Certification is worth it when someone you want to sell to requires it, or when you will use the discipline it forces. It is a poor buy when it is a badge to hang on a website. Here is how to tell which you are.
Good reasons
- A customer or tender asks for it. Read the requirement carefully: some ask for certification to a named standard, some for UKAS-accredited certification, some for a specific scope.
- You need a structure for a growing team. A management system gives new staff something to follow.
- You sell to security-conscious or regulated buyers and ISO 27001 shortens their due diligence.
Weak reasons
- It looks professional. A certificate nobody asks for is a recurring cost.
- A salesperson said you need it. Ask for the written requirement.
- You want it cheaply and quickly. Published costs are a cycle, not a one-off: surveillance audits come every year.
What it costs you, in sourced terms
For a small organisation the published ranges are in the low thousands of pounds across a cycle, rising with size and complexity. See each cost page for sources: ISO 9001, ISO 27001, ISO 14001, ISO 45001. The larger cost is often staff time, which no source prices.
Do a simple test
- List the customers or tenders that need it. Fewer than one: wait.
- Check the exact wording of what they accept.
- Get at least two quotes with audit days stated.
- Ask what the second and third year cost.
We earn nothing from you choosing certification. We do not sell it. How this site is run.