Sixteen Steps from First Assessment to ISO 9001:2015 Certification

What a national regulatory authority or pharmaceutical manufacturer must put in place, in what order, and how long each implementation stage realistically takes.

Author

Dr Chinedu Madichie

Service Line

Quality Management Systems & ISO 9001

Executive Summary

In today’s heightened regulatory environment, implementing an ISO 9001 Quality Management System (QMS) is frequently mischaracterized as a routine administrative exercise. At BethAri Limited, our executive advisory practice frames QMS adoption as a transformative organizational change program. Achieving accredited certification requires far more than drafting paperwork: it demands defining executive governance, mapping core operational processes, closing identified baseline gaps, operating the system long enough to generate verifiable performance evidence, and validating system integrity through rigorous internal and external audits.

For National Regulatory Authorities (NRAs), authoritative guidance from the World Health Organization (WHO) explicitly aligns institutional QMS development with ISO 9001 principles. For life sciences and pharmaceutical manufacturers, ISO 9001 serves as a vital management-system overlay operating alongside—rather than replacing—Good Manufacturing Practice (GMP) mandates and the International Council for Harmonisation (ICH) Q10 Pharmaceutical Quality System (PQS) model.

Corporate planning is currently constrained by a strict regulatory timeline following the publication of ISO 9001:2026 on September 16, 2026, which formally superseded the 2015 edition. Directives from Global Accreditation Cooperation (Global ACI) and ISO Technical Committee 176/SC 2 dictate that initial accredited certifications under ISO 9001:2015 remain permissible only until March 31, 2028, with all existing 2015 certificates requiring full transition by September 30, 2029. Consequently, corporate leaders must plan backward from fixed external audit gates and regulatory deadlines, utilizing a phased six-to-twelve-month program horizon tailored to organizational maturity, scope complexity, multi-site logistics, and corrective-action burden.

Download the 16-stage checklist (Excel)

The Market Challenge & Context

A Quality Management System is the coordinated architecture of policies, processes, responsibilities, controls, records, and evaluation mechanisms through which an enterprise ensures its outputs consistently satisfy customer, statutory, and regulatory requirements. ISO 9001 provides sector-agnostic requirements for quality management. However, in regulated healthcare and life sciences environments, generic conformity must be seamlessly integrated with sector-specific legal and technical mandates without creating duplicate administrative overhead.

For regulatory bodies, WHO guidelines on NRA QMS implementation adapt ISO 9001 principles to strengthen institutional consistency, transparency, and operational efficiency across core functions. This alignment is formally evaluated through the WHO Global Benchmarking Tool (GBT), which incorporates QMS maturity as a foundational indicator for institutional development plans. For pharmaceutical manufacturers, ISO quality concepts underpin the ICH Q10 PQS model, while European Union regulations embed PQS obligations directly within EU GMP Chapter 1 guidelines.

Strategic timing introduces an immediate imperative constraint. Following the release of ISO 9001:2026 on September 16, 2026, rules issued by Global ACI specify that accredited certification bodies may issue initial certificates to the 2015 edition only until March 31, 2028. Furthermore, certification bodies must secure 2026-edition accreditation by September 30, 2027, and all existing 2015 certificates expire on September 30, 2029. Organizations initiating implementation must therefore determine whether to pursue a 2015-edition certificate with a rapid subsequent transition or implement directly against ISO 9001:2026 based on certification body readiness.

Through our strategic research, BethAri Limited synthesizes authoritative guidance from ISO, WHO, ICH, FDA, and EU authorities alongside peer-reviewed empirical literature. This whitepaper addresses three critical operational questions for corporate executives: what structural elements must be established, in what logical sequence, and how long each stage realistically requires.

Strategic Insights & Operational Evidence

System Architecture and Regulatory Purpose

ISO 9001 mandates executive leadership, a process approach, risk-based thinking, controlled documented information, performance evaluation, and continual improvement. WHO operationalizes these principles for regulatory bodies through a structured seven-step roadmap: allocating leadership resources, conducting situational gap analysis, establishing risk-based priorities, assigning responsibilities and timelines, validating plans with personnel, consolidating an institutional action plan, and embedding QMS milestones into corporate strategic plans. A supporting twelve-step activity plan details progression from appointing a QMS lead through defining context, policies, risks, objectives, and procedures, culminating in internal audit and management review. WHO guidelines emphasize that implementation should address priority gaps rather than attempting simultaneous development of all QMS elements, a logic mirrored by the WHO Global Benchmarking Tool manual for institutional development plans.

For pharmaceutical manufacturers, regulatory hierarchy governs system design. Guidance from the U.S. FDA and ICH Q10 establishes a lifecycle PQS built upon ISO concepts while incorporating applicable GMP requirements. European Commission guidelines under EU GMP Chapter 1 similarly embed PQS within the regulatory framework. ISO 9001 certification provides an overarching management-system structure, but it does not constitute proof of GMP compliance and must not establish duplicate quality bureaucracies. Effective implementation requires cross-mapping existing deviation, Corrective and Preventive Action (CAPA), change control, supplier quality, and training mechanisms prior to drafting new procedures.

