Title: ISO 27001 internal audit cost UK: from £1,500 + VAT

> ISO 27001 internal audit cost in the UK: from £1,500 + VAT fixed after scoping, the six cost drivers, day rate versus fixed fee, in-house versus outsourced.

Source: https://aegentra.co.uk/knowledge/iso-27001-internal-audit-cost-uk  
Publisher: Aegentra (aegentra.co.uk), United Kingdom edition. Prices in GBP excluding VAT.  
Published: 2026-10-26  
Updated: 2026-10-26  
Licence: public web content; cite the source URL.

Practical guide / United Kingdom

# What an ISO 27001 internal audit costs in the UK

A real starting figure, the six things that move it, how to get comparable quotes, what a fixed fee should include, and when an in-house audit or a certification-body pre-assessment is the better spend.

By [Harry Sidhu](https://aegentra.co.uk/about#director) — ISO 27001 Lead Implementer · Director and Principal Consultant, AegentraPublished 26 October 2026 · 8 min read

Prices are Aegentra’s own UK prices in pounds sterling excluding VAT, correct at the date above and confirmed in a written proposal. Third-party pricing practices are described generally; no other provider’s price is quoted as ours.

## The short answer

An outsourced ISO 27001 internal audit for a smaller UK organisation with one clear ISMS scope and accessible evidence costs from **£1,500 + VAT** with Aegentra, as a fixed fee agreed in writing after scoping. Larger or multi-site scopes, wide Annex A sampling in a single cycle, on-site days and verification of corrective actions each add to the fee, and the written proposal states the total before work begins. Where UK providers publish prices at all, most quote a day rate and leave the number of days open; the comparison that matters is the scope and the deliverables behind the number, not the number itself.

The rest of this guide explains what moves the fee, how a day rate and a fixed fee compare, what our starting fee covers and excludes, and when an in-house audit, an outsourced audit or a certification-body pre-assessment is the right spend.

## What drives the fee

Every internal audit quote, ours included, is a function of auditor time plus the fixed cost of planning and reporting. Six things decide the time.

| Driver | What increases the fee | What keeps it down |
| --- | --- | --- |
| ISMS scope | Several products or business units, complex supplier chains, in-scope development and operations across many teams. | One service, one platform, a scope statement that matches how the business actually runs. |
| Sites | Each additional site with physical controls or local staff to interview. | One office plus remote workers; physical controls observed on one visit or by evidence. |
| Annex A coverage this cycle | All applicable controls sampled in one audit, or a first audit with no previous coverage to build on. | Risk-based coverage planned across the certification cycle, so each audit samples a subset with a recorded rationale. |
| Sample size and evidence access | Large populations, records spread across systems, no read-only access for the auditor, evidence collected by email. | Populations exportable from one or two systems, read-only access agreed in advance, a compliance platform that holds the records. |
| Remote or on site | Multiple on-site days, travel, and physical-security observation at several locations. | Remote interviews and evidence review, with a single on-site day only where the sample needs it. |
| Follow-up | Verification of corrective action closures, re-testing, support preparing for the certification visit. | Follow-up agreed as a separate, smaller fixed piece, or handled by the organisation with the auditor verifying on evidence. |

Two things do not drive the fee and should not be paid for: the length of the report, and the number of checklist lines ticked. A forty-page report with no sample references is worth less than ten pages with an indexed evidence trail.

## Day rate or fixed fee

UK consultancies price internal audits in one of two ways. A day rate is simple to publish and hard to compare, because the number of days is decided after you have signed. A fixed fee is harder to publish, because it needs a scoping conversation first, but it is the only form that lets you compare proposals and hold the provider to the deliverables.

| Question | Day rate | Fixed fee after scoping |
| --- | --- | --- |
| What do I know before I sign? | The rate. The total depends on days the provider estimates, often loosely. | The total, the scope it covers, the deliverables and the exclusions. |
| Who carries the risk of a harder-than-expected audit? | You. Extra days are billed. | The provider. Extra work needs your written agreement first. |
| How do I compare two proposals? | Multiply rate by estimated days and hope the estimates are honest. | Compare like-for-like scope, sample commitments and deliverables. |
| What is the incentive? | More days, more revenue. | Scope the work accurately and deliver it efficiently. |
| When does it suit? | Open-ended advisory work where the scope genuinely cannot be fixed. | An internal audit, whose scope is defined by the audit programme and the SoA before it starts. |

How to ask for a comparable quote

Send every provider the same four things: your ISMS scope statement, your Statement of Applicability, the number of sites and staff, and the controls you want covered in this cycle. Ask for a fixed fee that names the sample commitments and the report sections. A provider who will not fix the fee against that information is telling you something about how the engagement will run.

## What our from £1,500 + VAT fee covers, and what it excludes

The starting fee is for a smaller organisation with one clear ISMS scope, one site or remote-only operation, straightforward evidence access and risk-based Annex A coverage planned across the cycle. It is a fixed fee after scoping, quoted in pounds sterling plus VAT, and it includes the following.

- Audit objectives, criteria, scope and a documented impartiality assessment.
- A written audit plan and the evidence request list.
- Document review, remote interviews with control owners, and a justified sample of operating records for all of Clauses 4 to 10 and the Annex A controls agreed for the cycle.
- Findings written as criterion, evidence, condition and conclusion, graded, with matters examined and closed reported transparently.
- An audit report written for management review and for your certification body, with an indexed working-paper trail and an action record.
- A closing meeting and a written statement of limitations.

The following are agreed separately where you want them, and are stated in the proposal if included.

