ISO 9001 certification has no fixed UK price: you need a quote based on your business size, activities, sites and audit scope. The certification body's fee is only part of the budget; include the work needed to prepare your quality management system and maintain it after certification. For your 2026 budget, compare the complete certification cycle rather than the initial audit alone.
Why this matters
An audit quote is not your complete certification budget. You also need people to document processes, check that those processes work and resolve problems before the external assessment.
For manufacturing and engineering businesses, start with the activities your certificate must cover. The guide to ISO 9001 for manufacturing and engineering firms explains that context.
A useful budget separates external certification from internal preparation. That distinction lets you compare suppliers without confusing a certificate assessment with a consultancy project or software subscription.
How much does ISO 9001 certification cost?
Your ISO 9001 certification cost depends on the assessment your organisation needs. Ask a certification body to calculate the audit time against your proposed scope, then request an itemised quote.
Use this breakdown for your 2026 comparison. Keep each line separate so you can see what the certification body covers and what remains your responsibility.
| Budget component | What it covers | What to check |
|---|---|---|
| Initial certification | Stage 1 and Stage 2 external audits | Whether both stages appear in the proposal |
| Preparation | Process documentation, staff instruction and implementation | Who completes the work and who approves it |
| Internal audit | Checking your own quality management system | Whether you need independent external support |
| Corrective action | Resolving problems and checking the fixes | How the body handles additional assessment work |
| Surveillance | Ongoing external checks after certification | The proposed schedule and associated terms |
| Recertification | Reassessment at the end of the certification cycle | Whether the proposal includes this or quotes it separately |
| Supporting expenses | Travel, administration and applicable tax | Which items sit outside the stated audit fee |
Compare the same scope, deliverables and period. A proposal that covers only the initial assessment is not equivalent to one that includes ongoing surveillance.
Treat your employees' time as a separate budget line. Even when you prepare everything internally, that work still uses capacity that would otherwise support customers, operations or growth.
Initial certification: 2 audit stages
Initial management system certification normally involves 2 audit stages. ISO/IEC 17021-1 sets out the certification process used by management system certification bodies.
Stage 1: check readiness
Stage 1 evaluates your readiness for the main assessment. The certification body reviews matters such as your scope, documented information, understanding of requirements and preparation for Stage 2.
You need more than a folder of templates. Your quality management system must reflect how your organisation actually works.
Before Stage 1, check that you can explain:
- Which activities, sites and services your system covers.
- Who owns each important process.
- How you monitor quality objectives and process performance.
- How you handle customer feedback and problems.
- How internal audits and management reviews support improvement.
Ask the certification body how it handles concerns identified at this stage. Understand the implications for the next assessment before you commit to dates.
Stage 2: check implementation
Stage 2 evaluates whether your quality management system meets the requirements and works in practice. Auditors examine evidence, speak with staff and assess the processes within scope.
Your records must show what happens, not just what a policy says should happen. Examples include completed checks, supplier evaluations, customer feedback and records of corrective action, where relevant to your operations.
If the audit identifies nonconformities, you must address them under the certification body's process. Do not treat the final audit day as a guaranteed certification date. Ask what evidence the body needs before it can make its certification decision.
Ongoing certification: a 3-year cycle
ISO/IEC 17021-1 describes a 3-year certification cycle for management systems. Surveillance audits sit between initial certification and recertification.
The first surveillance audit must take place no more than 12 months after the certification decision. That deadline comes from the certification rules, not from your preferred financial year.
For a 2026 purchase decision, request the proposed schedule across the whole cycle. Confirm when surveillance takes place, what the contract covers and how changes to your business affect the agreement.
Maintain the system between assessments. Keep process records current, complete planned internal audits, hold management reviews and check that corrective actions work.
Recertification is not the same as an ordinary surveillance visit. Ask for its scope and commercial terms separately if the proposal does not include them.
Why ISO 9001 certification costs vary
Certification bodies assess the work needed to audit your organisation. IAF MD 5 provides guidance on determining audit time for quality management systems; it does not provide a universal retail price.
These factors help explain why apparently similar businesses receive different proposals:
- People covered by the system. Effective personnel numbers inform audit-time calculations. Give the body an accurate description of staffing and working arrangements.
- Activities and complexity. Describe what you make or deliver, including design responsibilities and significant outsourced processes.
- Sites and locations. Explain where relevant activities happen. Do not assume every location can be assessed in the same way.
- Scope boundaries. State which legal entities, products and services the certificate must cover. A narrower scope must still be accurate and useful.
- Existing readiness. Your preparation work depends on the gap between current practice and ISO 9001 requirements. Keep this separate from the body's audit-time calculation.
- Assessment arrangements. Confirm on-site work, remote assessment arrangements and travel terms directly with the body.
Use one written scope for every quotation request. Otherwise, you are comparing different projects rather than different suppliers.
Should you prepare internally, use a consultant or buy software?
