Set a budget for key iso certification expenses
In order for your company to gain an ISO certificate (e.g. ISO 27001 certificate), you will need to invest time, money and energy. On the one hand, you will incure costs by your own staff being busy in the implementation and preparation for the certification audit. On the other hand, you will have costs when a certification body conducts the audit of your management system. If you do need help in building a sustainable management system, then expect that ISO specialized consultants will add to your expenses. Hence, you need to set a realistic budget to cover the to be expected iso certification expenses.
Internal costs are part of the iso certification expenses
You need to be considering the time your staff will be busy with the management system project work as well as the awareness efforts to get every staff member committed to the future management system.
Internal costs in the Management System design phase
Writing a management system requires staff to invest part of their work day in drafting and verifying documentation. Do not underestimate the time and effort needed to develop a customized management system. There is learning curve that will gradually improve. In order to get started, your implementation team needs to read the relevant standards and also attend adequate foundation courses.
Internal costs in the Management System implementation phase
Once you have introduced your new management system to your organization, you will need to tweak a variety of controls, standard operation procedures (SOP) and train staff. Keep in mind, that you need to conduct that internal audit and also review the insights stated in the internal audit review. This has to be documented in the management review. Top management must decide whether to initiate corrective measures. This might include allocating, staff and budget as well as signing contracts for new software, hardware or even consulting services.
Internal costs in the Management System certification phase
As you want to successfully receive the ISO certification, you need to allocate work time from a variety of departments in your organization. During the audit the auditors will segment the topic areas into sessions. During each session, an auditor will not only inspect the documentation but also conduct an interview of stakeholders in such relevant departments (e.g. accountant, personnel training coordinator, IT administrator). These people do not need to attend every session, but when it is their session, then that is when they should attend the meetings in person or via a video call (e.g. MS Teams Session, Zoom Call or Google Meets session). The audit time is the top priority for all people you have been named on the audit plan as stakeholders. Hence, these people must be available when called up.
Internal costs in the Management System promotion phase
There will be an initiative to highlight to every staff member how to use iso certification badges as well as improving aspects which were noted by the certification auditors. During a certification audit, the audit team might note down opportunities for improvement as well as non-conformities which need to be resolved within a given time frame. These new tasks will consume work time and potentially add a variety of additional expenses.
Internal costs will be offset by the ROI generated after ISO certification
Once you have achieved the ISO certification, you will need to continue reminding people of the new SOPs and policies. As time progresses, you will notice several benefits, such as
- an iso 9001 related improvement
- an reduction in iso registrar cost
- operational savings due to iso improvement effects
External costs are part of the iso certification expenses
In order to become certified, n organization will have to expect costs generated before, during and after the certification audit. Here we would like to make you aware of what you need to budget for your ISO project.
External costs in the Management System design phase
Not everybody is an ISO expert or wishes to devote their entire work time to becoming an ISO master. Hence, companies tend to get help from an ISO specialized consultant. They either search the internet of ask help in finding an ISO consultant with relevant standard and industry expertise. This kind of expert help comes at a cost. Consultants often charge according to the organization’s size and business model complexity. Don’t forget that at the beginning of your ISO project, you need to draft a lot of documents. Then you need to train your staff so that they are aware of the requirements set by the standard and top management, so that the management system is implemented in a compliant way. You will also see that iso certification expenses also include your internal audit. Some organizations can conduct the internal audit of their management system with internal staff, but this might not be an option. That is why organizations hire audit companies to conduct an internal audit so that the organization does not fall for a myoptic perspective on their management system.
External costs in the Management System implementation phase
If you are hiring external consultants to conduct a gap analysis or an internal audit, then this cost needs to be part of your overall budget plan. Training is also an important aspect as you information security officer (ISO) needs to have completed the required education and training. If you are experiencing a sudden change of personnel, then you might have to send the new ISO to the same training again. If you want all other staff to be regularly reminded of important aspects of the management system requirements then you could consider booking training packages from a specilized training provider.
External costs in the Management System certification phase
Once you are ready to get your management system certified, you will be getting an offer from a certification body (a.k.a. CAB). After selecting the CAB of your choice, you will be making arrangements for the audit team to inspect your documentation. Here you will have costs for the time auditors are inspecting your documentation, as well as the time they need for preparing the audit. Writing a transparent and compliant audit report will take up several work hours of a lead auditor. All this time you will have to budget for. The offer you received from the certification body will usually display the different parts of allocated work time for the preparation, stage 1 audit and stage 2 audit as well as for final documentation work. This is usually invoices as audit time related costs, which are the largest part of the iso certification expenses invoiced by a certification body.
Some CABs charge additional fees for printing certificates or even registering a new client in their system. Stratlane sees no need for excessive side fees such as client registration fees.
Don’t forget to allocate budget for the travel expenses that the audit team will collect as they visit your office location. You might be charged flight tickets or train tickets besides the usual hotel accommodation. If the audit team is conducting the audit fully remotely, then you will see travel expenses to be completely avoided or only a small part of the total cost.
Just a small reminder: every year the certification body must conduct a surveillance audit of your management system, in order to ensure that it is being applied in a compliant way. Should the audit team identify that the management system is not really part of the business workflow then the lead auditor might recommend suspending the certificate. This would be a painful experience and is usually a very seldom situation. The surveillance audits are usually about 1/3 of the initial audit time.
After the 3 year period there will have to be a recertification audit, which is usually 2/3 of the initial audit time. Both surveillance and recertification audits will generate cost in relation to audit time and travel expenses. So keep that in mind when planing your 6 year budget so that you cover all to be expedcted iso certification expenses.
External costs in the Management System promotion phase
Once you achieved your ISO certification, it is time to let your clients and leads that you have now got a iso certification badge to display. This is where you might have marketing costs for printing stickers, brochures and even redesigning your website to display all those iso certification badges you are proud about. These expenses might be small compared to all previously mentioned costs, but do not deglect allocating funds to that part of your post certification phase.
Keep in mind, that there are regulations how you can use such iso certification badges in marketing material. This also applies to positioning statements that might mislead a B2B client or consumer. Read the iso certification badge rules guide of the certification body, so that you do not incure additional iso certification expenses, due to litigation costs when clients might sue you for misrepresentation of facts.
Summary
As you have learned from this article, there are internal and external costs that you need to include in your budget plan. A plan with a buffer helps avoid unpleasant funding issues, when you are crossing the finish line.