ISO certification is one of those requirements that tends to arrive as a single line in a tender or a customer questionnaire: please provide a valid ISO certificate. By the time it appears, the deadline is often close, and the market is full of offers that promise a certificate at once. Some of those certificates will not be accepted by the buyer who asked for them.
If you are looking for the best ISO certification consultant in Delhi, the useful test is whether the consultant is clear about what a consultant can and cannot do, helps you choose the right standard and the right accredited certification body, and builds a system your own team can run. This page explains how ISO certification works in India in October 2026, including the newly published editions of ISO 9001 and ISO 14001.
PC Media House is a Delhi-based agency that provides ISO consulting online for businesses across Delhi NCR and India. We prepare you for certification. We do not issue certificates and we do not run the certification audit.
What ISO certification is, and who certifies you
ISO, the International Organization for Standardization, writes the standards. On its own certification page, ISO states that it does not perform certification or issue certificates. Certification is carried out by external certification bodies, and accreditation is the formal recognition by an independent accreditation body that a certification body operates to international standards.
In India, the accreditation body for certification bodies is NABCB, the National Accreditation Board for Certification Bodies, a constituent board of the Quality Council of India. It accredits management system certification bodies against ISO/IEC 17021-1, and its website carries a directory of accredited bodies. NABCB also states that it takes part in international mutual recognition arrangements, which is one reason an accredited certificate is more widely accepted.
A certificate is a statement by the certification body that your management system meets the standard, within a defined scope, as of the audit. It is not a licence, not a product approval and not a government registration. Certification is voluntary, though ISO notes that for some industries it is a legal or contractual requirement.
There are three roles worth keeping apart: the standard (ISO), the auditor and certifier (the certification body, ideally accredited), and the consultant who helps you prepare. A reliable consultant never claims to be the second one.
Which ISO standard fits your business
The right standard is the one your customers, your risks or your regulator point to. Choosing by price or by what a competitor displays on a letterhead leads to expensive mistakes.
| Standard | Covers | Typical reason to adopt | Status in October 2026 |
|---|---|---|---|
| ISO 9001 | Quality management | Buyer or tender asks for it; process discipline | ISO 9001:2026 published 16 September 2026, replacing the 2015 edition |
| ISO 14001 | Environmental management | Manufacturing, contracting, customer requirements | ISO 14001:2026 published 15 April 2026, replacing the 2015 edition |
| ISO/IEC 27001 | Information security | IT, outsourcing and data-handling customers | The 2022 edition is current; the 2013 edition is no longer valid for certification |
| ISO 45001 | Occupational health and safety | High-risk workplaces, contractors | The 2018 edition is current; ISO lists a revision as planned |
| ISO 22000 | Food safety management | Food processing, packaging, catering supply chains | The 2018 edition is current; ISO lists a revision as under development |
Status as seen on the ISO website in October 2026. Standards change, so confirm the edition your certification body will audit against.
A short note on each standard
ISO 9001 is the general-purpose standard. It asks you to understand your context and customers, set objectives, control processes, handle complaints and improve. It suits almost any organisation, which is why it is the most common first certificate. ISO 14001 focuses on environmental aspects such as waste, energy, water and emissions, and on legal compliance in those areas.
ISO/IEC 27001 is about protecting information. It is built around a risk assessment, a Statement of Applicability and a set of controls, and certification bodies look hard at whether the controls actually operate. ISO 45001 deals with hazards, worker participation and incident handling. ISO 22000 applies to food safety, with hazard analysis and prerequisite programmes at its core. The certification route is the same for each, but the technical content and the evidence differ a great deal.
A word on editions, because many articles still describe the 2015 versions. ISO states that organisations certified to ISO 9001:2015 have three years to move to ISO 9001:2026, and that your certification body will explain the transition process and timelines. For ISO 14001, ISO's FAQ says certified organisations move within the timeframe set by their certification cycle. If you are certifying for the first time now, ask the body which edition it will audit you against.
On information security, the position is clearer: ISO/IEC 27001:2022 is the current edition, and a published transition period ended on 31 October 2025, so a 2013 certificate is no longer valid. If a vendor offers you 27001:2013, walk away.
Who usually asks for ISO, and why
Most requests come from the demand side. A large buyer wants evidence that a supplier controls quality. A procurement panel wants a documented system. An overseas customer wants a certificate it can verify with the accreditation chain.
- Suppliers to larger companies, government departments and public sector buyers.
- IT and software companies answering security questionnaires from clients.
- Manufacturers and contractors with environmental or safety obligations.
- Food businesses that need a documented food safety system, which sits alongside FSSAI registration, not instead of it.
- Exporters whose buyers prefer accredited certificates; our IEC registration page covers the trade side.
- Small enterprises that want to grow into larger contracts.
