Resources
How much does ISO certification actually cost?
Most answers to this question are a table of prices with no working shown. Here is the working. Certification-body audit time is set by a published standard, and once you can read it you can check any quote you are given — including ours.
The short version
There are two costs, and they go to two different places.
- The certification body's audit fee. Set by audit days × day rate. The days are governed by IAF MD 5 and are largely not negotiable. Typical US day rates run around $1,300–$1,800.
- Preparation. Whatever it takes to get from where you are to a system that passes. This is the part that varies enormously — by documentation maturity, process complexity, and how much of it your own team can carry. It has no governing standard, which is precisely why we do not publish a table of prices for it.
The number almost everyone gets wrong is the first one, and it is the one you can calculate for yourself in about two minutes.
Audit days are set by a standard, not by a salesperson
IAF MD 5:2023 is a mandatory document for accreditation bodies and the certification bodies they accredit. Table QMS 1 sets initial certification audit time — Stage 1 plus Stage 2 combined — against the effective number of personnel. Every accredited registrar works from it.
| Effective personnel | Audit days |
|---|---|
| 1–5 | 1.5 |
| 6–10 | 2 |
| 11–15 | 2.5 |
| 16–25 | 3 |
| 26–45 | 4 |
| 46–65 | 5 |
| 66–85 | 6 |
| 86–125 | 7 |
| 126–175 | 8 |
| 176–275 | 9 |
| 276–425 | 10 |
| 426–625 | 11 |
| 626–875 | 12 |
| 876–1,175 | 13 |
| 1,176–1,550 | 14 |
"Effective personnel" is not your headcount
This is the most consequential distinction on the page and the one that costs companies the most money when they miss it. MD 5 defines effective personnel as all people — permanent, temporary and part-time — involved within the scope of certification, including those working on each shift.
So a 300-person manufacturer certifying a single 40-person production line is a 40-person company for pricing purposes: 4 audit days, not 10. Drawing that scope boundary correctly, and defensibly, is the first real piece of work in a certification project — and it is why a cost estimate given before scope is defined is not an estimate.
Estimate your audit days
This returns the MD 5 baseline and applies the adjustments the standard allows. It prices the certification body's audit only — not consulting, and not your internal time. Registrars vary within these bounds, so treat the result as the range a compliant quote should fall inside.
Not total company headcount — only those inside the scope.
Day rate assumed at $1,300–$1,800, a typical US range. Your registrar's rate may differ; ask for it explicitly and the arithmetic becomes checkable.
The adjustment factors, in full
MD 5 does not just set a baseline — it names what may move it, and caps how far down it can go. Reductions must not exceed 30% of the table figure. Increases are not capped in the same way, which is why a regulated multi-site operation can land well above the baseline.
Factors that increase audit time
- Complicated logistics involving more than one building or location where work is carried out
- Staff speaking in more than one language, requiring interpreters or preventing individual auditors working alone
- Very large site for the number of personnel
- High degree of regulation — food, drugs, aerospace, nuclear power
- Highly complex processes, or a relatively high number of unique activities
- Activities requiring visits to temporary sites to confirm the activities of permanent sites
- Processes involving a combination of hardware, software, processed materials and services
Factors that decrease audit time
- No design responsibility, or other standard clauses excluded from scope
- Very small site for the number of personnel — e.g. an office block only
- Maturity of the management system
- Prior knowledge of the client's system, e.g. already certified to another standard by the same body
- Client preparedness for certification — prior third-party certification or recognition
- High level of automation
- Processes involving a single generic activity
If several reduction factors clearly apply to you and your quote shows no reduction at all, that is a fair thing to raise with the registrar. Ask them to show the day count and the adjustments they applied. A good one will do it without friction.
A worked example
A machine shop in the Kansas City metro. 40 people, all within scope. Single site. No design responsibility — they manufacture to customer drawings. Procedures exist and are followed but have never been formally documented as a system.
- MD 5 baseline: 26–45 personnel → 4 audit days
- Reduction — no design responsibility: a registrar may reduce, capped at 30% → 2.8–4 days
- Registrar audit fee at $1,300–$1,800/day: roughly $3,600–$7,200 for initial certification
- Surveillance, years 2 and 3: each roughly a third of initial time
- Recertification, year 3: roughly two-thirds of initial time
Preparation sits on top of that and is the larger and more variable number. For this company the honest answer is that it depends almost entirely on how much of the documentation work their own team takes on — which is a conversation, not a table.
