ISO 27001 audit days: how they are calculated

How ISO 27001 audit days are calculated for your organization

If a customer or contract now requires ISO 27001 certification, the audit time you will be quoted starts from one number: the total count of persons doing work under your organization's control, across all shifts. The certification body then adjusts that figure under the audit time rules in Annex C of ISO/IEC 27006-1:2024, which sets the additional requirements for bodies that audit and certify information security management systems. No fixed day count applies to every organization. The result depends on headcount, the number of sites, the scope of the certificate and how mature your management system is, and only the certification body can set and document the final days. Your job before requesting quotes is to assemble an accurate headcount with a clear definition of who is included, including contractors, part-time staff and people on other shifts, and to list every location where in-scope work happens.

Two adjustments matter most in practice. First, the rules allow a certification body to reduce the head count of a group of people performing identical activities, based on the risk of their tasks, but never below the square root of that group's head count. The body must justify and document its criteria, so ask for that written rationale. Second, on-site time for multi-site organizations is generally calculated from the total number of persons wherever they are located, so a distributed team does not automatically lower the days. Expect the body to review planned audit time at each surveillance and recertification audit as your organization and system maturity change. DeployOpen can prepare your systems, scope records and evidence so the auditor's time is spent testing controls, but DeployOpen does not set audit time, issue reports or certificates. Ask each certification body for a written audit time calculation, and confirm the details against the ISO/IEC 27006-1:2024 text and the IAF MD 29:2024 transition document.

What raises or lowers the audit days for an ISO 27001 audit

Certification bodies start from the people doing work under the organization's control, then adjust for how those people are spread across locations, how they work, and how far the scope reaches. The factors below are the ones that move the calculation most, and most of them are decisions the organization makes before the audit is booked.

Headcount including contractors and shifts

The starting point is the total number of persons doing work under the organization's control across all shifts, which means contractors, temporary staff and night-shift operators count alongside employees. Anyone who works inside the scope and is not on the payroll still adds to the count. Before booking, list every group that touches the ISMS, including outsourced operations staff, and confirm with the certification body how each group is counted.

Number and type of locations

Multi-site organizations are generally counted across all locations in scope, so each additional office, plant or data center adds people to the base. Sites with no physical presence, such as a fully remote team, are treated differently. Define which locations hold scoped activities and which are only supporting, and ask the certification body how its multi-site sampling and counting rules apply to your structure.

Remote and hybrid working

Remote work does not remove audit time, but it changes how much of the audit can happen off site. Where the certification body uses ICT for parts of the audit, the report must state how far remote auditing was used and how effective it was. Organizations with few or no physical sites may need certificates that state activities are conducted remotely. Ask early which parts of the audit need on-site presence.

Scope boundary

The certificate covers only what the clause 4.3 scope describes, so a narrow scope with clear boundaries usually means fewer people and fewer sites to audit. A broad scope that includes shared platforms, support teams or business units pulls more people into the calculation. Changes after certification also matter: extending scope to new sites or services carries its own audit time under the current rules, so plan extensions against the surveillance calendar.

Outsourced services

Outsourced operations are not automatically excluded. The organization must show how it controls the outsourced processes, which means contracts, service levels and monitoring evidence that the certification body can sample. Where a supplier performs in-scope work under the organization's control, its personnel may enter the count. Document each outsourced process in the Statement of Applicability and confirm the boundary with the certification body before stage 1.

Evidence maturity and review

Clear, consistent and well-kept records let the certification body sample efficiently, while gaps in evidence tend to lead to additional questioning and more time. Certification bodies review planned audit time at each surveillance and recertification audit to reflect changes in the organization and in how mature its system is. Keep the ISMS records current so a change in headcount or structure is visible at the next review.

Working through the audit time calculation step by step

The sequence turns the organization's workforce into a documented audit time figure that the certification body can justify, adjust and revisit at each surveillance audit. Each step closes with a written output the organization should hold before the audit plan is agreed.