If you are a small business and also exploring benefits for small enterprises, our MSME Udyam registration page explains the registration side. Some schemes link to certification, but eligibility changes, so check the current scheme conditions before you plan around any subsidy.
How ISO certification works, step by step
Whatever the standard, the path has the same shape: understand the requirements, build a system, run it, audit it yourself, then ask an external body to audit it.
Step 1: Define scope and standard
Decide which sites, products and activities are covered. A scope that is too wide creates unnecessary work, and one that omits the activity the buyer cares about makes the certificate less useful.
Step 2: Gap analysis
Compare your current practice against each clause. Most businesses already do much of what the standard asks, but lack records.
Step 3: Build the system
Write the policy, objectives, procedures, risk register and forms the standard needs, at a level your team can maintain.
Step 4: Train and operate
People must know their roles. The system must run for long enough to leave records, such as completed forms, review minutes and corrective actions.
Step 5: Internal audit and management review
Audit yourself against the standard, correct what you find and hold a management review with top management.
Step 6: External audit by a certification body
Stage 1 checks readiness and documentation. Stage 2 is the main assessment, and a certificate follows only after any major non-conformities are corrected and verified.
This sequence follows the certification process described by accredited bodies such as NQA and Bureau Veritas, which both describe Stage 1, Stage 2, a certification decision, annual surveillance and recertification. Individual bodies differ in detail, so read their terms before you sign.
Suppose a 40-person packaging unit wants ISO 9001 because a large customer has asked for it. In practice, most of the effort goes into replacing verbal instructions with simple forms, naming process owners, and showing that complaints and corrective actions are logged and reviewed. The certificate follows from the system, not the other way round.
Information we ask for
There is no government form in ISO. What we need is information about how your organisation works. A first call and a short questionnaire usually give us enough to quote and plan.
- Legal name, registrations and licences, such as GST, Udyam and sector licences.
- Site addresses, number of employees and shifts at each site.
- A description of products and services and the flow from order to delivery.
- Existing procedures, forms and records, even if informal.
- Customer requirements, complaints and the contracts that mention certification.
- Standard-specific inputs, such as an asset list for 27001 or a hazard list for 45001.
If you do not yet have a formal entity or registrations, sort that out first. Our business registration services page covers the options, since a certification body will certify a legal entity, not an idea.
Cost, audits and time
There is no government fee for ISO certification. The cost has two parts, and it helps to keep them apart when you compare quotes.
| Item | Amount | Notes |
|---|---|---|
| Government or statutory fee | No government fee | Certification is voluntary and not a government registration |
| Certification body audit fees | Set by the chosen certification body | Stage 1, Stage 2, yearly surveillance and recertification are billed separately by the body |
| Purchase of the standard | Optional | Available from ISO or national bodies |
| Training and internal audit | Included in the quote where agreed | Scope and sessions are written down |
| PC Media House consulting fee | Custom quote | Depends on standard, employees, sites, processes and existing documentation |
We do not publish rate cards for ISO, because audit days and consulting effort depend on size, sites and risk.
Audit effort is decided by the certification body from your size, scope, complexity and risk. A single-site service business with ten people will usually need fewer audit days than a multi-site manufacturer, and an information security scope will be assessed differently from a quality scope.
Time works the same way. A system has to be built and then run long enough to leave records, so there is no honest fixed duration. Smaller organisations with simple processes often move faster, but we would rather give you a plan after the gap analysis than a number before it.
The three-year cycle, and how to compare your options
Choosing a certification body
- Confirm that the body is accredited by NABCB, using NABCB's directory of accredited bodies.
- Check that your standard and your sector are within the body's accreditation scope.
- Ask for a written quote that covers the Stage 1 and Stage 2 audits, yearly surveillance and recertification.
- Ask which edition of the standard it will audit you against, and how it handles transition.
- Make sure that the body, and not your consultant, makes the certification decision.
Certification is not a one-time purchase. According to accredited bodies, a certificate is typically valid for three years, maintained through surveillance audits at least once a calendar year, with the first within twelve months of the certification decision, and a full recertification audit at the end of the cycle.
| Option | What you get | Watch out for |
|---|---|---|
| Do it yourself | Lowest cost, full control | Needs time and knowledge of the clauses; findings may delay the audit |
| ISO consultant | Gap analysis, tailored documents, training, internal audit and audit preparation | A consultant cannot certify you, and quality varies, so ask for a written scope |
| Accredited certification body | The external audit and the certificate | Should be accredited by NABCB or another recognised accreditation body |
| Certificate-only vendor | A certificate quickly, often with little or no audit | Often not accredited; customers may refuse it |
| Sector regulator licence | Needed in addition for some sectors | ISO does not replace licences such as FSSAI |
Ask every provider the same questions: who is the accredited body, what is in scope and what will the yearly surveillance cost.