Empirical Literature and Internalization Mechanisms

Peer-reviewed research demonstrates that ISO 9001 implementation outcomes vary significantly based on sector, organizational maturity, and internal motivation. A systematic review published by Susanto et al. (2025) in The TQM Journal identified diverse implementation frameworks across industries, noting that rigid, one-size-fits-all models fail to accommodate organizational variations. Methodological critiques led by Sampaio et al. (2009) in the International Journal of Quality & Reliability Management highlighted that early ISO 9001 research relied heavily on cross-sectional survey data and subjective perception metrics, limiting causal inference regarding operational impact.

Qualitative research by Cai and Jun (2018) in the International Journal of Production Economics established that genuine standardization requires distinct internalization mechanisms—specifically documentation, process improvement, staff education, and rigorous auditing—distinguishing substantive operational adoption from superficial compliance. In healthcare settings, a systematic review by Boukhaldi et al. (2026) in the International Journal for Quality in Health Care confirmed that top-management commitment, active staff engagement, and phased implementation are primary determinants of success, whereas resource constraints and cultural resistance represent major barriers.

Empirical studies on regulatory bodies reinforce these findings. An evaluation of medical product regulation in the East African Community by Ndomondo-Sigonda et al. (2021) in BMC Public Health observed an increase in ISO 9001 certification among national agencies from one of six in 2010 to four of six by 2021, linking certification with improved administrative efficiency and inter-agency trust. Retrospective analysis of the Pharmacy Board of Sierra Leone by Lahai et al. (2023) similarly observed enhanced non-conformance resolution speed following certification. Public reporting from The Guardian Nigeria also records the ISO 9001 certification of Nigeria’s NAFDAC as a milestone in regulatory strengthening. However, formal WHO benchmarking itself represents an extended institutional commitment, typically requiring two to five years of continuous development, as reported by Guzman et al. (2020) in BMJ Global Health.

Operating Evidence and Certification Audit Fixed Points

Initial accredited certification is governed by ISO/IEC 17021-1, which establishes requirements for management-system auditing bodies. As detailed by the ISO 9001 Auditing Practices Group (2016), initial assessment comprises a two-stage process:

• Stage 1 (Readiness Review): Evaluates organizational scope, documentation adequacy, regulatory requirements, staff understanding, internal audit completion, and management review status to judge readiness for Stage 2.
• Stage 2 (Conformity Audit): Evaluates operational implementation, process effectiveness, and complete system conformity over time.

While ISO standards do not dictate fixed timeframes, certification body rules impose clear operational boundaries. Practitioner guidance from National Quality Assurance (NQA) specifies that organizations typically require three to twelve months for full implementation (six to twelve months for complex or multi-site organizations) and mandates at least three months of continuous QMS operational records, a completed management review, and a full internal audit cycle prior to Stage 1. Guidance from DNV recommends scheduling six to eight weeks between Stage 1 and Stage 2 to allow complete closure of identified Stage 1 findings.

Business Advisory & Client Implications

Synthesizing regulatory mandates and empirical literature, BethAri Limited advises corporate clients to adopt a strict implementation logic: Govern, Diagnose, Design, Operate, Verify, Certify.

Implementation must be sequenced by process dependency rather than document drafting. Establishing quality policies before defining scope, or writing Standard Operating Procedures (SOPs) before completing risk assessments, generates redundant rework. For organizations with no prior formal QMS, establishing executive governance and securing resource allocation represent mandatory prerequisite gates.

Because empirical literature lacks validated, universal stage-duration benchmarks, program scheduling must operate backward from fixed external milestones:

1. Regulatory Transition Cut-Offs: The March 31, 2028 deadline for initial ISO 9001:2015 certificates and the September 30, 2029 final transition deadline.
2. Auditing Intervals: Certification body lead times and required intervals between Stage 1 and Stage 2 (typically 6–8 weeks).
3. Governance Decision Gates: Mandatory completion of a full internal audit cycle and executive management review.
4. Operational Evidence Window: The necessary operating period (at least 3 months) required to accumulate verifiable records.

For pharmaceutical manufacturers, baseline gap assessments must evaluate existing GMP and ICH Q10 controls to integrate ISO 9001 requirements into a single cohesive management architecture. For regulatory authorities, QMS implementation roadmaps must align directly with WHO GBT institutional development plans to eliminate duplicated effort and optimize resource utilization.

