ISO audit man-days in Singapore explained
A certification quotation should show how audit time was calculated before you set the budget.
By Nachi LeongPrincipal Consultant, PSCMCPublished 7 min readISO audit man-days are set by the certification body, using IAF audit-time rules, effective personnel and the factors that apply to your business. The ISO 9001, ISO 14001 and ISO 45001 tables give a starting point, then the certification body records the basis for its final audit time. The IAF term is audit time, counted in audit days. Singapore buyers often use man-days for the same measure.
On this page
- An audit day is normally eight hours.
- Effective personnel can differ from payroll headcount.
- ISO 14001 and ISO 45001 use complexity categories.
- An integrated audit reduction shall not exceed 20%.
Audit man-days are set by the certification body
Certification bodies set audit time. ZES prepares the management system and the information the certification body asks for. We do not set audit days or certify your business. IAF MD 5 is mandatory for accredited certification bodies applying ISO/IEC 17021-1 to ISO 9001, ISO 14001 and ISO 45001 audits. The Singapore Accreditation Council lists MD 5, MD 11 and MD 1 among its documents for certification body accreditation.
Audit time covers planning, document review, interaction with your personnel and report writing, on and off site. Audit duration runs from the opening to the closing meeting. It should typically be at least 80% of audit time.
An audit day is normally eight hours. Longer working days cannot reduce planned audit days. Travel and breaks are outside the on-site duration. A decimal is adjusted to the nearest half day, so 5.3 is 5.5 and 5.2 is 5.
Ask for the effective-personnel figure and audit-time basis when you compare quotations. Under MD 5, the justification for the effective number of personnel shall be available to the client.
ISO 9001 audit man-days follow effective personnel
IAF Table QMS 1 uses effective personnel for the initial ISO 9001 audit. It covers Stage 1 and Stage 2 together. Each table figure is a starting point, and the certification body records why its final audit time differs after applying the factors for your business.
Effective number of personnel
Source: IAF MD 5:2023, Table QMS 1. Starting point before the certification body's adjustments.
| Effective personnel | Audit days |
|---|---|
| 1-5 | 1.5 |
| 6-10 | 2 |
| 11-15 | 2.5 |
| 16-25 | 3 |
| 26-45 | 4 |
| 46-65 | 5 |
| 66-85 | 6 |
| 86-125 | 7 |
The certification body also considers risk. High-risk work normally needs more time than the table. Medium risk uses the table time. Low-risk work may need less. IAF examples include food and complex construction for high risk, and office services, education and retailing for low risk.
For ISO 9001 preparation with ZES, we prepare the scope, sites, shifts and effective-personnel information the certification body asks for.
ISO 14001 and ISO 45001 audit days use complexity categories
IAF Tables EMS 1 and OH&SMS 1 combine effective personnel with high, medium or low complexity. The figures are the same for both standards in these bands. They are a starting point only. The certification body uses the activities in your scope, then records the reason for any adjustment.
Effective number of personnel
Source: IAF MD 5:2023, Tables EMS 1 and OH&SMS 1. Starting point before the certification body's adjustments.
| Effective personnel | High | Medium | Low |
|---|---|---|---|
| 1-5 | 3 | 2.5 | 2.5 |
| 6-10 | 3.5 | 3 | 3 |
| 11-15 | 4.5 | 3.5 | 3 |
| 16-25 | 5.5 | 4.5 | 3.5 |
| 26-45 | 7 | 5.5 | 4 |
| 46-65 | 8 | 6 | 4.5 |
| 66-85 | 9 | 7 | 5 |
| 86-125 | 11 | 8 | 5.5 |
For ISO 14001, high-complexity examples include chemicals and pharmaceuticals, civil construction and demolition, and waste processing such as incineration. Food processing and technical testing are medium examples. Hotels and restaurants are low examples.
For ISO 45001, industrial and civil construction and demolition, chemicals, and healthcare and hospitals are high examples. Food processing and transport of non-dangerous goods are medium examples. These activities are part of the scope information we prepare for ISO 14001 implementation and ISO 45001 implementation.
Effective personnel can differ from payroll headcount
Effective personnel are people within the certification scope. This includes permanent, temporary and part-time personnel, and each shift. Part-time personnel are converted to a full-time equivalent. MD 5 gives the example of 30 people working four hours a day, counted as 15 effective personnel.
