ISO 9001 Certification Steps: Checklist from Gap Analysis to Stage 2

Where do you start an ISO 9001 certification?

With four decisions, before any writing: the target edition, the provisional scope, the project manager and the real date required by the customer. The edition is ISO 9001:2026, published on 16 September 2026: according to Global ACI, the body that took over the work of the International Accreditation Forum (IAF), no initial certification to the 2015 edition will be issued after 31 March 2028. The reasons and the special cases are explained in our article on a first ISO 9001 certification since the 2026 edition.

Before the gap analysis:

• The official text of ISO 9001:2026 has been bought and read by the project manager.
  
• Management has announced the project to supervisors, with the deadline and the project manager’s name.
  
• The provisional scope is written: activities, sites, construction projects or field jobs, outsourced activities.
  
• The intended process owners have been told and have time reserved.
  
• Existing documents are gathered: organisation chart, job descriptions, standard contracts, procedures, complaint logs.
  

What are the ten steps, and what must each one produce?

Ten steps, each with a deliverable the auditor may ask for. The order matters: documentation written before the process map almost always has to be redone.

An optional step fits between steps 7 and 8: the mock audit, run under certification audit conditions. The overall journey, from scoping to maintaining the certificate, is described in our guide to ISO 9001 certification in Morocco.

What evidence should you gather at each step?

The evidence that shows the system works, not just that it is written. The lists below are the ones we use in our assignments.

Gap analysis, context and scope (steps 1 and 2)

• An order, a complaint and a purchase followed end to end during the gap analysis.
  
• Dated internal and external issues, climate change included (relevant or not, with a justification).
  
• Interested parties and their requirements: customers, main contractors, authorities, staff.
  
• A scope written in the customer’s vocabulary, with non-applicable requirements justified.
  

Processes and documented information (steps 3 and 4)

• A one-page process map, approved by management, with a named owner for each process.
  
• For each process: inputs and outputs, risks, opportunities, indicators.
  
• A quality policy that refers to the company’s context and strategy.
  
• Measurable objectives, cascaded by process, each with a deadline.
  
• A master list of documents, and work instructions in the operators’ language.
  

Putting the system into operation (step 5)

• Indicators measured over several months and discussed in meetings.
  
• Complaints and nonconformities recorded, with root cause analysis when they recur.
  
• Suppliers and subcontractors evaluated against written criteria.
  
• Competence proven: training, authorisations, assessments.
  
• At least one planned change with its effectiveness criterion, its communication and its review (clause 6.3).
  

Internal audit and management review (steps 6 and 7)

• An audit programme that covers all processes in scope, built on the ISO 19011 guidelines.
  
• Trained auditors who do not audit their own work.
  
• Reports with precise findings, not “nothing to report”.
  
• A management review that addresses each input of clause 9.3.2, including changes in the expectations of interested parties.
  
• Review decisions with an owner and a date.
  

Training your internal auditors on your own processes is part of our ISO standards training domain.

Application to the certification body (step 8)

The application questionnaire is used to calculate audit time under document Global ACI-TECH-3-004. The headcount retained includes permanent, temporary and part-time staff within the scope, shift teams included. For activities organised in shifts, at least one shift must be audited, and the choice not to audit the others must be justified.

• A documented headcount, with part-time staff converted into full-time equivalents.
  
• The list of permanent sites, temporary construction projects or field jobs, and outsourced activities.
  
• Working hours and shifts, so that the auditor sees the real work.
  
• Working languages: an interpreter, if one is needed, lengthens the audit.
  
• The audit time retained and its justification, which the certification body must give you with the contract.
  
• Written confirmation of the body’s transition to ISO 9001:2026.
  

In Morocco, the lists of certification bodies accredited by SEMAC (Service Marocain d’Accréditation, the Moroccan Accreditation Service) to NM ISO/IEC 17021-1 are published by the Ministry of Industry and Trade.

Stage 1 (step 9)

• Up-to-date documents, accessible on the day, on paper or on screen.
  
• Evidence of the internal audit cycle and of the management review.
  
• The site in operation, so that the auditor can assess site-specific conditions.
  
• Each point raised at stage 1 entered in an action plan, with an owner.
  

Stage 2 (step 10)

According to Global ACI, stage 2 normally lasts longer than stage 1. It is decided on the shop floor.

• An audit plan circulated to process owners, with their time slots reserved.
  
• Workshops, warehouse or construction projects in operation, not shut down for the occasion.
  
• One guide per auditor, a room, access to records.
  
• Top management present at the opening and closing meetings and for the interview on leadership and quality culture.
  
• Findings noted as the audit goes, to prepare the response as soon as it closes.
  

How do you respond to stage 2 nonconformities?

By separating three things: the correction, which removes the gap found; the root cause analysis, which explains why it happened; the corrective action, which prevents it from happening again. A response that contains only the correction will be rejected.

The certification body grades findings as major or minor nonconformities and sets the response deadline. A major nonconformity blocks the certification decision until the body has verified the correction and the corrective action; for a minor one, it generally reviews and accepts a reasoned action plan.

Which mistakes make a first certification fail?

Almost all of them have the same cause: a system written for the audit rather than for the work. The ten we see most often:

1. Writing before mapping. Procedures describe the organisation chart, not the path of an order.
2. Choosing a scope that does not answer the customer. The certificate is valid, but it does not cover the service the customer buys.
3. Targeting the 2015 edition to go faster. The system will have to be reworked before 30 September 2029, and a stage 2 that slips past 31 March 2028 can no longer be certified to that edition.
4. Leaving the quality manager alone. If process owners cannot explain their processes, the auditor sees it from the first interview.
5. Creating indicators in the month of the audit. Values with no history prove nothing.
6. Having processes audited by their own owners. The internal audit loses its independence and its value.
7. Treating the management review as a formality. Minutes that skip an input of clause 9.3.2 are an easy finding.
8. Understating headcount in the application. Audit time is recalculated and the schedule slips.
9. Ignoring the stage 1 points. They come back at stage 2 as nonconformities.
10. Correcting without analysing. A response to findings without a cause or a corrective action is rejected, and the certification decision waits.

To estimate the time and budget for each step, see our article on ISO 9001 certification cost in Morocco.