Home/ISO certification/What it costs
What ISO certification costs in Pakistan, and what drives the price
Nobody can quote you a real number from a web page, and anyone who does is guessing. What you can do is work out the biggest line on the invoice yourself, because the rules that set it are public. Here is how the price is built, and what makes yours go up or down.
The four invoices
- 01Certification body auditStage 1 and stage 2, priced by audit days
- 02Surveillance, years two and threeSmaller visits that keep the certificate valid
- 03Getting readyConsultancy, training, testing or equipment if you need it
- 04Your own people’s timeThe cost nobody quotes, and often the largest one
Only the first two are set by rules. The rest depend entirely on where you are starting from.
In short
- There is no single price for ISO certification in Pakistan. Two companies on the same street with the same standard can pay very different amounts, for reasons that are entirely predictable.
- The largest external line is the certification body audit, and it is priced in audit days. Audit days are not invented by the auditor: they come from a public table that every accredited body has to follow.
- Your headcount is the single biggest driver of those days. Complexity, sites, shifts and risk adjust it, and the rules cap any reduction at 30 percent.
- Certification is a three year cycle, not a one off purchase. Budget the initial audit plus two surveillance visits, then a recertification.
- The cheapest quote is often unaccredited, which is the one thing that makes the certificate worthless in a tender or a buyer audit.
Where the money goes
The four things you are actually paying for
People ask for the cost of ISO certification as if it were one item. It is four, and only one of them is usually shopped around.
A certification body sends auditors for stage 1 (readiness and documents) and stage 2 (the full audit). You are billed for audit days at that body’s day rate, plus travel and expenses. The number of days is set by the accreditation rules, so this is the part you can check.
Each year of the cycle brings a smaller visit, roughly a third of the initial audit time. At the end of three years a recertification audit, roughly two thirds of the initial time, renews the certificate. Ask for all of it in the first quote.
Consultancy, training, internal audit capability, and sometimes calibration, testing or small equipment fixes. A company with a working system and good records needs very little. A company starting from nothing needs most of it.
The hours your people spend writing, meeting, auditing and fixing. It never appears on a quote, it is usually the biggest number of the four, and it is the one that a well run project actually reduces.
Only the first two can be estimated from public rules, and that is exactly what the next section does.
The number you can check
Work out your own audit days
Every certification body accredited under Global ACI, the body that replaced the International Accreditation Forum (IAF) in January 2026, has to calculate audit time from the tables in IAF MD 5. Enter your numbers and you will see roughly what your quote should be built on. The figures below are audit days for a quality management system. Multiply by your body’s day rate and you have the audit portion of the price.
Audit day estimator
Based on IAF MD 5, the public rules your auditor uses
Effective personnel means everyone involved in the work covered by the certificate, including part time, temporary and every shift.
- Initial audit
- 5days
- Each surveillance
- 1.7days
- Recertification
- 3.3days
- First three years
- 8.4days
Enter your headcount to see the audit time your quote should be based on.
These are audit days, not prices. Day rates differ between certification bodies and are theirs to set, which is the honest reason no consultant can publish your total. What you can do is refuse a quote that will not show you this calculation.
The source
The audit day table, in full
This is Table QMS 1 from IAF MD 5, the initial audit time for a quality management system, covering stage 1 and stage 2 together. Environmental and occupational health and safety systems use their own tables in the same document, where the risk complexity of your sector also changes the number. Information security and food safety schemes have their own equivalent rules.
| Effective personnel | Audit days | Effective personnel | Audit days |
|---|---|---|---|
| 1 to 5 | 1.5 | 176 to 275 | 9 |
| 6 to 10 | 2 | 276 to 425 | 10 |
| 11 to 15 | 2.5 | 426 to 625 | 11 |
| 16 to 25 | 3 | 626 to 875 | 12 |
| 26 to 45 | 4 | 876 to 1175 | 13 |
| 46 to 65 | 5 | 1176 to 1550 | 14 |
| 66 to 85 | 6 | 1551 to 2025 | 15 |
| 86 to 125 | 7 | 2026 to 2675 | 16 |
| 126 to 175 | 8 | 2676 to 3450 | 17 |
Source: IAF MD 5, issue 4 version 3, 14 June 2023. Audit time covers planning, document review, the audit itself and report writing. Travel and breaks are not counted in it.
