independent certification body audits it in two stages.

In this guide I’ll walk you through each step, explain what auditors are looking for, and share the pitfalls I see most often as a lead auditor, so you can get through Stage 1 and Stage 2 without nasty surprises.

The ISO certification process at a glance

1. Decide your standard and scope
2. Carry out a gap analysis
3. Build and implement your management system
4. Run the system and build up records
5. Carry out an internal audit
6. Hold a management review
7. Choose a certification body
8. Stage 1 audit
9. Stage 2 audit
10. Close out any nonconformities
11. Certification decision
12. Surveillance audits and recertification

Steps 1 to 6 are yours. Steps 7 onwards involve the certification body, which works to an international standard called ISO/IEC 17021-1.

Getting ready: steps 1 to 6

Step 1: Decide your standard and scope

Start with the standard your customers or tenders ask for: typically ISO 9001 (quality), ISO 14001 (environmental), ISO 45001 (health and safety) or ISO/IEC 27001 (information security). Check you’re working to the current edition. ISO 9001:2026 was published on 16 September 2026 and ISO 14001:2026 on 15 April 2026, while ISO 45001:2018 and ISO/IEC 27001:2022 remain current. If you want UKAS-accredited certification to one of the new editions, ask your certification body whether it has completed its own transition with UKAS, as accredited certificates to the 2026 editions can only follow that approval.

Then define your scope: which sites, activities, products and services the system covers. Your scope decides what gets audited, so make it accurate. A scope that doesn’t match what you actually do is one of the first things an auditor will question.

Step 2: Carry out a gap analysis

A gap analysis compares what you already do with what the standard requires. Most businesses are doing more than they think; the gaps are usually in the things the standard asks you to define, document or check formally. You come out with a clear list of what’s missing and a plan to close it.

Step 3: Build and implement your management system

This means putting in place the policies, processes and documented information the standard requires, in a way that reflects how your business really works. At CAW Consultancy we build systems within 48 hours and typically deliver them within 72.

A system on paper isn’t enough. Implementation means briefing and training your people, assigning responsibilities and starting to work to the new processes.

Step 4: Run the system and build up records

At Stage 2, the certification body evaluates whether your system is implemented and effective. That means it needs evidence: training records, monitoring results, progress on objectives, complaints handled, corrective actions taken, legal and other compliance checks.

So give the system time to run before Stage 2. There’s no one-size-fits-all period, but you need enough evidence to show the system is really working. Your certification body can tell you what it expects for your scope.

Step 5: Carry out an internal audit

Internal audit is a requirement of the standards themselves: both ISO 9001:2026 and ISO 14001:2026 include it at clause 9.2, and other ISO management system standards follow the same common structure. Check the system against the standard and your own procedures, using someone objective who isn’t auditing their own work. Record findings and act on them.

ISO 19011, the international guidance on auditing management systems, was updated in 2026 and is a useful reference for anyone running internal audits.

Step 6: Hold a management review

Management review (clause 9.3 in both new editions) is where top management looks at how the system is performing, typically covering audit results, progress on objectives, customer and other feedback, nonconformities and corrective actions, and whether resources are adequate. It should lead to decisions and actions, not just minutes.

Why do steps 5 and 6 matter before your certification audit? Under ISO/IEC 17021-1, Stage 1 checks whether internal audits and management reviews are being planned and performed, and Stage 2 includes a review of both. Certification body guidance commonly asks for internal audits and a management review to have been carried out before Stage 2.

Step 7: Choose a certification body

The certificate is issued by a certification body, not by ISO (which doesn’t certify anyone) and not by your consultant. ISO’s own advice is to evaluate several certification bodies, check they work to the relevant conformity assessment standard, and check whether they are accredited.

In the UK, UKAS is the national accreditation body. It doesn’t certify businesses; it assesses certification bodies to confirm they are competent and impartial. Accreditation is generally voluntary, but many buyers and tenders ask for accredited certification. Check the body’s schedule of accreditation on the UKAS website covers your standard and your sector.

Step 8: The Stage 1 audit – are you ready?

Stage 1 is the certification body’s readiness check. Under ISO/IEC 17021-1, it is used to:

• Review your documented management system
• Evaluate your readiness for Stage 2
• Review your understanding of the standard’s requirements
• Gather information about your scope, processes and locations, and the legal and regulatory requirements that apply
• Agree the details of Stage 2
• Check that internal audits and management reviews are being planned and performed

The certification body will tell you about any areas of concern that could be raised as nonconformities at Stage 2, giving you the chance to fix them first.