Count everyone doing work under the organization's control
The starting point is the total number of persons doing work under the organization's control, across all shifts. This includes employees, contractors and other people whose work falls within the ISMS scope, not only full-time staff on the payroll. The organization prepares the headcount by scope and shift pattern, and the certification body checks it against the ISMS scope statement. The output to request is a written headcount schedule that lists each group, its shift pattern and its location, with the certification body's confirmation that it is the figure used for the initial calculation.
Group people performing identical activities
Under ISO/IEC 27006-1:2024, people who perform identical activities can be treated as one group. Examples include a team of support staff working the same queue or engineers running the same deployment routine. The organization describes the activities each group performs, and the certification body decides where the grouping is valid. The output to request is a grouping table that names each group, the activities it covers and the headcount within it, so the basis for later reduction is visible.
Apply the risk-based reduction within the square-root limit
For each group, the certification body may reduce the head count according to the risk of the tasks people perform, but never below the square root of that group's head count. The certification body sets and documents its criteria, and the organization can ask which risk factors were applied to each group. Reductions for lower-risk roles are typically argued from access to sensitive data and systems. The output to request is the documented criteria and the reduced figure per group, with the justification recorded on file.
Add the on-site and remote elements
Audit time for multi-site organizations is generally calculated from the total number of persons doing work under the organization's control, wherever they are located. The certification body then sets how much of that time is on site and how much may be spent remotely, and it reports how far remote auditing was used and how effective it was. Organizations with few or no relevant physical sites should confirm with the certification body which activities are conducted remotely. The output to request is a split of planned on-site and remote time for each site or location, with the basis for any remote share stated.
Add scope extension time where the scope changes
If the organization adds sites, services or business units to the certificate, ISO/IEC 27006-1:2024 requires audit time for the scope extension itself. The organization describes the added people, locations and activities, and the certification body calculates the extra time using the same method as the core audit. The output to request is a separate audit time figure for each extension, showing how it adds to the existing plan and when it will be performed relative to surveillance audits.
Record the justification and agree the audit plan
The certification body documents the calculation, including the groups, reductions, remote share and any extension time, and the justification for each choice. The organization reviews the record before accepting the audit plan and asks for clarification of any figure it does not understand. The output to request is the written audit time justification, held with the audit plan and the ISMS scope, so the organization can show how the total was reached.
Review planned audit time at each surveillance audit
Planned audit time is not fixed for the whole cycle. The certification body reviews it at least at every surveillance and recertification audit to reflect changes in the organization and in the maturity of the ISMS. Headcount growth, new sites, outsourcing changes and a shift in the risk profile can all change the figure. The organization should notify the certification body of material changes and ask for the revised calculation in writing, so that each review is traceable against the previous record.

Why the square-root rule only trims identical activity groups

The square-root rule is a limited reduction, not a general discount on audit time. Under clause C.3.4 of ISO/IEC 27006-1:2024, a certification body may reduce the head count of a group of people who perform identical activities according to the risk of their tasks, but it may not reduce that group below the square root of its head count. The rule applies only to a group that does the same work. People with different tasks, reporting lines or responsibilities cannot be pooled into one group just because they sit in the same department or fall under the same policy. The starting point remains the total number of persons doing work under the organization's control, and the group reduction is applied afterward, group by group.

Because the reduction is a judgment, the certification body must justify it and document its criteria. European Accreditation FAQ 48.6 explains the method in detail. Before the audit plan is agreed, ask the body to list each group it treated as identical, the activity that defines the group, the head count it started with, the risk factor it applied and the resulting number. Also ask which groups it considered and rejected, such as help desk staff with privileged access or contractors working in production. Confirm in writing that the criteria are the body's documented criteria and not an unexplained figure.

If a group looks wrongly merged, challenge it before the audit days are fixed, because the same numbers drive the audit time billed and the sampling plan. A high-risk group, such as administrators with access to cardholder or customer data, may justify less reduction than a group of staff using the same standard workstation. Your own records should support the grouping: role descriptions, access rights and training records that show who performs which activities. Where the body's list does not match those records, resolve the difference with the body before stage 1, not during the audit.

How multi-site, remote and scope extension work change the days

For an organization certified across several offices, plants or data centers under one certificate, the on-site audit time generally starts from the total number of people doing work under the organization's control, wherever they are located. The certification body does not simply add up each site on its own, and it does not treat a central function as a separate audit. Sites that have no physical presence, such as a sales office with no equipment or staff who only work remotely, are handled differently and may not need an on-site visit at all. The certification body decides how to sample sites and document its reasoning.

