The certification audit is the moment when an independent body confirms that your quality system meets the requirements of ISO 9001. For an SME it is not an exam to be passed at the last minute, but the end point of work that should already be visible: context, objectives, processes, internal audits and management review. This guide explains how a certification works, what to look for when choosing a body, what changes with the new 2026 edition and how to prepare. The text of the standard is not reproduced.
Certification, accreditation and voluntariness
Whether a company is certified to ISO 9001 is its own decision. ISO states that organisations applying the standard can choose whether to seek certification. A certificate from an accredited body creates additional trust, it says, because accreditation independently confirms the body’s competence.
The Swiss Accreditation Service (SAS, part of SECO) explains the difference: certification confirms that a system meets specified requirements; accreditation confirms the competence of the body that certifies. According to the SECO SME portal, in Switzerland only the SAS grants internationally and nationally recognised accreditations for certification bodies. Bodies for management systems are called SCESm there and work to the standard ISO/IEC 17021-1. Without accreditation, according to the SAS, interested parties have to rely on the body’s own statement.
Check a certificate or the body of your choice against the information that, according to the SAS, must appear on every certificate, among other things: identification number, name and address of the body, name and address of the certified organisation and, for accredited certification, also the accreditation symbol with number. With this information you can ask the body or the SAS whether the certificate is valid. Also note the separation of consulting and certification: according to the SAS questions and answers, an organisation may not offer consulting if it or parts of it certify. We do not name bodies here; the SAS keeps the directory of accredited bodies.
Process: stage 1, stage 2, surveillance, recertification
The SECO SME portal describes the framework: the initial certification audit is followed, at periodic, mostly annual intervals, by surveillance audits during the validity of the certification. If the certification is to continue beyond that, it must be renewed by a recertification audit before it expires. Certificates are time-limited; an SNV notice from 2024 speaks of a usual three-year certificate validity cycle. The body sets the exact duration.
| Step | Purpose | Source |
|---|---|---|
| Stage 1 | Preliminary visit: overview, maturity and planning of stage 2 | APG; SAS document 506 (clause 9.3.1.2 of ISO/IEC 17021-1) |
| Stage 2 | the actual certification audit | SAS document 506 (clause 9.3.1.3) |
| Decision of the body | Grant, maintain, suspend or withdraw | SAS, SCESm page |
| Surveillance audits | mostly annual during validity | SME portal |
| Recertification | Renewal before expiry | SME portal |
The Auditing Practices Group (APG, an informal group of experts from ISO/TC 176 and the International Accreditation Forum IAF; its papers are not formally endorsed by ISO and IAF) describes stage 1 as a preliminary visit that serves mainly to define and plan stage 2 and to assess whether the organisation is ready for certification. It does not expect formal planning or a report for it. If a shortcoming shows up, the body should communicate it formally so that you can remedy it before stage 2. Two stages are not necessary for every later certification audit; in the event of significant changes a full or partial stage 1 may make sense.
How much time the body uses is not laid down across the board. According to the SAS information sheet, the body must determine and justify the time required for each customer according to documented rules; for quality management systems, IAF requirements (MD 5) apply. Ask in the quote how the body calculates the effort for you.
Transition to ISO 9001:2026
ISO 9001:2026 was published on 16 September 2026. For the transition, ISO/TC 176 gives the following dates in a notice of 23 September 2026: accreditation bodies must be ready by 31 March 2027 at the latest to assess against the new edition; certification bodies submit their transition declaration by 30 June 2027; from 31 March 2028, new and initial accredited certifications may be issued only to ISO 9001:2026; those certified to the 2015 edition have until 30 September 2029 and can switch in a surveillance or recertification audit or in a separate transition audit. The page points out that it is maintained by third parties.
Practice, not normative: ask your body which edition it already audits to today. On its page for management systems the SAS lists transition rules for individual standards; for ISO 9001 no such document was listed there on 27 October 2026, while for ISO 14001 one dated 9 October 2026 was available.
What stage 1 looks at: your preparation
The APG list for stage 1 is a usable preparation list: the management system must be documented (the guide Quality manual: structure and content for SMEs helps) and applied; sites and responsible people are discussed; it is assessed whether you understand the requirements, in particular metrics, processes, objectives and how the system is operated; the scope, processes and sites as well as legal requirements are surveyed; and it is assessed whether internal audits and management reviews are planned and carried out and whether the degree of implementation demonstrates readiness for stage 2. Do this work before the preliminary visit, not after.
Pay attention to the certification scope. According to the APG it appears on the certificate, is derived from the scope of your system and must be clear and not misleading; it may be smaller than your system. Customers should be able to read from it what is certified.
