When will certification realistically happen, and what will it cost?

Start

Someone asks when we will be certified, and for how much

The question usually comes from a sponsor, a sales team with a tender, or a regulator. An honest answer has two parts, worked out in the same way: a date built from what the auditor needs to see, and a budget in which the largest line is your own people's time.

• Then: Write down the reason for certifying and any fixed deadline

Step

Write down the reason for certifying and any fixed deadline

The reason sets the scope and the date: which customers, tenders or regulators will read the certificate, and by when. If one of them has set a deadline, plan backwards from it phase by phase as well as forwards from today. That shows early whether the two meet.

• Then: Have you scored readiness and listed gaps with owners?

Decision

Have you scored readiness and listed gaps with owners?

A real estimate needs each requirement scored from 0 (Not started) to 3 (Operating), and each gap given an owner and the weeks of work that owner can actually give it. Without that, you can only plan with typical durations. If you are unsure whether your scores are current, answer no.

• Yes: Work out the earliest Stage 2 date from three dates
• No, or not known: Plan with the typical phase durations for now

Step

Plan with the typical phase durations for now

The pack's default route is six phases, 38 weeks of elapsed time: decide and scope, assess risk, select and document controls, implement and operate, check, certify. A smaller organisation, or one with more in place, can shorten the first three. The implement-and-operate phase cannot be shortened by adding people: it is the time controls need to produce records. Replace these durations after your first readiness assessment.

• Then: Is the certification body booked for dates that fit?

Step

Work out the earliest Stage 2 date from three dates

(a) When the last gap is In place, with each owner working through their gaps one at a time, blocking items first. (b) When the last blocking item is In place, plus the operating period; the pack's default is 3 months, and your certification body may expect more. (c) When the internal audit and management review are done. The earliest Stage 2 date is the latest of the three.

• Then: Is the certification body booked for dates that fit?

Decision

Is the certification body booked for dates that fit?

Auditors are booked weeks or months ahead, and the date you want may not exist. The pack plans to book by the end of the phase that produces the Statement of Applicability, with a typical lead time of 8 to 12 weeks. If you have not booked, or are unsure the dates hold, answer no.

• Yes: Add the certification decision after Stage 2
• No, or not known: Get dates from at least two accredited bodies

Step

Get dates from at least two accredited bodies

Ask each body for its available dates and for the audit days per stage and per surveillance audit, not only the total. Leave room between Stage 1 and Stage 2: the pack's typical gap is 2 to 8 weeks, long enough to close Stage 1 concerns and short enough that Stage 1 is still current.

• Then: Add the certification decision after Stage 2

Step

Add the certification decision after Stage 2

The certificate does not arrive on the day of Stage 2. The certification body's own review usually takes some weeks; the pack's typical figure is 2 to 6 weeks, and only if no major nonconformity is open. A major nonconformity holds the recommendation until it is corrected and verified, which may need a further visit.

• Then: Does the certificate date meet the deadline you were set?

Decision

Does the certificate date meet the deadline you were set?

Compare the likely certificate date with the deadline from the customer, tender or regulator. If there is no external deadline, compare it with the date top management expects. If you cannot tell yet, answer no and say so: it is better raised at the first gate than discovered at Stage 1.

• Yes: Estimate internal effort first: it is the largest cost
• No, or not known: Raise it now: add resource, narrow the scope or accept later

Step

Raise it now: add resource, narrow the scope or accept later

Tell the executive sponsor the same month. More people help only with the work of putting controls in place; they cannot shorten the operating period of records. A narrower first scope can be widened later at a surveillance audit, if it still passes every scope test, but narrowing it after Stage 1 is expensive. If neither closes the gap, tell whoever set the deadline now, then cost the plan you choose.

• Then: Estimate internal effort first: it is the largest cost

Step

Estimate internal effort first: it is the largest cost

The pack estimates 150 to 300 person-days in total for 100 to 300 people, mostly the ISMS manager and the control owners. Budget it as time released from other work, or the project slips when controls are being put in place. Add the cost of closing each gap, such as backup or logging tools, budgeted per gap from the gap tracker.

• Then: Budget the certification body for the full three-year cycle

Step

Budget the certification body for the full three-year cycle

The pack's estimates, to be replaced by quotes: 10 to 15 audit days and about €10,000 to €25,000 for Stage 1 and Stage 2; surveillance audits in years two and three at about a third of the initial fee each; recertification at about two thirds of it every three years. The certificate lapses without the surveillance audits. Training, a contracted internal auditor and consultancy are optional.

• Then: Does any quote offer far fewer audit days, or lack accreditation?

Decision

Does any quote offer far fewer audit days, or lack accreditation?

Audit days depend mainly on the number of people in scope, the number of sites and the complexity of the scope, under the rules the body is accredited to. A quote with fewer days than other accredited bodies offer for the same scope is worth questioning. A certificate from a body without recognised accreditation may not be accepted by the customers you are certifying for.

• Yes, or not known: Question that quote before you rely on it
• No: Take the date and budget to top management for approval

Step

Question that quote before you rely on it

Ask the body how it arrived at its audit days for your scope and whether the quote covers the whole three-year cycle. Compare it line by line with the other quotes. Drop a body whose accreditation your customers or regulator would not recognise.

• Then: Take the date and budget to top management for approval

Outcome

Take the date and budget to top management for approval

Top management approves the scope, the policy and the resources before the project starts. Depending on how you are governed, that is the board or a committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board. Present the date as a measure that will change: reassess readiness monthly once controls are being put in place, and move the date early if the evidence says so.