ISO 27001 certification costs a company roughly 6,000 to 9,000 EUR in audit fees at up to 10 people, 8,400 to 12,600 EUR at 16 to 25, 12,000 to 18,000 EUR at 46 to 65 and 14,400 to 21,600 EUR at 86 to 125, for the initial Stage 1 and Stage 2 audits. The days behind those figures are set by ISO/IEC 27006 Annex B and the day rate runs roughly 1,200 to 1,800 EUR across accredited European bodies. Industry barely moves the number. Headcount does.
The audit line
Accredited certification bodies are held to the audit-time chart in ISO/IEC 27006 Annex B. It maps headcount to auditor days for Stage 1 and Stage 2 combined:
| People | Auditor days | At 1,200 to 1,800 EUR/day |
|---|---|---|
| up to 10 | 5 | 6,000 to 9,000 EUR |
| 16 to 25 | 7 | 8,400 to 12,600 EUR |
| 46 to 65 | 10 | 12,000 to 18,000 EUR |
| 86 to 125 | 12 | 14,400 to 21,600 EUR |
No accredited body publishes a day rate, so that band is the spread across published practitioner sources for Europe rather than a quotation. Get three quotes. The cost calculator runs this arithmetic against your own headcount.
The lines people forget
Surveillance. Roughly a third of the initial audit time, every year, for the two years after certification.
Recertification. At the end of year three, roughly two thirds of the initial time.
Your own people. The largest cost for most companies and the one that never appears in a budget, because it is salary rather than invoice. Someone writes the policies, runs the internal audit, chases the evidence and sits with the auditor.
Software, if you use it. Small next to the above.
What changes the number
Scope is the main lever: the audit covers what you declare, so a scope that includes more sites, products or processes than the certificate needs costs days. Multiple sites can add sampling. A management system that is not ready at Stage 1 can turn into a longer Stage 2.
The number behind the number
Certification is a judgement about whether your management system operates, evidenced over a period. Companies that find it expensive usually find it expensive twice: once for the audit, and once for the weeks spent assembling records that were never kept as they went. The second one is avoidable and is worth more than any discount on the first.