Adjustments
What pushes your audit time up, and what brings it down
The table is the starting point. The certification body then adjusts it, and the same rules list what may count in each direction. If a quote has an unusual number of days, ask which of these applied.
- More than one building or location inside the scope
- Complex processes, or many different activities
- High risk or heavily regulated work, such as food, medicines, aerospace or construction
- Processes you have outsourced to someone else
- Staff who need an interpreter, or work spread across shifts
- A very large site for the number of people in it
- Temporary sites, which many contractors run
- No design responsibility, so you build to the customer’s specification
- A mature system that has been running and improving for a while
- High automation, or a small site for the headcount
- Existing certification the body already knows, or prior third party recognition
- Staff who work off site with auditable records
- Simple, repeated processes rather than one off projects
One hard limit is worth knowing: the reduction from the table total cannot exceed 30 percent. If a body offers you an audit at half the days the table gives, it is either not applying the rules or not accredited to them.
Budgeting
You are buying three years, not a certificate
A certificate runs for three years, and audits continue through it. Budgeting only for the first audit is the most common planning mistake we see, and it is the reason year two feels like a surprise.
- Year one
- Initial auditStage 1 then stage 2, the full table time. Findings must be closed before the certificate is issued.
- Year two
- SurveillanceAbout a third of the initial audit time. Not the whole system, but always the core parts.
- Year three
- SurveillanceSame again, with attention on what changed and what was raised last time.
- Year four
- RecertificationAbout two thirds of the initial time, recalculated on your numbers as they are then.
If your headcount grows past a band in the table during the cycle, the numbers move with it. That is normal, and a good body will tell you before it happens rather than in the invoice.
Comparing offers
Why two quotes for the same company look nothing alike
| What differs | What it means for you |
|---|---|
| Accredited or not | An accredited certificate is backed by an accreditation body that audits the auditor. An unaccredited one is a printed document. The price gap is real, and so is the difference in what the certificate is worth. |
| Audit days used | One body applies the table, another cuts the days to win the job. Fewer days now often means a harder audit later, or a certificate that fails scrutiny. |
| Scope wording | A narrow scope costs less and may not cover the work your customer is asking about. Read the scope line before the price line. |
| What the quote includes | Travel, surveillance, certificate issue, re-audit of findings. A low headline with three exclusions is not a low price. |
| Consultancy bundled in | Some offers bundle the audit with the help to prepare. A certification body cannot consult and audit the same system, so check who is actually doing which part. |
That last line matters more than the money. The body that audits you cannot also build your system for you, because it would be auditing its own work. If one company offers to do both, ask how they separate the two.
The local picture
Accreditation, and the certificate that costs you a tender
Pakistan has its own accreditation body, the Pakistan National Accreditation Council, set up in 1998 under the Ministry of Science and Technology. It accredits certification bodies, laboratories and inspection bodies, and it is a signatory to the international arrangements that make a certificate travel: the IAF multilateral arrangement for quality and environmental management, and the ILAC and APAC arrangements for laboratories.
Anyone can print a crest. Ask which accreditation body accredits your certification body, for which standard, and verify it on that accreditation body’s own register before you sign.
Public tenders and export buyers increasingly ask for an accredited certificate. A cheap unaccredited one passes nobody’s due diligence, and you pay twice when you replace it.
Audit days exclude travel. A body sending auditors to a site far from Karachi, Lahore or Islamabad will price that journey, so ask early where your auditors come from.
If you are weighing up standards before you weigh up prices, our guide to ISO certification in Pakistan covers the process end to end, and the ISO 9001 certification page explains how we run the preparation side.
Before you sign
What a complete quote has to contain
Print this and hold every offer against it. A quote that answers all nine is comparable with another quote. One that answers six is not, however attractive the number at the bottom.
- Accreditation: which accreditation body, and for this exact standard
- Scope: the wording that will appear on the certificate, including sites
- Audit days: stage 1 and stage 2 separately, with the calculation behind them
- Day rate: what one audit day costs, so the arithmetic is visible
- Surveillance: days and fees for years two and three, quoted now
- Recertification: what happens at the end of the cycle
- Travel and expenses: included, capped, or billed at cost
- Findings: what happens if nonconformities are raised, and what a follow up visit costs
- Certificate fees: issue, registration, logo use, extra copies
Standard by standard
What does each standard cost in Pakistan, and why do they differ?