Some businesses hold more than one certificate. Because the newer ISO management system standards share a common structure, ISO describes the 2026 edition of ISO 9001 as keeping the Harmonized Structure, which makes it easier to integrate with other management system standards. A single internal audit and management review can then cover more than one standard, which saves effort, though each standard still needs its own audit scope.
An ISO system also pairs well with documented tax and legal compliance. If your records and statutory filings are scattered, our taxation and compliance services can bring them into line before an audit asks for them.
Common mistakes
- Buying a certificate from a body that is not accredited, then finding that the buyer will not accept it.
- Using a downloaded manual that describes processes you do not have, which collapses in an interview with the auditor.
- Over-documenting, so that staff stop using the system within months.
- Defining a scope that leaves out the site or service the customer is buying.
- Forgetting that surveillance audits are due every year and arriving unprepared.
- Working to an outdated edition after a new one is published.
The auditor's job is to test whether your system works in practice. People who can explain their own part in it, and show a recent record, tend to do well. People who recite a manual do not.
How PC Media House works, and what we do not do
We work online from Delhi and serve businesses across Delhi NCR and India. Discovery and training happen by call or video, documents are shared in a folder, and meetings in person are by appointment only. Certification body audits take place at your site and are arranged between you and that body.
- We quote consulting as a custom quote with the scope written down: standard, sites, sessions and deliverables.
- We help you compare accredited certification bodies, but you contract with the body directly.
- We keep documents proportionate, so your team can run them after we leave.
- We prepare you for surveillance audits and edition changes, so a new publication does not catch you off guard.
We cannot promise that a certification body will grant a certificate, because the audit decides that, and we do not issue certificates. What we can promise is clear scope, honest advice on the standard and the body, and practical preparation. Tell us which customer or tender is asking and what is in scope, and we will send you an itemised quote.
Frequently Asked Questions (FAQs)
Generally no. ISO standards are voluntary, and ISO itself says accreditation is not compulsory, though for some industries certification is a legal or contractual requirement. A tender, a buyer or a sector regulator may ask for it. Check the exact requirement in the document asking for the certificate before you commit.
No. ISO does not certify, and neither does a consultant. Certificates are issued by independent certification bodies after an audit. A consultant helps you prepare the system and the records. Be careful with anyone who promises a certificate without a proper audit, because it may not be accepted by buyers.
NABCB is the National Accreditation Board for Certification Bodies, a constituent board of the Quality Council of India. It accredits certification bodies against international standards such as ISO/IEC 17021-1 for management system certification. A certificate from an NABCB-accredited body is generally more widely accepted, and you can check the body in NABCB's directory.
It depends on what customers or risks drive you. ISO 9001 covers quality management, ISO 14001 environmental management, ISO/IEC 27001 information security, ISO 45001 occupational health and safety, and ISO 22000 food safety. Many firms start with ISO 9001, and add others when a customer or regulation asks for them.
ISO published ISO 14001:2026 on 15 April 2026 and ISO 9001:2026 on 16 September 2026, replacing the 2015 editions. ISO says organisations certified to ISO 9001:2015 have three years to move. Ask your certification body which edition it will audit you against and what its transition rules are.
No for certification. ISO/IEC 27001:2022 replaced the 2013 edition, and the published transition ended on 31 October 2025, by which date 2013 certificates had to expire or be withdrawn. A new 27001 certificate now means the 2022 edition, which has its own control set and Statement of Applicability.
A management system certificate typically runs for three years. In between, the certification body carries out surveillance audits at least once a calendar year, with the first within twelve months of the certification decision. At the end of the cycle a recertification audit reviews the whole system before a new certificate is issued.
There is no government fee. The cost has two parts: consulting, which we quote individually, and the certification body's audits, which the body quotes based on the standard, size, sites and risk. Yearly surveillance audits are an ongoing cost. We keep the two separate so that you can compare quotes.
Yes. The standards are designed to be applied to organisations of any size, and the documents and records can be proportionate to a small team. A small business still must show a system that is actually in operation, with internal audit and management review, before the external audit.
The certification body records them as findings and sets a time to respond. Minor findings usually need a corrective action plan, while major ones must be corrected and verified before certification can be granted. Our role is to help you analyse the cause and prepare the response, while the body decides whether it is accepted.
Sources and Official Links
Facts on this page were checked against the sources below, last reviewed on 7 October 2026. Fees, thresholds and rules can change, so confirm the current position on the official site before you pay or file.
- iso.org/certification.html
- iso.org/standard/9001
- iso.org/standard/62085.html
- iso.org/quality-management/iso-9001-2026
- iso.org/news/2026/09/ISO9001-2026
- iso.org/standard/14001
- iso.org/standard/60857.html
- iso.org/news/2026/04/iso-14001-2026-published
- iso.org/standard/82875.html
- iso.org/standard/63787.html
- iso.org/standard/65464.html
- iso.org/standard/61651.html