Choose preparation support based on the work your team cannot currently handle. Do not buy every option by default.
| Preparation option | Best for | Main advantage | Main limitation |
|---|---|---|---|
| Internal team | Businesses with quality management knowledge and available capacity | Keeps process knowledge and ownership inside your business | Uses staff time and requires suitable audit competence |
| Consultant support | Businesses needing help interpreting requirements or building the system | Adds specialist support to a defined preparation project | You still need internal owners to operate the system |
| Quality management software | Businesses needing controlled records, tasks and repeatable workflows | Organises ongoing work and makes records easier to manage | Software does not make the certification decision |
Internal preparation gives you direct control. It works when your team understands the requirements and has time to implement them, rather than simply assemble documents.
Consultant support gives you outside help with defined gaps. Set deliverables around your actual processes, staff understanding and usable records; avoid paying for documents nobody uses.
Software supports the system you operate. Check its quality management functions against your requirements instead of assuming that any compliance platform covers ISO 9001.
Keep preparation separate from certification. ISO does not certify organisations itself, and a software subscription or consultant engagement is not an ISO 9001 certificate.
How do you get a comparable ISO 9001 quotation?
Build a short specification before contacting certification bodies. For 2026 procurement, keep a dated copy of that specification alongside each response so you can identify later changes.
- Define scope. Describe your activities, relevant locations, legal entities and the wording you need on the certificate.
- Check readiness. Review existing processes, records, internal audits and management reviews. Identify work that remains unfinished.
- Request breakdown. Ask for initial certification, surveillance, recertification and excluded expenses as separate items.
- Confirm recognition. Check the body's accreditation for the relevant certification activity and your customer's acceptance requirements.
- Assign ownership. Name the person responsible for preparation, supplier questions and ongoing maintenance.
These steps produce a clearer buying decision. They also expose assumptions before you sign a contract.
Agree the scope before comparing certification proposals.
What should you send the certification body?
Give the body enough information to assess your organisation accurately. Include your activities, staffing arrangements, sites, shifts, outsourced processes and intended scope.
Explain any existing management system certification and the processes it covers. Let the body decide whether those arrangements affect the proposed assessment; do not assume they automatically reduce audit time.
State the customer or tender requirement driving the project. A certificate that does not cover the required activity will not meet that objective, however straightforward the assessment appears.
What should you ask before signing?
Ask the supplier to explain exclusions in writing. Check travel arrangements, rescheduling terms, additional assessment work and the process for changing your scope.
Request the accreditation details that apply to the proposed ISO 9001 certification. In the UK, UKAS accredits certification bodies; accreditation and certification are different roles.
Check the relevant accreditation scope and customer requirements rather than relying on a logo alone. Recognition is part of the buying decision, not an administrative detail.
How can you control the work without weakening the system?
Build your quality management system around processes your team actually follows. Rewriting the business into an elaborate manual creates another system to maintain.
Start with existing useful records. Check whether they demonstrate the required controls, who owns them and whether staff can retrieve the current version.
Use these practical controls:
- Give every process a named owner.
- Remove conflicting or obsolete documents.
- Record problems where the work happens.
- Check whether corrective actions prevent recurrence.
- Schedule internal audits around the processes in scope.
- Keep management review decisions and follow-up actions accessible.
Do not confuse fewer documents with weaker control. ISO 9001 requires a functioning quality management system, not a particular volume of paperwork.
Automation can organise reminders, approvals and records. It cannot decide your quality objectives, take management responsibility or demonstrate that a process works without evidence from your business.
Where cyber compliance automation fits
OneClickComply is best for growing businesses seeking cyber compliance automation. Its stated platform scope includes ISO 27001, Cyber Essentials and SOC 2, with policy generation, security control remediation, risk management and trust centres.
For a business buying ISO 9001 support, assess quality management requirements separately. Those cyber compliance capabilities do not establish ISO 9001 coverage or replace an independent certification assessment.
If you also need to manage cyber compliance, review OneClickComply against that separate requirement. Keep the quality management scope clear when choosing tools and assigning responsibilities.
Can you get ISO 9001 certified without a consultant?
You can prepare for ISO 9001 certification without a consultant. Your team still needs to implement the requirements, complete internal audits, hold management reviews and provide evidence to the certification body.
Choose external support for a defined skills or capacity gap. Do not treat consultancy as a mandatory certification requirement.
Does a smaller business need less audit time?
A smaller workforce is relevant to audit-time calculations, but headcount is not the only consideration. Activities, complexity, sites and working arrangements also matter.
Give the certification body the complete picture. A simple employee count is not a substitute for a scoped quotation.
Is ISO 9001 certification a one-off purchase?
ISO 9001 certification follows a 3-year certification cycle, with ongoing surveillance and later recertification. You also need to maintain the quality management system between external assessments.
For your 2026 approval request, separate initial implementation from recurring work. That gives management a clearer view of the commitment.
Frequently asked questions
One last thing
Check the certificate scope your customer needs before buying the assessment. The right certificate covers the relevant activities and meets the buyer's recognition requirements; the certificate title alone does not establish that.
Use that requirement to set your scope, request comparable proposals and assign the preparation work. Keep the system useful after the audit, not just ready for it.
Related guides
- How to choose the right compliance framework for your business
- How to structure a compliance team as your company scales
- How to reduce audit fatigue across multiple compliance frameworks
Seriously Simple Cyber Compliance.