ISO Compliance Insights & Best Practices
CART
ISO Compliance Insights & Best Practices
IMS certification cost in 2026 runs roughly $14,400 to $30,000 in registrar fees for a 40-person single-site manufacturer certifying ISO 9001, ISO 14001 and ISO 45001 together, against $18,000 to $37,500 for the same three certificates audited separately. That gap is real, but it is smaller than the “save 40%” figure you will see on consultant websites, and the reason is a rule most buyers have never read: IAF MD 11:2023, the mandatory document every accredited certification body has to follow when it audits an integrated management system. It caps the audit-day discount at 20%. Everything above that has to come from somewhere other than the audit.
This guide walks through where the number comes from, what the IAF rules allow a registrar to do, what a realistic three-year cycle looks like, and which parts of the budget you control.
An integrated management system is not a fourth certificate. It is one management system, with one policy set, one internal audit programme, one management review and one corrective action process, that meets the requirements of two or more standards at once. The certification body audits it in a single visit and issues one certificate per standard. For most companies the three standards in play are ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (occupational health and safety), which is why the market often calls the result a QHSE system. Our pillar guide to integrated management systems covers how the harmonized structure makes that possible.
The budget splits into four lines, and only one of them is discounted by integration in a way the rules define:
Accredited certification bodies do not price an integrated audit from scratch. IAF MD 11:2023, clause 2.1.1, makes them do it in three steps:
The starting-point tables matter because they set the scale. Here is the row that applies to a 26 to 45 person single site, from IAF MD 5:2023 Annexes A, B and C, in auditor days for Stage 1 plus Stage 2:
| Standard | What drives the band | Initial audit days (26–45 people) |
|---|---|---|
| ISO 9001 (Table QMS 1) | Effective headcount only | 4 |
| ISO 14001 (Table EMS 1) | Headcount and environmental complexity: high / medium / low / limited | 7 / 5.5 / 4 / 3 |
| ISO 45001 (Table OH&SMS 1) | Headcount and OH&S risk category: high / medium / low | 7 / 5.5 / 4 |
A 40-person light manufacturer with medium environmental complexity and medium safety risk therefore starts at 4 + 5.5 + 5.5 = 15 days. A registrar that is satisfied your system is fully integrated, and that fields auditors qualified in all three standards, can take that down to 12. One that finds a stapled-together system with three separate manuals can leave it at 15, or add time.
Annex 1 of IAF MD 11 is a grid, and the discount you get sits at the intersection of two scores. The vertical axis is the level of integration of your system, which the registrar judges against seven markers: an integrated documentation set, management reviews that look at the whole business, one internal audit approach, one policy and objectives approach, one process approach, one improvement mechanism, and integrated responsibilities. The horizontal axis is the audit team’s ability to run a combined audit, calculated from how many of the standards each auditor is qualified for. The grid reads like this:
| Level of integration | Team ability 20% | 40% | 60% | 80% | 100% |
|---|---|---|---|---|---|
| 100% | 0% | 5% | 10% | 15% | 20% |
| 80% | 0% | 5% | 10% | 15% | 15% |
| 60% | 0% | 5% | 10% | 10% | 10% |
| 40% | 0% | 5% | 5% | 5% | 5% |
| 20% | 0% | 0% | 0% | 0% | 0% |
Two consequences follow. First, a registrar that sends three single-standard auditors to your site cannot give you the discount at all, however well integrated your system is, because the team-ability score is zero. Ask who is on the team before you sign. Second, the level of integration is confirmed at Stage 1 (clause 3.2) and rechecked at every surveillance and recertification visit (clause 4), so a discount quoted on your application form can be taken back if the auditor finds three systems wearing one cover page. The registrar has to document the starting point and the justification for any change (clause 2.1.3), and you are entitled to see it.
