Independent cost guide. Not affiliated with any certification body or compliance platform. Published prices are cited to their source; certification-body and consultant fees are quoted per engagement, so we do not state them. Always obtain a formal quote.

NQA ISO 27001 cost: accreditation, trading names and quote drivers

No NQA fee appears on this page, because NQA does not publish one and no accredited certification body does. The audit-day tables are sold by ISO. What is public is NQA's schedule of accreditation on the UKAS register, including the exact legal entity and trading names it is issued under, and that is where this page starts.

Updated July 2026

NQA on the UKAS register

Legal entity, as printed

NQA Certification Ltd t/a NQA Certification and KIWA

Accreditation body

UKAS

Accreditation number

0015

ISO/IEC 27001 on the schedule

Confirmed, read from the schedule

Scope line, verbatim

"Information Security Management Systems (ISMS) to ISO/IEC 27001:2022"

Checked July 2026 by downloading the schedule and reading its accredited scope. Schedule of accreditation 0015 | UKAS register

A UK certification body trading as NQA Certification and KIWA, holding UKAS accreditation for ISMS alongside other management system schemes.

Legal entity, trading name, and why the difference bites

The schedule names the entity as NQA Certification Ltd t/a NQA Certification and KIWA. A trading name is simply a name that a legal entity trades under. The accreditation belongs to the entity, and the certificate has to name that entity for the accreditation to attach to it.

This bites at one specific moment: the register check. Someone looks up the name on the proposal, does not find it, and either concludes something is wrong or gives up on checking. Neither is right. Search for the legal entity, open schedule 0015, read the scheme list, and confirm the ISMS line is on it. Then check the certificate you are issued names the same entity.

The same discipline resolves most confusion in this market, whether the mismatch comes from a trading name, a group brand, a national subsidiary or an acquisition. The register is the record. Everything else is a name.

Why there is no NQA fee on this page

An audit fee is audit days multiplied by a rate. Neither input is published.

The rate is commercial. NQA quotes per engagement. No accredited certification body publishes a day rate, and the accreditation registers publish accreditation status only, never anything commercial. There is no rack rate in this market to quote, to discount from, or to rank bodies against.

The days are behind a paywall. ISMS audit time is determined under ISO/IEC 27006-1:2024. Its audit-time provisions are the normative Annex C, with methods for audit time calculations in the informative Annex D. ISO sells the standard and the annex tables are not in the free preview. We have not read them, so we do not reproduce them.

NQA holds the standard and applies Annex C to your scope. Ask for the audit days it determined and the basis for them. More on how audit fees are set.

What actually drives your quote from NQA

These are the drivers ISO/IEC 27006-1:2024 and the accreditation bodies name. They are drivers, not a formula, and they are the same drivers whichever accredited body you approach.

Number of persons doing work under the organisation's control, within the ISMS scope

The primary input. ISO/IEC 27006-1:2024 counts people doing work under the organisation's control within the ISMS scope regardless of whether they are members of the organisation, so contractors and freelancers inside the scope count toward the total.

ISMS scope

What the certificate actually covers: which services, systems, teams and locations sit inside the boundary. A tightly drawn scope is the single largest lever a buyer controls.

Complexity and risk of the ISMS

Criticality of the information handled and the risk associated with the ISMS. Two organisations with identical headcount can attract different audit time on this basis.

Sites

Where scoped activities physically happen, and whether multi-site sampling applies.

Delivery mode

How much of the audit runs remotely versus on site. This drives auditor travel and expenses, which are usually quoted separately from audit time.

Headcount is counted on the standard's definition, not on your payroll report. ISO/IEC 27006-1:2024 counts people doing work under the organisation's control within the ISMS scope whether or not they are members of the organisation, so contractors and freelancers inside the scope count. Fixing that number before you request quotes is the difference between a quote that holds and a quote revised upward after Stage 1.

