ISO certification is not a registration and it is not issued by the government. It is a third-party audit of your management system against an international standard, carried out by a certification body. Regikart does not issue ISO certificates, and no consultant can. We act as implementation and documentation consultants and coordinate the audit with an accredited certification body, which is the only entity that can certify you.
Reviewed by the Regikart team · Last updated 24 September 2026
Gap analysis from
₹999 plus GST, audit fee separate
ISO certification
Tenders, enterprise contracts, export supply chains
Timeline
Three year certificate cycle
An accredited certificate comes from a certification body that is itself accredited by an accreditation body inside the Global Accreditation Cooperation Multilateral Recognition Arrangement, which from 1 January 2026 covers the scopes previously recognised under the IAF MLA and the ILAC MRA. In India that accreditation body is NABCB, an autonomous body set up by the Ministry of Commerce and Industry under the Quality Council of India. Accredited certificates are recognised internationally and by tender authorities. A non-accredited certificate comes from a body accountable to nobody. They are cheap, they arrive in days, and they are rejected when anyone checks.
Accreditation
The certification body is itself assessed by an accreditation body inside the Global Accreditation Cooperation Multilateral Recognition Arrangement. In India that is NABCB, under the Quality Council of India. Accreditations already issued under the IAF MLA and the ILAC MRA continue to be recognised.
Stage 1 and Stage 2 audits
Stage 1 reviews documentation and readiness; Stage 2 is the on-site audit of implementation.
Surveillance audit
Conducted annually in years one and two of the three-year certificate cycle. The first is due not more than 12 months after the certification decision date.
Non-conformity closure
Corrective actions for findings raised at audit, closed before the certificate is issued.
The distinction that decides whether the certificate is worth anything.
ISO writes the standards. It does not certify anyone, and it does not let anyone put its logo on a certificate.
ISO's own position is short: it does not perform certification or issue certificates, and it does not permit anyone to use the ISO logo in connection with certification. Certification is performed by external certification bodies, so a company or organisation cannot be certified by ISO.
Three consequences follow, and they decide whether your certificate is worth anything.
ISO's own advice when you choose a body is to evaluate several of them, check that the body uses the relevant CASCO standard, and check that it is accredited. We do all three before we put a body in front of you.
Check the accreditation, not the certificate. A convincing PDF costs nothing to produce.
| What to check | Where to check it | What a pass looks like |
|---|---|---|
| Is the certification body accredited | NABCB, the Indian accreditation body under the Quality Council of India, publishes the bodies it accredits | The body appears on the accreditation body's list, for the specific standard and scope you need |
| Is the accreditation body itself recognised | Global Accreditation Cooperation Incorporated, which from 1 January 2026 carries the scopes previously recognised under the IAF MLA and the ILAC MRA | The accreditation body is inside that arrangement, so the certificate travels internationally |
| Does the certificate itself exist | The certification body's own register, and the certificate search run under the accreditation arrangement | The certificate number, the scope, the sites and the expiry date all match the PDF you were given |
| Is the scope the scope you need | The scope line on the certificate | It names the activity and the site your customer is buying from, not a holding company or a different unit |
| Is it in date | The expiry date and the surveillance history | Within the three year cycle, with surveillance audits actually done |
Two smaller tests catch most fakes. A certificate issued without anyone visiting your premises cannot have come from a stage 2 audit, because stage 2 is an on-site audit of implementation. And a certificate that arrives in a week has not had a management system run long enough to produce records for an auditor to look at.
Most Indian buyers and tender authorities ask for ISO 9001. Enterprise software and services contracts increasingly ask for ISO/IEC 27001 instead, or as well.
| Standard | Current edition | What it covers | Who usually needs it |
|---|---|---|---|
| ISO 9001 | 2026, published 16 September 2026 | Quality management system | Most tenders, manufacturing, engineering, services, anyone whose customer asks for ISO certification without naming a standard |
| ISO 14001 | 2026, published 15 April 2026 | Environmental management system | Manufacturing, construction, chemicals, exporters whose buyers run environmental screening |
| ISO 45001 | 2018 | Occupational health and safety management | Construction, plant and factory operations, contractors on industrial sites |
| ISO/IEC 27001 | 2022 | Information security management | IT and software companies, BPO and KPO, fintech, anyone handling enterprise or overseas customer data |
| ISO 22000 | 2018 | Food safety management | Food processing, packaging, catering, cold chain, alongside an FSSAI licence |
| ISO 13485 | 2016 | Medical devices, quality management for regulatory purposes | Medical device manufacturers, importers and their contract manufacturers |
| ISO 50001 | 2018 | Energy management | Energy-intensive plants, large facilities running efficiency programmes |
Start from the document that asked for it. A tender clause, a customer security questionnaire or a buyer's supplier code will normally name the standard, the edition and sometimes the accreditation requirement. Send us that clause and we will tell you what it actually requires, which is often less than it looks.
