What makes up the cost of ISO 9001 certification?
Three blocks: your teams’ time, consulting and training, and the certification audit. The first is almost always the heaviest, and the only one you fully control; the third should be reckoned over three years, not over the initial audit alone.
Block | What it covers | What makes it vary | Possible funding |
|---|---|---|---|
Internal time | Management, project manager, process owners, internal auditors, staff awareness | Starting point, number of processes, team availability | No |
Consulting | Gap analysis, building the system, mock audit, support during the audit | Gaps to close, number of sites, team autonomy | No (consulting) |
Training | ISO 9001:2026 requirements, process ownership, internal auditors | Number of people, in-house or public sessions | OFPPT CSF, under the rules in force |
Training engineering | Training needs analysis, training plan | Size and organisation of the company | GIAC, under the rules in force |
Certification | Stages 1 and 2, two surveillance audits, recertification, travel costs | Headcount, risk, sites, outsourcing | No |
We do not publish prices: quotes depend on your site, and a serious comparison is based on justified audit time and on the content of the support.
How does the certification body calculate audit days?
Under a public, mandatory document, Global ACI-TECH-3-004 (version 1.0 of 10 July 2026), which takes over the former IAF MD 5. Global ACI is the body that took over the work of the International Accreditation Forum (IAF). The starting point is the headcount within the scope: permanent, temporary and part-time staff, shift teams included. Part-time staff are converted into full-time equivalents: 30 people working four hours a day count as 15.
Extract from Global ACI table QMS 1 (initial audit, stages 1 and 2 combined):
Headcount retained | Audit days (stages 1 + 2) | Headcount retained | Audit days (stages 1 + 2) |
|---|---|---|---|
1 to 5 | 1.5 | 66 to 85 | 6 |
6 to 10 | 2 | 86 to 125 | 7 |
11 to 15 | 2.5 | 126 to 175 | 8 |
16 to 25 | 3 | 176 to 275 | 9 |
26 to 45 | 4 | 276 to 425 | 10 |
46 to 65 | 5 | 426 to 625 | 11 |
This starting figure is then adjusted:
- for the risk of the activity: high for food, pharmaceuticals, complex construction or chemicals, medium for simple construction or metal products, low for office services or education (Global ACI examples);
- upwards for several locations, construction projects to visit, the need for an interpreter, heavy regulation, complex or outsourced processes;
- downwards where there is no design, for a mature system, a high level of automation, or itinerant staff whose activity can be checked on records.
Three safeguards frame the calculation: the reduction cannot exceed 30% of the table time; on-site time should not fall below 80% of the calculated time; travel and breaks do not count. The certification body must give you the audit time retained and its justification as part of the contract.
Over the cycle, annual surveillance time is about one third of the initial audit, and recertification about two thirds of the time an initial audit would require at that point; neither is likely to last less than one day. For an SME of 40 people at medium risk, the theoretical calculation, before any adjustment, thus gives 4 days for stages 1 and 2, about 1.5 days per surveillance audit (the document rounds to the nearest half day) and about 2.5 days at recertification if the headcount has not changed.
Several sites, construction projects, subcontractors: what changes?
The number of sites matters, but not proportionally. Document Global ACI-TECH-3-001 allows sampling where sites carry out very similar activities under a central function that controls the system and carries out the internal audits. At the initial audit, the certification body audits at least the square root of the number of sites, rounded up to the next whole number, with at least a quarter of them chosen at random; at surveillance, 0.6 times that square root. The central function is audited at every initial audit and every recertification, and at least once per calendar year. A distributor operating nine identical depots would thus have at least three depots audited at the initial audit.
When sites are too different to be sampled, all of them are audited at the initial audit and at recertification, and 30% of them each year at surveillance.
Temporary construction projects are included in the audit programme and sampled according to risk, with on-site audit remaining the rule. For outsourced processes, the certification body audits your control over them, not your provider’s system.
How long does an ISO 9001 certification project take?
The time it takes to build the system, then to run it long enough to produce evidence. The standard sets no duration: only a gap analysis allows a realistic schedule.
Factor | Effect on project duration | Effect on audit days |
|---|---|---|
Practices already written and applied | Shortens the build considerably | None directly; lower risk of findings |
Headcount | More people to train and make aware | Basis of the calculation |
Number of processes, and design | More owners, more documents, more internal audits | Increase if processes are complex or include design |
Number of sites and construction projects | Site-by-site roll-out | Increase, or sampling if sites are similar |
Availability of the project manager and process owners | Frequent cause of delay | None |
Customer deadline | May call for a mock audit or a tighter schedule | None |
Certification body’s calendar | Stage 1 and stage 2 dates must be booked; the transition of its accreditation to the 2026 edition conditions the certificate | None |
That last point is specific to 2027: according to the Global ACI transition document, a certification body issues accredited ISO 9001:2026 certificates only after its accreditation body’s transition decision, due by 30 September 2027 at the latest. The consequences are detailed in our article on a first ISO 9001 certification since the 2026 edition, and the steps in our ISO 9001 certification steps checklist.
What can CSF and GIAC fund in Morocco?
Training and training engineering, not consulting or the audit. In Morocco, OFPPT (Office de la formation professionnelle et de la promotion du travail, the national vocational training office) runs the special training contracts (contrats spéciaux de formation, CSF). Training actions written into the company’s training plan can be reimbursed under the CSF of OFPPT, according to the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014), at a reference rate of 70% for planned training delivered by an external provider and 40% for unplanned training, within a ceiling calculated on the vocational training tax (taxe de formation professionnelle, TFP) the company has declared. Law No. 60-17 also gives the GIACs, the sector-based interprofessional groups, the task of helping employers draw up their training plans, engineering studies included.
A rate is not an amount: actual funding depends on the eligibility of each action, on your company’s own ceiling and on the compliance of the file. We promise no amount; we simulate your case and build the file with you, as explained on our page on OFPPT special training contracts (CSF) and GIAC funding.
For a company outside Morocco, the audit time rules described above stay the same, since they come from a mandatory Global ACI document rather than from Moroccan law; only the CSF and GIAC funding mechanisms are specific to Morocco.
To keep the budget under control:
The full journey is described in our guide to ISO 9001 certification in Morocco.