ISO 9001 ongoing cost: surveillance, recertification, and maintenance
The published certification cost is typically the Year-1 figure. The three-year cycle adds two surveillance audits and a recertification audit. Internal maintenance time across three years is often as large as the audit fee total, and competitor pages routinely omit it.
Full-cycle cost for UK firms, 2026
| Profile | Year 1 | Year 2 | Year 3 | Year 4 recert | 3-yr total | 4-yr total |
|---|---|---|---|---|---|---|
| 10-person services firm | £4,500 | £1,100 | £1,100 | £3,200 | £6,700 | £9,900 |
| 50-person manufacturer | £14,500 | £1,600 | £1,600 | £8,500 | £17,700 | £26,200 |
| 150-person contractor | £24,000 | £2,400 | £2,400 | £14,000 | £28,800 | £42,800 |
Surveillance audit fee components
Day count
Typically one third of Stage 2 day count. A 3-day Stage 2 produces a 1-day surveillance. Larger or multi-site organisations proportionally more.
Day rate
Matches the certification body's standard day rate. Day rates moved up 20 percent into 2026; budget surveillance at 2026 rates, not the rate at original certification.
Travel
Often the surprise cost for clients outside major UK cities. Typically £100 to £400 per visit when not absorbed into the day rate. Ask your body explicitly about travel charging.
Annual registration and admin fees
Most UKAS-accredited bodies charge a small annual fee, typically £100 to £400, on top of the surveillance audit fee. It covers certificate maintenance, directory listing, and back-office administration. It is a real line item; it shows up as a separate invoice or as a line on the surveillance invoice. Confirm at quote stage whether your body bundles or separates this fee.
Internal maintenance time
Realistic estimate: 0.1 FTE on quality coordination across the year. For a 50-person firm at a £45,000 fully-loaded operations manager cost, that is £4,500 to £5,000 imputed annually. Across three surveillance years, internal maintenance is £13,500 to £15,000, comparable to the cumulative audit fee total.
This time covers internal audit cycles, management review preparation, document review and update, corrective action tracking, and customer feedback monitoring. Outsourcing it to a consultancy on retainer typically costs £4,000 to £6,000 per year, which is a wash on cost but moves the work off the operations lead.
Recertification audit (every three years)
Recertification covers the full standard but at lower depth than initial certification, on the assumption that the QMS is mature. Stage 1 is typically a desk review rather than a separate visit. Stage 2 day count is roughly 60 to 70 percent of original.
What changes: scope review (has anything new been added?), risk review (are the risks captured in the QMS still the right ones?), and a closer look at process performance trends across the three-year cycle. Surveillance findings that recur across multiple years are a flag at recertification.
What goes wrong at surveillance audits
Internal audit programme not fully run
Audits scheduled but not completed across all clauses, or last cycle entirely missed. Most common surveillance finding.
Prevention: 1 to 2 hours per quarter of discipline. Schedule audits properly, hold the auditor accountable for completion.
Management review not held or not minuted
Annual management review meeting either skipped, or held without proper documented inputs and outputs.
Prevention: 1 hour to plan inputs, 1 hour for the meeting, 1 hour to minute decisions and actions. Annual.
Corrective actions opened but not closed
Non-conformances raised at last surveillance, corrective action plans drafted, but verification step skipped or evidence not collected.
Prevention: Block 1 hour per quarter to close out the previous quarter's actions before opening new ones.