ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
ISO 27001 audit days are the single biggest line in a certification quote, and almost nobody checks the arithmetic behind them. The figure is not a commercial decision your certification body makes over coffee. It comes out of a table in ISO/IEC 27006-1:2024, the standard that accredited bodies must follow when they audit an information security management system. Once you understand how that table works, you can tell a fair quote from a padded one in about ten minutes.
This guide covers where the ISO 27001 audit days figure comes from, how to work out the effective number of personnel the table is keyed on, what the typical day counts look like for a small, mid-sized and large scope, how the days spread across the three-year cycle, and which adjustments a certification body is actually allowed to apply. If you are earlier in the process, start with our step-by-step guide to getting ISO 27001 certified and come back here when the quotes land.
Free gap assessment
Where do you actually stand against ISO 27001?
Score every management system clause and all 93 Annex A controls, free, and get a prioritised gap list back.
Run the free ISO 27001 gap assessment → or View premium report sample
An audit day is a unit of auditor effort, not a date on a calendar. ISO/IEC 17021-1, the generic standard behind every accredited management system certification, puts the duration of an audit day at normally eight hours, and it excludes breaks, meals and travel. It defines audit time as the time needed to plan and accomplish a complete and effective audit, and the duration of the audit as the part of that spent from the opening meeting to the closing meeting inclusive.
Three practical consequences follow. First, ten audit days does not mean ten days of disruption. Two auditors working five days each is ten auditor days, and that is how larger scopes are usually delivered. Second, the quoted number includes planning and reporting; certification bodies commonly allocate no more than about 20 percent of the calculated time to preparation and report writing and keep at least 80 percent as actual auditing. Third, travel time is not auditing, so a body that bills travel inside the day count is quietly shrinking the audit you paid for.
ISO/IEC 27006-1:2024 is a first edition published in March 2024, replacing ISO/IEC 27006:2015 and its 2020 amendment. Its catalogue entry at ISO confirms it is the current International Standard for bodies providing audit and certification of information security management systems. Audit time lives in Annex C, which was Annex B in the 2015 edition — a renumbering worth knowing, because older certification body documents still cite the old letter.
The transition is finished, which matters for any quote you receive now. Accreditation bodies had to be ready to assess against the 2024 edition by the end of 2024, and accredited certification bodies had to complete the transition by 31 March 2026 under the relevant transition mandatory document. UKAS required its own bodies to finish by 31 July 2025. In other words, the ISO 27001 audit days behind any accredited quote issued in 2026 should be built on Annex C of the 2024 edition.
There is one trap here that costs buyers real money. The audit-duration table most people find online is the one from Global ACI-TECH-3-004, the reformatted successor to IAF MD 5. That document governs quality, environmental and occupational health and safety management systems. It does not govern an ISMS. If a certification body calculates your ISO 27001 audit days from the MD 5 table, it has used the wrong schedule, and the numbers come out materially different.
The table is keyed on the number of persons doing work under the organization’s control within the certified scope. That is broader than payroll. It includes part-time staff, converted proportionally to the hours they work, and it includes contractors, temporary staff and outsourced personnel who work under your direction inside the scope. It excludes people whose work falls entirely outside the ISMS boundary — which is exactly why defining the scope properly is a cost decision as much as a compliance one.
The 2024 edition added a concept that did not exist before: persons performing identical activities. Where a large group of people all perform the same simple, repetitive task, the square root of that group’s headcount may be used instead of the full count. European Accreditation’s FAQ 48.6 on clause C.3.4 is the clearest published explanation, and its worked example is the part people get wrong.
Take an organization with 147 people in scope: 49 technicians, 49 support staff and 49 service desk agents. The square root is applied to each category separately, not to the total. That gives seven plus seven plus seven, so 21 effective personnel — not the 13 you would get from taking the square root of 147. Get this backwards and your quote is wrong by two full bands.
Three conditions attach to the reduction. The activities must genuinely be similar, repetitive and simple. A documented, risk-based justification is needed for each category. And the certification body must still satisfy itself that enough audit time remains for a complete and effective audit. The square root is a sampling allowance for repetitive work, not a general discount on headcount.
The figures below are the indicative initial-audit day counts that certification bodies publish in their own audit-time schedules when applying the Annex C table, with surveillance at one third and recertification at two thirds of the initial total. Treat them as typical ranges for budgeting. ISO/IEC 27006-1:2024 holds the authoritative table, and your certification body must apply it to your actual scope.
| Effective personnel in scope | Initial audit (Stage 1 + Stage 2) | Annual surveillance | Recertification |
|---|---|---|---|
| 1–10 | 5.0 days | 1.7 days | 3.3 days |
| 11–15 | 6.0 days | 2.0 days | 4.0 days |
| 16–25 | 7.0 days | 2.3 days | 4.7 days |
| 26–45 | 8.5 days | 2.8 days | 5.7 days |
| 46–65 | 10.0 days | 3.3 days | 6.7 days |
| 66–85 | 11.0 days | 3.7 days | 7.3 days |
| 86–125 | 12.0 days | 4.0 days | 8.0 days |
| 126–175 | 13.0 days | 4.3 days | 8.7 days |
| 176–275 | 14.0 days | 4.7 days | 9.3 days |
Two things stand out when you read the table as a buyer. The curve is steep at the bottom and flat at the top: going from 10 people to 45 roughly doubles the days, while going from 175 to 275 adds one. And there is a floor. A six-person SaaS company does not get a two-day audit, however simple its ISMS is, because the first band starts at five days. That floor is why the ISO 27001 audit days element of a small company’s quote feels disproportionate, and it is the main reason the overall ISO 27001 certification cost does not scale down smoothly with headcount.
