How Much Does ISO Certification Cost for a Small Business in 2026?

What does ISO certification cost in 2026?

There is no official ISO price list, because ISO does not certify organisations or set what certification bodies charge. What a small business actually pays depends on the standard, the size and complexity of the organisation, how ready the management system already is, and how much outside help is used.

Published ISO cost examples for small businesses in 2026

These are examples published by individual commercial providers, not an official tariff or a statistically representative market average, and the scopes differ so the figures should not be averaged. Currencies are shown exactly as published, with no exchange-rate conversion applied, and the totals may exclude taxes, travel, corrective-action visits, software and ongoing maintenance. StandardsDesk has no commercial relationship with these cited editorial sources unless our current affiliate records explicitly show otherwise; if a commercial relationship exists now or later, we disclose it beside the relevant citation.

The UK example comes from Amtivo/British Assessment Bureau's ISO 9001 cost guide, which states that "an SME with fewer than ten employees and a single site should expect to budget around £2,250 – £2,750 for initial certification to one core standard". The US figures come from the 9001 Simplified ISO 9001 certification cost guide. That guide gives USD 3,000–USD 8,000 for the certification-body audit for a small business, and separately quotes a total project range of USD 5,000–USD 20,000 for organisations under 50 employees; the same page also uses a narrower USD 5,000–USD 15,000 total elsewhere. None of these providers is ranked or endorsed here.

What are you actually paying for?

"ISO certification cost" can mean the audit alone or the whole implementation project. Those are different totals. A consultant helps you prepare the management system; an independent certification body audits it and decides whether a certificate can be issued. The same organisation should not do both for you, and paying any fee never guarantees a certification decision.

If you are still choosing a standard, start with the ISO certification overview. When you are ready to price it, request ISO quotes with a single written scope, and use the ISO readiness self-assessment to see how much preparation work is likely first.

How much does the ISO standard itself cost?

Buying the standard is not the same as buying certification. These are current ISO Store list prices for the English PDF, checked on 13 August 2026.

National ISO members may charge different amounts, and taxes, language or format choices can affect what you actually pay.

Which ISO standard usually costs more?

ISO/IEC 27001 commonly requires a larger budget than ISO 9001 for a comparable organisation, because the scope covers systems, technical risk and specialist auditor competence. Any provider stating a fixed percentage difference between standards should be asked to show the calculation.

Version note, 13 August 2026: ISO 9001:2015 remains the current published edition. Its replacement is under publication and ISO expects it in September 2026, as shown on the ISO/FDIS 9001 page. Businesses starting now should ask prospective providers how the transition will be handled rather than claiming certification to an edition that has not yet been published.

How do certification bodies calculate audit time?

Audit fees usually follow audit days, and audit days follow accredited rules rather than a salesperson's judgement. Global Accreditation Cooperation Incorporated, or Global ACI, assumed the former roles of IAF and ILAC on 1 January 2026. As of 13 August 2026, Global ACI's documents area still includes an IAF/ILAC cross-reference table, under which specified IAF and ILAC documents, including IAF MD 5:2023 and IAF MD 11:2023, remain valid until equivalent Global ACI documents are adopted.

ISO 9001 initial audit-time starting points

Every qualification below matters when you read that table.

• It is the ISO 9001/QMS starting point from IAF MD 5:2023, not a price list and not a guaranteed final duration.
• The certification body must consider the effective number of personnel, not merely payroll headcount.
• Relevant temporary, part-time, contracted and shift personnel can count.
• Complexity, regulation, number of sites, outsourcing, temporary sites, languages and the breadth of scope can change the result.
• Reductions require justification, and the overall reduction permitted by MD 5 is limited.
• ISO 14001 and ISO 45001 use complexity and risk considerations in addition to personnel numbers.
• ISO/IEC 27001 audit planning follows the ISMS-specific requirements in ISO/IEC 27006-1:2024. Do not apply the ISO 9001 table to ISO/IEC 27001.
• An integrated audit can reduce duplicated work, but IAF MD 11:2023 states that where an integrated audit results in a reduction, it shall not exceed 20% from the calculated starting point. Not every integrated system receives the full reduction.

What makes an ISO quote increase or decrease?

Remote auditing can reduce travel expense and sometimes scheduling friction, but it does not automatically reduce the audit time the certification body is required to plan.

Hidden costs to check before you sign

The headline audit fee is rarely the whole bill. Application and annual account fees, and a certificate reissue fee if your legal name or address changes, are common and easy to miss on a quote that only shows the audit-day rate. Auditor travel and accommodation are usually billed separately from the audit-day fee, and can be significant if the certification body's nearest auditor is far from your site. If Stage 1 finds you are not ready, expect a charge for the additional visit needed before Stage 2 can proceed, and any nonconformity raised at Stage 2 usually carries its own charge for the verification review or visit that closes it out. Cancellation or rescheduling a booked audit close to the date can also trigger a fee. Beyond the certification body's invoices, internal staff time for building and running the management system, and for hosting audits every year, is a real cost even though no external invoice arrives for it - budget hours for it as carefully as you budget cash.