Using the 15-day starting point above and a US registrar day rate of $1,200 to $2,500 (the range accredited bodies typically charge in 2026; UK registrars publish roughly £850 to £1,500), the comparison for the 40-person manufacturer looks like this:
| Line item | Three separate certifications | Integrated (IMS) |
|---|---|---|
| Initial audit days (Stage 1 + Stage 2) | 15 | 12 to 15 (MD 11 cap of 20%) |
| Initial audit fee at $1,200–$2,500/day | $18,000 – $37,500 | $14,400 – $37,500; typically $14,400 – $30,000 |
| Opening and closing meetings, reports | Three of each | One of each |
| Auditor travel and expenses | Three trips per audit type | One trip |
| Annual surveillance (about one third of initial) | 5 days, $6,000 – $12,500 | 4 to 5 days, $4,800 – $12,500 |
| Recertification in year 4 (about two thirds) | 10 days, $12,000 – $25,000 | 8 to 10 days, $9,600 – $25,000 |
| Documentation to write and maintain | Three manuals, three sets of procedures | One set with shared clauses 4 to 10 |
| Internal audit programme | Three programmes | One combined programme |
| Management review | Three meetings a year, or one with three agendas | One meeting, one agenda |
Read the table honestly and the audit-fee saving is 0% to 20%, with a fully integrated system and a multi-qualified audit team at the top of that range. The bigger savings are on the rows below the fee: one set of documents instead of three, one internal audit cycle, one management review and one consultant engagement. That is where the 30% to 45% figures that circulate come from. A December 2025 consultancy article, for example, reports a manufacturer cutting audit expense by 35% and a pharma company cutting documentation workload by 45% after integrating; those are single case studies, not a rule, and the audit-expense figure almost certainly includes travel and the meetings, not just auditor days.
The bands below combine the IAF MD 5 tables, the MD 11 cap and the day-rate range above. They assume medium environmental complexity and medium OH&S risk on a single site; a construction firm or a chemical plant sits in the high category for both and should read the top of each range. The consultant column is optional and is drawn from the ranges quoted on our single-standard posts.
| Scope | Starting point T (days) | Integrated initial audit (days, fee) | Annual surveillance | Consultant, if used |
|---|---|---|---|---|
| 1–10 people, low risk, office or service | 2 + 3 + 3 = 8 | 6.5 to 8; $7,800 – $20,000 | $2,500 – $6,500 | $8,000 – $20,000 |
| 11–15 people, medium complexity | 2.5 + 3.5 + 3.5 = 9.5 | 7.5 to 9.5; $9,000 – $24,000 | $3,000 – $8,000 | $10,000 – $25,000 |
| 26–45 people, medium complexity (the example above) | 4 + 5.5 + 5.5 = 15 | 12 to 15; $14,400 – $37,500 | $4,800 – $12,500 | $15,000 – $40,000 |
| 66–85 people, medium complexity | 6 + 7 + 7 = 20 | 16 to 20; $19,200 – $50,000 | $6,400 – $16,500 | $20,000 – $50,000 |
| 126–175 people or multi-site | 8 + 9 + 9 = 26 | 21 to 26; quote-driven, $25,000 – $65,000 | $8,500 – $22,000 | $30,000 – $60,000+ |
Two adjustments can move you off these rows. IAF MD 5 lets a registrar cut each standard’s own time by up to 30% for factors such as a mature system, a very small site or processes outside the scope, and those cuts are applied before the MD 11 sum, so a well-run small company can land below the low end. In the other direction, MD 5 clause 2.1.2 says on-site time should not normally fall below 80% of the calculated figure, so there is a floor as well as a ceiling. If a quote is far outside these ranges in either direction, ask the registrar to show you the calculation. Under MD 11 clause 2.1.3 they have to have written it down.
Certification bodies quote the initial audit and leave the rest of the IMS certification cost for you to work out. For the manufacturer in the example, fully integrated and audited at $1,500 a day, a realistic cycle is:
| Year | Audit | Days | Typical fee |
|---|---|---|---|
| 1 | Stage 1 + Stage 2, all three standards | 12 | $18,000 |
| 2 | Surveillance | 4 | $6,000 |
| 3 | Surveillance | 4 | $6,000 |
| 4 | Recertification | 8 | $12,000 |
That is $42,000 over the first cycle, or $30,000 through the first three years, which is the two to two-and-a-half times initial fee rule that holds for every ISO management system. Add the standards ($720), any training and the internal hours, and a 40-person company should plan on $25,000 to $50,000 for year one and $8,000 to $15,000 a year after that, before consultants.
