By Russell Lawson, ISO consultant, lead auditor and founder of The Compliance Companion - the practical platform helping businesses achieve ISO 9001, ISO 14001, ISO 45001 and ISO 27001 through structured templates, AI-powered tools and real-world guidance. Russell has worked with hundreds of organisations across the UK and understands not just how ISO works - but what it actually costs in practice.
One of the first questions any business asks when considering ISO certification is:
“How much is this going to cost us?”
And it’s a fair question. Because unlike buying software or equipment, ISO isn’t a single purchase - it’s a combination of time, effort, external audit fees, and ongoing commitment.
The problem is, most answers online are vague. They either throw out a generic number or avoid the question entirely.
So here’s a clear, honest breakdown - based on what I’ve seen working with businesses of all sizes, and from the auditor’s side of the table as well.
The Short Answer (Before We Break It Down)
For a typical small to medium-sized business in the UK:
- ISO 9001: often £1,000 - £3,000 per year (certification body fees)
- ISO 27001: often £2,000 - £6,000+ per year (more complex, more audit time)
- Implementation costs: can range from near zero (DIY) to several thousand pounds (consultant-led)
But those numbers don’t tell the full story.
Because the real cost of ISO comes from three areas - and most businesses only think about one of them.
1. The Cost of Getting Ready (Implementation)
This is where the biggest variation happens.
Some businesses choose to:
- Build everything themselves from scratch
- Buy templates and work through them internally
- Use a consultant to guide or do the work
I’ve seen all three approaches work - but they come with very different costs.
If you do it yourself, your financial outlay might be low. But the hidden cost is time. Someone in your business has to learn the standard, build the system, and make sure it all fits together.
If you use a consultant, you’re paying for speed and experience. You’ll likely reach certification faster and avoid mistakes - but you’re trading that for a higher upfront cost.
This is exactly why I built The Compliance Companion - to sit in the middle. It gives you structure, templates and guidance without the full cost of consultancy.
2. The Cost of Certification (The Audit Itself)
This is the part most people think of first - the external audit.
Certification bodies charge based on:
- The size of your business
- The number of employees
- The complexity of your operations
- The standard(s) you’re going for
ISO 27001 is typically more expensive than ISO 9001 because it requires more audit time. There’s simply more to review - risk assessments, controls, access management, supplier security, and so on.
One thing I always tell clients:
The audit cost is relatively predictable. The preparation cost is where things vary.
Also worth noting - most certification bodies operate on a three-year cycle, with surveillance audits each year. So you’re not just paying once; you’re committing to maintaining the system.
3. The Cost Most Businesses Miss: Internal Time
This is the one that catches people out.
ISO requires:
- Internal audits
- Management reviews
- Ongoing updates to documents and controls
- Staff awareness and training
None of this is particularly difficult - but it does take time.
I’ve worked with businesses where ISO became a burden because it was layered on top of everything else, without being integrated into how they already worked.
And I’ve worked with others where ISO actually saved time - because it brought structure, clarity and consistency.
The difference is how the system is built.
What Drives Costs Up (And Down)
From my experience, the biggest cost drivers aren’t the standard itself - they’re the decisions you make early on.
Costs tend to increase when:
- The system is overcomplicated
- Too many unnecessary documents are created
- There’s no clear owner internally
- Everything is left until the last minute before audit
Costs tend to decrease when:
- The system is kept lean and relevant
- Existing processes are used (not reinvented)
- Responsibility is clearly assigned
- Preparation is done steadily over time
This is something I see clearly as an auditor. The businesses with the simplest systems are often the most effective - and the least stressed during audits.
Is ISO Worth the Cost?
That depends entirely on what you want from it.
If you’re doing it purely as a tick-box exercise, then yes - it can feel like an expense.
But if you’re using it to:
- Win contracts
- Build credibility
- Improve internal processes
- Reduce risk
- Strengthen customer confidence
Then it becomes an investment.
I’ve seen businesses win work directly because they achieved ISO certification. I’ve also seen others streamline their operations and reduce errors simply by putting a proper system in place.
A Final Thought
ISO doesn’t have to be expensive.
It becomes expensive when it’s overcomplicated, rushed, or treated as something separate from the business.
Done properly, it should fit around how you already operate - adding structure without adding unnecessary weight.
If you’re exploring certification and want a clearer, more cost-effective route, you can see how The Compliance Companion works here:
https://the-compliance-companion.co.uk/harness-the-future-of-iso