A rough grouping from our project experience. The segments say nothing about any particular certification body, and nobody is bound by these figures.
Our estimate: €1,400 to €1,800
Pick at least one standard and we will do the maths.
For ISO 9001, 14001 and 45001, IAF MD 5:2023 sets out how many audit days an initial certification takes at a given headcount. For ISO/IEC 27001, ISO/IEC 27006-1:2024 does the same in Annex C. Both rulebooks are binding for accredited certification bodies. A provider may deviate, but has to justify and document the deviation.
Count everyone working in scope, including contractors and freelancers. Part-time counts proportionally. What matters is who actually falls under the management system, not the headcount on the company register.
Data centre operations and many critical processes increase the effort. A workforce doing similar, repetitive tasks with restricted access reduces it. Downward the adjustment is limited: both rulebooks allow a reduction of at most 30 percent.
If you run an integrated management system, shared processes get audited once instead of twice. The more tightly the systems are linked, the larger the discount on total audit time.
A certification cycle runs for three years. Years 2 and 3 each carry a surveillance audit at roughly one third of the initial audit time. That makes the three-year total the more honest number than the year one price.
Planning ISO 27001 specifically? Read the detailed breakdown of ISO 27001 costs. Go to the ISO 27001 cost breakdown
Heading towards TISAX instead? Check out TISAX certification costs with its own calculator. Go to the TISAX cost breakdown
Want to understand what an ISO audit is and how it works? See our glossary. Read the ISO audit glossary entry
The audit days are solid because they come straight from the tables in the rulebooks. The day rate is the uncertain part, because certification bodies do not publish price lists. That is why we work with ranges from market experience rather than provider names. Expect a bandwidth, not a precise figure.
Because we cannot know their prices. Certifiers quote individually and do not publish day rates. Putting a fixed number next to a brand name would be a claim about a specific competitor. The three segments reflect what is common in the market without attributing a price to anyone.
Because IAF MD 5:2023 says so. The medium columns of Table EMS 1 and Table OH&SMS 1 carry identical values. We use the medium complexity and risk level as the baseline for both. If your environmental or occupational health risk sits well above or below that, reflect it through the complexity selector.
Travel cost and travel time, VAT, provider-specific discounts and surcharges, and specifics such as multiple sites or shift operations. Consulting cost and the internal effort of building the management system are not included either. In our experience the internal effort is the larger item.
For those standards headcount alone is not enough input. ISO 50003 works off energy consumption, ISO 22003-1 off HACCP studies and the food chain category, ISO/IEC 42006 off the number of AI systems. That needs its own input fields and its own logic. We are building it as a second step.
Then your actual effort sits above this estimate. Multi-site calculation follows IAF MD 1 and depends on how similar the sites operate and whether sampling is permitted. Talk to us and we will look at your specific case.