Common Stage 1 pitfalls

• A scope that’s vague or doesn’t match what you actually do
• Generic documents that don’t reflect your business
• No internal audit or management review yet
• Legal and other requirements not identified
• Objectives or risks set but not linked to anything real

Step 9: The Stage 2 audit – is it working?

The purpose of Stage 2 is to evaluate the implementation, including effectiveness, of your management system. The auditor will look at:

• Evidence that you meet the requirements of the standard
• Monitoring, measuring and reviewing performance against your objectives and targets
• Your performance in meeting legal, regulatory and contractual requirements
• Operational control of your processes
• Internal audit and management review
• Management responsibility for your policies

What auditors look for

In my experience as a lead auditor, the most convincing evidence is consistency: what your documents say, what your people tell the auditor and what your records show should all match. Expect interviews with staff at different levels, observation of work and sampling of records.

Common Stage 2 pitfalls

• Staff who can’t explain the policy or how their role affects it
• Gaps in records, such as training, monitoring or supplier checks
• Corrective actions that fix the symptom but not the cause
• Objectives that are set but never monitored
• Changes in the business that the system hasn’t caught up with

Step 10: Nonconformities and corrective action

ISO/IEC 17021-1 defines two grades:

• Major nonconformity: one that affects the capability of the management system to achieve its intended results. For example, there may be significant doubt that effective process control is in place, or several minor nonconformities against the same requirement may show a systemic failure.
• Minor nonconformity: one that doesn’t affect that capability.

For any nonconformity, the certification body will ask you to analyse the cause and describe the correction and corrective action you’ve taken or plan to take, within a defined time. Correction fixes the problem in front of you; corrective action stops it happening again.

Before certification can be granted, the certification body must have verified the correction and corrective action for every major nonconformity, and reviewed and accepted your plans for minors. If it can’t verify the majors within six months of the last day of Stage 2, it must carry out another Stage 2.

Step 11: The certification decision

The auditor doesn’t hand you a certificate on the day. They make a recommendation, and the certification decision is made by people at the certification body who weren’t involved in the audit. Once it’s approved, the certification body issues your certificate.

Step 12: Surveillance audits and recertification

Certification runs on a three-year cycle. Surveillance audits take place at least once each calendar year, except in recertification years, and the first must be no more than 12 months after the certification decision. Surveillance looks at areas such as internal audits and management review, action on previous nonconformities, complaints, progress on objectives and continual improvement, and any changes to the business.

In the third year, a recertification audit confirms the system remains effective, and it’s planned so renewal can happen before the certificate expires. Keep the system running all year and these audits become routine.

Frequently asked questions

How long does the ISO certification process take?

It depends on your size, scope and what you already have in place. At CAW Consultancy we build systems within 48 hours and typically deliver them within 72. After that, you need time to run the system, complete an internal audit and management review, and schedule Stage 1 and Stage 2 with your certification body. Ask the certification body early about its availability.

What is the difference between Stage 1 and Stage 2?

Stage 1 is a readiness review. The certification body checks your documented system, your scope, your understanding of the standard and whether internal audits and management reviews are under way. Stage 2 evaluates whether the system is implemented and effective in practice, through interviews, observation and sampling of records across your operation.

Can you fail a Stage 2 audit?

Not in a simple pass-or-fail sense. Any nonconformities are graded major or minor. Major nonconformities must be corrected, and the certification body must verify the corrective action before certification can be granted. If it can’t verify them within six months of the last day of Stage 2, another Stage 2 audit is needed.

Do I need an internal audit and management review before Stage 2?

Yes, in practice. Under ISO/IEC 17021-1, Stage 1 checks whether internal audits and management reviews are being planned and performed, and Stage 2 reviews both. Both are also requirements of the standards themselves. Certification bodies commonly expect them to have been carried out before Stage 2, so plan them into your timetable.

Who issues the ISO certificate?

A certification body issues the certificate after an independent certification decision. ISO itself doesn’t certify organisations, and a consultancy can’t issue certificates either. For extra assurance, choose a certification body that is accredited, in the UK by UKAS, and check its schedule of accreditation covers your standard and sector.

Start your certification journey with CAW Consultancy

Whether you’re starting from scratch or you’ve been told by a customer that you need certification by a set date, we can help. CAW Consultancy carries out gap analysis, builds your management system, runs internal audits and prepares you for Stage 1 and Stage 2. The certificate itself is issued by your chosen certification body.

Since 2011 we’ve helped thousands of organisations across more than 20 standards, with a 100% audit pass rate over 20+ years, including UKAS-accredited audits. Packages start from £999 ex VAT for a single standard (consultancy only).

Call 01257 824481 or visit www.cawconsultancy.co.uk to get started.