What makes up the cost of ISO 9001 certification?

Three blocks: your teams’ time, consulting and training, and the certification audit. The first is almost always the heaviest, and the only one you fully control; the third should be reckoned over three years, not over the initial audit alone.

Block

What it covers

What makes it vary

Possible funding

Internal time

Management, project manager, process owners, internal auditors, staff awareness

Starting point, number of processes, team availability

No

Consulting

Gap analysis, building the system, mock audit, support during the audit

Gaps to close, number of sites, team autonomy

No (consulting)

Training

ISO 9001:2026 requirements, process ownership, internal auditors

Number of people, in-house or public sessions

OFPPT CSF, under the rules in force

Training engineering

Training needs analysis, training plan

Size and organisation of the company

GIAC, under the rules in force

Certification

Stages 1 and 2, two surveillance audits, recertification, travel costs

Headcount, risk, sites, outsourcing

No

We do not publish prices: quotes depend on your site, and a serious comparison is based on justified audit time and on the content of the support.

How does the certification body calculate audit days?

Under a public, mandatory document, Global ACI-TECH-3-004 (version 1.0 of 10 July 2026), which takes over the former IAF MD 5. Global ACI is the body that took over the work of the International Accreditation Forum (IAF). The starting point is the headcount within the scope: permanent, temporary and part-time staff, shift teams included. Part-time staff are converted into full-time equivalents: 30 people working four hours a day count as 15.

Extract from Global ACI table QMS 1 (initial audit, stages 1 and 2 combined):

Headcount retained

Audit days (stages 1 + 2)

Headcount retained

Audit days (stages 1 + 2)

1 to 5

1.5

66 to 85

6

6 to 10

2

86 to 125

7

11 to 15

2.5

126 to 175

8

16 to 25

3

176 to 275

9

26 to 45

4

276 to 425

10

46 to 65

5

426 to 625

11

This starting figure is then adjusted:

  • for the risk of the activity: high for food, pharmaceuticals, complex construction or chemicals, medium for simple construction or metal products, low for office services or education (Global ACI examples);
  • upwards for several locations, construction projects to visit, the need for an interpreter, heavy regulation, complex or outsourced processes;
  • downwards where there is no design, for a mature system, a high level of automation, or itinerant staff whose activity can be checked on records.

Three safeguards frame the calculation: the reduction cannot exceed 30% of the table time; on-site time should not fall below 80% of the calculated time; travel and breaks do not count. The certification body must give you the audit time retained and its justification as part of the contract.

Over the cycle, annual surveillance time is about one third of the initial audit, and recertification about two thirds of the time an initial audit would require at that point; neither is likely to last less than one day. For an SME of 40 people at medium risk, the theoretical calculation, before any adjustment, thus gives 4 days for stages 1 and 2, about 1.5 days per surveillance audit (the document rounds to the nearest half day) and about 2.5 days at recertification if the headcount has not changed.

Several sites, construction projects, subcontractors: what changes?

The number of sites matters, but not proportionally. Document Global ACI-TECH-3-001 allows sampling where sites carry out very similar activities under a central function that controls the system and carries out the internal audits. At the initial audit, the certification body audits at least the square root of the number of sites, rounded up to the next whole number, with at least a quarter of them chosen at random; at surveillance, 0.6 times that square root. The central function is audited at every initial audit and every recertification, and at least once per calendar year. A distributor operating nine identical depots would thus have at least three depots audited at the initial audit.

When sites are too different to be sampled, all of them are audited at the initial audit and at recertification, and 30% of them each year at surveillance.

Temporary construction projects are included in the audit programme and sampled according to risk, with on-site audit remaining the rule. For outsourced processes, the certification body audits your control over them, not your provider’s system.

How long does an ISO 9001 certification project take?

The time it takes to build the system, then to run it long enough to produce evidence. The standard sets no duration: only a gap analysis allows a realistic schedule.

Factor

Effect on project duration

Effect on audit days

Practices already written and applied

Shortens the build considerably

None directly; lower risk of findings

Headcount

More people to train and make aware

Basis of the calculation

Number of processes, and design

More owners, more documents, more internal audits

Increase if processes are complex or include design

Number of sites and construction projects

Site-by-site roll-out

Increase, or sampling if sites are similar

Availability of the project manager and process owners

Frequent cause of delay

None

Customer deadline

May call for a mock audit or a tighter schedule

None

Certification body’s calendar

Stage 1 and stage 2 dates must be booked; the transition of its accreditation to the 2026 edition conditions the certificate

None

That last point is specific to 2027: according to the Global ACI transition document, a certification body issues accredited ISO 9001:2026 certificates only after its accreditation body’s transition decision, due by 30 September 2027 at the latest. The consequences are detailed in our article on a first ISO 9001 certification since the 2026 edition, and the steps in our ISO 9001 certification steps checklist.

What can CSF and GIAC fund in Morocco?

Training and training engineering, not consulting or the audit. In Morocco, OFPPT (Office de la formation professionnelle et de la promotion du travail, the national vocational training office) runs the special training contracts (contrats spéciaux de formation, CSF). Training actions written into the company’s training plan can be reimbursed under the CSF of OFPPT, according to the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014), at a reference rate of 70% for planned training delivered by an external provider and 40% for unplanned training, within a ceiling calculated on the vocational training tax (taxe de formation professionnelle, TFP) the company has declared. Law No. 60-17 also gives the GIACs, the sector-based interprofessional groups, the task of helping employers draw up their training plans, engineering studies included.

A rate is not an amount: actual funding depends on the eligibility of each action, on your company’s own ceiling and on the compliance of the file. We promise no amount; we simulate your case and build the file with you, as explained on our page on OFPPT special training contracts (CSF) and GIAC funding.

For a company outside Morocco, the audit time rules described above stay the same, since they come from a mandatory Global ACI document rather than from Moroccan law; only the CSF and GIAC funding mechanisms are specific to Morocco.

To keep the budget under control:

The full journey is described in our guide to ISO 9001 certification in Morocco.