27001cost

What ISO 27001 costs over 3 years

A certificate lasts 3 years. You pay for the initial audit in year 1 and a surveillance audit in years 2 and 3. For 50 people that is about 17 audit days, €15,725-35,714 at public day rates, before fees.

The cycle

  1. Year 1: initial audit. Stage 1 checks the documents and readiness. Stage 2 is the main audit. The certificate follows the decision.
  2. Year 2: surveillance audit. About 1/3 of the initial time. It must take place within 12 months of the certification decision.
  3. Year 3: surveillance audit. About 1/3 again.
  4. End of year 3: recertification. About 2/3 of a new initial audit. It must finish before the certificate expires. It starts the next 3 years.

So the first 3 years hold about 1.67 times the initial audit days. Each later cycle holds about 1.33 times: recertification plus 2 surveillance audits.

Days and cost by size

Audit days and audit cost in the first 3 years, before fees and travel
People Days, first 3 years At €925 At €1,590 At €2,101 Days, next 3 years
10 8 €7,400 €12,720 €16,807 6.5
50 17 €15,725 €27,030 €35,714 14
200 23 €21,275 €36,570 €48,320 18.5

€925 is a Spanish public framework contract (7-hour day). €1,590 is the TÜV Saar public list. About €2,100 is a quote from a large UK body (£1,759).

Your headcount, with fees

Adds fees, in EUR, GBP or CHF.

Estimate my 3 years

Surveillance costs more than 1/3 of the price

Public contracts show the split. In 3 Slovak contracts, each surveillance audit cost 33-52% of the initial audit. Report writing, the certification decision and travel do not shrink with the days.

Initial and surveillance prices in public contracts, EUR without VAT
ContractInitial auditEach surveillanceShare3 years
Slovak public contract, 2018, small body €7,500 €3,900 52% €15,300
Slovak public contract, 2022, state body travel extra €7,400 €2,450 33% €12,300
Slovak public contract, 2023, large group plus €250 per year €7,200 €3,615 50% €14,430

What a quote must show for the 3 years

  • Days and price of each surveillance audit. A quote for year 1 only hides about 40% of the cost.
  • Whether those prices are fixed or follow an index.
  • The yearly fees, for each year.
  • The recertification days and price, or at least the day rate that will apply.

The quote check fills in missing surveillance audits, so you compare 3 years with 3 years.