The table gives a single initial figure covering both audit stages. Certification bodies then divide it, and most cap Stage 1 at no more than about 30 percent of the initial total. Our guide to Stage 1 versus Stage 2 explains what each stage is looking for; the split below shows how a 30-person scope in the 26–45 band typically consumes its days.
| Audit event | When | Auditor days |
|---|---|---|
| Stage 1 (readiness) | Two to six weeks before Stage 2 | Up to 2.5 |
| Stage 2 (certification) | Year 0 | About 6.0 |
| Surveillance 1 | Within 12 months of certification | 2.8 |
| Surveillance 2 | About 24 months | 2.8 |
| Recertification | Before the certificate expires at three years | 5.7 |
| First full cycle total | — | About 20 |
So roughly 20 auditor days buys a 30-person company its first three-year cycle, of which fewer than half are spent on the initial certification. Budgeting only for Stage 1 and Stage 2 is the classic mistake; the annual surveillance audit and the recertification at the end are contractual commitments you sign up to on day one.
Multiple sites change the arithmetic again. Where a group of sites runs very similar processes, the certification body may sample them, and the audit-time reduction for each sampled site is capped at 50 percent. The sampling rules and the central-function requirement are covered in our guide to ISO 27001 multi-site certification.
Annex C is a starting point, not a verdict. The certification body is expected to adjust it for the complexity of what you actually do, and it must record why. Factors that push the number up include several sites or disaster recovery locations, a large number of distinct IT platforms, networks and databases, heavy reliance on outsourcing and cloud services, significant in-house software development, strict sector regulation, 24/7 availability requirements, interpreters, temporary sites, and more than one main business activity.
Factors that pull it down include a single location, an ISMS operating for more than three years, a standardised IT estate, no development activity, most staff performing the same role, other certifications already held with the same body, and genuine readiness.
There is a hard limit on all of this, and it is the most useful single number in this article: the deviation from the table should not exceed 30 percent, and a reduction in particular can never exceed 30 percent. Some published schedules also cap the reduction allowed for Annex A exclusions at around 15 percent on top of that. A quote offering three days for a 40-person scope is not a bargain — it is a reduction of roughly 65 percent, well outside what accreditation permits, and it puts the resulting certificate at risk. If that is what you have been offered, read our guidance on accredited ISO 27001 certification before signing.
Six questions separate a defensible calculation from a guess. Ask them in writing, before you sign a three-year agreement.
A certification body that answers all six without hesitation is applying the standard. One that treats the calculation as commercially confidential is telling you something useful.
A scope with 50 effective personnel falls in the 46–65 band, which puts the initial audit at around ten auditor days covering Stage 1 and Stage 2, roughly 3.3 days for each annual surveillance audit and about 6.7 days for recertification. Complexity adjustments can move that by up to 30 percent in either direction.
Eight hours, per ISO/IEC 17021-1, excluding breaks, meals and travel. Two auditors on site for one day consume two audit days, which is how large scopes are compressed into a shorter calendar window.
Report writing and planning are inside audit time; travel is not. Most certification bodies keep preparation and reporting to around 20 percent of the calculated figure, so a ten-day quote should still deliver roughly eight days of actual auditing.
You can argue for the reduction factors that genuinely apply to you — single site, mature ISMS, standardised IT, no in-house development — and you can narrow your scope. You cannot negotiate below the 30 percent reduction limit, and a body that lets you should worry you.
Yes. The count is persons doing work under the organization’s control inside the scope, so contractors and temporary staff working under your direction are included, and part-time staff are converted proportionally to the hours they work.
Marginally. Justified exclusions can support a reduction, and at least one published schedule caps that contribution at around 15 percent. The Statement of Applicability remains mandatory under clause 6.1.3 whatever your day count, and every one of the 93 Annex A controls has to be addressed in it, included or excluded with a reason.
Free ISO 27001 risk assessment
Which of your risks sit above your appetite line?
Set your own risk criteria, pick from 61 information security risk scenarios, rate likelihood and impact, and decide how to treat each one. You get a heat map, a process score and the findings an auditor would raise, free.
Run the free risk assessment → or View premium report sample
ISO 27001 audit days come from Annex C of ISO/IEC 27006-1:2024, keyed on the effective number of personnel in your scope, split roughly 30/70 between Stage 1 and Stage 2, repeated at one third annually for surveillance and two thirds for recertification, and adjustable by no more than 30 percent either way. A 30-person company should expect about 8.5 days to certify and about 20 across its first full cycle. If a quote cannot be reconciled to those rules, ask why before you commit to three years of it.
The fastest lever you control is readiness. An auditor who finds the risk assessment, the Statement of Applicability, the internal audit records and the management review minutes where they should be finishes inside the planned ISO 27001 audit days; one who has to go looking triggers findings and follow-up time. Our ISO 27001 Toolkit provides 165 templates mapped to ISO/IEC 27001:2022, including the risk assessment, Statement of Applicability, internal audit programme and management review records auditors ask for first. It is $99, and it is the difference between an audit that runs to plan and one that runs over.
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026
October 11, 2026