- On-site days beyond the agreed remote delivery, and travel.
- Additional sites, additional business units or a materially larger Annex A sample in one cycle.
- Verification of corrective action closures and re-testing after the report.
- Any implementation or remediation work. Where Aegentra has helped build the ISMS, the audit is assigned to a different auditor under a documented impartiality assessment, or declined if impartiality cannot be established.
- Certification-body fees, which are paid to the UKAS-accredited body you choose and are separate from any internal audit.

The full inclusions and the seven-step method are on the [ISO 27001 internal audit service](https://aegentra.co.uk/services/govern/iso-27001-internal-audit) page.

## In-house, outsourced or certification-body pre-assessment

Three different purchases get compared as if they were the same thing. They are not, and the cheapest option on paper is often the most expensive once the certification audit arrives.

| Factor | In-house internal audit | Outsourced internal audit | Certification-body pre-assessment |
| --- | --- | --- | --- |
| Meets Clause 9.2? | Yes, if the auditor is competent and independent of the areas audited. | Yes. This is the model Clause 9.2 explicitly allows. | No. A pre-assessment is an optional external review; it does not replace the internal audit. |
| Direct cost | Staff time: typically five to ten days of a trained person, plus training. No invoice, but not free. | From £1,500 + VAT fixed with Aegentra; day-rate providers vary. | Charged by the certification body at its audit day rate, usually one to two days. |
| Independence | Hard to achieve below about fifty staff; the ISMS owner cannot audit their own work. | Built in, with the impartiality assessment documented. | Independent, but the same body then audits you for certification, which limits what it can advise. |
| Competence | Needs training and practice; the first audit by a newly trained auditor is usually thin. | Experienced auditor; competence evidence supplied for your records. | Experienced auditor, but the output is a readiness opinion, not a Clause 9.2 report. |
| Output | Internal audit report, if the auditor knows how to write one. | Internal audit report, working papers, action record, evidence for the certification body. | A short readiness report; findings are indicative and not tracked as your internal audit. |
| Best for | Organisations with a trained auditor who is genuinely separate from the ISMS, or a group with an internal audit function. | Small and mid-sized organisations, first-cycle certifications, and anyone whose impartiality test would otherwise fail. | A one-off confidence check before Stage 2, in addition to the internal audit, when budget allows. |

The hidden cost of a weak in-house audit is paid at the external audit: a nonconformity against Clause 9.2 itself, findings the internal audit should have caught, and in the worst case a delayed certificate while corrective actions are verified. Against that, a fixed-fee outsourced audit is cheap insurance.

## Budgeting across the certification cycle

Plan the internal audit as a recurring line, not a one-off. A typical UK three-year cycle has an internal audit before Stage 2, one before each surveillance audit and one before recertification, so four audits in the first cycle and three in each cycle after. Coverage planned across the cycle keeps each audit proportionate: all of Clauses 4 to 10 every year, and Annex A sampled on a risk basis so every applicable control is covered within the three years. Budget separately for closing corrective actions, because that is where the real work after the audit sits, and for the certification body’s own fees, which are the larger number.

## Questions readers ask.

**How much does an ISO 27001 internal audit cost in the UK?**

With Aegentra, from £1,500 + VAT as a fixed fee agreed after scoping, for a smaller organisation with one clear ISMS scope and accessible evidence. Larger scopes, additional sites, wide Annex A sampling in one cycle, on-site days and follow-up verification increase the fee, and the written proposal states the total before work begins.

**Is VAT charged on top?**

Yes. UK fees are quoted in pounds sterling excluding VAT, and VAT is added at the prevailing rate on the invoice. The proposal shows the fee, the applicable tax treatment and the total payable.

**Why do some providers quote a day rate instead of a fixed fee?**

A day rate is easy to publish without knowing your scope, but it leaves the total open until the days are counted. An internal audit has a definable scope, set by your audit programme and Statement of Applicability, so it can be fixed after a scoping conversation. Ask any provider for a fixed fee against your scope statement and SoA.

**Is an outsourced internal audit cheaper than doing it ourselves?**

Often, once staff time is counted honestly. A competent in-house audit takes a trained person five to ten days plus the cost of training, and below about fifty staff the impartiality requirement usually cannot be met in-house anyway. The real comparison is against the cost of a weak audit: findings at the certification audit, a Clause 9.2 nonconformity and a delayed certificate.

**Does the internal audit fee include the certification audit?**

No. Certification is performed and charged by the UKAS-accredited certification body you choose; its fees cover Stage 1, Stage 2, annual surveillance and recertification. Aegentra never certifies. The internal audit is a separate Clause 9.2 requirement that the certification body relies on as evidence.

**Can we reduce the cost by auditing fewer controls?**

You can plan Annex A coverage across the three-year certification cycle rather than sampling every applicable control every year, provided the audit programme records the rationale and all of Clauses 4 to 10 are audited each year. You cannot leave applicable controls out of the cycle altogether; certification bodies expect full coverage within the cycle.

## Check the primary sources.

[ISO: ISO/IEC 27001:2022 Information security management systems](https://www.iso.org/standard/27001)

[UKAS: find an accredited certification body](https://www.ukas.com/find-an-organisation/)

## Choose the next step.

[Request a fixed-fee ISO 27001 internal audit service proposal](https://aegentra.co.uk/services/govern/iso-27001-internal-audit)

[ISO 27001 certification in the UK: scope, costs and responsibilities](https://aegentra.co.uk/knowledge/iso-27001-certification-uk)

[What ISO 27001 Clause 9.2 requires of the audit](https://aegentra.co.uk/knowledge/iso-27001-clause-9-2-internal-audit-requirements)

[How to conduct the audit in-house, step by step](https://aegentra.co.uk/knowledge/how-to-conduct-an-iso-27001-internal-audit)