Pricing Transparency
ISO 27001 Auditor Day Rates and Audit Duration by Company Size
Nobody else publishes this data transparently. Auditor day rates range from $900 to $2,000 per day depending on region and CB tier. Audit duration is set by IAF mandatory minimums based on employee count.
IAF Mandatory Minimum Audit Days (IAF MD 5)
These are minimums that no accredited CB can go below. Actual days may be higher based on complexity factors.
| Employees in Scope | Total Days | Stage 1 | Stage 2 |
|---|---|---|---|
| 1 - 10 | 5 | 1.5 | 3.5 |
| 11 - 25 | 6 | 2 | 4 |
| 26 - 45 | 7 | 2 | 5 |
| 46 - 65 | 8 | 2.5 | 5.5 |
| 66 - 85 | 9 | 2.5 | 6.5 |
| 86 - 125 | 10 | 3 | 7 |
| 126 - 175 | 11 | 3 | 8 |
| 176 - 275 | 12 | 3.5 | 8.5 |
| 276 - 425 | 13 | 3.5 | 9.5 |
| 426 - 625 | 15 | 4 | 11 |
| 626 - 875 | 17 | 4.5 | 12.5 |
| 876 - 1,175 | 19 | 5 | 14 |
| 1,176 - 1,550 | 20 | 5.5 | 14.5 |
| 1,551 - 2,025 | 21 | 5.5 | 15.5 |
| 2,026 - 2,675 | 22 | 6 | 16 |
| 2,676 - 3,450 | 23 | 6 | 17 |
| 3,451 - 4,350 | 24 | 6.5 | 17.5 |
| 4,351 - 5,450 | 25 | 7 | 18 |
| 5,451 - 6,800 | 26 | 7 | 19 |
| 6,801 - 8,500 | 27 | 7.5 | 19.5 |
| 8,501 - 10,700 | 28 | 8 | 20 |
Source: IAF MD 5:2019 (Determination of Audit Time). Stage 1/Stage 2 split is approximate; CBs have some flexibility in allocation.
Auditor Day Rates by Region (2026)
Regional rates reflect local auditor availability, cost of living, and market maturity.
| Region | Day Rate Range | Average | Notes |
|---|---|---|---|
| United States | $1,400 - $2,000 | $1,700 | Highest rates globally. Premium CBs (Schellman, A-LIGN) at upper end. Budget CBs at lower end. |
| United Kingdom | GBP 800 - 1,500 | GBP 1,100 | BSI and LRQA at upper end. NQA and Alcumus ISOQAR at lower end. London premium of 10-15%. |
| European Union | EUR 900 - 1,600 | EUR 1,200 | Germany/France at upper end (TUV, Bureau Veritas). Eastern Europe at lower end. Wide variation. |
| Asia-Pacific | $800 - $1,400 | $1,100 | Lowest rates. Singapore/Australia higher ($1,200-$1,600). India/Philippines lower ($800-$1,000). |
Day Rates by Certification Body Tier
Premium
$1,600 - $2,000/day
BSI, LRQA, TUV SUD, Schellman
Highest rates but often the most experienced auditors. Brand value in enterprise sales.
Mid-tier
$1,200 - $1,600/day
SGS, Bureau Veritas, A-LIGN, DNV
Good balance of quality and cost. Strong sector expertise. Globally available.
Budget
$900 - $1,300/day
NQA, Alcumus ISOQAR, regional CBs
Same accredited certificate for 30-40% less. Ideal for SMBs where CB brand is not critical.
Remote vs On-Site Audit Rates
Remote Audit
- Day rate: 15-25% lower than on-site
- No travel expenses ($0 vs $500-$3,000)
- Easier scheduling (no travel coordination)
- May require 5-10% more audit days
- Best for Stage 1 and surveillance audits
On-Site Audit
- Full day rate applies
- Travel + accommodation added ($500-$3,000)
- Necessary for physical security checks
- Better for staff interviews
- Required for at least part of Stage 2
Multi-Site Audit Day Calculation
IAF MD 1 defines how additional audit days are calculated for multi-site organisations. The general principle is sampling: not every site needs visiting in every audit cycle, but a representative sample must be covered.
The sampling formula is approximately the square root of the number of sites. For example: 4 sites = 2 visited, 9 sites = 3 visited, 25 sites = 5 visited. Each visited site adds 0.5-1 audit days plus travel time.
2 - 5 sites
+25%
2-3 sites visited
6 - 10 sites
+50%
3-4 sites visited
11 - 25 sites
+75%
4-5 sites visited
25+ sites
+80-100%
5-6 sites visited
Frequently Asked Questions
How are ISO 27001 audit days calculated?
Audit days are primarily determined by IAF MD 5, which sets mandatory minimum audit durations based on the number of employees in the ISMS scope. Additional days are added for: multiple locations (IAF MD 1 multi-site rules), high-risk industries, complex IT environments, and multiple data centres. CBs cannot go below the IAF minimum but can add days based on complexity assessment.
Can you negotiate ISO 27001 audit day rates?
Yes. The number of audit days is set by IAF minimums and cannot be reduced, but day rates and admin fees are negotiable. Request 3+ quotes and use them as leverage. Multi-year contracts (3-year bundled pricing) typically offer 10-15% discount. Timing also matters: CBs may offer lower rates for off-peak periods or short-notice availability.
Are remote audits cheaper than on-site?
Yes, typically 15-25% cheaper per day. Remote audits eliminate travel expenses entirely ($500-$3,000 savings) and some CBs offer a reduced day rate for remote days. However, remote audits may require slightly more days due to evidence review limitations and the inability to do physical security walkthroughs remotely.