# Audit days for a certification: ISO 9001 and ISO 27001

How many auditor days a certification body plans for the initial audit
(Stage 1 and Stage 2 together), by the number of people in the certified
organisation.

## Files

- `iso9001.csv`: the headcount bands and the days, read from IAF MD 5:2023, Issue 4, Version 3, Annex A, Table QMS 1. IAF MD 5 is published by the International Accreditation Forum and free to read at https://iaf.nu/en/iaf-documents/. Read 2026-09-12.
- `iso27001-examples.csv`: worked examples for ISO 27001 at four headcounts. The full audit-time chart for ISO 27001 is Annex B of ISO/IEC 27006, a standard under ISO copyright, so the chart itself is not reproduced here; the examples are the arithmetic the site shows, and anyone with a copy of the annex can check them. The chart stops being a useful guide alone above 1550 people.

## Reading the numbers

Days are the body's planning figure for the initial certification audit.
Each yearly surveillance audit is about a third of it; the recertification
audit in year three about two thirds. Multiply by a day rate to get a
fee: accredited bodies in Europe do not publish prices, and the spread
across published practitioner sources is EUR 1200 to 2000 per day, which is why the advice is three quotes rather than an average.

Last verified: 2026-09-12.