What a certification body quote should include

A certification-body quote is not a software subscription. It is a designed audit program: initial certification, surveillance, and recertification, plus assumptions about your scope. If those assumptions are wrong, the number on page one is fiction even when the CB is honest.

This guide explains the anatomy of a competent proposal. It does not publish day rates or typical invoice totals. Those vary by country, sector, headcount, and integration. Anyone offering a single “average ISO 9001 price” for all mid-market manufacturers is not doing your procurement any favors.

The three-year shape

Accredited management-system certification is usually a three-year cycle:

1. Stage 1 — readiness / documented-information review. Often shorter, sometimes remote.
2. Stage 2 — implementation audit. This is where most initial days sit.
3. Surveillance — typically annual (sometimes more frequent). Confirms the system still lives.
4. Recertification — before the certificate expires. What those later visits actually sample is in surveillance and recertification.

A quote that only prices Stage 2 is incomplete. Ask for the cycle fee or a clear table of years 1–3, including surveillance.

Days are calculated, not invented (in theory)

IAF mandatory documents — especially MD 5 for QMS/EMS/OHSMS duration and related documents for ISMS — give CBs a starting point based on effective personnel, complexity, and risk. CBs may justify reductions or additions. Your job is to see the justification.

Demand in writing:

• Headcount and site list they used.
• Complexity category.
• Reductions (integrated MS, mature system, simple scope) and additions (shifts, high risk, multiple standards).
• How multi-site sampling was applied (the multi-site scope chapter).

If two CBs differ by a large number of days on the same scope pack, do not assume the cheaper one is efficient. One of them may have under-counted a warehouse, a development team, or a second shift.

Line items that should appear

A complete proposal usually names:

• Standards and editions (9001:2015, 27001:2022, 42001:2023, and so on).
• Legal entity of the CB and accreditation marks. Confirm those marks live (how to verify accreditation).
• Sites in the certificate scope — and sites explicitly excluded.
• Audit days by stage and year.
• On-site versus remote split (what buyers should ask for sits in remote vs on-site ISO audits).
• Travel and expenses policy (not “TBD” if you have plants in three states).
• Certificate and administration fees.
• Translation or technical-expert days, if any.
• Transfer-in activities, if you already hold a certificate (how transfer works).
• Optional extras clearly marked as optional: gap analysis, training, extra copies of certificates.

Training and consulting sold by a related company should be walled off from the certification decision. If the same people would both implement and certify, stop.

Integration is a calculation, not a vibe

“We’ll just add 27001 onto your 9001 week” is not a method. Integrated audits follow rules of their own (IAF MD 11 is the usual reference for QMS/EMS/OHSMS combinations; ISMS and AIMS have additional competence needs). Whether the operations stack (9001 + 14001 + 45001) belongs on this RFQ at all is a buying decision, not a vibe in the proposal.

Ask:

• Which clauses will be audited once versus twice.
• Whether you get one report or three.
• Whether certificates can have different expiry dates.
• Who the lead auditor is when quality and security collide.

A smaller total day count can still be the right design. An unexplained smaller count is a risk transfer onto you.

What quotes should not do

• Guarantee certification. A CB that promises a pass is advertising the wrong product.
• Hide the accreditation body.
• Quote ISO/IEC 42001 without naming the accredited entity and AB.
• Use unofficial ISO logos as if you were licensed to apply the ISO mark. (ISO’s name and logo rules are strict; CBs have their own marks.)
• Bundle a consultant’s implementation fee as if it were accreditation.

How to run the RFQ on this site

1. Write one scope pack (RFQ / scope pack).
2. Shortlist three to five CBs in the directory and score them on one page (shortlist and scorecard).
3. Submit the same pack through Get quotes or send it directly to each CB’s contact page.
4. Compare days, assumptions, and accreditation — not a single bottom-line number taken out of context.

Why two honest replies still diverge, and what to freeze on the pack so the comparison stays like-for-like, is what drives ISO certification cost.

If a proposal is missing the items above, send it back. A registrar that cannot describe its own program will not describe your nonconformities clearly either.