What drives the price?
The scope, evidence readiness, interviews and testing required. We estimate the delivery phases and roles for your engagement.
Pricing & scope
A fee shaped by the work.
We estimate the phases, roles and evidence effort your engagement needs, then show the assumptions, deliverables and payment terms in a scoped proposal.
Your quote, explainedKnow what you are paying for.
- Plan the work
- Agree your scope, sites, people and timetable.
- Review the evidence
- Read relevant records and speak with your team.
- Test the controls
- Check selected activities and records against agreed requirements.
- Report and review
- Document the results and check the report before release.
Three things to know
A clear scope makes a useful quote.
Can the fee be fixed?
Yes, where the work and assumptions are defined. Phased fees suit implementation; daily or hourly arrangements can suit uncertain or incremental work.
What if we are still deciding?
A 20-minute fit call can clarify the starting point. Where the facts are sufficient, we can provide a budgetary indication before a proposal.
What will the proposal include?
The professional fee, deliverables, payment milestones, timing, exclusions and revision rounds, with expenses and applicable tax identified.
Planning your engagement
Effort and elapsed time are different.
Gap & readiness assessment
Often 2–5 working days for a defined scope, followed by a results workshop.
We tailor the emphasis to an early baseline or a pre-certification evidence check.
Focused internal audit
Typically 3–8 audit days, depending on scope, evidence volume, locations and complexity.
The proposal distinguishes fieldwork from planning, reporting and review so the quoted total is clear.
ISMS implementation
Commonly 8–20 elapsed weeks, depending on starting maturity and team availability.
This is a programme window, not a number of full-time consultant weeks. We agree the work and fee for each phase.
These are indicative planning guides. Your scope, availability and evidence readiness determine the estimate and timetable confirmed in the proposal.
Explore the detail
What affects your quote?
What information should I have ready?
A proposed scope is enough to start the conversation. Share what you know; we can clarify the gaps together.
- Proposed ISMS scope and any additional privacy capability
- Legal entities, sites and locations
- Products, services and cloud environments
- Statement of Applicability or expected control coverage
- Stakeholders and likely interview count
- Evidence readiness and GRC platform
- Target dates and delivery method
How are the hours and fee estimated?
Planning, evidence review, interview preparation and time, notes, sampling, testing, findings, meetings, reporting, quality review, project management and contingency are estimated separately and assigned to the right role.
Fees follow the work, roles, delivery costs, commercial risk and agreed pricing structure. We do not apply one universal market rate.
- ISO 27001 scope breadth and maturity
- Legal entities, sites, countries and relevant jurisdictions
- Products, services and cloud environments
- Applicable controls and technical complexity
- Evidence volume, alignment and readiness
- GRC platform access, mappings, exceptions and off-platform evidence
- Stakeholders, interviews and specialist availability
- Sampling populations and testing depth
- Reporting, quality review and timetable
- Travel, translation, legal or technical specialist needs and delivery constraints
Which payment and pricing structure fits?
- Fixed fee: best where scope, evidence, interviews and timetable are defined.
- Daily rate: useful for time-boxed fieldwork or specialist support.
- Hourly: appropriate for uncertain or incremental work.
- Phased: useful for implementation programmes with decision gates.
Every proposal confirms payment milestones, included deliverables and revision rounds, assumptions, exclusions, validity, expenses, applicable tax or VAT treatment, and change-control and rescheduling triggers.
Does using Vanta, Drata or another GRC platform affect the fee?
Tested access, reliable mappings, current evidence, clear ownership and usable exports can reduce retrieval, administration and reconciliation time.
Multiple workspaces, stale or misaligned evidence, unresolved automated-test exceptions, off-platform records and failed exports create additional review and follow-up.
Interviews, risk-based sampling, control testing, findings, reporting, professional judgement and independent quality review are still estimated on their merits.
The platform brand does not create an automatic surcharge or discount. The quote shows measurable platform-handling assumptions and a confidence level.
When could the agreed scope or price change?
The proposal states the assumptions and change-control process, including how additional work is agreed.
- Additional sites, products, processing activities or frameworks
- A new controller or processor role, jurisdiction or material data flow
- Interview volume above the agreed assumption
- Materially incomplete evidence or client delay
- Extra report-revision rounds
- Remediation or corrective-action verification
- On-site delivery or accelerated timelines
Show me how a scope change affects an estimate.
Fictional worked example. This illustrates estimation logic only. It is not a quote, rate card, promise of duration or historical client engagement.
Focused remote SaaS audit
- 75 employees and one legal entity
- One remote operating location and one SaaS product
- 10 planned stakeholder interviews
- Evidence index substantially complete before fieldwork
Effort can be built from a stable interview plan, known evidence set and agreed risk-based tests.
Additional breadth and uncertainty
- A second operating location enters scope
- Interviews increase from 10 to 16 stakeholders
- Incomplete evidence requires additional review cycles
- A second cloud environment needs technical walkthroughs
Planning, interviews, follow-up, sampling, testing, project management and contingency all increase. The quote is recalculated from those components rather than one flat multiplier.
The proposal confirms assumptions, inclusions, exclusions, the pricing structure, change-control triggers and any tax or expense treatment for that engagement.
From request to proposal
Start with your situation.
- Share non-confidential scope information.Tell us the service, target dates and current management-system stage.
- We assess the fit.We review scope, competence and independence, including any privacy context, specialist needs and material uncertainties.
- Clarify the open points.A 20-minute fit call can establish whether the engagement is suitable. Where the facts are sufficient, we can first provide a budgetary indication.
- Review your proposal.Deliverables, assumptions, exclusions, fee and timetable are stated together so you can make an informed decision.