How much does ISO certification actually cost?
Ask a certification body, and you get «ask for a quote». Ask a consultant, and you get «it depends». Both are right, and neither answer helps you when you're trying to budget. Here you get the numbers. What initial certification actually costs for a small business, what it costs to keep the certificate per year, and what determines whether you end up in the lower or upper part of the range.
It rarely starts with a desire for quality management. It starts with a tender. A major customer demands ISO 9001 to qualify, the board asks what it will cost, and someone has to reply by Friday.
This article is the answer.
How much does ISO certification cost?
A small business (under 20 employees, simple operations, one location) must expect 80,000 to 200,000 kroner in direct costs to become ISO 9001 certified for the first time. After that, it costs £15,000 to £30,000 per year surveillance audits to maintain the certificate, plus a major recertification audit every three years. In addition, there is internal working time, which for most is the largest item of all.
The range blows out by over 100,000 kroner because the price is less about the certificate and more about their starting point. We'll come back to that. First, let's look at where the money goes.
The four cost items
An ISO certification has four cost items. They behave so differently that they should be budgeted separately.
| Cost item | Typical level (year 1) | What it is |
|---|---|---|
| Certification audit | £30,000 to £60,000 | Payable to the accredited certification body for stage 1 (preliminary document and maturity review) and stage 2 (the main audit, conducted at your premises). This is what earns you the certificate. |
| Consultancy services | £50,000 to £150,000 | Help with building the management system with routines, procedures and internal audit. Optional, and the item that varies the most. |
| Internal working hours | 100 to 300 hours | Our own people writing standard operating procedures, outlining responsibilities, participating in interviews and tidying up the documentation. Never appear on any invoice. |
| System tools | 0 to £60,000 per year | The quality management system where procedures, documents and non-conformances are to reside. The standard does not require software, and some manage with Office files. Most people end up with a tool anyway, and that is an ongoing cost that is rarely included in certification offers. |
The table above shows normal levels for businesses with under 20 employees and straightforward operations. The number of employees, locations and complexity push the figures upwards.
The certification audit itself is the only item you cannot avoid, and usually the smallest one. The consultant can cost twice or three times as much. And if you convert 100 to 300 internal hours into salary costs, internal work is easily the most expensive item in the entire project.
The consultant sends an invoice. Internal hours never do.
What does it cost to keep the certification per year?
The certificate is valid for three years, but you will be audited every year. This is what the cycle looks like.
| Year | Revision | Typical cost |
|---|---|---|
| Year 1 | Initial certification (step 1 + 2) | £30,000 to £60,000 |
| Year 2 | Follow-up audit | £1,500 to £3,000 |
| Year 3 | Follow-up audit | £1,500 to £3,000 |
| Then | Recertification every three years | £20,000 to £40,000, normally around two-thirds of the initial audit |
Over a three-year period, that means 60,000 to 120,000 kroner in direct audit costs. On top of that come the system tool and ongoing maintenance, i.e. internal audits, management review, updating of procedures and closure of non-conformities. Companies that buy external help for the maintenance typically end up at 30,000 to 80,000 kroner per year in total.
The audits can also uncover non-conformities. Minor non-conformities are closed with an action plan by a set deadline and normally cost nothing extra from the certification body. Major non-conformities may require an extra audit before the certificate is issued or renewed, in which case you pay for the extra audit days. Budget for some leeway in year one.
The certification is therefore no one-off investment with a bit of maintenance. It is a subscription to having your house in order, with an annual check that you actually do.
How much does ISO certification cost for a company with 10 employees?
Take a business with ten employees and one location that delivers services to larger industrial customers. The figures below are a calculation example based on the intervals above, not an actual customer. What determines the calculation is where the business starts.
The routines exist and are followed
The routines are second nature to people
Same company, same standard, same auditor, and easily 80,000 to 100,000 kroner in difference. The difference lies in the state of the management system on the day you begin.
It is not the certificate that is expensive. It is the gap between how you work and how it is documented.
"Can the audit really cost so little?" This is how the price is set
Many who receive an offer from a certification body are surprised that the price is so low. The explanation is that the body's invoice is only one of the four items above. When the total cost of a certification is referred to as 150,000 kroner and the body asks for 40,000, the body is not cheap. It is the consultant, the system and the internal hours that make up the rest.
The price from the certification body is also not entirely open to negotiation. Accredited bodies price according to the number of audit days, and the number of days is based on international accreditation rules tied to the company's size and complexity, with limited room for adjustment. A body therefore cannot dump its price far below competitors without breaking the rules it is accredited under. What actually moves the price is five factors.
- Number of employees directly controls the number of audit days
- Number of locations provides several places to be revised
- Complexity in the deliveries determine how much needs to be reviewed
- Number of standards to be covered in the same audit
- Choice of body. The rules set the floor, but the daily rate and travel costs actually vary between the bodies
Size hits hardest. The audit days follow the number of employees, and a company with 50 employees must expect around two and a half times as many audit days as one with 10. One with 100 lies at three times or more. The intervals in this article apply to the smallest companies, so scale accordingly.
