What drives ISO certification cost for mid-market teams

This page is the cost-driver chapter. It is for operations, quality, IT, and compliance leads at mid-market manufacturers and professional-services firms who are about to RFQ registrars and need to know why two quotes for "the same ISO" will not match.

The useful product is a like-for-like comparison. Audit days, sites, headcount bands, standards stacked on this cycle, travel, remote versus on-site, integration method, and surveillance plus recertification in the three-year cycle all change what a certification body (CB) is actually selling. None of those drivers is a dollar figure to copy from a blog. Anyone offering a single "average ISO price" for every plant and every practice is guessing. Freeze the drivers on one pack, ask every body to restate them, and compare the programmes that come back.

What each line on a competent proposal should be called is what a certification body quote should include. How to write the outbound page those lines are calculated from is the RFQ / scope pack. Where the same facts sit on a calendar is how long ISO certification takes. This page is why the commercial replies diverge, and how to stop scoring unlike objects. It does not publish day rates, invoice totals, fee tables, or accreditation identifiers. Confirm the live proposal with the body, on your scope, in the quarter you would book.

1. Two quotes diverge because the programmes are not the same object

"We asked three registrars for ISO 9001" is not a bake-off. It is three conversations until you can lay the replies on one sheet and recognise your own company in each of them.

The ordinary ways mid-market teams lose that sheet:

• The familiar logo hears "about 400 people, headquarters." The regional registrar hears the warehouse, the second shift, and the development office. The famous proposal looks lean. It was thinner.
• One body prices Stage 2. Another prices Stage 1, Stage 2, two surveillance visits, and recertification. You are comparing a visit with a cycle.
• One quote assumes Stage 1 is remote and Stage 2 is on the floor. Another assumes the whole programme is a video call. Those are different samples, and they will not survive the same procedure.
• "We're integrated, so it should be less" goes to one salesperson as a shared management system you already run, and to another as three certificates audited back to back. The word "integrated" did not do the work. The method sentence would have.

A gap between two honest bodies can still be real. Sector competence, language, where their auditors live, and how they justify a reduction all move a proposal. You cannot see that gap until the assumptions match. Until then the argument is about a number, and the number is describing two companies.

Do not average the replies. Do not ask a favourite body to "match" a figure unless you also show the site list and the year-by-year days the other body used. A match against a thinner story buys the warehouse twice: once as a pleasant surprise in the proposal, and once as a scope extension after Stage 1.

The set is still three to five bodies. How to build it, and how to keep a logo from winning on familiarity, is shortlist and score 3–5 registrars. This page is the comparability test you run before anyone awards on price.

2. The number on page one is a cycle, not a sticker

Accredited management-system certification is a designed programme. Initial certification, surveillance, and recertification sit in one window, usually three years. The page-one total is a summary of assumptions about that window. If the assumptions are wrong, the summary is fiction even when the body is honest.

What you are buying is auditor time against a scope, the way that time is delivered, the administration of a certificate, and whatever it takes to put a competent person on your sites. A proposal that guarantees certification is advertising the wrong product. A related company's implementation fee does not belong inside the certification number. Who writes the system and who may certify it are different jobs, spelled out in consultant versus certification body.

Read every proposal as four questions. What scope did they price? What sample did they design, by stage and by year? What did they add or remove, and why? What did they leave for later — travel still "to be confirmed," surveillance "at prevailing rates," a follow-up with no method? Later is still your budget. It is a budget you cannot compare.

The labels a complete proposal usually carries live in what CB quotes include. This chapter is why two proposals with the same labels can still describe different programmes.

3. Driver, what it changes, what belongs on the RFQ

Freeze the driver on the pack you send. Ask every body to restate it in the reply. If a cell comes back blank, or comes back as a different company than the one you described, stop scoring.

