27001cost

Why a very cheap ISO 27001 quote is a risk

A quote far below the others saves money in 1 of 2 ways. It has fewer audit days than the rules allow, or the certificate has no accreditation. Either way, the customer who asked for the certificate can refuse it, and you pay again.

Way 1: too few audit days

Audit time follows the people in scope. A body can cut up to 30% for a simple scope and must record why. Below that floor, the quote does not follow the rules. An accreditation body that reviews the file can question it. So can a customer's auditor.

Example: 40 people

The starting point is about 9.5 days, the floor 5.5 days. A 4-day quote leaves out more than half of the audit. It saves about 5.5 days of fees and puts the certificate at risk.

A 4-day quote and a 9.5-day quote against a floor of 5.5 daysfloor 5.50246810121416audit days, Stage 1 + Stage 2Cheap quote: 4 daysFull quote: 9.5 days
  • Below 5.5 days: more than the allowed reductions
  • 5.5-8 days: reduced, needs recorded reasons
  • 8-10 days: starting point for 40 people

Check the days in your quote

It flags days under the floor and a missing accreditation body.

Check my quote

Way 2: no accreditation

Anyone can issue an ISO 27001 certificate. An accredited one carries the mark of a national accreditation body, such as UKAS, DAkkS, COFRAC or ACCREDIA. That body checks the certification body's audits.

  • In the UK, an online certificate without accreditation costs £1,295 plus VAT, then £295 per year, for up to 25 employees.
  • For a company under 50 employees, UKAS-accredited certification starts at about £6,800-10,000 for the audit alone.
  • Public tenders often name the requirement. A UK nuclear regulator's 2026 tender is open only to UKAS-accredited bodies.

How to check accreditation in 3 steps

  1. Ask the body for the name of its accreditation body and its accreditation number for ISO/IEC 27001.
  2. Find the body in that register, with ISO/IEC 27001 in its scope: UKAS, DAkkS, COFRAC.
  3. Check that the accreditation body is a signatory in the EA directory or the IAF list. A "board" that is in neither list gives no international recognition.

Other signs

  • A promise of a certificate in days, with no Stage 1.
  • No surveillance audits in the price, or 1 short visit for 3 years.
  • Fewer than 5 days for 25 people, or under the floor for your size.
  • The same company sells the consultancy and the certificate.

How the check judges a quote 44 s

2 quotes for one certificate: the one with too few audit days gets a warning, the other is in line, and the 3-year totals sit side by side.