What ISO 20000-1 really costs and how to budget

Someone on your board has asked, “What will ISO 20000-1 cost us?” They want a neat figure. You want to give one. The truth is, it depends — but not in a vague way. There are specific levers that drive the price and the effort, and you can plan for them.

As auditors, we see budgets blown by hopeful guesses and saved by clear scoping. Here’s a straight view of what you’ll pay for, where internal time goes, and how to avoid last-minute spend.

What you’re actually paying for

There are two cost buckets: external certification costs and your internal investment. Both matter.

• Certification audits: Stage 1 (readiness and documentation review) and Stage 2 (implementation and effectiveness), followed by annual surveillance audits and a three-year recertification cycle. These are charged by audit days and a day rate, sometimes with travel and subsistence.
• Preparation and maintenance: gap analysis or pre-assessment (optional), internal audits, management review, closing findings, staff training, and any process or tooling improvements you choose to make.

Think of the certification fee as the meter for independent assurance. Your internal spend is how you build and prove a service management system that actually works.

How certification bodies calculate fees

Certification bodies don’t pick audit duration out of thin air. We apply international rules and risk-based judgement to set audit days. The main drivers are:

Size and complexity: not total headcount, but the people and suppliers involved in planning, delivering, transitioning, and improving your IT services. A single, standardised service is faster to audit than a mixed catalogue delivered across several sites with many third parties.

Scope and boundaries: a tight, well-defined scope (e.g. “Managed service desk and end-user support for UK clients”) takes fewer audit days than “All IT services worldwide”. Multi-site sampling and remote work are considered, but complexity still adds time.

Outsourcing model: heavy reliance on partners can increase audit effort because we need to sample how you control and measure those interfaces.

Stage split: Stage 1 is shorter and focused on readiness; Stage 2 is longer and evidence-driven. Surveillance audits in years two and three are shorter again, and recertification sits between surveillance and a full Stage 2 in duration.

Day rate: rates vary by body, sector expertise and whether travel is required. Cheapest is not always least expensive once delays, re-audits or unclear scoping are factored in.

Typical timelines and when the bills land

Most organisations do their groundwork over a few months, then book Stage 1 and Stage 2 with a short gap between to close any early findings. Surveillance audits happen annually for the next two years. In the fourth year you recertify and start a new cycle. Many clients prefer to spread the certification fee annually across the three-year cycle; others pay per event. Ask for both options so finance can plan cash flow.

If you’re migrating from another standard to align frameworks (for example, folding ITIL practices formally into an ITSMS), build time for process alignment and evidence gathering. If you’re transferring from another certification body, you may be able to transfer at surveillance rather than restarting the cycle, which affects cost and timing.

Budgeting the internal effort

The cost that gets underestimated most often is people time. On a lean service team, every hour on audits is an hour not spent on incidents or projects. Be realistic.

Assign a project lead who can pull threads together — service desk, change, incident, problem, configuration, supplier management, continual improvement, and information security where it intersects. Budget their time for planning, risk and service catalogue updates, and coordinating internal audits and management review.

Subject-matter experts will need to evidence how work is actually done: tickets, change records, service reports, SLAs, supplier performance, emergency change handling, and lessons learned. Build evidence collection into BAU as early as possible so you’re not scrambling before Stage 2.

Training doesn’t have to be exotic. Short, targeted briefings on the standard’s requirements, roles and responsibilities, and how to raise nonconformities internally are usually enough. Internal auditor training for a few people pays for itself by catching issues before we do.

Where costs creep — and how to keep them down

We see the same budget leaks during audits:

Scope drift: expanding scope mid-project drags extra audit days and more internal work. Write a plain-English scope statement, get it agreed, and hold the line until after certification.

Over-documentation: a glossy manual nobody uses creates rework. Document what people actually do, and align existing ITIL/DevOps artefacts with the standard rather than starting from scratch.

Tool changes at the wrong time: switching ITSM platforms during the audit window is a recipe for missing evidence. If you must change, freeze the old system’s data and plan demonstrations carefully.

Late internal audits: a thin internal audit program means Stage 2 becomes your real audit, which is riskier and more expensive if we need follow-up time. Schedule internal audits early, sample across processes and sites, and track findings to closure.

Poor supplier control: ISO 20000-1 cares how you manage suppliers. If vendor KPIs, service reviews and exit plans are weak, expect findings. Tighten those controls ahead of Stage 1.

Two common scenarios (without the sales gloss)

Single-site managed service provider: One office, clear service catalogue, a compact team using a mature ITSM tool. Certification tends to be straightforward. Audit time is driven by the breadth of services (service desk, incident, change, problem, request, capacity, availability, continuity, information security alignment) and any cloud partners. Internal time is mostly coordination and tidying up evidence.

Multi-site internal IT department: Several campuses, different teams handling infrastructure, applications and end-user support, mixed on-prem and cloud, and multiple outsourcers. Audit days increase due to sampling across sites, interfaces between teams, and supplier management. Internal effort is heavier: harmonising processes, clarifying ownership, standardising KPIs, and ensuring consistent records.

Should you hire a consultant?

You don’t have to. If your ITSM practices are already disciplined and measured, a capable internal lead can get you there. A consultant can shorten the learning curve, especially for first-time certifications or complex scopes, but avoid buying a full document set that nobody will maintain. Consider targeted coaching, gap analysis, and internal auditor training instead of wholesale outsourcing.

Remember the guard-rails: your certification body can’t consult. Keep consultancy and certification separate to protect impartiality.

Getting a clear quote

Good scoping makes for accurate quotes. Share a concise description of services in scope, where they’re delivered from, headcount involved in the ITSMS (employees and regular contractors), key suppliers, and any planned changes during the audit window. Ask the certification body to break down Stage 1, Stage 2, surveillance and recertification days, note any travel costs, and explain their multi-site sampling approach and remote audit ratio. If you’re considering ISO 20000-1 certification alongside other standards, ask whether combined audits are feasible and what the trade-offs are for timing and focus.

Finally, clarify how nonconformity closure is handled. A clean, timely process avoids follow-up days. If a follow-up is needed, understand whether it can be done remotely.

What not to cut

Three things are false economies. Skipping internal audits, deferring management review until after Stage 2, and under-investing in supplier management. All three tend to push costs into the certification stage through findings and additional time. Keep them in the plan.

What a sensible budget looks like

Think in layers rather than a single figure:

External: audit day fees spread over three years, with a small contingency for follow-up time if required.

Internal: project lead time, SMEs for evidence and process tweaks, internal auditor training, and a modest pot for tightening supplier controls or minor tool configuration.

Optional: a limited number of consultancy or coaching days if you’re new to the standard or your scope is complex.

If finance wants confidence, create a simple risk register for the certification project. Put scope change, resource availability, supplier gaps, and tool changes on it. Agree triggers and mitigations. It’s dull, but it prevents surprises.

If you’d like a grounded discussion about your scope, audit duration and scheduling, speak to us at UKCTL. We’ll give you a clear, line-by-line proposal and practical guidance on how to prepare without overspending.