Driver	What it changes on the quote	What to put on the RFQ
Audit days	The size of the sample: Stage 1, Stage 2, surveillance, recertification, and any justified reduction or addition	Standards and editions, processes, shifts, complexity in plain language, and a request for days by stage and year with each reduction named
Sites and the central function	How many addresses are in the certificate, which are sampled when, and where the system is actually owned	One line per location: address, in or out, what it does, whether it is the central function. Exclusions in writing
Headcount bands	Which duration band the body starts from, per site, including contractors who do the work	A band per site, not the about-page total. Say who is in scope. Ask them to restate the number they used
Standards stacked this cycle	Separate visits versus one programme, extra competence, and whether any activity is audited once	Which standards are this cycle, which are later, and whether shared processes already run. "Quote whichever is cheaper" is not a scope
Travel and expenses	Getting a competent auditor to the work: distance, overnight, language, a technical expert	Countries and regions, language of the floor or the practice, visitor rules, and a request for the expenses policy in one sentence
Remote versus on-site	Whether days include travel, and whether the sample is one the body's procedure allows	The split by stage and by site type. "Fully remote" is a proposal only where the work can be seen that way
Integration method	Whether a reduction is a shared sample or a discount with no design	One sentence you want back: what is audited once, what is repeated, one report or several, and the assumption
Surveillance and recertification	Year 2, year 3, and the visit before expiry. A Stage 2-only price hides them	Ask for the cycle table. Name what you already know will change: a new site, headcount moving bands, a standard you will add later
Follow-up, transfer, administration	A major that needs another visit, a move from your current body, certificate and admin lines that repeat	If you already hold a certificate, say so, including open majors. Ask which admin lines repeat each year. Do not invent the amounts

Manufacturers and professional-services firms use the same rows. The facts that fill them differ. A plant fills them with addresses, shifts, and time on the floor. A practice fills them with delivery teams, evidence that lives in tools, and people who are also on client work. Put the facts you have. Leave a row blank only when the honest answer is "none."

4. Audit days are a sample, not a discount code

Days are the unit a certification body uses to describe how much of your system it will look at. A shorter unexplained programme is often a thinner certificate. You discover that when a customer, an accreditation body, or the next surveillance asks about the warehouse the quote never counted.

For quality, environmental, and occupational health and safety systems, IAF mandatory documents — buyers meet the duration document as MD 5 — give bodies a starting point from effective personnel, complexity, and risk. Information security has its own duration logic. Bodies may justify reductions or additions. See the justification in writing. This page will not reproduce a day table, a factor, or a "typical" total. A blog copy of those tables is how teams argue with a quote using someone else's company.

On the same pack, ask every body for the headcount and site list they used, the complexity in words you recognise, each reduction or addition with its assumption, and days split by stage and by year. "Integrated," "mature," "high risk," and "shifts" are not self-explanatory. A single lump could be Stage 2 or the whole cycle. A simple assembly scope is not a regulated design scope. A single-office practice is not a follow-the-sun delivery firm.

A target day count on the RFQ asks the quoting manager to make the scope fit the number. Competent bodies will no-bid, or they will quietly drop something the certificate needed. If two replies differ by a large stretch of days on a pack you know was identical, read the restated scope before you call the smaller one efficient. One of them has usually missed a warehouse, a development team, a second shift, or a standard. The other may have added a technical expert or a site you meant to exclude. Only one of those replies is your company.

What the days are for, visit by visit, is Stage 1 versus Stage 2 and surveillance and recertification. The commercial test is whether the quote shows the days before you award.

5. Sites change the programme before they change the invoice

Every address the certificate will claim is a commercial fact. It changes who must be present, how sampling works, and how an auditor gets there. A location you leave off because the drive is annoying comes back as added days, a scope extension, or a finding that the certificate on the wall does not match the work.

Name the central function: the place that owns documented information, internal audit, management review, and the authority to make other locations follow the same rules. It is often headquarters. It is sometimes the largest plant, or — for ISO/IEC 27001 or ISO/IEC 42001 — the floor that actually holds the Statement of Applicability or the AI records. "Corporate" is not an address. Quotes that under-count the programme often started from a missing central function.