Headcount across all locations: Provide a complete, current list of people doing work under the organization's control at each site, including contractors and shift workers.
Central functions: Identify which processes, such as security operations or access management, run from one headquarters and which run locally.
Site classification: Describe each site as physical, partly physical or without physical presence, with the reason for the classification.
Sampling plan: Ask how the certification body will select sites for on-site audit and how it will justify the selection.
Multi-site procedure: Confirm that your internal audit and management review cover every site in scope.

Confirm with the certification body how it counts each site, whether any site can be audited remotely, and how the certificate will describe sites with no physical presence.

Which audits carry audit time and who sets it

This table compares the ISO 27001 audit types that carry audit time, from stage 1 and stage 2 through surveillance, recertification and scope extensions. Read each row for when the audit falls in the three-year cycle, what sets its time, and which parts the organization owns compared with the certification body.

Audit type	When it happens in the cycle	How audit time is set	Organization owns vs certification body
Stage 1 audit	Before the initial certification decision, ahead of stage 2	Certification body plans time from the in-scope headcount under ISO/IEC 27006-1 rules	Organization owns documentation readiness; certification body reviews and reports
Stage 2 audit	After stage 1, following the interval the certification body sets	Time set from the initial number of persons doing work under the organization's control	Organization owns evidence of operation; certification body tests and decides
Surveillance audit	Each year of the three-year cycle, with at least one audit every calendar year	Certification body reviews planned time at each surveillance audit for changes and maturity	Organization reports changes to scope, staffing and sites; certification body sets the plan
Recertification audit	Near the end of the three-year cycle, before expiry	Time reviewed again from current headcount, sites and system maturity	Organization owns renewed evidence over the cycle; certification body decides on renewal
Scope extension audit	When sites, services or business units are added to an existing certificate	Time determined under the scope extension requirements added in ISO/IEC 27006-1:2024	Organization defines the new scope and evidence; certification body calculates added time
Multi-site audit time	Across all audits where the certificate covers more than one location	On-site time generally counts people doing work under the organization's control wherever they are located	Organization maintains central and site records; certification body samples and calculates
Remote activity within any audit	Any audit where part of the work is done through ICT	Time reflects the remote share, and the report must state how far remote auditing was used	Organization provides secure access and records; certification body decides what can be remote

What records make the headcount defensible

Certification bodies start audit time from the number of people doing work under the organization's control, so the headcount has to be traceable to records. The cards below cover the records an auditor will ask to see and who should keep them current. The certification body decides how these records are used in its audit time calculation.

Current staff list

This is the baseline register of employees whose work falls within the ISMS scope, with their location, role and employment status. Check that it reconciles with payroll or the HR system and that leavers and joiners are dated. Ask HR to own it, and have the security lead confirm which roles fall inside the scope statement. An auditor will compare this list against the number you declare, so any gap between the two invites questions about the whole calculation.

Contractor and outsourced worker register

People who do work under the organization's control but are not employees still count toward the total, so they need their own register. Record the supplier, the service, the site or system they access, and the start and end dates of each engagement. Procurement or the contract owner should keep it, and it should be checked against access provisioning, since an active account without a register entry is a common finding. Confirm with the certification body how it wants outsourced staff reported.

Shift rosters

Where staff work in shifts, the number of people working for all shifts is the relevant figure, not the number present at one time. Keep rosters for a representative period and show how shift patterns map to the people on the staff list. Operations or the duty manager should own them. Check that rotas cover night and weekend staff, because omitting a shift is an easy way to understate the headcount and undermine the rest of the records.

Site and location list

This list shows every location where people doing in-scope work are based, including offices, data centers, plants and home-based staff regions. It supports the multi-site calculation and shows which sites need an on-site visit. Facilities or the ISMS owner should maintain it, with the address, function and whether the site is covered by the certificate scope. Confirm that the list matches the clause 4.3 scope wording, since mismatches between the two cause rework during the audit.

Role and activity groupings

Under ISO/IEC 27006-1:2024, people performing identical activities may be grouped, and the certification body may reduce the head count of each group according to the risk of their tasks, but not below the square root of that group's head count. Keep a written grouping showing the roles, the activities they perform and the risk rationale behind each group. The security lead should own it and review it when roles change. Ask the certification body which criteria it uses to justify its reductions.