The audit day table above applies to every management system standard, so two standards at the same headcount start from a similar number of audit days. What separates them is the preparation, and that is where the real difference in cost sits. Below is what actually moves the number for each one.
What drives the cost of ISO 9001 certification in Pakistan?
ISO 9001 is usually the cheapest of the management system standards to prepare, for a reason that surprises people: most organisations already do most of it, informally. The work is describing what you genuinely do and proving it is controlled, rather than inventing new activity. Cost therefore tracks headcount and number of sites more closely than it does complexity. The exceptions are organisations whose work lives in people’s heads rather than in any documented flow, consultancies and contractors most often, where defining the process at all is the expensive part.
What drives the cost of ISO 14001 certification in Pakistan?
Two things, and only one of them is consultancy. The first is the compliance obligations register, meaning working out which federal and provincial environmental requirements actually apply to your site, which takes longer than most people budget. The second is whether you have a real discharge or emissions question. For an office or a light assembly operation ISO 14001 is close to ISO 9001 in cost. For a dyeing, tanning or plating operation the effluent position can be a capital cost rather than a documentation cost, and no amount of consultancy closes that gap. We separate the two at the gap analysis so you know which one you are facing before you commit.
What drives the cost of ISO 45001 certification in Pakistan?
Hazard, and contractor count, more than headcount. A hundred person office and a hundred person engineering workshop are the same size and not the same job. The requirements that generate the most preparation work are worker consultation, which has to be genuine and documented rather than asserted, hazard identification that covers contractors and visitors as well as employees, and emergency preparedness that has actually been rehearsed. Sites that already run ISO 9001 find the system structure familiar and the safety specific evidence is where the time goes.
What drives the cost of ISO 27001 certification in Pakistan?
Scope is the single biggest cost lever on this standard, and it is decided in the first week. A tightly drawn scope covering one service and one location is a different project from one covering the whole company. After that the cost sits in the risk assessment and the Statement of Applicability, because they have to be defensible rather than copied. One Pakistan specific factor is worth knowing: there are fewer auditors qualified for ISO 27001 here than for ISO 9001, so certification body day rates on this standard tend to run higher and availability can set your timeline.
What drives the cost of ISO 22000 and HACCP certification in Pakistan?
Product lines and processes, not headcount. A small factory running six product types can be more work than a larger one running two. HACCP alone is the faster and cheaper route, covering the hazard analysis and the critical control points without the management system around them, which suits a domestic customer or a first export order. ISO 22000 wraps that in a full management system and costs more to prepare. The expensive mistake in this market is buying HACCP when the customer meant a GFSI recognised scheme, because the work is then done twice.
What drives the cost of FSSC 22000 certification in Pakistan?
FSSC 22000 costs more than ISO 22000 because it is ISO 22000 plus sector specific prerequisite programmes and a set of additional scheme requirements, all of which take audit time. It is the GFSI recognised option, so it is what large international retailers ask for, and for many exporters it is the only answer that is accepted. There is also a timing cost right now: audits run against Version 6 until 30 April 2027 and Version 7 upgrade audits follow, so a site certifying today should budget the upgrade rather than discover it. The Version 7 dates and changes are set out here.
Does certifying several standards together cost less?
Usually yes, and this is the most reliable saving available. The standards share a common structure, so one set of core procedures, one internal audit programme and one management review can serve all of them. A certification body auditing two or three standards in one visit charges less than it would for separate visits, because the shared elements are audited once. The saving is real but it is not half: expect a meaningful reduction on the combined audit days rather than a second standard for free.
What is the cheapest ISO certificate, and should you buy it?
The cheapest certificate available in Pakistan is an unaccredited one, and it is cheap because it is worth very little. If the point of the certificate is to hang on a wall, it will do. If the point is to satisfy a customer, pass a tender or open an export market, an unaccredited certificate fails at the first check, and the money is simply gone. The question worth asking a cheap quote is not what it costs but who accredits the body issuing it, and whether your customer accepts that accreditation.
The legitimate ways to pay less are different and they are covered further down this page: draw the scope accurately, combine standards into one audit, prepare properly so the audit does not generate findings that need a return visit, and use what you already have rather than rebuilding it.