Two of the three standards have just been revised. ISO 14001:2026 was published on 15 April 2026, with the 2015 edition withdrawn and a three-year transition that certification bodies are quoting as 30 April 2029. ISO 9001:2026 followed in September 2026, replacing the 2015 edition; expect a similar three-year window once the IAF publishes the binding transition resolution. ISO 45001 is at the Draft International Standard stage, with the revised edition expected in 2027 and, by then, a third transition. If you hold three separate certificates, that is up to three transition audits over the next three years. If you integrate now, the transition to both new editions can be covered in one recertification visit, where the extra time is usually small or zero because the auditor is already on site for the full recertification duration.
The registrar’s day rate and the MD 5 starting point are largely fixed once you have chosen a body and declared your headcount. Four things are not.
The level of integration you present at Stage 1. This decides whether you get 0%, 10% or 20% off, and it is judged on the seven markers in MD 11 Annex 1. A single manual with shared clauses 4 to 10 and standard-specific annexes, one risk register that carries quality, environmental and safety risks, one internal audit plan and one management review agenda are the evidence the auditor is looking for. Our guide to the combined internal audit covers the coverage matrix that keeps the single programme defensible.
The audit team. Ask the registrar, in writing, how many of the three standards each proposed auditor is qualified for. One auditor qualified for all three gives a 100% team-ability score and unlocks the full grid; three single-standard auditors give 0%. The difference on a 15-day starting point is three days, or $3,600 to $7,500 per initial audit and a proportional amount every year after.
The documentation. Writing three sets of procedures from scratch is the largest hidden cost of the separate route: our single-standard breakdowns for ISO 9001 and ISO 45001 each put the internal authoring effort at weeks of a manager’s time, and an integrated set removes most of the duplication. If you would rather start from a working baseline than a blank page, our IMS Toolkit is a 90+ template document set covering ISO 9001, ISO 14001 and ISO 45001 in one structure, for $99. Against a consultant engagement in the $10,000 to $50,000 range it is the cheapest line in the budget, and the shared-clause structure is exactly what the MD 11 integration markers ask for.
The consultant scope. If you use one, buy the gap analysis and the internal audit, not the writing. Consultants price by the day, and the day count for an integrated system is not three times a single standard; it is closer to 1.5 times, because clauses 4 to 10 are written once.
Yes. IMS certification cost is lower, but the audit fee itself falls by at most 20%, because IAF MD 11 clause 2.1.2 caps the reduction from the summed single-standard audit times. The larger savings are one document set, one internal audit programme, one management review, one trip per audit and one consultant, which is why total programme savings of 30% or more are plausible even though the auditor-day discount is not.
Normally one certificate per standard, issued from a single integrated audit, and the registrar may write one integrated audit report or three. MD 11 clause 2.4 requires every finding in an integrated report to be traceable to the standard it belongs to, and clause 2.5 requires the auditor to consider whether a nonconformity against one standard affects the others.
Yes. The registrar calculates the time for the new standards, adds it to your existing ISO 9001 time and applies the MD 11 adjustment to the total. Most bodies will realign the cycles so all three standards recertify together, which usually means a slightly early recertification of ISO 9001 once.
Certification bodies quote three to six months for a small organization and three to twelve months for a medium or large one, measured from a working system to certificate. Building the system first typically adds six to twelve months if you are starting with no certification at all, and less if a mature ISO 9001 system is already in place and you are extending it.
Yes. The surveillance share of IMS certification cost is about one third of the initial audit time, recertification about two thirds, and both are calculated from the reduced integrated figure. MD 11 clause 4 requires the registrar to confirm at every visit that the level of integration has not changed, so the discount continues as long as the system does.
IMS certification cost for a 40-person single-site company is $14,400 to $30,000 in registrar fees for the initial audit when the system is fully integrated, against $18,000 to $37,500 for three separate audits, with surveillance at roughly a third of that each year. The audit-day discount is capped at 20% by IAF MD 11 and depends as much on who the registrar sends as on how integrated you are, so ask for the calculation and the auditor qualifications before you sign. The money you actually save is in the documentation, the internal audit and the management review you only build once, and with two of the three standards freshly revised in 2026, the cheapest transition plan is to integrate before the recertification that has to cover them anyway.
September 20, 2026
September 20, 2026
September 19, 2026
September 19, 2026
September 19, 2026