How to build a registrar RFQ / scope pack

Choosing how to buy a registrar is one job. Scoring replies is another. This page is the artifact in between: the one-page scope pack — the RFQ — you send so every certification body (CB) designs the same programme. If you have not yet decided whether the system is real enough to quote, start at first-certificate readiness.

It is written for mid-market manufacturers and professional-services firms — typically operations, quality, IT, or compliance leads — who need accredited certification to ISO 9001, ISO/IEC 27001, ISO 14001, ISO 45001, and/or ISO/IEC 42001.

It does not teach you how to read a proposal. That chapter is for after replies arrive: line items, audit days, travel, integration method. This page is only how to write the outbound pack. It does not republish the selection method, the scorecard, or the multi-site map. It does not invent prices, day-rate totals, or accreditation identifiers.

1. Why one pack to every CB

A quote is a designed audit programme. The design starts from your facts. If two bodies receive two different stories, you will not have a bake-off. You will have folklore, and you will blame price.

That happens in ordinary mid-market ways:

• The famous logo gets “ISO 9001, about 400 people, headquarters.” The regional registrar gets the warehouse, the second shift, and the 27001 add. The global brand then looks cheaper. It was never cheaper. It was thinner.
• A salesperson who already likes you “simplifies” the site list so the number lands. Another salesperson, working from the email you actually sent, keeps the overflow building. You score the numbers as if they were the same object.
• You customize the pack so the security boutique “only sees 27001” while the factory-dense body “only sees 9001,” then wonder why integration methods cannot be compared. If the programme is integrated, the pack is integrated.

One pack does two jobs. First, like-for-like: same standards and editions, same sites, same headcount bands, same constraints. Second, it starves logo bias. The familiar TIC name has to price the same programme as the body your plant manager has never heard of. Familiarity is not a scope reduction.

Three to five bodies is enough. How to build that set is the shortlist. This page is what they all receive. Send it once, through one intake, so the assumptions cannot drift while you wait for the fourth reply.

If you already hold a certificate and the question is stay-or-move, read transfer before you collect a second set of Stage 2 prices. The pack still has to be one page. Transfer is a fact on that page, not a reason to write two packs.

2. Pack contents checklist

Write one page. A site table can be an attachment; the story still has to fit on a page a quoting manager will actually read. Headcount is a band per site, not a company total and not a LinkedIn about-page.

Put this on the page	What “good” looks like	What “vague” looks like
Standards and editions	9001:2015, 27001:2022, 14001:2015, 45001:2018, 42001:2023 — only the ones in this cycle	“ISO and maybe security later”
Sites + headcount bands	Address or city/country, a range per location, contractors who do the work if they are in the system	“About 400 people, a few locations”
Central function	The building that owns documented information, internal audit, and management review	“Corporate” with no address
Processes	What is actually done where (CNC and assembly; receiving and kitting; application development; model approval)	“Manufacturing” / “professional services”
Shifts	First only, two-shift, continuous, seasonal peak	Silence — then surprise night-shift interviews
Integrated vs separate certificates	One IMS certificate set, or factory stack with one body and ISMS/AIMS with another, on purpose	“We’ll add 27001 onto the 9001 week”
Transfer of existing certs	Issuing body you have now, expiry, open majors if you know them	“We might move” with no cycle facts
Customer AB / brand constraints	“ANAB only,” a named mark a portal can store, languages, union or visitor rules	Discovering the portal rule at Stage 2
Remote vs on-site prefs	What you will and will not allow, by site type if needed	Hoping every CB guesses the same split
Timeline	The window you can staff, shutdown or inventory weeks, when you actually need the mark	“ASAP” with no planning window
Existing certificates	What is on the wall today, including sister-company certs that customers already see	Pretending the new RFQ is your first certificate

If the decision is whether to stack 9001 + 14001 + 45001 on this pack at all, that is a buying question, not a formatting question: integrated ISO management systems. This page still needs the row filled. That page is when the row should say “yes, one operations-stack programme” versus “9001 only this cycle.” If the decision is ISO 14001 or ISO 50001 this cycle, use ISO 14001 vs ISO 50001 before you fill the standards row. ISO 50001 is not a checkbox on the quote form. Put the edition in the notes when it is this cycle.

Also say, in one line each:

• Legal entities the certificate should name — not the group brand on the reception sign.
• Exclusions you will defend at Stage 1. A location left off because travel is annoying is not an exclusion. It is under-scoping.
• Who implemented the system, if anyone outside your team did. Independence is a fact, not an appendix.

You are not asking for a single number. You are asking each body to restate your pack and return a designed programme. What that return should look like — cycle table, days by stage, travel policy, integration method — lives in what a CB quote should include. Write the pack first. Read the anatomy after replies arrive.