Price the three-year cycle, not year one

Certification runs on a three-year cycle: a two-stage initial audit, surveillance audits in the intervening years, and a recertification audit before the certificate expires. Surveillance audits are shorter than the initial audit, are also determined under ISO/IEC 27006-1:2024, and are also quoted per engagement.

A year-one quote is not your cost of certification, and a cheaper year one with unstated surveillance is not a cheaper programme. Ask NQA to price the whole cycle up front and to state what happens to the rate across the three years. See the three-year cycle page.

How to get a comparable quote from NQA

  1. Write one scope brief and send it unchanged to every body. Scope, headcount on the ISO/IEC 27006-1:2024 definition, sites, remote versus on-site appetite, and every scheme you intend to certify.
  2. Ask NQA to state the audit days it determined. Days are the quantity the standard governs.
  3. Confirm schedule 0015 covers the scheme you are buying, searching the register by legal entity rather than trading name.
  4. Ask for the full cycle. Initial audit, surveillance, recertification, and the rate across three years.
  5. Get travel and expenses stated separately. They sit outside audit time and are a real line on an on-site audit.
  6. Confirm audit time is determined under ISO/IEC 27006-1:2024. UKAS required transition by 31 July 2025 and ANAB required application to all clients by 31 March 2026.

Verify accreditation yourself: UKAS register | ANAB directory

Frequently asked questions

How much does NQA ISO 27001 certification cost?
NQA publishes no rate card and no day rate for ISO 27001, and neither does any other accredited certification body. An audit fee is audit days multiplied by a rate. The rate is commercial and unpublished. The audit days are determined by the body under ISO/IEC 27006-1:2024, whose audit-time provisions sit in the normative Annex C, and ISO sells that standard rather than publishing it openly. Both inputs are unpublished, so any figure printed here would be invented. NQA quotes against your actual scope.
Is NQA accredited for ISO 27001?
Yes. NQA's management systems schedule of accreditation on the UKAS register, number 0015, is held by NQA Certification Ltd t/a NQA Certification and KIWA and carries "Information Security Management Systems (ISMS) to ISO/IEC 27001:2022". We downloaded and read that schedule in July 2026. Accreditation attaches to a legal entity rather than to a brand, so confirm the entity named on your certificate against the register.
Why does the UKAS register show NQA trading as NQA Certification and KIWA?
The schedule names the entity as NQA Certification Ltd t/a NQA Certification and KIWA. A trading name is a name a legal entity trades under, and the accreditation belongs to the entity rather than to any of the names. For a buyer this matters at exactly one moment: when you check the register. If you search for the trading name you saw on a proposal and cannot find it, search for the legal entity instead, and confirm that the entity on your certificate is the entity on the schedule.
What drives the audit days NQA will quote?
The primary input under ISO/IEC 27006-1:2024 is the number of people doing work under the organisation's control within the ISMS scope, counted regardless of whether they are members of the organisation, so contractors and freelancers inside the scope count toward the total. Audit time also reflects the ISMS scope itself, the complexity and risk of the ISMS including the criticality of the information handled, the sites involved, and how much of the audit runs remotely rather than on site.
Is a certificate from a smaller certification body worth less?
Accreditation is the thing procurement teams check, and an accredited ISO/IEC 27001 certificate carries the same scope line whichever accredited body issues it. What differs between bodies, and what you can verify, is the shape of the accreditation itself: which legal entity holds it, which accreditation body granted it, and which schemes it covers. That is on the register. Rankings and tiers are not on the register, and we do not publish them.
How do I brief NQA so the quote is comparable to another body's?
Send NQA and every other body an identical brief: your ISMS scope, the number of people doing work under your control inside that scope including contractors, your sites, and how much of the audit can run remotely. Ask each body to state the audit days it has determined, to confirm its ISO/IEC 27001 accreditation on the accreditation body's register, to price surveillance and recertification across the full three-year cycle, and to state travel and expenses separately. Quotes built on different briefs cannot be compared.

Other certification bodies on the register

Updated July 2026