The cheapest way to get ISO 27001 is to keep the scope narrow and truthful, count your people correctly, and do the recurring work yourselves, because the audit fee is close to fixed before anyone quotes you: ISO/IEC 27006 Annex B sets the auditor days by headcount, 7 days for a 20-person company, and accredited European bodies charge roughly 1,200 to 1,800 EUR a day, so about 8,400 to 12,600 EUR for initial certification. Software is a small line against that. Your own people's time is the large one.
The audit fee is arithmetic, not a negotiation
Certification bodies do not price freely. Accreditation holds them to the audit-time chart in ISO/IEC 27006 Annex B, which turns your headcount into a number of auditor days for Stage 1 and Stage 2 combined:
| People | Auditor days |
|---|---|
| up to 10 | 5 |
| 16 to 25 | 7 |
| 46 to 65 | 10 |
| 86 to 125 | 12 |
Day rates for accredited bodies in Europe run roughly 1,200 to 1,800 EUR. No accredited body publishes a price, so that band is the spread across published practitioner sources rather than a quote. A 20-person company is therefore looking at something like 8,400 to 12,600 EUR for the initial audit, before anything else.
You can shop between bodies. You cannot shop your way out of the day count, and a body offering materially fewer days than the chart is a body whose certificate is worth less.
Work your own number on the cost page, which runs the same arithmetic.
Then it happens again, twice
Certification is a three-year cycle. Surveillance audits are about a third of the initial audit time, once a year, and recertification at the end is roughly two thirds. Budgeting only for the first audit is the most common way the total surprises people.
What actually moves the number
Three things, in order of how much they matter.
Scope. The audit covers what you say it covers. A scope that includes offices, products and processes the certificate does not need adds days. Write the scope narrowly and truthfully, and defend it at Stage 1.
Readiness at Stage 1. A Stage 1 that finds the management system half-built turns into a longer Stage 2, or a second visit. This is the one place preparation converts directly into money.
Whether the evidence exists on the day. Auditors ask for records covering the period, not policies written last week. Assembling twelve months of evidence in the week before an audit is where most of the internal cost actually goes, and it is invisible in every budget because it is somebody's salary rather than an invoice.
Where the money is not
Software is a small line next to the audit, whatever you pick. Choosing a tool primarily on price optimises the wrong number: if it does not leave you with dated, complete records at the audit, it has cost you the expensive thing to save the cheap one.
If you want the honest version of what any tool covers, ask the vendor for a clause-by-clause list including the gaps. Ours is published, gaps included.