Name sampled sites as locations that do the work, not as interchangeable badges. Three machine shops on one process book can be a homogeneous network. A foundry, a warehouse, and a professional-services office are not the same sample point. Ask which sites are in the initial visits and which the body plans to reach later in the cycle. A year-1 price that never visits the second plant is not a discount. It is a different certificate, or a bill you have not seen yet.

An exclusion is a written decision that a location or a process is out. It is not a way to hide headcount so the duration band looks kinder. If the warehouse ships certified product, it is in the argument. If the sales office only takes orders and you can defend that, write the exclusion and the reason. Stage 1 is where an undefended exclusion becomes a rewrite. The scope chapter, including when sampling is even available, is multi-site certification scope. Attach the site table. Do not paste that chapter into the RFQ.

A hollow system at a single office is a readiness problem: Stage 1 buys a delay. A second plant on a true system is a larger sample and a larger schedule. Hide neither to help a number.

6. Headcount is a band per site

Duration starts from people who do the work in scope, not from the number on the about page. The about page includes the parent, the dormant subsidiary, and sometimes a shift that never touches the certified process. The quote should include the people the certificate will claim, at the sites you listed, in a band the body can show you.

Write a band per site. Contractors, temporary staff, and outsourced processes that sit inside the scope belong in the sentence, not in a footnote you hope nobody prices. A night shift that runs the same process is not zero people because the management review happens on days. Shifts change who must be available and can change the sample. Say "first shift only," "two shifts," or "continuous." Silence is how one body prices a day shift and another prices a technical-expert add for nights.

Ask each body to restate the figure it used. If the figures differ, you are not looking at a price spread. You are looking at two headcounts. Send the same band back and ask them to recalculate. Do not pick the reply that used the smaller number and call it procurement.

Headcount that moves during the cycle is a later commercial event. A second shift you plan to hire, or a delivery team you will bring into scope next year, belongs on the pack now. Ask what crosses a band and forces a recalculation. This page will not invent the breakpoints. They live in the body's procedure and in the mandatory document it is applying.

People who work from home, from a client site, or across a follow-the-sun roster still count if they do the work in scope. A headcount that only names the headquarters lease under-counts both the quality system and the ISMS. Put the pattern in one sentence: where the work is done, and roughly how many people do it.

7. Stacked standards are extra systems, unless the work is already shared

Each standard on the RFQ is a system someone has to run and a competence the body has to staff. ISO 9001 follows the work. ISO 14001 and ISO 45001 follow aspects and hazards someone maintains. ISO/IEC 27001 follows information, which is often not the largest factory. ISO/IEC 42001 follows an AI management system, not a slide. Two numbers on one email are not one audit.

The second system has to exist. "Quote 9001 and 27001, we're integrated" is a sentence. Integration is real when shared processes already run and the second system is used: a Statement of Applicability someone can walk, aspects that match the plant, an AI inventory with an owner. A hollow second system is days you will spend, then findings. If you are still choosing which single certificate this cycle, settle that before you ask for a stacked price. The buying comparisons on this site are for that argument. They are not fee schedules.

The body has to staff the combination. A plant-dense registrar and a security-competent body do not carry the same bench. Adding 42001, or adding 45001 where nobody owns EHS, can move the first date and can add a technical expert. Ask for that row when it applies. A large logo does not mean the expert is included.

Say whether you want one programme or several. Integrated certificates and separate certificates in the same week produce different reports, expiry dates, and day counts. If 27001 or 42001 is later, write the later add and a recheck date. Whether 9001, 14001, and 45001 belong together is integrated ISO management systems. That page does not replace the method sentence on the quote.

A smaller day count can be the right design when the shared processes are real. An unexplained smaller count is a risk on the certificate. Ask what was audited once.

8. Travel is a policy, not a footnote

Days are the sample. Travel is the cost of putting a competent person where that sample has to happen. A proposal that folds them into one number, or that writes "expenses TBD" against plants in three regions, cannot sit next to a proposal that states the policy.

