How many audit days should an ISO 27001 quote have?

It depends on the people in scope. For 50 people, Stage 1 and Stage 2 start at about 10 days. A certification body can cut up to 30% with recorded reasons, so a quote below 7 days for 50 people needs an explanation.

What should a 3-year ISO 27001 quote include?

Stage 1, Stage 2, a surveillance audit in year 2 and in year 3, every fee outside the audit days, the travel terms and the accreditation body. Recertification starts the next 3 years.

Is this ISO 27001 quote fair?

Check the audit days, the fees and the 3-year total of up to 3 quotes.

1 of 3 quotes is in line with the rules. See the check

People in scope

Contractors in scope count too.

Currency

EURGBPCHF

Figures from each quote

Example figures.

Figures from your quotes
From the quote	Name of quote A (stays on this device)	Name of quote B (stays on this device)	Name of quote C (stays on this device)
Result3-year total	Clarify before you sign€6,825	Ask before you sign€25,210	In line with the rules€22,175
Day rate
Stage 1Readiness review	= €990	= €3,180	= €3,375
Stage 2Main audit	= €2,970	= €9,540	= €9,450
Surveillance, year 2	= €990	= €4,770	= €4,050
Surveillance, year 3	= €990	= €4,770	= €4,050
RecertificationNext 3 years		= €9,540	= €8,775
My quote has a price per audit
	€885 fees, travel included, no accreditation named	€1,350 fees, travel at cost, accredited	€1,250 fees, remote, accredited
One-off feesApplication, review	once	once	once
Yearly feesCertificate, listing, management	x 3 = €885	x 3 = €900	x 3 = €750
Other one-off feesCopies, extra sites	once	once	once
Travel
Accreditation body
Prices in years 2 and 3

40 people in scope

1 of 3 quotes is in line with the rules.

Quote A has 2 risks. Quote B needs answers to 2 questions.

Get this check as a PDF

Details by quote

Quote A: 5 issues

Send to Quote A

The quote has 4 days for Stage 1 and Stage 2. For 40 people in scope we expected about 9.5 days. Please send the audit time calculation, the headcount you used and the reason for each reduction.
Which accreditation body accredits you for ISO/IEC 27001, and what is your accreditation number? Will our certificate carry its mark?
The surveillance audits have 1 day. Are these days fixed for years 2 and 3, or can they change after the initial audit?
Are the prices for years 2 and 3 fixed? If they follow an index, which index and what cap?
What will the recertification audit in year 3 cost, and will the day rate stay the same?

Below 5.5 days: more than the allowed reductions
5.5-8 days: reduced, needs recorded reasons
8-10 days: starting point for 40 people

How the check works 44 s

2 quotes for the same 40-person company: audit days against the minimum, fees, and the total for 3 years on the same basis.

No quote yet?

Estimate a fair quote for your headcount: the audit days, the lowest days a body can justify, and the cost for 3 years.

Estimate the cost