# ISO 9001 certification in Saudi Arabia

Source: https://goitf.com/en/resources/iso-9001-certification-saudi-arabia

The seven stages from gap analysis to certificate, who sets the pace, and why accreditation decides whether the certificate is worth anything.

ISO 9001 certification runs in seven stages: gap analysis, documentation, implementation, internal audit and management review, a Stage 1 readiness audit, a Stage 2 certification audit, and a certification decision. Your documentation (manual, procedures, forms): within a week of the gap analysis. Then your team runs it. Before the certification audit, that means at least one internal audit and one management review, with the records to show them. You and your certification body set the pace. The certificate then runs a three-year cycle.

## The question to settle before anything else

Ask whether the certification body is accredited, and by whom. In the Kingdom that means the Saudi Accreditation Center, SAAC, or another IAF MLA signatory. An unaccredited certificate is a printed document with no recognition behind it, and buyers increasingly check.

SAAC is Saudi Arabia's national accreditation body. It does not certify anybody. It accredits the bodies that do, against ISO/IEC 17021-1 for management systems, ISO/IEC 17065 for products, processes and services, and ISO/IEC 17024 for persons. Its 17021-1 sub-scopes cover ISO 9001, 14001, 45001, 22000, 13485, 27001, 22301 and 50001.

SAAC became an IAF MLA signatory for main scope ISO/IEC 17021-1, including the ISO 9001 sub-scope, on 16 January 2024. That is the mechanism that makes a Saudi-accredited certificate readable abroad: the multilateral arrangement is a chain of mutual recognition between accreditation bodies, and a certificate outside the chain does not travel.

The practical check takes five minutes. Look for the accreditation mark on the certificate, note the accreditation body, then verify the certification body on that accreditation body's own published list rather than on the certification body's website. A body that is accredited will make this easy. A body that hesitates has told you the answer.

- SAAC accredits certification bodies. It does not issue certificates to organisations
- The accreditation mark and the certificate number both belong on the certificate
- Verify the body on the accreditation body's list, not on the body's own site
- A certificate from an unaccredited body carries no IAF MLA recognition

## Which edition you will be audited against

ISO 9001:2026, published on 16 September 2026. It replaced ISO 9001:2015 and the clause structure is unchanged. If you are certifying for the first time, confirm the edition with your certification body in writing before you sign anything.

During a transition window a certification body may still be able to run an initial audit against the outgoing edition for a period. Accepting that means transitioning again within a year or two, and paying for the audit time twice. Ask the question at quotation stage, when it costs nothing to ask.

Anyone quoting you a documentation package built around ISO 9001:2015 in late 2026 is selling you last year's work. The clause numbering is identical, so the package will look plausible. The policy wording, the risk register structure and the awareness material are the parts that have moved.

## Seven stages and what each one really takes

The gap analysis identifies what needs work. The stages below show who writes the documents, who runs the system and who makes the certification decision.

The sequence below separates documentation from running the system. The audit samples evidence of work that actually happened. Records cannot be backdated.

| Stage | What happens, and who does it |
| --- | --- |
| Gap analysis | One to two days on site. Every clause tested against what you already do, producing a list of what exists, what exists but is unevidenced, and what is missing. On an established business most of the system already exists and is simply unwritten. |
| Documentation | Within a week of the gap analysis. Scope, policy, objectives, process interactions and the documented information the standard requires are written around your work. |
| Implementation | Your team runs the system and keeps the completed forms and registers from normal work. |
| Internal audit and management review | Both completed before Stage 2, across the full scope. An auditor cannot verify a system that has never checked itself, and this is the most common reason a Stage 2 is postponed. |
| Stage 1 | Usually one day. Document review, scope and site confirmation, and a judgement on whether Stage 2 is viable. Stage 1 findings close before Stage 2 begins. |
| Stage 2 | Duration is determined under IAF MD 5 from your effective number of personnel and risk category, with any adjustment documented by the certification body. Conformity and effectiveness tested across all applicable clauses, and across relevant shifts. |
| Nonconformity closure and decision | Major findings closed with correction, root cause and corrective action the certification body has verified, and an accepted plan for minor ones. An independent decision-maker inside the certification body then grants the certificate. The auditor who audited you does not decide. |

## What happens after the certificate arrives

The certificate is valid three years. The first surveillance audit falls within twelve months of the certification decision date, then annually. Recertification is completed before expiry, not after it, and a lapsed certificate is a reinstatement problem rather than an administrative one.

