ISO 9001 Software Cost UK: What You Pay For

ISO documentation is sold four different ways in the UK — a one-off template pack, an annual toolkit licence, a per-seat subscription, and consultancy days — and the quotes are not comparable, because each covers a different share of the work. Before you compare prices, work out which of the four you are being quoted for. Then separate it from the cost that is not software at all: your certification body's audit days, which are the one line on the whole project with a published basis you can check for yourself.

Why two quotes for "ISO 9001 software" differ by an order of magnitude

Because they are not the same product. The word covers everything from a zip of Word files to a hosted system with workflow and audit trails, and almost nobody states which they are selling.

What is being sold	What you get	What you still have to do	What drives the price
Template pack (one-off)	Documents to edit	All the tailoring, all the implementation, all the evidence	Number of documents; nothing else
Toolkit licence (annual)	Templates plus guidance, updated when standards change	Tailoring and implementation	Number of standards covered; update entitlement
Subscription system (per seat, monthly or annual)	Somewhere to store, control and version documents; often task tracking	Writing the content; running the system	Seats, standards, modules — seats usually dominate
Consultancy (day rate or fixed project)	Someone doing the work with you	Operating the system afterwards	Days, and whether the deliverable is defined

The decision that moves the number most is not which product you buy — it is how much of the writing you do. Documentation is the largest controllable line on an ISO project, and it stays the largest whichever tool sits underneath it.

Our guide on where the savings actually are ranks the levers; DIY ISO 9001 certification is honest about where doing it yourself genuinely struggles.

We are not publishing £ figures for these four models here. UK vendors and consultancies quote per scope and most do not publish rate cards, so any range we printed would be our own observation rather than a sourced figure — and a made-up band is worse than no band. What we can give you is the structure, and the one part of the bill that is published.

The cost line you can actually check: audit days

Certification body fees are usually the second-largest line, and unlike everything above, their basis is a public document.

Audit duration for quality management systems is set out in a mandatory accreditation document. It was published for years as IAF MD 5; since the International Accreditation Forum "ceased operations on 01 January 2026" (per its own legacy site), the work has passed to Global Accreditation Cooperation Incorporated, whose technical documents index lists the successor as Global ACI-TECH-3-004 (M), Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems, issued 10 July 2026 with an implementation date of 28 August 2026.

Usefully, the reissue changed nothing that matters to you. Global ACI-TECH-3-004 (M) says so in its own introduction: it "is based upon the IAF (International Accreditation Forum) document IAF MD 5:2023 … On the transfer of the role of IAF to the Global Accreditation Cooperation Incorporated (Global ACI), the text has been reformatted to be a Global ACI document without any substantive change to the text."

So the figures below are Table QMS 1 as printed in the current document — "Relationship between Effective Number of Personnel and Audit Time (Initial Audit only)":

Effective number of personnel	Initial audit, Stage 1 + Stage 2 (days)
1–5	1.5
6–10	2
11–15	2.5
16–25	3
26–45	4
46–65	5
66–85	6
86–125	7
126–175	8

(The table continues above 175 people: 176–275 is 9 days, 276–425 is 10, and it rises to 22 days at 8,501–10,700.)

Three things in that document matter more than the table itself.

Surveillance and recertification are derived from it, not quoted independently. Annual surveillance should total "about 1/3 of the audit time spent on the initial certification audit", and recertification "is normally approximately 2/3 of the audit time that would be required for an initial certification audit (Stage 1 + Stage 2) of the organisation if such an initial audit were to be carried out at the time of recertification (i.e. not 2/3 of the original time spent on the initial audit)". In practice that means re-reading the table at your current headcount at recertification time, not halving your original day count — and the document adds that "It is unlikely that a surveillance audit duration will be less than one (1) audit day."

There is a floor. "The duration of a management system certification audit … should typically not be less than 80% of the audit time calculated following the methodology in Section 3. This applies to initial, surveillance and recertification audits." A quote materially below the table is not a better price; it is a shorter audit, and under-auditing is an accreditation problem for the body rather than a bargain for you.

You are entitled to see the calculation. This is the single most useful sentence in the document and almost nobody asks for it: "The CAB shall provide the audit time determination and the justification to the client organisation as part of the contract and make it available to its Accreditation Body."