Ask for one sentence you can score: included, at cost against receipts, or a capped approach; who books; which sites are in the first visits and which are later. This page will not invent a daily rate. "TBD" for a single office in the body's home city is a smaller hole than "TBD" for a plant someone has to fly to.

What moves the line, in ordinary mid-market programmes:

• Distance and borders. A second country, a plant off the usual route, or a site that needs a visa is a planning fact. Put the country on the site line. A body that cannot staff it should no-bid.
• Language. Floor interviews in a language the lead auditor does not work in become an interpreter or a different auditor. Name the language of the work.
• Technical experts. A specialised line, a sector the lead is not competent for, or an AI system the bench does not cover can add a person and a trip. Ask whether any expert day is in the proposal, and whether that person is on-site.
• Your calendar. Shutdown, inventory, peak, and the week the system owner is out move confirmed travel. Ask whether a date you move changes the expenses assumption. Do not invent a cancellation schedule the body has not written.

Remote delivery removes travel only for activities the body's procedure lets you take off site. A quote that deletes travel by declaring the plant "remote" has changed the product. Read it against the next section.

9. Remote and on-site are different products

Remote, hybrid, and on-site are methods. They change the sample, the travel, and sometimes whether the visit can happen in the week you named. They do not change the standard. A fully remote implementation audit of a line is not a thrifty version of an on-site Stage 2. It is a design many competent bodies will refuse, and a design you should not shop for until someone agrees.

Write the split the same way to every body:

• Stage 1 at the central function: remote, on-site, or either, and what would force a visit.
• Stage 2 at a plant: on-site, unless you are prepared to hear no.
• Stage 2 for a professional-services process that lives in tools: say what can be shown on a call, and what still needs a person in the room.
• Surveillance: the same honesty. A remote surveillance of records can be legitimate. A remote surveillance that never sees a new line is a scope you are hiding.
• Which sites, if any, are "no remote." Visitor rules, union agreements, and classified or customer-controlled rooms belong in that sentence.

Then ask each body to accept or decline that split, and to show days and travel against the split they accept. A body that returns a different split has quoted a different programme. You may prefer their design. You may not score it against a neighbour that followed your page.

Where the method is a buying argument of its own, use remote versus on-site ISO audits. Until the split matches, a "cheaper" remote quote is a second product.

If the body declines the split, keep the decline. Do not keep asking until a less careful body says yes. A method their procedure does not allow becomes a replan, often after you have told a customer a date.

10. An integration reduction only counts when the method is written

Teams hear "integration discount" and start shopping for a percentage. There is no percentage on this page. A reduction is justified when the design samples shared processes once and the body can say so. It is a slogan when the proposal is simply smaller and the second system is a PDF.

Ask four things, in writing, from every body that claims a combined programme:

1. Which activities are audited once, and which are repeated? Document control, internal audit, management review, and corrective action are the usual shared spine. Process control, aspects, hazards, a security risk treatment, and an AI approval are not the same activity with three covers. If the quote cannot name the split, the reduction has no design.
2. One report or several, and one cycle or several expiry dates? You can live with either. You cannot compare them until both bodies have said which.
3. Who is the lead, and who else has to be competent? Quality and security in one week collide when nobody on the team can sample both. Deleting the technical expert to "save" the reduction is a competence gap.
4. What assumption is the reduction standing on? "Mature integrated system" means you have already run an internal audit and a management review that touched the standards in this cycle. If that has not happened, say so, and expect the reduction to come off.

Combined audits of quality, environment, and occupational health and safety follow their own rules (buyers meet the usual reference as IAF MD 11). Information security and AI management systems add competence needs of their own. Show the method. Whether the plant stack belongs on this RFQ stays in the IMS guide. The line-item labels stay in what quotes include.

"Integrated, so less" is a mood. A once-versus-twice split is a programme.

11. Surveillance and recertification are part of the price

A quote that prices Stage 2 and leaves the rest "to be agreed" wins a careless comparison and loses the second year. You will be a client by then. Shopping again is a transfer, with its own rules, not a rewind.