Remote-working arrangements

Record which in-scope staff work remotely, from which countries or regions, and under what policy. This record supports the remote-audit decisions and shows whether any site is effectively a home-working population. Keep the arrangement list with the HR policy owner and link it to the staff list so each remote worker is counted once. Check whether the certification body needs the remote arrangements recorded in the audit report, because the 2024 changes require reports to state how far remote auditing was used.

How yearly surveillance reviews change next year's audit time

A three-year ISO 27001 certification cycle requires at least one audit in every calendar year, either a surveillance audit or the recertification audit. Each of those audits gives the certification body a chance to re-plan the audit time for the next one. Under the rules the certification body follows, it reviews planned audit time at every surveillance and recertification audit to reflect changes in the organization and in the maturity of the management system. The practical effect is that audit days are not fixed at the first certification. A growing organization can see its planned days rise, and a stable one may see them hold or fall. Ask your certification body in writing how it will carry out this review and which inputs it will use, so the planning figure for next year is not a surprise.

Several kinds of change are likely to trigger a new review. Headcount growth or a wave of hiring changes the total number of people doing work under your control, and that total is the starting point for audit time. New sites, data centers or remote locations change the multi-site calculation. A reorganization, a change of business unit, or a shift of functions to an outsourced provider can alter which people and locations are inside the scope of the certificate. A new product or service that the certificate should cover may also bring a scope extension with its own audit time. Maturity changes matter too: a system that has run through several internal audit and management review cycles may justify different sampling than one that was newly introduced. Keep a dated record of these changes so you can explain them when the body asks.

Report changes to the certification body promptly rather than waiting for the next scheduled audit. A late report can leave the planned audit time based on an out-of-date headcount, and that can cause a reduced audit to miss parts of the organization or an audit to be scheduled too late for a required change. Before a surveillance audit, check your current headcount by location, the list of outsourced functions, and any scope changes against the scope statement on the certificate. If a change would affect the certificate's scope or sites, confirm with the body whether it needs a formal review before the audit date. Treat the body's planned-time letter as a document to check line by line, not as a final figure.

What to ask a certification body before accepting its audit time

Audit time is the certification body's calculation, so the organization should ask for the working behind it before signing. The four questions below cover the inputs, the reductions, the adjustments and the review plan, and each one can be answered in writing.

How was the starting head count counted?

Ask which people were included in the total number of persons doing work under the organization's control, and for which shifts. Contractors, temporary staff and people at remote sites are all candidates for inclusion. Request the list of roles or counts the body used, and check it against your own records of who works on the ISMS scope. A wrong starting number changes every later step, so this is the first figure to verify.

Which groups were treated as identical?

Ask which groups the body treated as performing identical activities and how each group was reduced. Under ISO/IEC 27006-1:2024, a group's count may be reduced according to task risk but not below the square root of that group's head count. Ask the body to show the risk criteria it used and where it documented them, and check that no group was reduced further than that floor allows.

How were multi-site and remote factors applied?

Ask how sites were counted, whether any site was left out because it does no work for the scope, and whether remote activities were given their own time. Confirm that on-site time follows the total head count across locations, not only the largest site. Ask how the body plans to report any remote auditing, since the audit report must say how far remote methods were used and how effective they were.

What time is planned for scope extensions?

If the scope may grow during the cycle, ask how much audit time the body reserves for extensions under clause C.7 and when that time is scheduled. Ask whether the figure appears in the plan now or will be added later, and whether it is separate from surveillance time. A scope extension without agreed time can delay a certificate update or push work into the next audit.

How will the plan be reviewed at each surveillance audit?

Ask when the body reviews planned audit time, and what it will change when the organization's headcount, sites or system maturity shift. The review is expected at least at every surveillance and recertification audit. Request the review date and the criteria, and keep a copy of each revised plan so you can compare how the time moved over the three-year cycle.

What can DeployOpen prepare, and what stays with the body?

DeployOpen can help you assemble the headcount records, site lists, remote work logs and scope change history that these questions depend on. It cannot answer for the certification body or change its calculation. Only the certification body sets and justifies the audit time, so send these questions to the body directly and keep its written replies with your certification file.

Common questions about ISO 27001 audit days

Is there a fixed number of ISO 27001 audit days I can budget for?

