ISO Certification in India: ISO 9001 and More, Done Right

ISO certification is a written confirmation, issued after an audit, that your business runs a management system meeting a published ISO standard. The audit checks how you actually work: how you plan, control, record and improve your processes. It does not test a single product.

Three different bodies are involved, and people often mix them up:

ISO says this plainly in its own help note: ISO does not certify companies. So a certificate that says "issued by ISO" or "ISO approved" is a warning sign. A genuine certificate names the CB, its accreditation body, the standard, your scope and your sites.

In short, the process is: you build the system, the CB audits it, and the CB issues a certificate valid for three years, kept alive by yearly audits.

No Indian law makes ISO certification compulsory for businesses in general. It is a voluntary certification. In practice, though, many businesses cannot win work without it. You will usually need it if:

• A government department or PSU tender lists ISO 9001 (or 14001 or 45001) as an eligibility condition.
• A large customer or OEM puts it in the vendor registration form.
• An export buyer asks for it before placing the first order.
• An IT, BPO or SaaS client asks you to prove information security (ISO/IEC 27001).
• You make medical devices. The Medical Devices Rules, 2017 require a quality management system under the Fifth Schedule, and ISO 13485 certification is the usual way to show it to buyers abroad.
• You run a food business supplying to large retailers or exporters, who often ask for ISO 22000 or a similar food safety certificate.

Here is what buyers typically ask for, by type of business:

Size does not matter. A proprietorship, partnership firm, LLP, company, trust or society can be certified, and so can a one-room service business. What matters is that your activities are real and you can show records of them.

There are thousands of ISO standards, but only some are "management system" standards that a CB can certify. These are the ones Indian businesses ask for most:

A closer look at ISO/IEC 27001

The current edition is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four themes: organisational, people, physical and technological. You do not have to apply every control. You assess your information risks, pick the controls that treat them and explain each choice in a Statement of Applicability. The auditor then checks that the chosen controls really work, for example access reviews, backups, supplier checks and incident logs.

ISO 14001 and ISO 45001 in short

ISO 14001 asks you to list the environmental aspects of your work, such as waste, emissions, water and energy, and to control the significant ones. It also checks that you meet environmental laws, like your pollution board consent. ISO 45001 asks you to find workplace hazards, assess risks, involve workers and plan for emergencies. Both expect a register of legal requirements that you review regularly.

ISO 14001, 45001, 27001 and 50001 share the same high-level clause structure as ISO 9001. That is why many businesses run two or three of them as one integrated system with one set of audits. Food businesses still need their FSSAI licence: ISO 22000 does not replace it. See our FSSAI registration page for that part.

ISO 9001 is the most common starting point. The current edition is ISO 9001:2026, published on 16 September 2026, which replaces ISO 9001:2015. Both editions use the same ten-clause layout. Clauses 4 to 10 hold the requirements:

1. Context (clause 4): your business, its interested parties, the scope of the system and your key processes.
2. Leadership (clause 5): the owner or top management sets the quality policy and stays involved.
3. Planning (clause 6): risks, opportunities, quality objectives and planned changes.
4. Support (clause 7): people, skills, equipment, calibration, records and communication.
5. Operation (clause 8): how you take orders, design, buy, produce or deliver, and control faulty output.
6. Performance evaluation (clause 9): monitoring, customer feedback, internal audit and management review.
7. Improvement (clause 10): corrective action and continual improvement.

ISO 9001 is not only for factories. A consultancy, school, travel agency or IT firm applies the same clauses to its own service: how enquiries become orders, how work is planned and checked, how complaints are handled and how staff are trained. Design and development (clause 8.3) can be left out only when you truly do not design anything, and you must explain why.

The standard does not ask for a thick manual. It asks for documented information where it matters, plus records that prove you follow your own rules. A small business can meet it with a short, practical set of documents.

Anyone can register a company in India and call it a certification body. No licence is needed to print a certificate. Accreditation is the only objective check. That is the main point of the NABCB guidance on choosing a certification body (BCB 602).

Here is how the chain of trust works:

• NABCB (National Accreditation Board for Certification Bodies) works under QCI. It accredits CBs operating in India and lists them in its online directory.
• International recognition: NABCB is a signatory to the multilateral recognition arrangements now run by Global Accreditation Cooperation Incorporated (Global ACI). Global ACI took over the work of IAF and ILAC from 1 January 2026. So an accredited Indian certificate is accepted abroad on the same footing as one from other signatory countries.
• Foreign accreditation: some CBs in India hold accreditation from a foreign body. This is valid if that body is a signatory, but NABCB notes that foreign bodies rarely inspect Indian franchisees, so oversight is thinner.