Surveillance audits and recertification

Certification is not a one-off payment. A certificate typically runs on a three-year cycle: surveillance audits happen in the years between certification and recertification, usually annually, and a recertification audit takes place at the end of the cycle to keep the certificate valid. Under IAF MD 5, annual surveillance time is generally planned at about one-third of the initial audit time, and recertification at about two-thirds of the then-current initial-audit requirement, subject to updated information and the provider's determination. Surveillance and recertification fees are set by the certification body, can be fixed or indexed over the contract term, and are separate from any application or administration fees. When comparing quotes, ask for the number of surveillance visits, the days per visit, and whether the fees are fixed for the full cycle or can rise - the total cash cost through the first recertification is a more useful figure than the price of the first certificate alone.

How should a small business compare ISO quotes?

ISO's own certification guidance advises evaluating several certification bodies, checking whether the body uses the relevant CASCO standard, and checking accreditation. Ask each provider for an itemised quote against an identical scope, and confirm every line below.

• Exact standard and edition
• Certification scope wording that will appear on the certificate
• Effective personnel figure used in the calculation
• Sites and shifts included
• Accreditation body and accredited scope
• Stage 1 audit days
• Stage 2 audit days
• Surveillance schedule and fees
• Recertification basis
• Application and certificate fees
• Travel and accommodation
• Taxes
• Corrective-action or follow-up charges
• Cancellation and rescheduling charges
• What consultancy or preparation support includes
• Whether internal-audit support is included
• Total cash cost through the first recertification

Accreditation bodies accredit certification bodies; they do not sell you certification and they do not set the certification body's price. The price always comes from the provider.

How can a small business reduce the cost safely?

1. Start with the ISO readiness self-assessment so you know what is actually missing.
2. Confirm which standard and which accreditation your customer or tender genuinely requires.
3. Define a truthful but focused scope instead of certifying everything at once.
4. Reuse effective existing processes rather than producing documentation nobody uses.
5. Decide honestly which work your team can complete internally.
6. Obtain comparable, itemised quotes on identical scope assumptions.
7. Plan early enough to avoid urgent scheduling and last-minute rework.
8. Consider an integrated management system if you are pursuing more than one standard.
9. Verify accreditation before accepting a very cheap certificate.
10. Budget for surveillance, recertification and internal upkeep from the start.

A consultant does not always save money, and do-it-yourself preparation is not suitable for every organisation. The right split depends on your internal capacity and deadline.

Get ISO quotes based on your actual scope

Bring your cost model output to the conversation and ask every provider to price the same scope.

• Primary: Request ISO quotes
• Secondary: Check your ISO readiness

StandardsDesk is an independent information and referral service. We do not perform ISO audits or issue certificates. We may receive a referral fee if we introduce you to a provider. Providers set their own prices, terms and certification decisions.

Frequently asked questions

How much does ISO 9001 certification cost for a small business?

There is no single answer. A UK provider publishes £2,250–£2,750 for an initial standalone certification audit for a business with fewer than ten employees on one site, for one core standard, while a US-focused guide estimates USD 3,000–USD 8,000 for a small-business ISO 9001 certification audit with 1–50 employees. Both are published examples in their own currency, not market averages, and neither includes preparation, internal time or ongoing audits.

Does ISO charge the certification fee?

No. ISO writes standards and sells the standards documents; it does not audit organisations, issue certificates or set certification-body prices. Your certificate comes from an independent certification body, which sets its own fees.

Can a small business get ISO certified without a consultant?

Yes, that is possible where the team has the time and competence to build and run the management system, including internal audit and management review. It usually takes more internal hours, which is a real cost even though no invoice arrives. Certification bodies audit the system; they cannot also implement it for you.

Is ISO certification a one-time cost?

No. A certificate typically runs on a three-year cycle with surveillance audits in between and a recertification audit at the end. Under IAF MD 5, annual surveillance is generally planned at roughly one-third of initial audit time and recertification at roughly two-thirds, so budget for the full cycle rather than the first certificate alone.

How many audit days does a small business need?

For ISO 9001, the IAF MD 5:2023 starting point is 1.5 combined Stage 1 and Stage 2 audit days for 1–5 effective personnel and 2 days for 6–10, before the certification body adjusts for complexity, sites, shifts, outsourcing and risk. It is a starting point for their calculation, not a quote. ISO 14001, ISO 45001 and ISO/IEC 27001 use their own considerations, and ISMS audits follow ISO/IEC 27006-1:2024.

Why does ISO/IEC 27001 often cost more than ISO 9001?

The ISMS scope usually covers systems, suppliers, technical controls and risk treatment, which takes longer to prepare and to audit, and requires auditors with specialist competence. One provider publishes an all-in estimate of USD 15,000–USD 60,000 for small-to-mid-sized organisations, covering preparation, internal audit and the external audit. That is a provider estimate for its own service model, not a market rate.

Can remote ISO audits reduce the price?

Remote activity can cut travel and accommodation charges and make scheduling easier. It does not automatically cut the audit time the certification body must plan, so the day-rate portion of the fee may not change. Ask each provider to show remote and on-site days separately.

Should I choose the cheapest ISO certification quote?

Only after you have checked that the quotes cover the same standard, scope, effective personnel, sites, audit days and accreditation. A cheap certificate that your customer will not accept, or one from a body without relevant accreditation, costs more in the end. Compare the total cash cost through the first recertification, not the first invoice.