None of this produces a figure on its own. Axora Global quotes a consultancy fee band after a free gap analysis, once the scope, your number of sites and the maturity of your existing system are known, and the certification body’s audit fee is contracted separately and directly with them.
Practical
How to lower the cost without cutting corners
Most of the honest savings come before the auditor arrives, not during the negotiation.
- Get the scope rightCertify the part of the business that needs the certificate, not everything you own. A scope that is honest and tight costs less and is easier to defend.
- Count effective personnel properlyIt is the people involved in the certified work, not your entire payroll. Counting wrongly is the most common reason a quote is too high.
- Use multi site sampling if you qualifyWhere sites do very similar work under one system, the rules let the body sample them rather than visit every one. The central function is always audited.
- Combine standards in one auditIf you want quality and environment, or health and safety too, an integrated audit costs less than three separate ones and takes less of your team’s week.
- Fix findings before stage 2, not afterStage 1 exists to tell you what is not ready. Acting on it is free. A failed stage 2 and a return visit are not.
- Build internal audit capability onceTraining two of your own people is cheaper over three years than buying internal audits every year, and it is what keeps the system alive between visits.
- Write lessEvery document you create is a document you maintain and an auditor reads. Our ISO 9001 documents list shows how little the standard actually requires.
- Run the system before you book the auditA system with three months of real records audits faster than one built the week before. Auditors can tell, and it costs you time when they have to look harder.
The cost depends on your organisation’s size, number of locations and the complexity of your systems. Axora Global quotes a consultancy fee band after a free gap analysis and arranges the certification body audit separately.
We will not publish a figure that pretends to fit every business, and we will not quote you before we understand your scope. Book a free consultation and you will get an exact number for your situation, along with the audit day calculation behind it.
Questions
Common questions about ISO certification cost
How much does ISO 9001 certification cost in Pakistan?
There is no single figure, and any page that gives you one without asking about your business is guessing. The audit portion is your audit days multiplied by your certification body’s day rate, and you can work out the days yourself from the table above. The preparation cost depends entirely on how much of a system you already have. A free consultation will give you an exact number.
What is an audit day, or a man day?
One auditor working for one day. Audit time includes planning, reviewing your documents, the audit itself and writing the report. It does not include travel between sites or breaks, which are billed separately.
Who decides how many audit days my audit needs?
The certification body, using the tables in IAF MD 5 and the adjustment factors in the same document. It is not a negotiation, and any reduction is capped at 30 percent of the table figure.
Is surveillance included in the first quote?
It should be. Surveillance is about a third of the initial audit time each year, and recertification about two thirds at the end of three years. Ask for all of it up front so you are comparing three year costs, not first year costs.
Why is one quote half the price of another?
Usually one of three reasons: it is not accredited, it uses fewer audit days than the rules allow, or it excludes travel, surveillance and follow up visits. Check all three before you assume you found a bargain.
Does a smaller company always pay less?
Less, yes, but not proportionally. A five person company still needs a minimum audit, and the table starts at one and a half days. Below a certain size the fixed elements dominate, which is why very small firms sometimes feel the cost is high relative to turnover.
Can we get certified in a week?
You can be sold a certificate in a week. You cannot be audited properly in one, because an audit looks for records of a system that has been running. If the offer skips stage 1, skips evidence and skips accreditation, what you are buying is a printed document.
Does certifying two standards cost twice as much?
No. An integrated audit against two or three standards shares the common parts of the system, so the combined audit time is less than the sum of separate audits. It also disrupts your business once instead of three times.
Can we reduce the price by reducing the scope?
Yes, and it is legitimate when the excluded part genuinely does not belong in the certificate. It is not legitimate as a trick, because the scope is printed on the certificate and your customer will read it.
What does it cost, and why are there two prices?
Because there are two suppliers. The consultancy fee pays for building the system and training your people. The certification body’s audit fee is separate, you contract with them directly, and it recurs through the certification cycle because accredited certification carries surveillance audits. Anyone quoting a single all in number is hiding one of the two. The consultancy cost depends on your size, your number of locations and the complexity of your operation, so book a free consultation for an exact quote rather than a guess.
Can you certify us as well as consult?
