For most Australian SMEs pursuing ISO 9001, certification takes between three and six months from the start of a gap assessment to the issue of a certificate. Other standards take longer — ISO 13485 for medical devices typically takes nine to eighteen months, ISO 27001 six to twelve, and an Integrated Management System combining ISO 9001 and ISO 14001 sits in the six to ten month range. The rest of this article explains exactly what drives those timelines, what happens at each of the six phases, and four specific things you can do to move faster without cutting corners.
The reason most certification timelines are longer than expected is almost never the standard itself. It is one of four variables that most businesses do not account for when they start planning — and which this article will help you get right from the beginning.
ISO certification timelines — quick reference
| Standard | Focus Area | Typical SME Timeline | Main Complexity Driver |
|---|---|---|---|
| ISO 9001 | Quality Management | 3–6 months | Documentation volume; depth of existing process maturity |
| ISO 14001 | Environmental Management | 4–8 months | Environmental aspects identification; baseline data collection |
| ISO 45001 | Work Health & Safety | 4–8 months | Hazard and risk assessment depth; WHS system integration |
| ISO 13485 | Medical Devices | 9–18 months | Regulatory complexity; design control and technical file requirements |
| ISO 27001 | Information Security | 6–12 months | Asset inventory; risk treatment plan; control implementation |
| ISO 50001 | Energy Management | 6–12 months | Energy baseline establishment; metering infrastructure |
| ISO 22000 | Food Safety Management | 6–10 months | HACCP plan development; prerequisite programme documentation |
| ISO 42001 | AI Management Systems | 6–12 months | AI system inventory; impact assessment methodology |
| IMS (9001+14001) | Integrated Management System | 6–10 months | Integration planning; shared documentation; combined audit preparation |
All timelines assume a dedicated internal lead, active engagement with an experienced consultant, and a certifying body booking made at the start of the implementation process. Organisations starting from scratch with no management system documentation should add four to eight weeks to the documentation phase. Organisations with a mature existing QMS may move faster.
What actually determines your timeline — the four key variables
- Your starting point. A business with documented processes, existing SOPs, and some form of quality management — even informal — will move through Phase 2 (documentation) significantly faster than one starting from scratch. The gap assessment in Phase 1 measures this directly. A business that has never documented its processes should expect Phase 2 to take four to eight weeks longer than one that has a working foundation.
- The standard. ISO 9001 has the most widely understood implementation pathway and the most available consulting support. Regulated standards — particularly ISO 13485 for medical devices — carry substantially higher documentation and evidence requirements that extend timelines considerably. See the reference table above for standard-specific ranges.
- Internal resource availability. This is the variable that most businesses underestimate. A dedicated internal lead who can commit 40–50% of their time to the certification project will complete Phase 2 and Phase 3 two to three months faster than a team managing certification as a fragmented side project alongside a full operational workload. If no one can be allocated, factor the extended timeline into your planning.
- Certifying body scheduling. The Stage 2 certification audit requires an on-site visit from the certifying body’s auditor. Lead times for audit scheduling vary — in peak periods, the earliest available slot may be four to six weeks after you request it. Businesses that book the certifying body at the end of Phase 1 — rather than at the end of Phase 4 — reliably save four to six weeks from their total timeline.
The 6-phase certification journey
Phase 1 — Gap Assessment
The gap assessment is the foundation of the entire certification program — and the phase that most businesses either skip, rush, or underinvest in. It is a structured review of your current state against the requirements of the target standard, clause by clause, producing two outputs: a gap report that tells you what is missing, and an implementation roadmap that tells you what to do about it, in what order, and how long it will take.
In practice, a gap assessment involves reviewing your existing documentation, interviewing the people who run your key processes, and mapping the current state against each clause of the standard. For ISO 9001, the assessment typically takes two to three days of structured work and produces a report within one to two weeks. For more complex standards like ISO 27001 or ISO 13485, the assessment itself may take three to four weeks.
Phase 2 — Documentation Development
Phase 2 is typically the most time-consuming phase for businesses starting from scratch. The standard requires a documented management system — policies, procedures, SOPs, record templates, and a set of supporting documentation that demonstrates how the requirements are addressed.
For a business with some existing documentation, Phase 2 typically takes four to six weeks. For a business starting from scratch, six to ten weeks is a more realistic planning assumption. Note that Phase 2 and Phase 3 overlap deliberately — documentation does not need to be fully complete before implementation begins.
Phase 3 — Implementation
Phase 3 is where certification programs most commonly stall — and where the gap between a paper system and a functioning one is exposed. Implementation means embedding the documented management system into actual daily operations: training staff, collecting evidence, and running the documented processes consistently enough to generate a meaningful evidence trail.
Most certifying bodies require a minimum of three months of implementation evidence before conducting a Stage 2 audit. This reflects the reality that a system running for six weeks has not been tested against the full range of operational conditions the business faces.