Practical example: Muster Präzision AG
Muster Präzision AG is a fictitious precision engineering company with 28 employees. In the plan it enters 3 November 2026 as the start and the certification audit (stage 2) on 14 June 2027 as the target date, so 223 days of preparation. QMS | base spreads the due dates proportionally over nine phases:
| Phase | Due by |
|---|---|
| Foundations | 25.11.2026 |
| Policy and objectives | 18.12.2026 |
| Processes | 31.01.2027 |
| Documents | 06.03.2027 |
| Risks and opportunities | 28.03.2027 |
| Operations: reports and actions | 19.04.2027 |
| Internal audit | 18.05.2027 |
| Management review | 03.06.2027 |
| Certification audit | 14.06.2027 |
On 12 January 2027 the plan shows “24 % met”, with 153 days to go. The Foundations phase is done and the quality policy is approved, but one of the two objectives still has no actual value. For that reason the Policy and objectives phase is overdue, and Processes is at “Later”. The person responsible enters the missing value and chooses the body in January; in the plan the body can be entered at any time, not only in the last phase. In March the gap report shows six of 52 applicable clauses without evidence, including one on measuring equipment; the link leads straight to that area. For stage 1 the quality manager gives the audit lead of the body access for 30 days, limited to documents, processes, objectives and internal audits.
Checklist
- The body is accredited (SAS directory checked) and does not offer consulting at the same time.
- Time required and quote are comprehensible, the edition of the standard is clarified.
- Scope and certification scope are worded clearly and not misleadingly.
- Policy, objectives, processes and documents are controlled and communicated.
- At least one internal audit is planned, better still carried out, and nonconformities are being dealt with.
- The management review is planned, better still carried out.
- Legal requirements for operations are surveyed.
- Documents for stage 1 are ready (manual, evidence, reports, action list).
- Access for the body is time-limited and restricted to certain areas.
- After the certificate, surveillance audits and recertification are in the calendar.
How KMU | base helps
QMS | base guides you through the preparation with its own criteria. The check points are orientation aids, not text of the standard; the standard and your certification body are authoritative. QMS | base does not issue certificates and does not send requests.
Path to certification. On the QMS overview, the Path to certification button (for people with the right for reports and certification status) opens a plan up to the certification audit in nine phases, with target date, due dates and status from your data. “Now” leads straight to the open task. Without a plan of your own, the system suggests an audit in 90 days; the target date may be at most two years after the start.
Gap report on standard clauses. On the same page it shows all applicable clauses of the standard without evidence and leads to the area where you create the evidence. You create the evidence report per standard as a PDF with coverage, assessment, evidence and open gaps in the Standard mapping (evidence report per standard).
Certification readiness. Under Management system › Reports and certification status you see 14 check points from context to coverage of the standard, each “evidenced”, “not met”, “not checked” or “not applicable” with a reason (certification readiness with gap list). Missing data never counts as met. The thresholds are the software’s own criteria, for example at least three context issues, three processes, 90 per cent read acknowledgements, 80 per cent coverage of the standard and one internal audit and one management review in the last twelve months. They do not come from the standard.
Body, request, certificate. Under Management system › Audits › Certification you maintain your certification bodies with accreditation and standards, create a planned external audit and prepare the email in your mail program (certification bodies and audit request). You record the certificate number and expiry date in the report of the external audit; 90 days before expiry a warning appears (certificate with expiry warning).
Access and package. Auditors receive time-limited read access without an account, only for the areas chosen (access for the certification body). Every access is logged and the access can be blocked at any time; it is valid for 90 days at most, and the link is visible only when it is created. The audit package bundles the manual, evidence report, latest approved management review, reports of internal audits (the most recent ten) and the action list as a ZIP; parts for which you lack the right are left out.
Limits you should know about:
- The audit package is also produced incomplete: parts that are missing or for which you lack the right are left out, without an error message. Check the contents before you pass it on.
- Readiness measures your status against the software’s criteria; it replaces neither stage 1 nor the decision of the body.
- The plan does not force a sequence; the body belongs to the last phase but can be entered earlier.
- The software does not check whether the body is accredited. You ask the SAS about that.
The guide to QMS | base explains how to use it. Take a look at the demo or open a trial account. If you have questions, the contact page will help. You will find the terms under Pricing.
Sources
- ISO: ISO 9001:2026, Quality management systems – Requirements (Edition 6, published on 16.09.2026), accessed 27.10.2026.
- ISO/TC 176: ISO 9001:2026 has been released!, news of 23.09.2026, accessed 27.10.2026. The page points out that it is maintained by third parties.
- ISO 9001 Auditing Practices Group: Guidance on Two stage initial certification audit (Edition 1, 13.01.2016; not endorsed by ISO and IAF), accessed 27.10.2026.
- ISO 9001 Auditing Practices Group: Guidance on Scope and applicability (Edition 3, 01.12.2023), accessed 27.10.2026.
- Swiss Accreditation Service SAS (SECO): Certification body for management systems SCESm, accessed 27.10.2026.
- SAS (SECO): Frequently asked questions regarding accreditation, accessed 27.10.2026.
- SAS (SECO): Information sheet on determining the duration of a certification audit for management systems (document 526, Rev. 02, December 2018; in German), accessed 27.10.2026.
- SAS (SECO): Reference document for ISO/IEC 17021-1:2015 (document 506, Rev. 14, April 2024; in German; only the structure of the standard in clauses 9.3 and 9.6), accessed 27.10.2026.
- SECO SME portal: Bodies that carry out audits and certifications (in German), accessed 27.10.2026.
- SNV: Revision of ISO 9001 and 14001 – what changes for companies? (in German; notice on the information event of 8 March 2024; reference to the three-year validity cycle), accessed 27.10.2026.
The tables, examples and recommendations marked “practice” are editorial aids, not text of the standard. This guide does not replace legal or tax advice. Information as at 27 October 2026.