Working it out

Compare two ISO 27001 quotes: 6 checks before you sign

Two quotes arrive for the same company. One is roughly half the other. Nothing in either document explains the gap, and the obvious conclusion — that somebody is overcharging — may be wrong.

A certification quote is two numbers multiplied together. One of them comes from a published rule that every accredited certification body works to. The other is a commercial rate that nobody publishes. Almost everything that looks inexplicable about a quote becomes obvious once you separate them, and the six checks below do that in about twenty minutes.

Check 1 — find the day count

The days are not the certification body’s to choose

Audit length comes from an audit time table in ISO/IEC 27006-1:2024 Table C.1, indexed by the number of people doing work under your control inside the scope. A 40-person scope falls in the 26–45 band, which the table sets at 8.5 days for the initial certification audit covering Stage 1 and Stage 2 together.

From there the rule permits adjustment of up to 30% either way for genuine complexity — multiple sites, several technology platforms, heavy outsourcing, in-house development, disaster recovery sites — and it states that audit time is never reduced by more than 30%, for any reason.

So the first question is not “how much?”. It is “how many days, and which band?”.

If the quote does not state it

Ask. Any accredited body will answer, because the answer derives from a rule it is assessed against and there is nothing commercially sensitive in it. A reluctance to state the day count is itself informative, and it is the cheapest signal you will get in the whole process.

The full table is published here in all 22 bands, from one person to 10700, so you can find your own row before anyone quotes you.

Check 2 — divide the fee by the days

The implied rate is the comparable number

Once you have days and a price, divide one by the other. That is the day rate you are actually being charged, and it is the only figure that compares two proposals meaningfully. Headline totals do not, because they contain a scoping assumption you cannot see.

Worked through, one pattern looks like this:

The first two rows are the 40-person example at each end of our day-rate band; the last two are constructions, to show the two shapes a gap can have. Day counts come from the published table and are exact. The rates are our estimate, and the methodology page names them.

The third row is the one that surprises people. Two quotes can be charging the same rate and simply disagree about how big your organisation is. That is worth resolving before you choose on price, because one of the two bodies has understood something about your scope that the other has not — and the certificate carries the scope, not the price.

When the two bodies disagree about your size

Send both of them the same written scope statement and the same headcount, and ask them to requote. If the gap closes, it was a communication problem and you have just avoided buying the wrong certificate. If it does not, ask each one which people they are counting and why.

Check 3 — reconcile the days to your own headcount

Who counts as a person in scope

Not your payroll. Everyone doing work under the organisation’s control within the scope, not everyone on the payroll. Part-time people count in proportion to the hours they work. Contractors and outsourced staff inside the scope count. People in a business unit that is genuinely outside the scope do not.

That is ISO/IEC 27006-1:2024 clause C.3.4, and it is worth settling before you ask for quotes, because it is the single input that moves the answer most. It is also why scope is a cost decision as much as a commercial one: certifying one product team rather than the whole company is legitimate, cheaper to audit, and printed on the certificate for your customer to read.

Four of the 22 bands, so you can see the shape before you look yours up:

The surveillance and recertification columns are not separate opinions — they are one third and two thirds of the initial audit, in every row of the published table. That is why Check 5 below is arithmetic rather than negotiation.

When a short day count is a warning, not a bargain

If the division in Check 2 produces a day count materially below the band for your headcount, there are three explanations and all of them are worth pursuing.

The scope may genuinely be narrower than you described — fine if that is what you want, a problem if the certificate then fails to cover what your customer asked about. The headcount may have been counted as employees rather than as everyone doing work under your control inside the scope. Or the reduction exceeds what the rule allows, in which case you are not buying what you think you are buying.

An unusually short audit at an unusually low price is also the shape of a certificate from a body nobody has assessed. That is a different product, and it is worth knowing which one is in front of you before rather than after a customer checks.

Check 4 — ask what the number excludes

The charges that are not day-rate items

A calculation built on the day table — including ours — captures audit days and nothing else. Several charges can sit outside it entirely, so they never appear in a figure derived that way and may not appear in a headline quote either.

None of these is unreasonable. The problem is only that they arrive after a decision has been made on a number that did not contain them. Asking for the full schedule of charges rather than the audit quote takes one sentence.

Check 5 — get three years, not one

Why years two and three exceed year one

Most quotes cover the initial certification audit. The same published rule puts each annual surveillance audit at one third of that audit and recertification at two thirds.

Add those up for the 40-person example. The initial audit is 8.5 days. Surveillance in each of years one and two is 2.83 days apiece, and recertification in year three is 5.67 — 11.33 days in total, against 8.5 for certifying in the first place.

The three years after you certify contain more audit time than certifying did. That is knowable on the day you are quoted, and a three-year figure is the only honest basis for comparing two certification bodies.

The annual cost nobody quotes at all

While you are adding up years, add the internal audit. Clause 9.2 requires one and your certification body is barred from providing it, so it is a separate purchase every year for as long as you hold the certificate. It appears in no certification quote because it is not the certification body’s to sell. What a consultant can and cannot do covers who can.

Check 6 — ask how the two suppliers know each other

The clause behind the question

This one costs nothing and is not a rude question. Ask both the certification body and any consultancy either of them has mentioned what the relationship between them is.

ISO/IEC 17021-1:2015 clause 5.2 clause 5.2.5 says a certification body “shall not offer or provide management system consultancy”. Clause 5.2.7 goes further: where a client has received consultancy from a body related to a certification body, that body must not certify the management system for at least 2 years afterwards. And clause 5.2.9 forbids a certification body from even implying that certification would be “simpler, easier, faster or less expensive” if a particular consultancy were used.

Most of the time the answer is that there is no relationship, it takes ten seconds, and everybody moves on. Occasionally it surfaces a two-year problem that would have been extremely expensive to discover after signing. Why your certification body goes quiet sets out what else those clauses stop an auditor from telling you.

What to do with the answers

Put the six answers in one table next to each other — days, implied rate, band reconciliation, exclusions, three-year total, relationships — and the decision may make itself. If it does not, the remaining difference is genuinely about fit: lead times, sector experience, and whether the auditor you will actually get has worked in your industry.

Choosing a certification body covers those, and what the terms in the quote actually mean covers the wording, if a document you have been sent is using “certified”, “compliant” and “accredited” as though they were the same thing.

All notes · Cost calculator · ISO 27001 consultants