How to Apply for ISO 9001, 14001 or 45001 Certification: Application Form, Contract Review and Audit Time

“How much does ISO 9001 certification cost?” is not a pricing question. It is an arithmetic one. The price of a management system certification is driven first by a number of auditor days, and that number is calculated before the audit, from the information you declare on the application form. That is where the gap between two quotations is decided.

An ISO application is not a commercial form

ISO writes the standards but certifies no one. Certification is issued by independent certification bodies whose own rules are set by ISO/IEC 17021-1 and verified by a national accreditation body — UKAS in the United Kingdom, ANAB in the United States, Cofrac (the French accreditation committee) in France; our guide to checking an ISO certificate walks through the entries line by line.

It follows that the application form you fill in is not drafted freely by the certification body. Clause 9.1.1 requires it to obtain, from an authorised representative of the applicant organisation:

• the desired scope of certification;
• relevant details of the applicant organisation: the specific certification scheme, the name and address of each of its sites, its processes and operations, its human and technical resources, its functions, relationships and any relevant legal obligations;
• identification of outsourced processes that will affect conformity to requirements;
• the standards or requirements for which certification is sought;
• whether consultancy relating to the management system to be certified has been provided, and if so by whom.

That last question is not idle curiosity. ISO/IEC 17021-1 treats consultancy as a significant threat to impartiality: a certification body must not certify a management system where a related body provided consultancy, for a minimum of two years after that consultancy ended — a structural constraint worth knowing before you appoint a consultant, as our article on ISO 45001 consultancy support, cost and limits sets out.

Application review: what the certification body checks on its side

Clause 9.1.2 requires a formal review before any proposal. The body must satisfy itself that the information is sufficient, that any known difference of understanding between it and you is resolved, and that it has the competence and ability to perform the certification activity — with regard to the desired scope, the location, the time required, the language, safety conditions and any threats to impartiality. It then either accepts or declines: a refusal must be reasoned, documented and communicated to you.

Calculating audit time: the IAF MD 5 mechanism

IAF MD 5:2023 (Issue 4, Version 3), from the International Accreditation Forum, is mandatory for the consistent application of ISO/IEC 17021-1. Its title states its scope: determination of audit time of quality, environmental, and occupational health and safety management systems — that is, ISO 9001, ISO 14001 and ISO 45001. It opens by stating that the correct determination of audit time for an initial audit (stage 1 plus stage 2) is an integral part of the application review.

Effective number of personnel: the starting variable

The starting point is the effective number of personnel: all personnel — permanent, temporary and part-time — involved within the scope of certification, including those working on each shift, and contractors where they fall within the scope. For ISO 45001, it also covers personnel from contractors and subcontractors performing work under the control or influence of the organisation.

A few conversion rules that applicants routinely get wrong:

• Part-time staff are converted to full-time equivalents. The document’s own example: 30 part-time people working 4 hours a day equate to 15 full-time personnel.
• Seasonal operations are calculated on the personnel typically present in peak season, not on an annual average.
• Similar or repetitive roles (cleaning, security, transport, sales, call centres) may attract a reduction, provided it is coherent, applied consistently from company to company and documented.
• The justification for the effective number used must be available to you and to the accreditation body.

The starting table

The IAF MD 5 tables give initial audit time (stage 1 + stage 2) in days. ISO 9001 has a single column, modulated afterwards by risk category; ISO 14001 and ISO 45001 have one column per complexity category.

Effective personnel (FTE)	ISO 9001 (days)	ISO 14001, low → high complexity	ISO 45001, low → high complexity
1-5	1.5	2.5 → 3	2.5 → 3
6-10	2	3 → 3.5	3 → 3.5
11-15	2.5	3 → 4.5	3 → 4.5
16-25	3	3.5 → 5.5	3.5 → 5.5
26-45	4	4 → 7	4 → 7
46-65	5	4.5 → 8	4.5 → 8
66-85	6	5 → 9	5 → 9
86-125	7	5.5 → 11	5.5 → 11
126-175	8	6 → 12	6 → 12
176-275	9	7 → 13	7 → 13

Values from Tables QMS 1, EMS 1 and OH&SMS 1 of IAF MD 5:2023. ISO 14001 additionally has a “limited” complexity category below the figures above. The tables set neither a minimum nor a maximum: they are a starting point.

Two lessons. The progression is not linear: moving from 25 to 45 employees adds one ISO 9001 audit day, and so does moving from 125 to 175. And the gap between standards is real: at equal headcount, an environmental or health and safety system in a complex sector consumes far more time than a quality system, which is consistent with observed ISO 14001 budgets and ISO 45001 budgets.

What moves the number

IAF MD 5 lists the adjustment factors. Upwards: logistics spread across more than one building, staff speaking more than one language, a very large site for the headcount, a highly regulated sector, highly complex processes, temporary sites to visit and — for ISO 9001 — high-risk activities and outsourced functions or processes. Downwards: client not design responsible, a very small site for the headcount, maturity of the management system, prior knowledge of the client, a high level of automation, and off-location staff whose compliance can substantially be audited through records.

