Days by headcount
These are estimates. Each body sets its own figure and must record how.
| People | Stage 1 + 2 | Floor | Each surveillance | Recertification | 3 years |
|---|---|---|---|---|---|
| 5 | 5 | 3.5 | 1.5 | 3.5 | 8 |
| 10 | 5 | 3.5 | 1.5 | 3.5 | 8 |
| 25 | 7 | 5 | 2.5 | 5 | 12 |
| 50 | 10 | 7 | 3.5 | 7 | 17 |
| 100 | 12 | 8.5 | 4 | 8 | 20 |
| 250 | 14 | 10 | 4.5 | 9.5 | 23 |
| 500 | 16 | 10 | 5.5 | 11 | 27 |
| 1,000 | 18 | 11 | 6 | 12.5 | 30 |
"Floor": the starting point less 30%, the largest allowed cut. "3 years": Stage 1 and Stage 2 plus 2 surveillance audits.
Who counts as "people in scope"
- Everyone who works inside the certified scope counts, employees or not. Since the 2024 edition of ISO/IEC 27006-1, contractors and freelancers in scope count too.
- Part-time staff usually count as a share of a full-time person. Ask the body how it converts them.
- Some bodies count people who do the same simple, repeated task at a lower weight, for example a large support desk. Ask whether the body did so, and by how much.
- People outside the scope do not count. A narrow scope means fewer people and fewer days, but your customer must accept that scope.
What can raise or cut the days
The body adjusts the starting point for the risk and complexity of the scope. It must record each reason.
- More days: complex IT, critical or regulated data, software development in scope, many legal requirements, a weak first audit.
- Fewer days: a simple, low-risk scope, few IT systems, a mature system. The total cut stays at 30% or less.
- Sites: since the 2024 edition, the total follows the people, not the number of sites. Sites change how the body splits the days.
- Remote audit: it removes travel, not days. Remote time counts as audit time and can add planning time.
Try it: where does a quote sit?
4 days is below the floor of 5.5 days. The 30% cut does not explain it. Ask for the audit time calculation.
- Below 5.5 days: more than the allowed reductions
- 5.5-8 days: reduced, needs recorded reasons
- 8-10 days: starting point for 40 people
Surveillance and recertification
- Each surveillance audit, in years 2 and 3, takes about 1/3 of the initial audit time. It is rarely less than 1 day.
- The recertification audit takes about 2/3 of the time an initial audit would take at that moment. If you grew, the days grow too.
- The body reviews the surveillance days each year. A quote with short surveillance audits can rise after year 1.
Ask for the calculation
Accredited bodies record how they set the audit time. Ask for that record with the quote. Since 2026-03-31, they must use ISO/IEC 27006-1:2024 for every client. A calculation that leaves out contractors, or adds days per site, uses the old rules.