No, and nobody honest in this market can. ISO/IEC 17021-1 clause 5.2.5 says a certification body shall not offer or provide management system consultancy, and clause 5.2.7 bars it from certifying a management system for at least two years after any consultancy ends. We build your system and arrange the certification body audit separately. If a consultancy offers you implementation and an accredited certificate in one price, that combination cannot exist.
Does the certificate have to be accredited?
If the point of it is to satisfy a customer, yes. Accreditation is a check on the checker: an accreditation authority audits the certification body against ISO/IEC 17021-1. In Pakistan that authority is the Pakistan National Accreditation Council, which is a signatory to the multilateral arrangements of Global ACI, the body that replaced the International Accreditation Forum (IAF) in January 2026, and of the Asia Pacific Accreditation Cooperation (APAC), which replaced the Pacific Accreditation Cooperation (PAC) in 2019, for quality and environmental management systems. Many certificates here carry foreign accreditation instead, from authorities such as UKAS or ANAB, which is equally valid. An unaccredited certificate exists as a document but your buyer cannot verify it.
How do we check a certificate is genuine?
Look it up in IAF CertSearch, the public database of accredited certificates, and check the accreditation authority’s own register for the certification body. Not every certificate is listed, because it depends on the body uploading its data, so an absence is a question rather than a verdict. If it is not listed, contact the certification body using details you found independently rather than details printed on the certificate.
Do we need a separate certificate for each site?
Not necessarily. A certificate carries a scope statement naming the activities and the sites it covers, and a multi site certificate can cover several locations under one management system. What matters is that the scope on the certificate actually covers the site and the activity your buyer is asking about. Adding a site later is a scope extension, not a new certification, and it is cheaper to include it from the start than to bolt it on.
What happens after the certificate arrives?
Accredited certification runs on a cycle with surveillance audits and a full recertification audit at the end of it. Your internal audit and management review have to keep happening, and those two are what organisations most often fail on at the first surveillance visit. Ask any consultancy what post certification support is included and what it costs before you sign, because a system nobody maintains lapses quietly.
Which ISO standard is cheapest to certify in Pakistan?
ISO 9001 is usually the least expensive to prepare, because most organisations already do much of it informally and the work is describing and controlling what exists rather than building something new. That said, the cheapest standard is rarely the right question. Certifying to a standard your customer did not ask for costs more than certifying to the one they did, however little the first one cost.
Why is ISO 27001 more expensive than ISO 9001?
Two reasons. The preparation is heavier, because the risk assessment and the Statement of Applicability have to be defensible rather than copied, and scope definition carries more weight than on any other standard. The second reason is local: there are fewer auditors qualified for ISO 27001 in Pakistan than for ISO 9001, so certification body day rates tend to be higher and auditor availability can decide your timeline as much as your readiness does.
Does certifying two standards cost twice as much?
No. The standards share a common structure, so one set of core procedures, one internal audit programme and one management review serve all of them, and a certification body auditing two standards in a single visit charges less than for two separate visits. The saving is meaningful on the combined audit days, but it is not half, so treat a quote that offers a second standard for almost nothing with care.
What is the cheapest ISO certificate I can get?
An unaccredited one, and it is cheap because it is worth very little. It will satisfy nobody who checks. If the certificate exists to pass a tender, satisfy a buyer or open an export market, an unaccredited certificate fails at the first check and the money is wasted. Ask any cheap quote who accredits the certification body, and confirm your customer accepts that accreditation before you sign.
Sources
- International Accreditation Forum, IAF MD 5, determination of audit time, issue 4 version 3, 14 June 2023
- International Accreditation Forum, IAF MD 1, audit and certification of multi site organisations, 2023
- Pakistan National Accreditation Council, about PNAC and its international recognitions, pnac.gov.pk
- ISO, ISO 9001:2026 and the certification cycle, iso.org
- Axora Global published cost and timeline wording, ISO 27001 certification page
Next step
Get the number that applies to your business
Tell us your headcount, your sites and what you actually do, and we will give you the audit day calculation, a fixed price for the preparation, and an introduction to accredited certification bodies. No obligation, and no figure invented to win the conversation.
Request a quoteSee our ISO training
We work with clients across Pakistan, including Lahore, Karachi and Islamabad.