What a certification body quote should include

A certification-body quote is not a software subscription. It is a designed audit program: initial certification, surveillance, and recertification, plus assumptions about your scope. If those assumptions are wrong, the number on page one is fiction even when the CB is honest.

This guide explains the anatomy of a competent proposal. It does not publish day rates or typical invoice totals. Those vary by country, sector, headcount, and integration. Anyone offering a single “average ISO 9001 price” for all mid-market manufacturers is not doing your procurement any favors.

The three-year shape

Accredited management-system certification is usually a three-year cycle:

1. Stage 1 — readiness / documented-information review. Often shorter, sometimes remote.
2. Stage 2 — implementation audit. This is where most initial days sit.
3. Surveillance — typically annual (sometimes more frequent). Confirms the system still lives.
4. Recertification — before the certificate expires.

A quote that only prices Stage 2 is incomplete. Ask for the cycle fee or a clear table of years 1–3, including surveillance.

Days are calculated, not invented (in theory)

IAF mandatory documents — especially MD 5 for QMS/EMS/OHSMS duration and related documents for ISMS — give CBs a starting point based on effective personnel, complexity, and risk. CBs may justify reductions or additions. Your job is to see the justification.

Demand in writing:

• Headcount and site list they used.
• Complexity category.
• Reductions (integrated MS, mature system, simple scope) and additions (shifts, high risk, multiple standards).
• How multi-site sampling was applied.

If two CBs differ by a large number of days on the same scope pack, do not assume the cheaper one is efficient. One of them may have under-counted a warehouse, a development team, or a second shift.

Line items that should appear

A complete proposal usually names:

• Standards and editions (9001:2015, 27001:2022, 42001:2023, and so on).
• Legal entity of the CB and accreditation marks.
• Sites in the certificate scope — and sites explicitly excluded.
• Audit days by stage and year.
• On-site versus remote split.
• Travel and expenses policy (not “TBD” if you have plants in three states).
• Certificate and administration fees.
• Translation or technical-expert days, if any.
• Transfer-in activities, if you already hold a certificate.
• Optional extras clearly marked as optional: gap analysis, training, extra copies of certificates.

Training and consulting sold by a related company should be walled off from the certification decision. If the same people would both implement and certify, stop.

Integration is a calculation, not a vibe

“We’ll just add 27001 onto your 9001 week” is not a method. Integrated audits follow rules of their own (IAF MD 11 is the usual reference for QMS/EMS/OHSMS combinations; ISMS and AIMS have additional competence needs).

Ask:

• Which clauses will be audited once versus twice.
• Whether you get one report or three.
• Whether certificates can have different expiry dates.
• Who the lead auditor is when quality and security collide.

A smaller total day count can still be the right design. An unexplained smaller count is a risk transfer onto you.

What quotes should not do

• Guarantee certification. A CB that promises a pass is advertising the wrong product.
• Hide the accreditation body.
• Quote ISO/IEC 42001 without naming the accredited entity and AB.
• Use unofficial ISO logos as if you were licensed to apply the ISO mark. (ISO’s name and logo rules are strict; CBs have their own marks.)
• Bundle a consultant’s implementation fee as if it were accreditation.

How to run the RFQ on this site

1. Write one scope pack (see how to choose a registrar).
2. Shortlist CBs in the directory.
3. Submit the same pack through Get quotes or send it directly to each CB’s contact page.
4. Compare days, assumptions, and accreditation — not a single bottom-line number taken out of context.

If a proposal is missing the items above, send it back. A registrar that cannot describe its own program will not describe your nonconformities clearly either.