3. What not to put in the pack

The pack is a description of the programme. It is not a negotiation opening, a consultant brochure, or a wish list.

Do not ask for a price without a scope. “What do you charge for ISO 9001?” is not an RFQ. Bodies that answer it are guessing, and you will compare guesses. Day counts start from effective personnel, complexity, and sites. If those are missing, the number on page one is fiction even when the CB is honest. This site does not publish prices. Your pack should not pretend a price is the product.

Do not send a consultant-steered pack without disclosure. A well-written pack from the firm that drafted your procedures can be efficient. It can also be a conflict. ISO/IEC 17021-1 restricts certification bodies from certifying a management system they consulted on. If the same firm wrote the system, they should not be on the shortlist — and every other body still needs to know who implemented it. Hide that, and you waste a competent CB’s time or walk into an independence problem after you have already picked a favorite. Referral fees the consultant will not name belong in the same bucket: say so, or take them off the process. What belongs in a consulting SOW versus this registrar RFQ is consultant vs certification body. This page is only the outbound pack to CBs.

Leave these off as well:

• A different pack per logo. The famous brand does not get a tidier site list. The boutique does not get a secret 42001 line the others never saw.
• A day-count target dressed up as a requirement. “We need this under X days” teaches the salesperson what to omit. Ask for the calculation and the assumptions. You can reject unexplained short later. You cannot un-omit a warehouse after Stage 1.
• A hint that you want a guaranteed pass. The product is an independent audit. A pack that sounds like a purchase order for a certificate is advertising the wrong product — and it attracts the wrong bodies.
• Guessed accreditation identifiers. Name the mark or AB your customer requires (“ANAB only”). Do not invent schedule numbers you have not viewed. The lookup is verify accreditation.
• The whole IMS binder. Quoting managers will not read your quality manual to find the second shift. The pack is the facts. Evidence waits for Stage 1 and Stage 2.
• Customer names you cannot share, unless the constraint is the name. “Portal requires this mark” is enough. A confidential prime does not have to appear in five inboxes.

If a row in the checklist is blank because you have not decided, fill the row. Do not send the pack to “get a number” while the site list is still an argument.

4. How the pack feeds Stage 1 and the quote

The pack is not the audit. It is the first written answer to questions the audit will ask anyway.

Stage 1 is a design review of readiness: is the scope sane, does documented information exist, have internal audit and management review touched this system. A pack that omitted the warehouse, named no central function, or claimed 27001 controls nobody operates should die there — as written findings, not as a shrug and a Stage 2 date next week. What that visit is for sits in Stage 1 versus Stage 2. You do not need to restate the visit plan in the RFQ. You do need the pack and the Stage 1 conversation to be about the same programme.

The quote is a commercial translation of the same facts. Headcount bands, sites, complexity, shifts, integration, remote versus on-site, transfer, and travel all become line items — or they become silent omissions. If you did not write the second shift, one body will invent zero days for it and another will invent a technical-expert add. That is not a price fight. That is two programmes. After replies arrive, line the assumptions up with what quotes include. If two replies used different buildings, stop scoring and send the same pack back.

The pack also feeds staffing honesty. Timeline, shutdown weeks, and “no remote Stage 2 at plants” tell a quoting manager whether they can staff the programme you described. A body that cannot live with your inventory week should no-bid. That is a successful RFQ. A body that “fits you in” without reading the window is a weak proposal waiting to happen. How to write the remote versus on-site row so travel and days stay comparable is remote vs on-site ISO audits.

Do not treat Stage 1 readiness as something the registrar will write for you. Certification bodies should not design the system they later certify. Gap assessments they sell are bounded. Implementation is yours or a disclosed consultant’s. The pack says who did the work. It does not ask the CB to finish it.

5. Multi-site: name the map, then stop

If more than one location does work the certificate will claim, the pack needs a site list, not a company-wide headcount. Name the central function. Say which locations are in, which are excluded, and which are temporary.

That is the whole note on this page. How to decide when a warehouse is a site, when an exclusion is honest, and how sampling actually works is multi-site certification scope. Do not paste that chapter into the RFQ. Attach the filled site table from that page if you have more than one address. Single-site programmes can skip the table and still must name the one building and the band.

6. Check the entity before the pack goes out

An RFQ sent to a body you cannot award is theater. Check the legal entity and the live accredited scope for the standards and editions on the pack before you invite them — not after a friendly proposal arrives.

The method is how to verify an ISO registrar’s accreditation. Why the entity beats the brand, and how to build a three-to-five set from constraints, is how to choose a registrar.

