What drives the cost and timeline of ISO certification

This page explains what the rules and common practice call for. Every site is different, and what a survey or a filing needs at your facility is something we work out with you after we see it.

ISO 14001 is the international standard for environmental management systems, and ISO 45001 is its counterpart for occupational health and safety. Certification to either one carries three separate costs: certification body fees, consulting, and the time your own team spends. The third is usually the largest, and it is the easiest to leave out of a budget.

Below is how each cost behaves and what moves it. We also explain why one part of the timeline cannot be shortened: a management system has to operate long enough to generate the records an auditor will ask for.

Three separate costs

People budget for one cost and are surprised by three.

1. Certification body fees

These go to your certification body (also called a registrar), the outside organization that audits you and issues the certificate. The fees depend on your employee count, your number of sites, the complexity of your scope and the standard you choose, and they are typically quoted as audit days at a day rate.

Get quotes from three certification bodies accredited by ANAB (explained below), and ask each one for the same items:

• Audit days for Stage 1, the first part of the certification audit
• Audit days for Stage 2, the second part
• The day rate
• The annual surveillance audit days in years 1 and 2
• The recertification audit in year 3
• How travel and expenses are handled

Two quotes that look different often differ only in how many of those lines they show you.

This cost recurs. The certification cycle is 3 years, running from initial certification to a surveillance audit in year 1, another in year 2, and recertification in year 3, after which it starts over.

The international standard for certification bodies sets two timing rules (ISO/IEC 17021-1, clause 9.1.3.3). Surveillance audits must be conducted at least once a calendar year, except in recertification years, and the first surveillance audit must be no more than 12 months from the certification decision date. (Clause 9.6.2.2 is a different rule, which sets what a surveillance audit has to cover.)

Budget for the 3-year cycle, not the first invoice.

2. Consulting

This goes to whoever helps you build the system. Scope varies more than price does, so the useful question is which of these you are buying:

• A gap analysis only (an assessment of where you fall short of the standard)
• A full build of the system
• Transition of an existing certified system to a new edition of the standard
• Ongoing internal audits once you are certified

Those are four different engagements, and one cannot be substituted for another.

Check one thing before you sign anything: a consultant who also issues your certificate is a problem under ISO/IEC 17021-1. Can your certification body also consult?

3. Your own team's time, the cost that rarely shows up in a quote

This is the largest cost and the hardest to see. Your team writes procedures, runs the first internal audits, takes part in the management review, gathers records and is interviewed during audits.

The load falls mostly on one person, a management representative or an EHS (environmental, health and safety) lead, and across a first project it is measured in hundreds of hours, not dozens. If nobody has capacity for that, the project stalls no matter who you hire, and that is the most common reason ISO projects run long.

Timeline

For a first-time project at a single site, 6 to 12 months is realistic. A shorter schedule is possible where a management system is already operating. From a standing start, compressing the schedule means the operating record that Stage 2 looks for does not exist yet.

The phase that will not move is operating the system. It cannot be shortened, and this is where every optimistic timeline breaks.

The reason is that Stage 2 evaluates the implementation and effectiveness of the system, meaning whether it is in place and working. You need records that show the system ran:

• Internal audits completed
• A management review held
• Corrective actions raised and closed
• Objectives tracked
• For ISO 45001, evidence that you genuinely consulted workers (Clause 5.4 of that standard)

Those records accumulate only as time passes. A system written in January and audited in February has no evidence that it works, because it has not worked yet.

A 30-day certification describes a certificate, not a management system. Often it is an unaccredited certificate, so if you are offered that timeline, ask which accredited body issues the certificate.

What drives cost up

• More than one site. This is the single biggest factor.
• Complex scope, meaning multiple processes, high-hazard operations or significant environmental aspects.
• Starting from nothing, compared with having EHS programs that only need to be formalized.
• No capacity on your own team. Every hour your team cannot cover moves onto the consulting invoice.
• An integrated management system. Covering both standards means more scope, though it costs less than certifying each one separately.
• A transition to a new edition on top of the build. This matters right now, because ISO 14001:2015 was withdrawn in April 2026 and ISO 45001 is under revision.

What drives cost down

• Compliance programs you already run. If you already manage permits, hazardous waste determinations and the written programs OSHA requires, a large share of the system exists, though not on paper.
• Integrating ISO 14001 and ISO 45001 rather than certifying each one separately, which gives you shared clauses, one audit and one management review.
• Capacity on your own team. Every hour your team covers is an hour you do not buy.
• Building to ISO 14001:2026 directly if you are new, so there is no transition later.
• A gap analysis first. Scoping the real project costs a fraction of doing it, and it beats a full-build quote that rests on assumptions.

The question to ask about every quote

"Is the certificate accredited, and by whom?"

An accredited certificate means the certification body is itself audited against ISO/IEC 17021-1, the international standard for certification bodies. That audit is performed by an accreditation body that has signed the Multilateral Recognition Arrangement of the International Accreditation Forum (IAF).

In the United States that body is ANAB, the ANSI National Accreditation Board. UKAS, DAkkS, JAS-ANZ and the other IAF signatories carry the same recognition.

Unaccredited certification is cheaper and faster because it is a different product, and a customer who required ISO certification may not accept it.

Verify at IAF CertSearch. A low quote sometimes reflects efficiency and sometimes an unaccredited certificate, and it is worth knowing which before you compare numbers. → Can your certification body also consult?