NABCB's guidance also says a CB must not provide consultancy to the same client, and that a scope of accreditation is granted by industry sector. So check that the CB is accredited for your sector, not just for ISO 9001 in general. TaxCaller acts as your consultant only. We never issue certificates, and we keep the CB independent.

Certificates sold as "non-audited", "online in one day" or "no visit needed" for a first certification usually come from unaccredited bodies. Many tender committees and foreign buyers reject them.

Before you pay any CB, and before you trust a supplier's certificate, run these checks:

1. Search the certificate on IAF CertSearch, the global database of accredited certificates, by company name or certificate number.
2. Look up the CB in the NABCB directory (Directory, then Accredited Bodies, then Management Systems) and confirm the standard and sector are inside its scope.
3. Check the CB's own website for a certificate verification page.
4. Match the details: legal name, every site address, scope wording, issue date, expiry date and the edition of the standard.
5. Look for the accreditation symbol next to the CB's own logo. Under NABCB 010, clause 5.3 (May 2026 revision), NABCB-accredited bodies must use the NABCB Accreditation Symbol on their certificates, with effect from 1 July 2026.

Questions to ask a certification body before you sign

• Which accreditation body accredits you, and is my industry sector in your scope?
• Will I get a signed certification agreement and a written quote for the full three-year cycle?
• Will you send an audit plan and the names of the audit team before each audit? (You may object to an auditor with a conflict of interest.)
• Will nonconformities and the audit report be given in writing?
• Will my certificate show both your logo and the accreditation symbol, and appear on IAF CertSearch?

These points come straight from the documents NABCB asks clients to insist on. A CB that cannot answer them clearly is not worth the saving.

Red flags: no accreditation body named, an accreditation body you cannot find in the global list, no audit plan or report, a certificate issued without any audit, or a "marketing agent" who does everything while the CB never contacts you. If you doubt a certificate, NABCB accepts complaints and has run validation visits at certified sites.

ISO is about how your business is managed. It is not a licence to trade. Before spending on it, make sure your basic registrations are in place, because a CB will ask for them. Our business licences guide shows which registrations each type of business needs.

• BIS (ISI mark) is different: products under a Quality Control Order need BIS product certification. An ISO certificate does not satisfy a QCO.
• ZED is different: the MSME Sustainable (ZED) certification is a government scheme for MSMEs. It is independent of ISO and you may hold both.
• FSSAI is different: a food licence is a legal must. ISO 22000 is voluntary on top of it.

If a buyer or tender has asked for ISO, or you want a working quality system, ISO is the right step. If you only need a certificate to show, with no system behind it, the surveillance audits will expose that within a year.

The real value comes from both the certificate and the system behind it:

• Government tenders: many central, state and PSU bids list an ISO certificate as a qualifying condition. Missing it can knock you out at the technical stage.
• GeM: registering as a seller on GeM does not need ISO, but buyers can add certification conditions to a bid. A valid accredited certificate keeps you eligible for more bids.
• Exports: foreign buyers use accredited certificates to shortlist suppliers they have never visited. Pair it with your IEC registration.
• Bigger customers: OEMs, hospitals, banks and IT clients often ask for 9001, 13485 or 27001 in vendor audits.
• Fewer mistakes: clear procedures, trained staff and corrective action reduce rework and complaints.
• Owner freedom: when processes are written down, work does not stop when one person is absent.
• Data protection: ISO/IEC 27001 helps show the reasonable security safeguards that Section 8(5) of the Digital Personal Data Protection Act, 2023 expects from data fiduciaries.

There are two kinds of documents: business records that prove who you are, and system documents that prove how you work. You give us the first set. We draft the second set with you.

Business documents you provide

• Proof of the business: certificate of incorporation, LLP certificate, partnership deed, or proprietor's PAN and Udyam certificate
• PAN of the business and GST certificate, if registered
• Address proof of every site to be covered (rent agreement, sale deed or utility bill)
• List of products or services, main processes and any outsourced work
• Headcount at each site and shift pattern (the CB uses this to set audit days)
• Licences that apply to you: factory licence, pollution consent, FSSAI, CDSCO, trade licence
• Existing SOPs, checklists, formats or records, if any

System documents we prepare with you

• Scope statement and process map
• Policy (quality, environment, safety or security) and measurable objectives
• Risk and opportunity register (aspects register for 14001, hazard register for 45001, risk assessment and Statement of Applicability for 27001)
• Key procedures and work instructions
• Record formats: training, supplier evaluation, calibration, complaints, nonconformity and corrective action
• Internal audit report and management review minutes

We handle the consulting and paperwork online. The CB's audit is done by the CB, on your premises or remotely as it decides. This is the path we follow:

1. Free first call: we confirm why you need ISO, which standard, how many sites and staff, and any tender deadline.
2. Gap analysis: we compare your current way of working with each clause and give you a short gap list.
3. Documentation: we draft the policy, objectives, procedures and formats to fit your real work. No copy-paste manuals.
4. Implementation: your team starts using the formats. We train key staff online so that they can answer the auditor.
5. Internal audit: we audit the full system against the standard and record findings.
6. Management review: the owner or top management reviews results, risks and objectives. We prepare the agenda and minutes.
7. Choosing the CB: we help you compare written quotes from accredited CBs and check their scope. You sign the contract directly with the CB and pay it directly.
8. Stage 1 audit: the CB reviews your documents and readiness.
9. Stage 2 audit: the CB checks that the system works in practice.
10. Closing findings: we help you answer any nonconformities with root cause and corrective action.
11. Certificate: the CB's decision maker reviews the audit and issues the certificate.

What we need from you: one coordinator in your team, about two to four hours a week during the project, access to your current records, and the owner's time for the policy, objectives and management review. Everything else, from drafting to audit preparation, is our job.

After that, we remind you before each surveillance audit and help you keep records up to date.

For a first certification, ISO/IEC 17021-1 (the rulebook that CBs follow) requires a two-stage initial audit.

Findings come in two levels. A major nonconformity means a requirement is missing or failing in a way that affects results. The CB will not certify until it is closed, sometimes with a follow-up visit. A minor nonconformity is a smaller lapse. You submit a correction plan and the CB checks it later. Most first audits raise a few minors, which is normal.

Time depends mostly on how ready your business already is, and on the CB's audit calendar. These are typical ranges we see for a small or medium business with clean cooperation:

What speeds things up: a named coordinator, quick replies on drafts, existing SOPs or registers, and booking the CB early. What slows things down: owners who cannot spare time for the management review, records that start only a week before the audit, missing legal licences, and a CB with no free audit slot near your deadline.

So a small ISO 9001 project usually takes about 6 to 12 weeks from start to certificate. ISO/IEC 27001 and integrated systems take longer, often 3 to 6 months, because the risk assessment and controls need more evidence. If someone promises a certificate in one or two days with no audit, it is not an accredited certificate.

There is no government fee for ISO certification. Your total cost has three parts:

1. Certification body fee: for Stage 1, Stage 2, the certificate and the yearly surveillance audits. You pay this directly to the CB.
2. Consultant fee: for gap analysis, documents, training and internal audit. This is TaxCaller's part.
3. Your own costs: staff time, calibration of instruments, safety equipment or IT tools, if the gap analysis shows they are missing.

The CB fee is mainly driven by audit days. CBs work these out from accreditation rules, such as IAF Mandatory Document 5 for 9001, 14001 and 45001, using:

• effective number of employees, including contract staff and shifts
• number of sites and how far apart they are
• the standard, and whether you combine several standards
• risk and complexity of your activities
• the auditor's travel and stay

Multi-site and integrated audits

If you have several branches doing the same work under one central office, accreditation rules allow the CB to audit a sample of sites rather than every one. This can cut audit days. If you take two or three standards together, an integrated audit usually needs fewer days than separate audits, because records like training, internal audit and management review are checked once. Ask the CB to quote both ways.

Because these vary so much, we do not publish a CB fee. Ask each CB for a written quote that shows the initial audit, each surveillance audit and the recertification audit separately, plus GST and travel. Then compare like with like. A very low quote with no surveillance plan is a red flag.

TaxCaller's fee starts at ₹3,999 + GST. It covers consulting and documentation as per the plan you choose. The certification body's audit fee is paid separately at actual, directly to the CB, against its written quote. There is no government fee for ISO certification.

We confirm the scope and our fee in writing before you pay. You can choose any accredited CB you like. If you plan to claim the ZED support explained below, keep the CB invoice in the business name.

Many websites still quote an old central scheme that repaid 75% of ISO certification charges, up to ₹75,000, for small enterprises. We could not find it among the central schemes running today. The Ministry of MSME also said in an August 2021 circular that its CLCS-TUS scheme for technology and quality upgradation is no longer in operation; it ran until 31 March 2020. The CLCS-TUS circulars are on the DC (MSME) website. Do not budget for the old reimbursement unless your MSME-DFO confirms it in writing.

The live central route today is the MSME Sustainable (ZED) Certification Scheme. According to the scheme guidelines and the QCI ZED FAQs:

• The QCI FAQs describe the scheme for Udyam-registered manufacturing MSMEs, so check that your unit is covered before you plan around it.
• ZED has three levels: Bronze, Silver and Gold, with certification costs of ₹10,000, ₹40,000 and ₹90,000.
• The government pays 80% of that cost for micro, 60% for small and 50% for medium enterprises, with extra support for women-owned units and units in special regions.
• After you achieve a ZED level, you can claim support of 75% of the cost of one testing, management system or product certification, capped at ₹50,000.
• The management system certificate must come from a NABCB-accredited CB, and only certification charges count, not consultancy fees.