Phase 4 — Internal Audit
An internal audit is a structured self-assessment of your management system against the standard’s requirements — conducted before the certifying body arrives. It is, in effect, a rehearsal for the Stage 2 audit, conducted by people inside the organisation who have been trained to audit against the standard.
A well-run internal audit typically takes two to three weeks including corrective action closure. The internal audit must be conducted by people who did not write the documents they are auditing — an explicit requirement of most ISO standards.
Phase 5 — Certification Audit (Stage 1 & Stage 2)
The certification audit is conducted in two stages. Stage 1 is a document review, typically conducted remotely over one to two days. Stage 2 is the on-site audit — the auditor spends one to three days reviewing implementation evidence, interviewing staff, observing processes, and checking records. This audit determines certification.
The single most important timeline decision in the entire process: book the certifying body’s Stage 2 slot at the end of Phase 1, not at the end of Phase 4.
Phase 6 — Surveillance & Renewal
ISO certification is not a one-time achievement. It is maintained through a three-year cycle: annual surveillance audits in Years 1 and 2, followed by a full recertification audit in Year 3. Surveillance audits are shorter — typically one to two days — and focus on confirming the management system continues to be actively maintained and improved.
The gap assessment is not overhead — it is the plan. A business that skips it saves two weeks and loses two months. Every hour invested in Phase 1 returns multiples downstream.
Over-documenting is a more common delay than under-documenting. Write processes to the depth the standard requires — not to the depth that feels thorough. The auditor needs evidence, not encyclopaedias.
A management system that exists on paper and is not embedded in practice will fail a Stage 2 audit. Three months of implementation evidence is not a hurdle — it is a minimum meaningful test of whether the system actually works.
Finding a non-conformance in your internal audit is good news — it means you found it before the certifying body did. Treat the internal audit as the most valuable investment of the certification process.
Stage 2 audit availability is the most commonly overlooked bottleneck in certification timelines. Book your certifying body the week your gap assessment is complete — not the week before you want to certify.
Certification is the start of the management system’s working life, not the finish line. The surveillance audit in Year 1 will reveal whether the system was built to operate or built to impress.
This is where the connection to a functioning CI program becomes practical rather than aspirational. ISO 9001 clause 10 explicitly requires continual improvement of the management system — not as a nice-to-have, but as a standard requirement. A business with a working CI rhythm satisfies this requirement as a natural output of its normal operations.
How to move faster without cutting corners
These four tactics consistently shorten certification timelines for Australian SMEs — without compromising the quality of the management system or the integrity of the audit.
- Book the certifying body at the end of Phase 1. Stage 2 audit availability is the most commonly missed bottleneck. Booking early — with a date range based on your Phase 1 roadmap — saves four to six weeks from the total timeline without requiring anything else to change.
- Use a consultant with implementation templates. Building the documentation architecture from first principles adds four to eight weeks to Phase 2. A consultant who brings a pre-built template library converts a design task into a customisation task.
- Assign a dedicated internal lead. A team member who can commit 40–50% of their time to the certification project will move through Phases 2 and 3 two to three months faster than a fragmented team where certification is everyone’s secondary responsibility.
- Do not over-document. Write processes to the minimum depth the standard requires — not to the depth that feels comprehensive. Less, written accurately, is better than more, written vaguely.
What about the cost — a realistic range
The question most businesses ask alongside “how long” is “how much.” The ranges below are indicative and will vary based on your organisation’s size, the standard you are pursuing, and the consultancy partner you engage. Innovengg provides fixed-fee proposals after completing a gap assessment — so the investment is confirmed before any work begins.
| Cost Element | Indicative Range | Notes |
|---|---|---|
| Certifying body fees (Stage 1 + Stage 2) | $3,000–$8,000 | Varies by certification body and organisation size |
| Annual surveillance audit (Years 1 & 2) | $1,500–$4,000 | Per year; required to maintain certification |
| Recertification audit (Year 3) | $2,500–$6,000 | Full audit cycle repeated every 3 years |
| Consultant fees (if used) | $8,000–$30,000 | Depends on scope, starting point, and number of standards |
| Internal time cost | $5,000–$20,000 | Depends on FTE allocation and organisation complexity |
For ISO 9001 in a small to medium engineering or manufacturing business, a realistic all-in investment — certifying body fees plus consultant support plus internal time — typically falls in the $20,000 to $45,000 range. This figure is almost always recovered within the first twelve months through process efficiency gains and the new commercial opportunities that ISO-certified status makes accessible.
A realistic start is better than a perfect plan.
The most common reason ISO certification takes longer than it should is starting later than planned. A free gap assessment with Innovengg will tell you exactly where you stand today, how long your specific certification journey will take, and what it will cost — before you commit to anything. No jargon, no sales pressure, just a clear answer.
Book Your Free Gap Assessment →