Ask for a cycle table:

• Stage 1 and Stage 2 in the initial year, with the method and the sites.
• Surveillance after that. On an accredited programme, plan the first visit so it falls no later than twelve months after the certification decision. The body may schedule it earlier. The anchor is the decision date. Ask whether those visits are in the proposal, how the days compare with Stage 2, and which sites they reach.
• Recertification before expiry, closer to a full sample than to a quiet surveillance. Ask which year carries it, and whether the days are shown or deferred.
• What recalculates the later years. Headcount that crosses the band they used, a site or standard you add, a shift you start, a follow-up because a major has to be seen on the floor.

A major can require a review of records or another visit. The grade and the response live in closing ISO nonconformities. While you are still comparing bodies, ask whether a major follow-up is on-site, whether it sits outside the cycle table, and what has to be true before they book Stage 2 or issue a certificate. You are asking them to state their rule, not to predict your findings.

Certificate issue, extra copies, a scope change, and any annual administration line belong on the same page. Ask which repeat and which are one-time. Do not invent the amounts. "Admin is extra" is not a programme.

If you already hold a certificate, compare transfer proposals with each other. A transfer is not a new-client Stage 2, and an open major blocks it. The chapter is transfer an ISO certificate. The dates those later visits have to hit are the timeline. What they sample is surveillance and the three-year cycle.

12. Compare the pack the body restated

When the replies exist, build one sheet. Rows are the drivers in the table above. Columns are bodies. The cells are their words. Add the issuing legal entity and the accreditation body they name — you verify that live, the same way as verifying accreditation — plus anything they marked optional, and the planning window: earliest Stage 1, the interval to Stage 2, the decision, first surveillance. A brand is not a cell.

Score a blank cell as incomplete and send the proposal back. A registrar that cannot describe its own programme will not describe your nonconformities clearly either.

Do not score a single bottom line until the rows that feed it match. If they match and one programme is still leaner, read the reason. A justified reduction on a system you actually run is a design. A missing warehouse is a mistake. A refusal to state surveillance is a body that wants to win the first invoice.

Then use the shortlist scorecard. Quote transparency is already one of its criteria. This sheet is the evidence for that row. A window you cannot staff is not a saving, because you will move it. Award the programme you recognise as your company, from a legal entity you can award, in a week you can host.

Leave these moves off the comparison: averaging unlike totals into a "market rate"; negotiating days down without changing scope; sending a competitor's price without the competitor's site list; folding a consultant's implementation fee into the CB's cycle fee; scoring a friendly salesperson with the same points as a cycle table that is actually filled in.

13. What to put on the RFQ, and what to leave off

The outbound page is still one pack. The full checklist and the paste-ready outline are the RFQ / scope pack. The cost-driver rows are a block inside it, identical for every body.

Write the rows from the table above, identical for every body: standards and editions this cycle, one line per site, integrated or separate, the remote split, the weeks you cannot host, existing certificates and any open majors, and one request that they restate days by stage and year, the travel policy, the integration method, and the issuing legal entity.

Leave off a price question with no scope, a day-count target, a percentage you copied from a blog, a thinner site list for the logo you prefer, a guessed accreditation identifier, a promise that the audit will be light and clean, and the whole management-system binder. Name a customer-required mark if they named one. Look the entity up before you invite them. Do not type a schedule number you have not viewed.

If a row is blank because the leadership team has not decided whether the warehouse is in scope, do not send the pack "just to get a number." You will get numbers. You will not get a comparison.

14. Send one pack, then read the replies

Choose bodies you can award: sector fit, a legal entity whose accreditation you have checked for this edition, and a planning window the operation can live with. Choose a registrar for that gate. Then send one pack.

Use the Get quotes button below when the facts are true. Compare the sheets they send back — days, sites, bands, method, travel, the cycle — on the same scope. Award the programme you can staff. Keep surveillance and recertification in the award note, so year 2 is not a new argument with a new price and no memory of what you bought.