ISO 27001 is priced differently — don't blend the two
ISMS audit time is governed by ISO/IEC 27006-1:2024, not MD 5, and it produces materially more days at the same headcount. Commonly cited derivations put a 1–10 person organisation at around five audit days where ISO 9001 gives two, and a 200-person organisation around fourteen.
The 2024 revision made one change worth knowing: audit time is now calculated solely on the number of people working within the ISMS scope, including freelancers and external staff, and the previous requirement to automatically factor in physical locations was removed. If you were quoted under the older basis, a re-quote may be worth requesting.
The practical warning: any page or proposal giving you a single blended range across ISO 9001 and ISO 27001 is under-quoting the ISO 27001 side, often by a factor of two or more.
Why we don't publish a rate card
We publish the audit-day standard because it is a published standard — you are entitled to check your registrar's arithmetic and we would rather you could. We do not publish a table of our own consulting fees, and the reason is the same reason the table above exists.
Registrar time has a governing document. Consulting effort does not. It is driven by documentation maturity, the number and uniqueness of your processes, design responsibility, sector regulation, and how much your own team can carry — none of which track headcount. A table of consulting prices by employee band is a guess wearing the costume of a fact, and the companies who suffer for it are the ones who anchor on the friendly number and get a different one at proposal.
What we will do, in the first conversation and before any commitment: walk your scope, tell you roughly where you land on the table above, and give you a fixed-scope, fixed-price gap analysis. After that one you will have a real number rather than an average.
Common questions
What is the single biggest driver of certification cost?
Scope, and it is not close. Audit days are set against the effective number of personnel within the scope of certification — not company headcount. A 300-person manufacturer certifying one 40-person division is priced as a 40-person company. Defining scope correctly is the first substantive decision in any certification project, and getting it wrong in either direction costs money for the full three-year cycle.
Why won't you give me a fixed number over the phone?
Because until scope is defined, any figure is an assumed day count multiplied by an assumed day rate. We would rather show you the table the registrar is actually working from and help you land your scope correctly than give you a number that turns out to be wrong. No certification body publishes a rate card either, for exactly the same reason.
Can the registrar's quote be wrong?
It can be higher than the standard requires, yes — usually because scope was drawn wider than it needed to be, or because available reductions were not applied. IAF MD 5 permits reductions of up to 30% for factors like no design responsibility, system maturity and high automation. If your quote does not reflect any reduction and several of those apply to you, it is worth asking the registrar to show their working.
Is ISO 27001 priced the same way?
Same principle, different table. ISO/IEC 27006-1:2024 governs ISMS audit time, and it produces meaningfully more days than ISO 9001 at the same headcount — commonly cited figures put a 1–10 person organisation at around five days where ISO 9001 gives two. The 2024 revision also removed the automatic multiplier for physical locations, basing time solely on persons working within the ISMS scope. Anyone quoting you a blended ISO 9001 and ISO 27001 range is under-quoting one of them.
What about surveillance and recertification?
Budget for the full three-year cycle rather than the certificate. Surveillance audits in years two and three are each roughly a third of the initial audit time, and recertification at year three is roughly two-thirds. A first-year figure that ignores this understates your real cost by a substantial margin.
Does using a consultant reduce the registrar's fee?
Not directly — the registrar prices against MD 5 regardless of who helped you prepare. What preparation changes is the number of findings, whether Stage 2 has to be repeated, and whether your scope was drawn efficiently in the first place. The last of those is where most of the avoidable money sits.
Sources
- IAF MD 5:2023 — Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, Issue 4 Version 3, 14 June 2023. Table QMS 1 and the adjustment factors above are reproduced from it; the IAF document is authoritative.
- ISO/IEC 27006-1:2024 — Requirements for bodies providing audit and certification of information security management systems. Audit-time basis referenced above.
- Day-rate ranges reflect published US market figures and our own experience of registrar quotes. They are indicative, not a quotation, and no certification body publishes a rate card.
Last reviewed 25 August 2026.