Get ISO Certification in India: 7 Steps (2026)

Step 1: Pick the right standard

Most Indian companies start with ISO 9001 (quality) because tenders, OEMs and export buyers ask for it first. Manufacturing plants usually add ISO 14001 (environment) and ISO 45001 (occupational health and safety) as an integrated system, since one combined audit costs 20–30% less than three. Food businesses need ISO 22000 or HACCP, IT and SaaS firms ISO 27001, medical device makers ISO 13485, and automotive suppliers IATF 16949.

If a specific customer or tender is driving the requirement, read their clause. "ISO certified" in a GeM bid or a PSU tender almost always means ISO 9001 from an IAF-accredited body; some OEM supplier codes name the exact standard and even the accreditation.

Step 2: Gap assessment

A consultant visits the site (or reviews remotely for service firms) and maps what you already do against every clause of the standard. The output is a gap report: which processes exist, which documents are missing, and which practices must change. For a 30-person unit this takes one to two days.

This step sets the real timeline. A plant with working procedures and records closes gaps in four weeks; one running on verbal instructions needs eight to ten.

Step 3: Documentation

ISO 9001:2015 requires a defined scope, a quality policy, objectives, and the "documented information" each clause names — control of documents, records of training, calibration, supplier evaluation, internal audit and management review. It does not require a quality manual any more, though most certification bodies still like to see one.

The consultant drafts these to fit your processes; you review and adopt them. Templates copied from the internet are the single most common reason for non-conformities at audit, because the auditor checks that what is written is what happens.

Step 4: Implementation and training

Over four to six weeks the documented system is run: records are kept, objectives measured, suppliers evaluated, calibration done. Staff are trained on the parts that touch their work — a shop-floor operator needs to know the work instruction and the record, not the standard.

An auditor expects at least two to three months of records for ISO 27001 and about one month for ISO 9001 before the certification audit. Starting record-keeping in week one is what keeps the programme short.

Step 5: Internal audit and management review

Before the certification body arrives, your own trained internal auditor (or the consultant) audits every clause and raises non-conformities, which are closed with corrective actions. Top management then holds a management review covering audit results, customer feedback, objectives and resources. Both are mandatory and both will be checked.

• Internal audit report with findings and closure evidence
• Management review minutes signed by top management
• Corrective action log

Step 6: Certification audit (Stage 1 and Stage 2)

The certification body conducts Stage 1 — a document and readiness review, often remote — and Stage 2, the on-site audit of implementation. Audit man-days are fixed by IAF MD 5 from your headcount: a 25-person company gets about 2 man-days of Stage 2, a 100-person plant 4–5.

Minor non-conformities are closed with a corrective action plan within 30 days; a major one needs a follow-up visit. The auditor recommends certification; the body's independent reviewer issues the certificate, usually within two to three weeks of closure.

Step 7: Certificate, surveillance and recertification

The certificate is valid for three years. Surveillance audits at 12 and 24 months are shorter (about a third of the initial audit) and confirm the system is still running. Recertification in year three repeats a full audit. Miss a surveillance window and the certificate is suspended, then withdrawn — buyers check the status on the certification body's register.

Who can issue an ISO certificate in India?

ISO itself issues nothing. Certificates come from certification bodies accredited by a member of the IAF multilateral arrangement: NABCB (India), UKAS (UK), JAS-ANZ (Australia/NZ), ANAB (US), DAkkS (Germany) and others. An accredited certificate carries the accreditation body's mark and can be verified on the IAF CertSearch database.

Unaccredited "certificate mills" sell certificates for ₹5,000–₹10,000 with no audit. They are rejected by PSU tenders, by every automotive and pharma OEM, and by export buyers who verify on CertSearch. If a quote has no audit day in it, it is not a certification.

How long does it take?

Micro and small units: 6–10 weeks from gap assessment to certificate. Medium multi-site companies: 3–4 months. ISO 27001 takes 3–5 months because of the evidence period. Fast-track programmes that promise 7 days exist only with unaccredited bodies.

MSME reimbursement

Registered MSMEs can claim 75% of certification cost (up to ₹75,000) under the Ministry of MSME ISO reimbursement scheme for ISO 9001, 14001 and HACCP, subject to the scheme being open in the current financial year and the certificate coming from an NABCB-accredited body. Check the scheme status on msme.gov.in before you budget around it.