What a certification body needs to quote, and what to ask it

Send about 10 facts in the first email and you get a firm quote in days, not a call request. Accreditation rules set the audit time from these facts, so the quotes become comparable.

The facts to send, and why

Facts a certification body needs before it quotes
Fact	Why the body needs it
Number of people in scope per location: full-time, part-time and shift workers. Add an organisation chart.	Headcount is the main input for audit time. The NSAI quotation form asks for it per site.
A draft scope statement: the services, teams and locations the certificate must cover.	The scope text appears on the certificate. The body prices the audit from it.
A list of locations in scope with the main activities at each one. Write "remote only" if there is no office.	Each extra site can add audit time and travel.
The Statement of Applicability, if it exists. Write "in progress" if not.	Certification bodies ask for it with the quotation form when it exists.
A list of outsourced processes and key suppliers, for example cloud hosting, payroll and customer support.	Outsourced processes are part of the audit. The body asks for them to plan the time.
A short IT profile: number of developers, business applications, cloud platforms and laptops.	Bodies use the size and complexity of the IT to set the audit time for ISO/IEC 27001.
The current certificate and the reports of the last certification or recertification audit and of the latest surveillance audit.	IAF MD 2 requires the new body to review these reports before a transfer.
The customer or tender requirement that sets the deadline, and any rule it sets for the accreditation body.	The body can only confirm dates and the accreditation mark against a written requirement.
For each country: the local entity, its headcount and the language of its staff.	Bodies plan auditors and languages per country.

2 facts to get right

Headcount. Count employees and contractors who work in the scope or access your systems. Give part-time staff and each country separately. The auditor checks the number at stage 1, so a low number changes the price after you sign.
The scope sentence. It appears on the certificate and your customers read it. Name the product, the teams and the locations.

Questions to ask, and why

13 questions go in every request. Pick what applies to you to add the others.

13 questions

Questions for a certification body, with the reason
Question	Why ask
Accreditation
Which accreditation body accredits you for ISO/IEC 27001 certification? What is your accreditation number?	The accreditation number is the key to the official registry. Without it you cannot check the body.
Please send the direct link to your entry in the registry of that accreditation body.	Tender panels and large customers check the registry, not only the logo on the certificate.
Does your accreditation scope name ISO/IEC 27001:2022?	Accreditation for ISO 9001 does not cover ISO/IEC 27001. The scope must name the standard.
Will our certificate show your accreditation mark and your accreditation number?	A certificate without the mark of an accreditation body can be an unaccredited certificate.
Can you send a sample certificate?	The sample shows the scope wording, the dates and the marks your customers will see.
Independence
Do you, or a company under your control, sell ISO/IEC 27001 consultancy or implementation work? If you offer a pre-audit, on what terms?	A certification body and its group must not offer management system consultancy. A single pre-audit before stage 1 is allowed, but it cannot replace stage 1.
Do you pay a commission to a consultant, a platform or a partner for this referral?	EA names a sales commission for a referral as a possible threat to impartiality.
Will your auditors plan and do their own tests? Can you confirm this in writing?	After public reports about pre-written audit results in 2026, security buyers ask for this in writing.
Price and audit days
Please fill in the price grid: audit days, days on site and price for each of the 5 audits in the cycle.	Quotes in the same grid are comparable. A lump sum for year 1 hides the cost of years 2 and 3.
Which fees are not in these prices: application, certificate, annual registration, report or travel?	Fees outside the day rate change the 3-year total. Ask for every fee in writing.
For how long are these prices fixed? Do the surveillance audit prices change each year?	The surveillance audits come 1 and 2 years later. A fixed price makes the 3-year total reliable.
Audit team
Who will lead our audit? What experience does the audit team have with companies of our size and our sector?	An auditor who knows SaaS companies asks the right questions and wastes fewer audit days.
Give 2 examples of what the auditor will test in our cloud environment.	The answer shows if the auditor understands cloud services such as storage buckets or Kubernetes.
Remote audit
Can you do the stage 1 and stage 2 audits fully remote? Which parts need a visit?	Remote audit needs the agreement of both sides. IAF MD 4 sets the rules for remote methods.
Which video and file-sharing tools do you use in a remote audit? How do you protect our data?	IAF MD 4 requires the security and confidentiality of information when remote methods are used.
Does a remote audit change the number of audit days?	IAF MD 4 says remote methods count towards the total audit time and can need extra planning.
Language
In which language will the auditor work with our team?	An audit through an interpreter takes longer and can cost more.
In which language do you write the audit report and the certificate?	Your customers read the certificate. Some tenders ask for a certificate in a set language.
Compliance platform
Have your auditors audited companies that use our compliance platform? Can they review evidence in it?	Auditors who know the platform can review its evidence directly.
Do you have a commercial agreement with our compliance platform? Do you pay it for referrals?	Platforms run partner programmes for audit firms. Ask about any payment for the referral.
ISO/IEC 42001
Are you accredited for ISO/IEC 42001 certification? Which accreditation body gave the accreditation, and when?	Accreditation for ISO/IEC 42001 is new. Fewer bodies hold it than for ISO/IEC 27001.
If you are not accredited for ISO/IEC 42001 yet, will our certificate carry an accreditation mark later?	A certificate issued before accreditation carries no accreditation mark.
Can you do 1 integrated audit for ISO/IEC 27001 and ISO/IEC 42001? How many audit days does it save?	An integrated audit can share days between the 2 standards. Ask for the number.
ISO/IEC 27701
Does your accreditation scope cover ISO/IEC 27701? If not, what will the ISO/IEC 27701 certificate show?	An extension outside the accredited scope gives a certificate without an accreditation mark.
Transfer of a certificate
Do you accept a transfer of our current certificate? What do you need for the pre-transfer review?	Under IAF MD 2 the new body reviews the certificate, the latest audit reports and open findings before it takes over.
Will the transfer keep our current 3-year cycle, or start a new cycle?	IAF MD 2: if the review finds no problems, the cycle continues from the previous one. Otherwise the client is treated as new.
Sites and countries
Will you audit every location, or a sample? Which locations need a visit?	The number of sites in the audit changes the days and the travel cost.
Can one audit team cover all our countries, or do you use local auditors?	Local auditors can cut travel cost but can add a second team to coordinate.
Dates
What is your first free date for the stage 1 audit? And for the stage 2 audit?	Some bodies are booked weeks ahead. The first free date decides if you meet the deadline.
How many days after the stage 2 audit do you issue the report and the certificate?	The certificate comes after the certification decision, not on the last audit day.

Build the email with your facts and only your questions

Answer 4 questions. You get the email to send, the files to attach and your decision dates.

Build the request