iso27001partnersWorking it out
How to read an ISO 27001 quote
Key points
- The audit-day count comes from a published table. Ask for it before you ask for a price.
- Divide the fee by the days to get the real rate. That is the comparable number between two bodies.
- A quote materially below your headcount band means the scope is different or the reduction exceeds what the rule allows.
- Always ask for three years. Surveillance and recertification together exceed the initial audit.
Two quotes arrive for the same company. One is £9,000 and one is £21,000. Nothing in either document explains the gap, and the obvious conclusion — that one of them is overcharging — is usually wrong.
A certification quote is built from two numbers multiplied together. One of them comes from a published rule that every accredited certification body works to. The other is a commercial rate that nobody publishes. Most of what looks inexplicable about a quote becomes obvious once you separate them.
Ask for the day count first
The days are not a commercial decision. They come from an audit time table in ISO/IEC 27006-1:2024, indexed by the number of people doing work under your control inside the scope. Twenty-five people is seven days for the initial certification audit. Sixty people is ten. A hundred and fifty is thirteen.
From there the rule permits adjustment of up to 30% in either direction for genuine complexity — multiple sites, several different technology platforms, heavy outsourcing, in-house development, disaster recovery sites — and it states that audit time is never reduced by more than 30%, for any reason.
So the first question is not “how much?”. It is “how many days, and which band?”. Any accredited body will answer, because the answer is derived from a rule they are assessed against. A reluctance to state it is itself information.
Then divide
Once you have days and price, divide one by the other. That is the day rate you are actually being charged, and it is the only number that compares two proposals meaningfully.
The £9,000 and the £21,000 quotes usually turn out to be a seven-day audit and a fourteen-day audit — at almost the same rate. The gap was never about price. It was about scope, and one of the two bodies had understood something about your organisation that the other had not. That is worth finding out before you choose on cost.
When the day count is the problem
Occasionally the division produces a day count materially below the band for your headcount. There are three explanations and they are all worth pursuing.
The scope might genuinely be narrower than you described — which is fine if it is what you want, and a problem if the certificate then fails to cover what your customer asked about. The headcount might have been counted as employees rather than as everyone doing work under your control inside the scope, which is the definition the rule uses and which includes contractors. Or the reduction exceeds what the rule allows, in which case you are not buying what you think you are buying.
An unusually short audit at an unusually low price is also the shape of a non-accredited certificate. That is a different product and it is worth knowing which one is in front of you.
Ask for three years, not one
Most quotes cover the initial certification audit. The rule puts each annual surveillance audit at one third of that audit and recertification at two thirds.
Add those up. Two surveillance years plus recertification in year three comes to more audit time than the initial certification. The number that belongs in your business case is the three-year one, and a certification body can produce it on request.
While you are asking, ask what is not a day-rate item at all: application fees, certificate issue fees, annual registration or licence charges, travel and expenses. None of these appear in a calculation based on the day table, including ours, and all of them appear on invoices.
The question that is not about money
One more, and it costs nothing. Ask what the relationship is between the certification body and any consultancy either of them has mentioned.
ISO/IEC 17021-1 clause 5.2.5 says a certification body “shall not offer or provide management system consultancy”. Clause 5.2.7 goes further: where a client has received consultancy from a body related to a certification body, that body must not certify the management system for at least two years afterwards.
Most of the time the answer is that there is no relationship and everyone moves on. Occasionally it surfaces something that would have been very expensive to discover after signing.
Sources cited on this page
- ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of information security management systems
- ISO/IEC 27006 audit time table, reproduced in a certification body's published audit-duration procedure
- BS EN ISO/IEC 17021-1:2015, clause 5.2
Every figure above was read from the source it is attributed to on 20 September 2026. Figures that are our own arithmetic rather than a published rule are labelled as estimates wherever they appear. How we check this.
Want this costed for your own scope?
Enter the number of people who would be inside it. The audit days come from the published rule; nothing is charged to you.
Get a costed answer, not a call-back to discuss pricing
Five questions, all of them click-only. Your details are the last step, never the first.
Your enquiry is ready to send
Here is what happens after you submit:
- Your answers go to ISO 27001 consultancies that advertise for your sector.
- No more than three of them may contact you, using the details you gave.
- You decide who, if anyone, you speak to. You are committed to nothing.
We are not a certification body and cannot issue, arrange or influence a certificate. Only a UKAS-accredited certification body can do that, and you appoint it yourself.