The twelve-month clock runs from the certification decision date, which is not the date printed as the start of validity and is not the date of your Stage 2. Find the decision date, put surveillance in the calendar against it, and you will never have the conversation about why the audit is late.

Surveillance is a sample, not a repeat of Stage 2. It always covers internal audit, management review, complaints, nonconformities and corrective actions, changes since the last visit, and use of the certification mark. Everything else rotates.

## What moves the price

Audit cost is driven by effective number of personnel, number and dispersion of sites, scope complexity and risk category, shift patterns, whether the system is integrated with other standards, auditor travel, audit language, and whether findings need a second visit.

Audit duration is determined under IAF MD 5 from your effective personnel and risk category, and any adjustment to it has to be documented and justified. The day rate is each body's own. Compare quotations on audit days as well as on price, and treat a quotation with far fewer days than the others as a question rather than a signature.

Consultancy is a separate cost from certification and must be. A body that certifies you cannot also have built your system, because that is the impartiality rule the whole scheme rests on. If one organisation offers you both, you have found a problem rather than a discount.

- Effective number of personnel, counted the way IAF MD 5 counts it, including shifts and part-time
- Number of sites, and how far apart they are
- Scope complexity and the risk category your activity sits in
- Integration with ISO 14001, 45001 or 22000, which reduces total days rather than adding them
- Travel, and the language the audit is conducted in
- A second visit if nonconformities are not closed inside the agreed window

## Why Stage 2 goes wrong

Five failures cause most of it: no completed internal audit cycle, no measured process performance, corrective actions closed with a correction only, outsourced processes inside the scope but uncontrolled, and a scope or exclusion the operation cannot support.

None of these are surprises on the day. Every one of them is visible weeks earlier to anyone who looks, which is the argument for a real internal audit rather than a form filled in the week before.

The corrective action one is worth stating plainly, because it is the most common finding in this market and the easiest to fix. Somebody finds a nonconformity, somebody fixes the instance, somebody signs the log. The cause was never established and nothing stops it happening again. Clause 10.2 asks for the cause, the action, and evidence the action worked. Three fields, and most logs carry one.

- Internal audit and management review not completed across the full scope before Stage 2
- Clause 9.1 has nothing to examine because process performance was never measured
- Corrective actions closed with a correction, no root cause and no effectiveness check
- Outsourced processes inside the scope with no control evidenced under 8.4
- A scope statement, or an exclusion, that the operation on the floor does not support

## Questions buyers ask before they start

### Is ISO 9001 mandatory in Saudi Arabia?

No. It is voluntary in law. It becomes effectively mandatory through buyer and tender requirements, and in some sectors through other authorities' licensing conditions, which is a different mechanism with the same practical result.

### How long does it take from a standing start?

Your documentation (manual, procedures, forms): within a week of the gap analysis. Then your team runs it. Before the certification audit, that means at least one internal audit and one management review, with the records to show them. You and your certification body set the pace.

### Does SAAC issue ISO 9001 certificates?

No. SAAC accredits certification bodies against ISO/IEC 17021-1. The certification body certifies your organisation. Anybody offering you a certificate directly from an accreditation body has misunderstood the structure, or is hoping you have.

### What is the difference between Stage 1 and Stage 2?

Stage 1 checks readiness: documentation, scope, sites, and whether the internal audit and management review are done. Stage 2 checks implementation and effectiveness against every applicable requirement, on the floor, with records. Stage 1 findings close before Stage 2 starts.

### Can the consultant who built our system also certify it?

No, and this is not a technicality. ISO/IEC 17021-1 requires certification bodies to manage impartiality, and a body cannot audit a system it designed. Keep the two purchases separate and separately documented.

### We hold a certificate to ISO 9001:2015. What now?

It stays valid until it expires or the transition ends, whichever comes first. Transition to ISO 9001:2026 inside the window, normally at surveillance or recertification. The clause structure did not change, so this is a delta review and a document re-issue rather than a rebuild.

### Do you certify?

No. ITF does not certify and does not select your certification body. We prepare the system, produce the evidence and sit with you through the audit. Certification is a separate purchase from an accredited body of your choosing, and it has to be.

Contact: [ops@goitf.com](mailto:ops@goitf.com) · [+966 55 682 4636](tel:+966556824636) · [WhatsApp](https://wa.me/966556824636)