Four guardrails frame the exercise:

• total reduction shall not exceed 30 % of the times established from the tables;
• the result is rounded to the nearest half day (5.3 becomes 5.5; 5.2 becomes 5);
• on-site duration should not fall below 80 % of the calculated audit time;
• time spent by auditors-in-training, observers and technical experts does not count towards audit time.

One provision few applicants use: the certification body shall provide the audit time determination and its justification to the client as part of the contract. It is the only serious way to compare two quotations.

Multi-site: the square root that sets the quotation

As soon as several locations are involved, IAF MD 1:2023 applies. Site sampling is not automatic: it requires an eligible organisation — a single management system, an identified central function that is not subcontracted, a centralised management review, an internal audit programme covering all sites — and sites performing very similar processes and activities. Where it is permitted, the minimum sample size is arithmetic:

Audit type	Number of sites sampled
Initial audit	√x, rounded up to the next whole number
Surveillance audit (annual)	0.6 × √x, rounded up to the next whole number
Recertification audit	√x; reducible to 0.8 × √x where the system has proved effective over the cycle

x = total number of sites. At least 25 % of the sample is selected at random; the central function is audited at initial certification, at every recertification and at least once a calendar year as part of surveillance.

For 16 sites: 4 at initial audit, 3 at surveillance. Declaring 12 instead of 16 therefore buys very little — but letting a forgotten site surface during the audit can force a contract revision.

The audit programme: a three-year cycle, not an audit

Application review results in an audit programme covering the full certification cycle, not a stand-alone engagement. ISO/IEC 17021-1 sets the architecture; IAF MD 5 sets the time proportions.

Sequence	Timing	Indicative time
Stage 1 then stage 2	Initial audit; the three-year cycle begins with the certification decision	Table baseline; in practice stage 2 exceeds stage 1
Surveillance, years 1 and 2	At least once a calendar year; the first no more than 12 months after the certification decision	About 1/3 of initial audit time per year
Recertification, year 3	Before the certificate expires	About 2/3 of the time an initial audit would require if carried out at that date — not 2/3 of the time originally spent

Stage 1 reviews the documented management system, evaluates readiness for stage 2, reviews your understanding of the standard’s requirements, obtains the information on scope — sites, processes and equipment, levels of control, applicable statutory and regulatory requirements — and evaluates whether internal audits and management reviews are being planned and performed. Its conclusions are documented; unresolved areas of concern are raised as nonconformities during stage 2, and the body may postpone it or repeat all or part of stage 1. Stage 2 evaluates implementation and effectiveness on site: see our comparison of initial, surveillance and renewal audits.

The mistakes that cost most at application stage

1. A scope written too broadly. Every declared activity has to be audited; a scope inflated for marketing effect is paid for in audit days and in nonconformities.
2. A misdeclared headcount. Leaving out agency staff, night shifts or peak season distorts the calculation and exposes you to a mid-cycle contract revision.
3. Undeclared sites — branches, warehouses, virtual sites, project sites. A virtual site counts as a single site in the calculation.
4. Outsourced processes left unmentioned. The body must obtain evidence that you control them; it is an explicit factor for increasing audit time under ISO 9001 and ISO 14001.
5. Comparing quotations without comparing scopes. Two proposals with identical headcount but different complexity assumptions are not comparable.

What the research says about the return on certification

Audit time is a cost; the benefit has been measured. Charles Corbett, María Montes-Sancho and David Kirsch analysed in 2005 in Management Science (“The Financial Impact of ISO 9000 Certification in the United States: An Empirical Analysis”) the financial performance of publicly traded US manufacturers certified to ISO 9000 between 1987 and 1997 (see the study). David Levine and Michael Toffel extended the argument to the employment side in 2010, also in Management Science (“Quality Management and Job Quality: How the ISO 9001 Standard for Quality Management Systems Affects Employees and Employers”), using a matched sample of nearly a thousand Californian companies (see the study). On the environmental side, Matthew Potoski and Aseem Prakash examined in 2005 in the Journal of Policy Analysis and Management (“Covenants with weak swords: ISO 14001 and facilities’ environmental performance”) more than 3,000 US facilities regulated as major sources under the Clean Air Act (see the study).

One practical conclusion emerges: the value of a certification lies in what the system actually produces, not in the certificate.

Take action

Before sending an application form, lock down three things: the exact wording of the scope, the complete list of sites, and your effective number of personnel in full-time equivalents — then require each certification body to hand over its audit time determination and justification. For preparing the system itself, see our guides to ISO 9001, ISO 14001 and ISO 45001, together with our step-by-step routes to obtaining ISO 14001 certification and obtaining ISO 45001 certification.