Our Core Framework & Actionable Takeaways

Strategic Execution Principles

At BethAri Limited, we partner with client leadership to operationalize quality systems through six core execution principles:

• Strategic Edition Selection: We guide executive leadership in evaluating certification body accreditation schedules for ISO 9001:2026 versus the March 31, 2028 cut-off for initial ISO 9001:2015 certificates.
• Governance as a Prerequisite Gate: Our advisors ensure executive authorization, dedicated budget, a designated QMS lead, and protected staff hours are formally secured prior to documentation drafting.
• Dependency-Based Execution: We structure implementation sequentially through scope definition, risk assessment, procedure development, operational deployment, and internal verification.
• Operational Evidence Generation: BethAri Limited embeds control mechanisms into daily operations to ensure systems run continuously for at least three months prior to formal assessment.
• Backward Milestone Planning: We construct project timelines backward from targeted audit dates, internal audit schedules, and certification body lead times rather than relying on unverified generic estimates.
• System Integration: Our consultants cross-map ISO 9001 requirements against GMP/ICH Q10 for manufacturers or WHO GBT frameworks for regulatory bodies to eliminate administrative duplication.

The BethAri 16-Stage Timeboxed Implementation Blueprint

The following timeboxed allowances represent program-planning estimates synthesized from WHO implementation steps, NQA published ranges, BSI training guidance, and DNV audit recommendations:

1. Executive Mandate and Edition Strategy (1–2 weeks): Secure leadership commitment, define strategic purpose, and select target ISO edition.
2. Appoint and Train QMS Lead (1–2 weeks): Formally designate the QMS lead and execute core standard training.
3. Baseline Gap Assessment (2–6 weeks): Evaluate current processes against ISO 9001, WHO GBT, or GMP/ICH Q10 standards.
4. Edition and Certification Body Selection (1–2 weeks): Select accredited certification body and confirm submission deadlines.
5. Strategic Roadmap Integration (1–2 weeks): Consolidate risk-ranked action plans into corporate strategic planning.
6. Staff Awareness and Training (1–3 weeks): Conduct orientation on quality principles and functional responsibilities across all operational levels.
7. Context, Scope, and Process Mapping (2–4 weeks): Define organizational context, formal QMS boundaries, and core process interactions.
8. Quality Policy and Objectives (1–2 weeks): Establish executive quality policy, key performance indicators (KPIs), and functional performance targets.
9. Risk Assessment and Opportunity Management (2–4 weeks): Develop corporate risk register and risk mitigation controls.
10. Documented Information Architecture (3–6 weeks): Establish document control, record retention, and SOP formatting structures.
11. Sector-Specific QMS/PQS Controls (4–8 weeks): Map and refine core operating procedures, integrating GMP/ICH Q10 or regulatory functions.
12. System Go-Live and Evidence Generation (At least 3 months): Operate system routinely to generate audit trails, performance records, and operational metrics.
13. Performance Monitoring and CAPA (Concurrent with Stage 12): Track KPIs, log nonconformities, and manage root-cause corrective actions.
14. Full Internal Audit Cycle (1–3 weeks): Execute comprehensive internal audit covering all scope processes and close identified findings.
15. Executive Management Review (1–3 weeks): Convene executive review to evaluate system performance, resource adequacy, and audit results.
16. Stage 1 & Stage 2 Certification Audits (6–8 weeks interval): Undergo Stage 1 readiness review, resolve identified issues, and complete Stage 2 conformity assessment.

Strategic Outlook & Emerging Horizons

From a strategic risk management perspective, BethAri Limited highlights that the empirical literature exhibits notable gaps regarding ISO 9001 implementation timelines. No peer-reviewed study provides statistically validated, stage-by-stage duration benchmarks for regulatory agencies or life sciences manufacturers. Existing literature relies predominantly on cross-sectional surveys, observational designs, or preprints. Furthermore, detailed weekly timeboxes represent program-management planning allowances constrained by certification body rules rather than empirically proven constants.

As certification bodies transition to ISO 9001:2026, guidance frameworks and transition rules will continue to evolve. Corporate leadership must maintain adaptive governance mechanisms to respond to changing accreditation schedules, emerging regulatory expectations, and updated industry benchmarks.

How We Help 

ISO 9001 certification achieves corporate credibility only when it represents the verified outcome of a fully operational, integrated management system. BethAri Limited serves as the premier strategic partner for organizations navigating this complex landscape. Our management consulting practice provides end-to-end support across three core capability areas:

1. Executive Governance & Transition Strategy: We align corporate leadership, establish strategic edition timing (ISO 9001:2015 vs. 2026), and integrate QMS roadmaps into broader business strategies.
2. Regulatory Integration & Diagnostic Mapping: Our experts conduct rigorous baseline gap assessments, cross-mapping ISO 9001 against GMP, ICH Q10, and WHO GBT frameworks to prevent administrative duplication and streamline compliance.
3. Turnkey Execution & Audit Facilitation: We guide process architecture, establish risk registers, oversee internal audit execution, facilitate executive management reviews, and support clients through Stage 1 and Stage 2 certification audits.

By combining rigorous methodology with deep sector expertise, BethAri Limited empowers organizations to mitigate compliance risk, accelerate certification timelines, and drive sustained operational performance.

Get in touch

If you would like to discuss how these issues apply to your organisation, BethAri would be glad to talk. Contact us to start the conversation.