Two of the six standards most Indian businesses certify against were reissued in 2026, and the accreditation arrangement behind every certificate was renamed.
| Change | Date | What it means for you |
|---|---|---|
| ISO 9001:2026 published, replacing ISO 9001:2015 | 16 September 2026 | The sixth edition of ISO 9001. It adopts the latest Harmonized Structure for management system standards and puts more weight on leadership, a culture of quality and ethical behaviour, and on risks and opportunities |
| ISO 14001:2026 published, replacing ISO 14001:2015 | 15 April 2026 | Climate change is built into the environmental management system, with more on biodiversity, resource availability, pollution and supply chain control |
| Transition period for both | 36 months from publication | Certificates to the 2015 editions run out during 2029. The binding date is set under the Global Accreditation Cooperation arrangement, and it also depends on your certificate's own issue date, so we confirm it with your certification body |
| ISO/IEC 27001:2013 certificates expired | 31 October 2025 | If you are still showing a 2013 certificate, you are showing an expired one. The current edition is ISO/IEC 27001:2022 |
| International Accreditation Forum and ILAC now operate as Global Accreditation Cooperation Incorporated | 1 January 2026 | Its Multilateral Recognition Arrangement covers what the IAF MLA and the ILAC MRA covered. Existing accreditations stay recognised and the old marks stay valid until the new mark is fully adopted |
If you are certifying for the first time, certify to the 2026 edition. If you already hold a 2015 certificate, the transition is normally folded into your next surveillance or recertification audit rather than run as a separate exercise, which keeps the extra audit cost down.
01
Current practice assessed against the standard's requirements, then the manual, procedures, work instructions, forms and records drafted. This is the bulk of the consulting work.
02
The system is run for long enough to generate records - a certification body needs evidence that it operates, not just that it is written down. Awareness training across the organisation and internal auditor training.
03
A full internal audit cycle, then a documented review by top management.
04
The certification body reviews documentation and readiness at stage 1, then audits implementation on site at stage 2. Non-conformities are closed and the certificate is issued. Under ISO/IEC 17021-1 the first surveillance audit takes place not more than 12 months after the certification decision date, with a second surveillance audit in year two and a recertification audit in year three before the certificate expires.
There is no portal and no government filing in ISO certification. We use these documents to scope the work and to build the management system.
One certificate, three years, and audits at fixed points inside it. The dates come from ISO/IEC 17021-1, the standard certification bodies are themselves accredited against.
| Stage | When | Who does it | What happens |
|---|---|---|---|
| Gap analysis and documentation | Before any audit | Regikart | Current practice assessed against the standard, then the manual, procedures, work instructions, forms and records drafted |
| Implementation and records | Before stage 2 | You, with our training | The system runs long enough to generate evidence that it operates |
| Internal audit and management review | Before stage 1 | You, with our internal auditor training | A full internal audit cycle and a documented top management review |
| Stage 1 audit | Start of the certification audit | Certification body | Reviews the documented management system and your readiness for stage 2 |
| Stage 2 audit | After stage 1 | Certification body | On-site audit of implementation and effectiveness, including statutory compliance, operational control and internal auditing |
| Non-conformity closure | After stage 2 | You, with us | Corrective action on findings, closed before the certification decision |
| Certification decision | End of the audit | Certification body | The certificate is issued. The three year cycle runs from this decision |
| Surveillance audit 1 | Not more than 12 months from the certification decision date | Certification body | On-site surveillance |
| Surveillance audit 2 | Year two | Certification body | On-site surveillance |
| Recertification audit | Year three, before the certificate expires | Certification body | Full recertification for the next cycle |
The 12-month rule is the one that catches people. It runs from the certification decision date, not from your financial year and not from the anniversary of the audit you remember. Miss the surveillance audit and the certificate can be suspended or withdrawn, and you are back to a full initial audit. We put the dates in your compliance calendar at the point the certificate is issued.
Read this twice: ₹999 is our gap analysis fee. It is not the price of an ISO certificate, and nobody can sell you one at that price.
| Service | Regikart fee |
|---|---|
| Gap analysis, single standard, single site | From ₹999 |
| Management system documentation, training, internal audit support and audit coordination | Quoted after the gap analysis |
| Additional standards, multiple sites, or an integrated management system | On quote after scoping |
| Transition of an existing certificate to ISO 9001:2026 or ISO 14001:2026 | On quote after scoping |
| Item | Who charges it | Amount |
|---|---|---|
| Stage 1 and stage 2 audit, and the certificate | The accredited certification body, billed to you directly | Quoted by the body after it scopes your organisation. Not a Regikart fee |
| Surveillance audits in years one and two | The same certification body | Quoted with the initial audit, or at each cycle |
| Recertification audit in year three | The same certification body | Quoted at the time |
| Government fee | None | No government fee. No authority in India issues ISO certificates |
The certification body prices audit time, and audit time is driven by five things. None of them are negotiable by a consultant.
Where a tender or a customer is driving the deadline, tell us the date first. The audit calendar of the certification body, not the documentation, is usually what sets the critical path.
ISO certification sits alongside your statutory registrations. It does not replace any of them.
Not sure which standard your buyer actually wants? Send us the tender clause or the contract wording and we will tell you.
Still have questions about ISO certification?
Call or WhatsApp +91 70444 94804 with the standard you need and the number of sites and people in scope.
Get an ISO quote →Tell us the standard, the sites and the headcount. We scope the consultancy, and we get the certification body's audit quote for you in writing before you commit.
Call or WhatsApp +91 70444 94804 with the standard you need and the number of sites and people in scope.
