How Long Does Certification Approval Take?

You submitted your application days ago, the portal still says it is under review, and you are starting to wonder whether silence means a problem. Almost always, it does not. Certification bodies review applications in batches, on business days, through a mix of automated checks and human reads — and the honest answer to "how long?" is that no major provider commits to a fixed decision date. What they publish instead are the stages your application passes through, and it is the stage you land in — standard review, audit, or endorsement — that determines whether you wait days, weeks, or months.

This article deals only with timing. If you want the full step-by-step of what happens between submission and exam day, that pipeline is mapped in what happens after you submit a certification application, and the mechanics of reading portal status labels live in how to check your certification application status.

Why providers do not publish a guaranteed approval date

Three structural facts explain the vagueness. First, applications are not uniform: a candidate with tidy, well-documented experience is faster to assess than one whose employment history needs interpretation. Second, several bodies run random audits — PMI and ISC2 both do — and an audited application follows a longer path through document collection and verification that no reviewer can pre-schedule. Third, review capacity fluctuates. Application volume rises around exam changes and price increases (2026 saw both at PMI, with a new Project Management Professional exam from 9 July and a reported fee increase from 6 August), and a queue that is short in a quiet month can lengthen in a busy one.

So rather than fixating on a single number, it pays to understand the three tracks and which one your application is likely on.

The three approval tracks and how they differ

Track 1: standard eligibility review

This is the default path at PMI. A reviewer (or automated screen) checks that your declared experience months, education and contact hours meet the published eligibility bars. When everything lines up, approval follows and PMI opens your one-year eligibility window — the period in which you can schedule the exam and use up to three attempts. PMI does not publish a binding review duration on a page we can cite, so check your certification portal and PMI's current application guidance for the present estimate; what you can rely on is that a clean, unambiguous application is the fastest thing a reviewer ever handles.

Track 2: the audit detour

PMI and ISC2 both state that applications can be selected for random audit. An audit replaces "reviewer reads your form" with "you gather evidence": signed verification of experience, proof of education, and whatever else the provider requests. The timeline is now partly in your hands — and in the hands of former managers who must sign forms — which is why audits, not slow reviewers, cause most of the long waits candidates complain about. Two practical implications:

1. Respond fast and completely. The audit clock largely runs while the provider waits for you.
2. Warn your verifiers in advance. A supervisor who expects the email signs in days; one you have to track down after five years takes weeks. Choosing reachable references is part of application preparation — covered in how to prepare a certification application.

Track 3: post-exam endorsement (the ISC2 model)

ISC2 inverts the usual order: for the Certified Information Systems Security Professional (CISSP) and its sibling certifications you sit the exam first, and the application-style review — called endorsement — happens after you pass. ISC2 gives you nine months from your exam pass to complete endorsement, in which an ISC2-certified professional in good standing (or ISC2 itself, with employment verification) attests to your experience. ISC2 does not publish a fixed processing duration for endorsement review on the pages we verified, and random audits apply here too, so the same logic holds: a complete submission with a responsive endorser moves through the queue as fast as anything can, while a missing detail parks it.

The nine-month figure is a deadline on you, not a promise about ISC2's speed — but it tells you the design intent: endorsement is measured in weeks-to-months territory, not days, so plan job-application timing accordingly.

The panel-review outlier

A few credentials add a human panel to the pipeline. PMI's Program Management Professional (PgMP) and Portfolio Management Professional (PfMP) both put your documented experience before a panel review prior to exam authorisation; once approved, the eligibility ID is valid for one year. Panel evaluation is inherently slower than a checklist review, so if you are pursuing one of these, build the wait into your study calendar rather than booking training against an assumed date.

What actually delays an approval

Across providers, the same handful of causes account for nearly every extended wait:

• Audit selection — the single biggest variable, and random, so you cannot plan around it, only respond quickly to it.
• Incomplete or ambiguous experience descriptions that force a reviewer to query rather than approve. (Writing these well is its own craft — see how to document experience for certification applications.)
• Unresponsive verifiers or endorsers — supervisors, references, or your ISC2 endorser.
• Peak demand periods around exam version changes and announced fee increases, when many candidates rush to apply under the old rules.
• Errors that need correcting mid-review — a mismatched name or date can stall a file; the fix process is covered in how to correct an incorrect certification application.

Notice what is missing from that list: anything the provider does slowly for no reason. Extended waits are almost always waiting on information, not waiting in a queue.