On this page, only the gate:

• The brochure is not the certificate. Your pack and your later contract should name the company that holds the accreditation you care about.
• A customer “ANAB only” or “UKAS only” rule belongs on the pack and kills names before you send it.
• A 42001 offer with no accreditation body named in the quarter you would book Stage 1 is not a shortlist candidate.
• A consultant who wrote the system is not a certifier.

This site’s directory tags are an editorial shortlist, not a live accreditation feed. Verify off-site. Then send the pack.

7. 27001 SoA honesty and 42001 maturity

Do not invent a scope because a standard number looks good on a bid form.

ISO/IEC 27001. The Statement of Applicability is a used document: which Annex A controls apply, which do not, and why. The pack does not need the SoA attached. It does need an honest information-security map — where the work lives (headquarters, development office, cloud estate, remote workers), whether the plant list for 9001 is even the ISMS site list, and whether you are buying this cycle or a later add. A SoA that claims a third-party SOC and a cloud the site list never named will not survive Stage 1. Neither will “we have 27001-shaped policies” with no risk treatment you can show. If the customer named a SOC 2 report rather than a 27001 certificate, that decision is ISO 27001 vs SOC 2. Do not type SOC 2 into the standards line and expect an accredited certification body to issue the report. If the customer named NIST CSF alignment, a CSF profile, or a self-assessment rather than a certificate, that decision is ISO 27001 vs NIST CSF. Do not ask a certification body to certify the CSF. If the customer named ISO/IEC 27701, or a privacy certificate on top of information security, that decision is ISO 27001 vs ISO 27701. Do not type 27701 into a note and expect a 27001 accreditation line to cover it.

ISO/IEC 42001. An AIMS is a governance layer for organizations that develop or materially use AI. It is not a model-quality badge and not a modern-looking substitute for an ISMS. If AI is a pilot in one corner, say so — or leave 42001 off this cycle. If it is material, name where models are approved and monitored. That address is often not the largest factory. Confirm live accredited AIMS scope in the quarter you would book; press releases age. The sequence and the recheck habit live on the 9001 → 27001 → 42001 path and the 42001 briefing. This page only requires that you do not invent an AIMS on the RFQ.

If 27001 or 42001 is twelve to twenty-four months out, write that as a later add and put a recheck date on the pack. Do not ask five bodies to quote a fashionable line you cannot staff.

8. Copy-ready outline (email or Get quotes)

Paste into an email, a CB contact form, or the Get quotes fields. Fill every line you can. Leave a line blank only when the fact is truly “none.”

Subject: Scope pack for accredited certification quote — [legal entity], [standards]

Organisation
- Legal entity to be certified (not the group brand):
- Sector / what we make or deliver:
- Who implemented the management system (internal / named consultant / none):

Programme this cycle
- Standards and editions:
- Integrated certificates or separate:
- 27001 / 42001 later? Recheck date for live scope:

Sites (one line per location; attach a table if more than one)
- Name / address / country:
- Headcount band (plus in-scope contractors):
- Processes:
- Shifts / seasonal peak:
- Central function? (what it owns):
- In scope or excluded (reason):
- Language of the work:
- Remote vs on-site constraint:

Existing certificates
- Standard, issuing body, expiry, next audit if known:
- Transfer requested? Open majors we know about:

Constraints the CB must not “fit in”
- Customer-named mark or AB (or “none stated”):
- Shutdown / inventory / peak weeks:
- No-remote rules:
- Visitor / union / IT access for evidence walkthroughs:
- Timeline we can staff (and when we actually need the mark):

What we are asking you to return
- Restated site list and headcount bands you used
- Days by stage and year (not Stage 2 only)
- On-site vs remote split
- Integration method in one sentence, if more than one standard
- Travel / expenses policy if more than one site
- Issuing legal entity and accreditation body
- Planning window and change lead-time

Independence
- Confirmation you did not consult on this system:

If a row is blank because you have not walked the floor, you are not ready to collect day counts. Walk the floor. Then send the same pack once.

9. Send the pack, then read the replies

The bake-off only works if every body sees the same programme. Submit that pack with the Get quotes button below. Then open the directory and keep the shortlist to three to five names you can actually award.

Do not send a second, thinner pack to the body you already like. Do not collect prices before the page is written. Do not treat this site’s editorial tags as a live accreditation feed — verify the entity you intend to invite.

When replies arrive, switch chapters: what a CB quote should include is how to read line items, days, travel, and integration. What drives ISO certification cost is why two of those replies still will not match, and how to keep the comparison on one programme. Shortlist and score 3–5 is how to keep a famous logo from winning the bake-off. If you are still deciding how to choose at all, start with the selection method. This page is the outbound pack, not a substitute for competence and independence.