Ask for it. A quote with the day count and its justification attached is comparable with another quote on the same basis. A headline price is not.

What is and is not inside an audit day

Also from Global ACI-TECH-3-004 (M), and worth knowing before you agree a schedule:

• Audit time "includes the total time on-site at a client's location (physical or virtual) … and time spent off-site carrying out planning, document review, interacting with client personnel and report writing."
• "Travel (en-route or between sites) and any breaks are not included in the on-site duration" — so travel is usually billed separately. Ask.
• "The number of audit days allocated shall not be reduced at the planning stages by programming longer hours per working day." A body cannot compress three days into two long ones.
• "Normal practice is that time spent for Stage 2 exceeds time spent for Stage 1."

⚠️ One scope limit to respect: MD 5 and its successor cover quality, environmental and occupational health and safety management systems. They do not govern ISO 27001. ISMS audit time sits under ISO/IEC 27006-1, which UKAS notes was revised in 2024 with "updated the audit time calculation requirements" in its ISO/IEC 27006-1:2024 technical bulletin. Do not apply the QMS table to an ISO 27001 quote.

Nine questions to put on every quote

Whatever you are being quoted for, these separate a comparable quote from a headline price.

1. Which of the four models is this — pack, toolkit licence, subscription, or days?
2. If it is a subscription: what happens to my documents if I stop paying?
3. Is there a setup, onboarding, implementation or data-migration fee on top of the recurring price?
4. Is the price per seat, and which of my people genuinely need a seat?
5. When the standard changes, do I get updated content inside this price or is it a new purchase? (ISO 9001 changed on 16 September 2026 and ISO/IEC 27001 in 2022 — this is not hypothetical.)
6. Does it cover both standards if I need both, or one price each? An integrated management system is usually cheaper to run than two.
7. From the certification body: the audit-time determination and its justification, in writing, as part of the contract.
8. From the certification body: Stage 1 days, Stage 2 days, surveillance days for years 2 and 3, recertification days, travel, certificate fees, and the cost of a nonconformity follow-up visit — itemised.
9. Is the certification body UKAS-accredited for my sector? Check it in the UKAS directory of accredited organisations, because an unaccredited certificate is cheaper and usually fails the requirement you were certifying for.

The honest answer for a lot of small businesses

You may not need dedicated software. ISO 9001 requires documented information to be available, controlled and maintained; it does not require a product to do that. A well-organised shared drive with a naming convention, a version column and a review date does satisfy document control for a single-site business under about 25 people, and an auditor will accept it if it genuinely works.

Software earns its cost when the manual version has started failing — multiple sites, people editing the wrong copy, review dates being missed, or an audit finding against document control. Buy it for a problem you have, not for the certificate.

What this actually costs, end to end

Software is rarely the biggest number. For the full first-year picture — certification body fees, consultancy, internal time, the standard itself — see the ISO 9001 certification cost breakdown, and note that its figures are stated there as this site's own estimates rather than published rates. The free ISO 9001 cost estimator gives you a baseline for your size and sector to compare quotes against, and what to look for in an ISO documentation tool covers capability rather than price.

Practical takeaway checklist

1. Establish which of the four models you are being quoted for before comparing anything
2. Expect a setup fee on top of a subscription, and ask what it covers
3. Ask what happens to your documents if you stop paying
4. Ask whether standard updates are included — ISO 9001 changed in September 2026
5. Get the certification body's audit-time determination and justification in writing; you are entitled to it
6. Sanity-check the day count against the published QMS audit-time table
7. Treat a quote materially below the table as a shorter audit, not a saving
8. Surveillance is roughly a third of initial audit time; recertification roughly two-thirds
9. Never apply the QMS audit-time table to an ISO 27001 quote
10. Confirm UKAS accreditation and sector scope before signing anything

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. No prices for software, toolkits or consultancy are stated here, because UK vendors quote per scope and do not publish rate cards — treat any figure you are given as specific to your scope. The audit-day figures are quoted from Global ACI-TECH-3-004 (M), issue 1.0, the current mandatory document, which states it carries IAF MD 5:2023's text "without any substantive change". ISO 9001 is a voluntary standard, not a legal requirement. Verify audit duration and accreditation scope with your UKAS-accredited certification body.