No. There is no fixed number of audit days for ISO 27001, because the certification body calculates audit time from your organization's own facts. The main inputs are the number of people doing work under your control, the number of sites, the scope of the ISMS, the complexity of the activities and how mature the system is. Two organizations of the same revenue can receive very different day counts if their headcount, locations and scope differ. Ask each certification body for its written audit time calculation before comparing quotes, because a lower price with a lower day count may simply reflect a narrower scope or a different treatment of sites.

Can my team calculate ISO 27001 audit days on its own?

You can estimate the inputs, but only the certification body sets and documents the audit time. Start by counting the people doing work under your control inside the scope, including contractors and staff at each location, and listing every site. Then compare that count with the head count rules in ISO/IEC 27006-1:2024, which the accredited bodies must apply to all clients by 31 March 2026. Your estimate will help you spot scope decisions that change the days, but the final figure comes from the body's own method, its risk-based reductions and its review of your documents. Use your estimate to check the quote, not to replace it.

How does headcount drive the cost of an ISO 27001 audit?

Headcount is the starting point for audit time, so it is the largest driver of audit days. Under the head count method in ISO/IEC 27006-1:2024, the total number of persons doing work under your control for all shifts is the base figure. Groups of people performing identical activities may be reduced according to the risk of their tasks, but never below the square root of that group's head count, and the body must justify and document that reduction. Practically, this means a large group of similar call-center or support staff may be sampled more heavily than a small specialist team. Ask the body to show how it applied the reduction to each group in your quote.

Do outsourced or contracted staff count toward ISO 27001 audit time?

They can, if they perform work under your organization's control within the scope of the ISMS. The test is not the employment contract but whether the people do work that the ISMS governs, such as operating systems, handling customer data or running security processes that you direct. Staff of a managed service provider working on your systems are a typical case to discuss with the certification body early. Decide the boundary deliberately, document it in the scope and in the supplier controls, and confirm with the body how those people are counted. Excluding them can be possible, but the exclusion must be justified and must not hide work that affects the information security of the scope.

Do remote ISO 27001 audits reduce the number of audit days?

Remote auditing changes how time is spent, but it does not automatically reduce the days. Certification bodies must follow the rules on using information and communication technology in audits, and ISO/IEC 27006-1:2024 added requirements for remote audits. The audit report must state how far remote auditing was used and how effective it was. Some activities, such as physical security checks in a data center, still need a site visit. Ask the body which parts of your audit it plans to conduct remotely, whether that changes the day count, and what evidence it will need from your side, such as live system access or recorded walkthroughs.

What can an implementation partner do about ISO 27001 audit time, and what can it not do?

An implementation partner can prepare the inputs that the certification body uses: an accurate people count, a clear scope, an up-to-date asset and site list, a Statement of Applicability and evidence that controls operate. It can also help you check the body's calculation against your facts. It cannot set the audit time, reduce the days by negotiation, or issue an audit report or certificate. Only the independent certification body makes those decisions. An implementation partner that promises a specific day count or a particular outcome is a warning sign, and the independence of the auditor from the consultant should be confirmed before work starts. Agree in a written scope what the partner delivers and what remains with you.

How DeployOpen prepares your headcount and evidence before the audit

DeployOpen prepares the systems, records and headcount evidence that a certification body uses to work out ISO 27001 audit days. We do not issue audit reports or certificates, and the certification body sets the final audit time and plan.

How we scope

Engagements are fixed-scope, with the ISMS boundary, persons in scope and sites agreed in writing before work starts.
We build a headcount register listing people doing work under your control, grouped by activity, for the certification body to review.
The written scope states which sites, cloud accounts and self-hosted platforms are covered, so audit time follows a defined boundary.

How we build

We set up self-hosted open-source tooling inside your infrastructure so access, change and logging records are generated consistently.
We document how identical activities are grouped, with the risk basis you will need to justify to the certification body.
We prepare multi-site and remote evidence, such as site inventories and records showing which activities can be reviewed without a visit.

How we hand over

You receive the headcount register, scope statement, site inventory and evidence index in documents you own and can maintain.
We walk your team through how each figure was derived so you can answer questions from the certification body directly.
Runbooks explain how to update headcount and scope records when staff, sites or services change between audits.

How we support

Ongoing support, upgrades and continuous testing are available as retainers for the three-year certification cycle.
We can refresh headcount and scope records ahead of each surveillance or recertification audit when your organization changes.
Questions about the certification body's audit time calculation are answered with you, while the body keeps sole authority over its determination.