The Assurance Desk
Part of the guide What does ISO 27001 certification take, and who can certify you?
Why is a day rate not the full certification cost?
The public listings below cover different services. Fortis offers implementation and certification consultancy. PGI lists work such as risk reviews, policies and internal audit. Romano Security Consulting lists an internal audit service, which can come before the certification audit.
A daily price does not tell you how many days your project needs or what other work is included. Ask each firm to set out the service, the amount of work and the total price for the same brief.
What do published UK consultancy prices show?
These are supplier prices on the government’s Digital Marketplace. They are examples of advertised services, rather than an average for the UK market or prices for the same package. Keep each listing’s unit when comparing them.
| Supplier | Service in the listing | Published price and basis |
|---|---|---|
| Fortis | ISO 27001 implementation and certification consultancy | £795 to £1,095 a unit a day |
| PGI | ISO 27001 consultancy | £675 to £1,500 an instance a day |
| Romano Security Consulting | ISO 27001 internal audit | £750 to £1,000 a unit a day |
What belongs in your ISO 27001 budget?
Start by separating preparation from the independent certification work. UKAS accreditation checks the competence of certification bodies. An internal audit is a different piece of work that can take place before the certification audit.
Then ask what the preparation covers. PGI’s listing includes risk work, policies, defining the scope and developing the management system. Fortis says it can tailor services to objectives, budget and timescale. Your quote needs to say which work you want.
Ask for separate prices
Preparation and support
- Help with scope, risks and policies.
- Work on the management system.
- Internal audit where included.
Certification work
- The certification body’s assessment.
- The scope the audit will cover.
- A separate quote from the body.
What should you ask before accepting a quote?
Ask the supplier to name the work, explain the pricing unit and estimate the days. Ask what changes the total. The published ranges alone do not settle those questions for your project.
Ask whether VAT, expenses, software, follow up work and later audits are included. Also plan for your own team’s time. Put the answers beside the price so you can compare the whole offer.
What to do
- Write the same short brief for each firm you approach.
- Ask for preparation, internal audit and certification work to be priced clearly.
- Ask what each pricing unit means and how many days are expected.
- Record what is included, what costs extra and what your own team must do.
Common questions
Is a consultancy day rate the cost of certification?
No. The examples here are consultancy and internal audit listings. Internal audit can be carried out before the certification audit.
Can you rank these firms from cheapest to most expensive?
Not from these figures alone. They describe different services and pricing units. Ask for quotes against the same brief.
Can the support be tailored to our project?
Fortis’s listing says its services can be tailored to objectives, budget and timescale. Ask the provider what its own offer includes.
Where next
Sources
- applytosupply.digitalmarketplace.service.gov.uk, ISO/IEC 27001:2022 Certification Consultancy, Digital Marketplace, checked 7 October 2026
- applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Consultancy, Digital Marketplace, checked 7 October 2026
- applytosupply.digitalmarketplace.service.gov.uk, ISO 27001 Internal Audit, Digital Marketplace, checked 7 October 2026
- UKAS, Certification Body Accreditation, checked 7 October 2026
This is an independent editorial guide, not legal advice.