What drives price — and what does not
For ISO audit preparation, boards look at total cost of ownership. Price depends on scope size, sites, IT/chain complexity, certification body fees and how many skilled hours you already have in-house.
Low-cost ‘document packs’ without operational follow-through often create expensive rework at audit. Always ask what is included: internal audit, management review, corrective actions and surveillance.
Line items in a credible budget
Budget for internal project time, external audit fees, tooling, awareness training and supplier assessments. ISO 27001 often needs roughly 40–120 internal days depending on maturity.
Software does not replace governance but can save 20–30% effort on registers, follow-up and evidence — especially in scaling SaaS teams.
Timeline: zero to certificate
ISO audit preparation: allow 6–12 months for a first certification from a ‘basic’ maturity, or 3–6 months if logging, access control and supplier basics are already sound.
Do not parallelise risk/SoA work with the external audit — that is the most common planning mistake.
SME vs scale-up
SMEs can keep scope intentionally small. Scale-ups must include chain and cloud tenancy explicitly — more audit time upfront, fewer painful scope changes later.
Consultant, in-house or software
Consultants add speed; in-house builds capability; software supports execution (actions, evidence, risks, suppliers) when you know the playbook but need consistency.
Common budgeting mistakes
Under-estimating line hours, no budget for internal audit findings, no surveillance reserve. Document assumptions — auditors sample decisions and behaviour, not folders alone.
Checklist
- Inventory scope and existing controls
- Run a gap or readiness assessment
- Allocate realistic monthly internal hours
- Select a certification body and quote stage 1+2
- Tie budget to milestones (SoA, internal audit, certification)
Next step with ISO Ready
For ISO audit preparation, ISO Ready keeps gaps, actions and evidence in one workflow — moving from search intent to audit-ready status with less spreadsheet drift. Run the readiness scan on iso-ready.nl (UTM: content_hub).
It does not replace a certification body: you retain ownership of scope, risk and decisions.
Related guides
- Iso Audit Checklist
- Iso 27001 Interne Audit
- Iso 27001 Management Review
- Audit Evidence Management
- Audit Readiness Dashboard
Practice notes (1)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.
Practice notes (2)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.
Practice notes (3)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.
Practice notes (4)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.
Practice notes (5)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.
Practice notes (6)
In SME and SaaS programmes, ISO audit preparation often stalls when ISO audit preparation is discussed but not recorded with owners and evidence. Certification bodies sample three tracks: policy, operation and monitoring. Missing any track yields a finding — even with good intent.
State which systems, suppliers and roles are in scope. Record change and exception decisions (who may deviate, for how long, with what risk). Link actions to the risk register so controls are clearly tied to analysis.
Give executives three quarterly numbers: open high-risk actions, mean time to close corrective actions, and percentage of controls with fresh evidence. That makes ISO audit preparation governable rather than abstract.