Fixed fee vs time and materials is the pricing decision every compliance consultant makes on every proposal, and the one most often made by habit rather than by the shape of the work. A fixed fee sells certainty: the client knows the number, the consultant carries the risk of the estimate, and the margin depends on delivering in fewer hours than the price assumes. Time and materials sells flexibility: the client pays for what is used, the consultant carries no estimating risk, and the margin depends on utilisation and the rate.
Neither is right in general; each is right for a particular kind of engagement, and the mistake is pricing open-ended remediation as a fixed fee or a repeatable ISO 27001 implementation as T&M. This guide sets out the six differences between the models, which compliance engagements suit each, the hybrids that solve most of the hard cases, how to write a fixed-fee scope that does not become an unpaid T&M engagement, how to run T&M so the client does not feel the meter, and the pricing faults that cost consultants their margin.

Fixed fee vs time and materials: six differences
| Dimension | Fixed fee | Time and materials |
|---|---|---|
| What the client buys | An outcome at a price | Effort at a rate |
| Who carries the estimating risk | The consultant | The client |
| Where the margin comes from | Delivering in fewer hours than priced — methods, templates, experience | Rate and utilisation; every hour billed |
| Scope discipline | Essential; every change is a negotiation | Optional; scope drifts and the invoice follows |
| Cash flow | Milestones — deposit, stage payments, completion | Monthly in arrears against timesheets |
| Client relationship | Aligned on outcome; friction on change | Aligned on effort; friction on the bill |
Which compliance engagements suit fixed fee vs time and materials
| Engagement | Best model | Why |
|---|---|---|
| ISO 27001 / 9001 / 14001 / 45001 implementation to certification-ready | Fixed fee, phased | Repeatable scope; templates and method give the efficiency margin; the client wants a number |
| Gap analysis or readiness assessment | Fixed fee | Bounded effort; often credited against the follow-on |
| Internal audit programme | Fixed fee per audit or per cycle | Known scope per standard and site |
| SOC 2 readiness | Fixed fee with a capped T&M tail for evidence remediation | Design is bounded; remediation is not |
| Remediation after audit failure or enforcement | Time and materials, with a not-to-exceed cap and weekly reporting | Scope unknown until the root cause is found |
| Regulator liaison, investigation support, expert witness | Time and materials | Effort driven by third parties the consultant does not control |
| Virtual CISO or compliance officer | Retainer — fixed monthly fee for defined days | Ongoing role; predictable for both sides |
| Policy and documentation drafting | Fixed fee per document set | Template-led; highest efficiency margin |
| Multi-framework programme (ISO 27001 + SOC 2 + GDPR) | Phased fixed fees per framework, T&M for integration surprises | Each framework is bounded; the overlap is where surprises live |
The fixed fee vs time and materials choice per engagement is the first pricing decision; our guide to compliance consulting rates gives the fixed-fee ranges for the bounded engagements; our guide to multi-framework compliance covers the overlaps that make the last row hard to price.
Fixed fee vs time and materials hybrids
- Capped time and materials. T&M with a not-to-exceed figure; the client gets a ceiling, the consultant is paid for effort up to it, and a change process reopens the cap.
- Phased fixed fees. Discovery at a small fixed fee, then a fixed price for implementation set from what discovery found — the estimate is made with information rather than guessed.
- Fixed fee with a T&M tail. Design and documentation fixed; remediation and evidence chasing on a rate card.
- Retainer with a bank of days. A monthly fee for defined days, unused days rolling for a limited period, overage on a rate card.
- Value-based fee for the outcome — a certification, a closed enforcement action — where the consultant controls enough of the outcome to price it; rare in compliance because certification bodies and regulators decide the result.
Writing a fixed-fee scope that stays fixed
| Element | What to write | What happens without it |
|---|---|---|
| Deliverables | Named documents, records, workshops, audits — with acceptance criteria | The client expects more; the consultant delivers more; nobody is paid for it |
| Assumptions | Client availability, decision turnaround, site count, staff count, existing controls, tools provided | Every missed assumption is unpaid work |
| Exclusions | Certification body fees, remediation of technical controls, tools and licences, travel, work outside the named standard | The fee is read as all-inclusive |
| Client responsibilities | Evidence provision, approvals, access, a named counterpart | The consultant chases; the hours vanish |
| Change process | How a change is raised, priced and approved before work continues | Scope creep by email |
| Milestones and payments | Deposit; stage payments on named deliverables; final on completion, not on certification | Payment held hostage to an auditor’s diary |
| Rate card for out-of-scope work | Day and hour rates for additional work | Extras done free or argued over |
Running time and materials so the client does not feel the meter
- Estimate anyway. A T&M engagement with a written estimate and weekly burn reporting is what clients mean when they say they want a fixed fee.
- Report weekly: hours used, hours remaining against estimate, what was done, what is next.
- Cap it and reopen the cap with a written change, not a surprise invoice.
- Bill promptly and in detail. Late, vague invoices are where T&M relationships die.
- Convert when the scope settles. Once remediation is understood, offer a fixed fee for the remainder.
Fixed fee vs time and materials: pricing faults that cost margin
- Fixed fee without assumptions. The most expensive four words in consulting are “we assumed you had”.
- Fixed fee for unknown scope. Remediation priced before the root cause is known.
- T&M without an estimate. The client’s trust runs out before the work does.
- Final payment on certification. The certification body’s diary controls the consultant’s cash flow.
- Discounting the rate rather than the scope. The next client hears about the rate.
- Underpricing template-led work. The efficiency the library creates is the consultant’s margin, not the client’s discount — provided the licence permits client use. Our guide to white-label compliance templates covers the terms.
Frequently asked questions
Is fixed fee or time and materials better for compliance consulting?
Neither in general. Fixed fee suits bounded, repeatable work — implementations, assessments, audits, documentation; time and materials suits open-ended work — remediation, regulator liaison, investigations. Most practices run both, with a rate card published for the T&M work.
How do I protect a fixed fee from scope creep?
Named deliverables with acceptance criteria, written assumptions, explicit exclusions, client responsibilities, a change process that prices changes before work continues, and a rate card for extras.
Should the final payment depend on certification?
No. Tie it to completion of the named deliverables — the audit-ready system, the internal audit, the management review. The certification decision belongs to the certification body and its calendar.
What is a capped T&M engagement?
Time and materials with a not-to-exceed figure and a change process to reopen it. It gives the client a ceiling without making the consultant guess an unknown scope.
Can templates make fixed fees more profitable?
Yes. A library that removes drafting hours lets a fixed fee carry a higher effective rate. The condition is a licence that allows use on client engagements — single-organisation packs cannot be reused.
Where this leaves you
Decide fixed fee vs time and materials by the shape of the work: fixed for bounded and repeatable, T&M for open-ended, hybrids where the two meet. Write fixed-fee scopes with assumptions, exclusions and a change process; run T&M with an estimate, a cap and weekly reporting; tie final payment to deliverables rather than an auditor’s diary; and let the template library be the margin, not the discount.
References
- ISO/IEC 17021-1:2015 — Requirements for bodies providing audit and certification of management systems — Why a consultant cannot control or guarantee the certification decision.
More for consultants
- Fixed fee vs time and materials — you are here
- Compliance consulting rates
- Compliance consulting practice: six decisions
- Compliance consultant certifications
- White-label compliance templates
- Choosing an ISO 27001 consultant
The Consultant Package — 85 toolkits and 7,700+ editable documents licensed for unlimited client engagements, $1,399 one-time — is the library that makes fixed-fee delivery profitable, or start with the free templates.