How an MSME uses ZED for its ISO certificate

1. Register on the ZED portal with your Udyam number and take the ZED pledge.
2. Achieve a ZED certification level. Bronze is the entry level.
3. Get your ISO certificate from a NABCB-accredited certification body, with the invoice in the business name.
4. Apply for the support on the ZED portal with the certificate and invoice, as per the process shown there at that time.

If you take ISO first and ZED later, the FAQs say reimbursement is open only after a ZED level is achieved, so plan the order with us before you pay the CB.

You need Udyam registration to join ZED. If you do not have it yet, see our MSME registration service. Some states also run their own quality certification incentives under their industrial policies; check your state's current policy before you claim.

The certificate is valid for three years, but only if you keep passing the audits in between. Under ISO/IEC 17021-1, clause 9.1.3, the three-year cycle includes:

• Surveillance audit 1: no later than 12 months from the certification decision.
• Surveillance audit 2: in the second year. Surveillance audits take place at least once each calendar year, except in the recertification year.
• Recertification audit: in the third year, before the certificate expires.

Surveillance audits are shorter. The auditor samples parts of the system, checks complaints and corrective actions, and looks at changes. To stay ready:

• Run one internal audit and one management review each year.
• Keep records live, not written the week before the audit.
• Tell the CB about changes in name, address, sites, scope or ownership.
• Use the CB's certification mark only as its rules allow. Never print the ISO logo itself, and never put a system certification mark on a product as if the product were tested.

Changing the CB, adding a site or adding a standard

You can move a valid accredited certificate to another accredited CB. The new CB reviews your certificate, past audit reports and open findings before it takes over. A suspended certificate cannot be moved this way. To add a new site, product line or standard, ask the CB for a scope extension. It may combine the extra audit with your next surveillance visit to save cost.

If you skip a surveillance audit or fail to close a major finding, the CB can suspend or withdraw the certificate. A withdrawn certificate is no longer valid, and a check with the CB or on IAF CertSearch will not show it as a valid certificate.

Not having ISO is not an offence. Claiming ISO when you do not have a valid certificate is a different matter:

The simple fix is to quote only the exact scope on your valid certificate, update marketing material when a certificate lapses, and keep the surveillance calendar.

• Buying a certificate, not a system: unaccredited "instant" certificates fail tender checks and leave you with nothing to show a buyer.
• Wrong CB scope: the CB is accredited, but not for your industry sector.
• Copied manuals: documents from another company that do not match your work. Auditors spot this in minutes.
• Scope too wide or too narrow: leaving out the site the tender cares about, or adding activities you do not perform.
• No records: procedures exist, but there is no proof they were followed.
• Skipping the internal audit or management review: the CB will not move to Stage 2 without them.
• Owner not involved: leadership is a clause of its own, and the auditor will talk to top management.
• Uncalibrated instruments: a common finding in manufacturing and labs.
• Legal licences missing: a lapsed factory licence, pollution consent or FSSAI licence becomes a finding under 14001, 45001 or 22000.
• Forgetting surveillance: the certificate gets suspended mid-way through a tender.

Transition: a three-year transition is expected for ISO 9001, so ISO 9001:2015 certificates should stay valid until about September 2029. The final dates come from Global ACI and each CB. Some CBs plan to stop new 2015-edition audits well before the end. If you are starting now, ask your CB whether it can audit you to the 2026 edition, so you do not need a transition audit later.

Note also that ISO/IEC 27001:2013 certificates stopped being valid after 31 October 2025. Any 27001 certificate shown to you now should be to the 2022 edition.

TaxCaller has served businesses since 2018 from our office in Ghaziabad, and we work online across India. For ISO, that means:

• Independent advice: we are consultants, not a CB. You pick any accredited CB and pay it directly.
• Accreditation check first: we verify the CB's accreditation and sector scope before you sign.
• Documents that fit: written for your actual processes, in simple language your staff can follow.
• Fee told upfront: our fee + GST in writing; the CB's fee shown separately.
• One team for compliance: the same experts can handle the registrations a CB or buyer will ask for.

Our consulting work is fully online, so location does not limit you. Whether the CB audits on site or remotely is the CB's decision. Clients in Ghaziabad, Noida and Delhi can also meet our team at our Ghaziabad office by appointment.

Related services: MSME (Udyam) registration for ZED support, IEC registration for exporters, FSSAI registration for food businesses, GST registration, company registration, trademark registration and Startup India registration. See all licences on our business licences page, or contact us to book a call.