Therefore, ask for quotes from at least two accredited certification bodies. The price differences are real, but check that the quotes cover the same number of audit days. Otherwise, you are comparing apples and hourly rates.
And check that the body is actually accredited, in Norway normally by Norwegian Accreditation. There are companies that sell cheaper, non-accredited certificates, and they look just as good on the wall. However, in the tender that was the reason you started in the first place, they are often rejected. Then the cheapest certificate is the most expensive one you have ever bought.
How you end up in the lower part of the range
1. Tidy up before you ring the consultant
The consultant's hourly rate is the same whether the hours are spent structuring a system or searching for documents in three binders and a SharePoint folder. The more that is collated and described before start-up, the fewer hours you buy. Our checklist for ISO certification shows what needs to be in place.
2. Document the operations, not the revision
The most expensive mistake in ISO projects is building a document system for the auditor that no one uses afterwards. Then you pay for the system twice, first to build it and then every year to maintain something that does not connect with how people actually work. Write the procedures the way you work, not the way the standard is worded.
3. Obtain quotes from at least two bodies
The same audit scope can be priced differently. Ask for quotes that specify the number of audit days, daily rate, and travel costs so that the quotes become comparable.
4. Factor the internal hours into the budget
100 to 300 hours are taken from people who already have a job. Companies that plan for this set aside time with a dedicated person in charge and cross the finish line. Companies that do not do this find that the project stops every time day-to-day operations demand attention, and then the consultant hours tick by while nothing happens.
Will it be cheaper to take 9001, 14001 and 45001 at the same time?
Yes, measured against the standard. ISO 9001, ISO 14001 and ISO 45001 are built on the same structure, so an integrated management system can cover all three with shared document control, shared non-conformance management and a shared management review. The certification body can audit the standards combined, with fewer audit days in total than three separate processes.
Yet cheaper per standard is not the same as cheap. The total cost will be higher than for a single standard alone, and the internal work grows with each set of requirements. Many therefore choose to take 9001 first and build 14001 and 45001 on a system that already works, instead of introducing everything at once. What requirements the three standards actually set, and where they overlap, we have reviewed clause by clause.
Want to see what this looks like in practice?
Lie Blikk received three ISO certifications at the same time as they introduced Business Online. The quality control plans were what tied the system together.
You can do something about the biggest cost
The audit fee is regulated and the consultant fee is market-driven. The item you actually control is the internal hours, both in the certification year and in all the years afterwards.
Time goes in two places. First to build structure, namely document control, deviation workflow and an overview of competence and suppliers. Then to search, every time an auditor or a customer asks for evidence. A system where the structure already exists cuts the first item. A system where the requirement and the evidence are linked cuts the second, because the auditor can go from the non-conformance requirement or the supplier requirement
right to the log showing that the routine is followed.
The HSEQ module in Business Online is built around precisely these requirements. How it covers ISO 9001, 14001 and 45001 we have documented openly, clause by clause, so you can check that yourselves before you talk to us.
Auditors don't care how nice the system is, only that it's used. For companies that already work in Microsoft 365, that's the argument for putting routines where people actually work, not in a separate system on the side.
FAQ
Budget 15,000 to 30,000 Norwegian kroner per year for a surveillance audit for a small business, plus a recertification audit of 20,000 to 40,000 Norwegian kroner every three years. With system tools and potential external assistance for maintenance, many small and medium-sized enterprises end up at 30,000 to 80,000 Norwegian kroner per year in total, in addition to internal time.
Typically 80,000 to 200,000 kroner in direct costs the first year for consultancy assistance. Of this, 30,000 to 45,000 kroner goes to the certification body and the rest to the consultant, depending on how much of the management system already exists. Without a consultant, the direct costs can come down to around 30,000 to 45,000 kroner, in exchange for more internal hours. In any case, expect 100 to 300 hours of internal work.
Every year. The certificate is valid for three years, with surveillance audits in years two and three and a full recertification every third year. The surveillance audits are smaller in scope than the initial and recertification audits.
Per standard, yes. ISO 9001, 14001 and 45001 share the same structure, and an integrated management system can be audited together with fewer audit days than three separate runs. The total cost will still be higher than for a single standard alone, and the internal work increases with each set of requirements.
Yes. Consultancy assistance is optional, and companies in good order with a dedicated internal person responsible carry it out without. The calculation is hours versus money. What you save in fees, you pay in your own time, and an experienced adviser usually uses fewer hours on the same tasks. Without a consultant, you should in any case set aside well over 200 internal hours the first year.
Non-conformities are normal and do not mean you will lose your certification. Minor non-conformities are closed with a documented action plan by a set deadline, at no extra cost to the certification body. Major non-conformities may require an additional audit before the certificate is issued or renewed, in which case you pay for the extra audit days.
Number of audit days, which are governed by international accreditation rules based on the number of employees, locations and complexity. Certification bodies therefore cannot price themselves much lower than each other for the same scope, but the daily rate and travel costs vary. Always request quotes from at least two accredited bodies.
Be auditor ready. Requirements, documents and non-conformances in one system
The biggest certification cost is the hours you spend searching. See how companies like Lie Blikk and Soiltech have brought their quality management together where the work is done.