A documented reduction may apply where a high percentage do similar or repetitive work. The IAF examples are cleaners, security, transport, sales and call centres. For ISO 45001, the count also includes contractors and subcontractors working under your business's control or influence.
Two businesses with the same payroll total can have different audit-time calculations. Give the certification body the shifts, part-time arrangements and relevant contractor numbers. Ask for the documented basis if the figure is unclear.
The effective-personnel count is settled once the certification scope is written. This is the first step in an ISO 9001 project with ZES.
Tip: Personnel outside the certification scope are not part of the effective personnel calculation.
Three standards can use one integrated audit
The certification body calculates audit time for each standard separately and adds the results. Example: a company with 60 effective personnel in the medium category for all three standards starts at 5 audit days for ISO 9001, 6 for ISO 14001 and 6 for ISO 45001. The separate-audit total is 17 audit days.
- ISO 90015 days
- ISO 140016 days
- ISO 450016 days
Source: IAF MD 5:2023 tables. Illustration only.
IAF MD 11 permits a reduction where the management system is integrated. The reduction shall not exceed 20% of the starting point. In this illustration, 17 multiplied by 0.8 is 13.6 days, adjusted to 13.5 days. The certification body decides the actual reduction. The reduction can be smaller, nil, or the audit time can increase.
Source: IAF MD 11:2023. Illustration only.
The reduction depends on integration and how many standards each auditor is qualified for. MD 11 identifies one documentation set, management reviews, internal audits, policy and objectives, processes, improvement and management responsibilities. The certification body confirms integration at Stage 1 and may adjust the duration.
For integrated management system preparation, we prepare the scope, standards, sites, shifts and existing management-system records for Stage 1.
Audit days change across the certification cycle
During the first three-year cycle, each year's surveillance time is about 1/3 of the initial audit time. It is unlikely to be less than one audit day. Recertification is normally about 2/3 of the audit time an initial audit would need then, using updated company information.
For the integrated illustration, year 2 and year 3 surveillance are about 4.5 audit days each. Year 4 recertification is about 9 audit days. The 13.5 initial days, 4.5 days and 4.5 days total 22.5 audit days across the first certification cycle, before the certification body's adjustments. The cycle figures are a starting point because recertification uses updated company information.
Source: IAF MD 5:2023. Illustration only.
The tables show the initial audit total. The ISO audit process at Stage 1 and Stage 2 gives the wider sequence.
Business factors, sites and quotation points affect audit days
MD 5 requires the certification body to consider factors that apply to your business and record the basis. More than one location, an interpreter, high regulation, complex or many unique activities, and outsourced processes can increase time. ISO 14001 can also need more time for a sensitive receiving environment or additional environmental aspects. ISO 45001 can also need more time for an accident rate above the sector average, members of the public on site, or many subcontractors.
No ISO 9001 design responsibility, a very small site, management-system maturity, prior knowledge by the same certification body, and automation can reduce time in stated circumstances. Automation is not a reduction factor for ISO 45001. Any reduction shall not exceed 30% of the table times, and the decision must be justified and recorded.
Four points to confirm on a certification body quotation
- Effective personnel
The figure used, including the basis for part-time staff, shifts, repetitive work and, for ISO 45001, relevant contractors.
- Risk or complexity
The ISO 9001 risk position or the ISO 14001 and ISO 45001 complexity category used.
- Initial audit time
Audit days for each standard, any integrated reduction, and separate Stage 1 and Stage 2 days. Stage 2 normally takes more time than Stage 1.
- Cycle and travel
Surveillance days for years 2 and 3, with travel shown apart from audit days because travel is not audit duration.
For groups, site sampling is permitted only when sites perform very similar processes or activities. Where it is permitted, the initial sample is the square root of the number of sites, rounded up. Each surveillance year uses 0.6 times that square root, rounded up. Recertification uses the initial sample, or 0.8 times the square root where the system has proved effective. The central function is audited every time.
Where sampling is not appropriate, all sites are audited at initial audit and recertification. At surveillance, 30% of sites, rounded up, are audited each calendar year. Audit time is calculated for each selected site. The reduction per sampled site shall not exceed 50%. ZES covers client sites outside Singapore too.
Send us your scope, sites, shifts, headcount and certification body quotation if you have one. We prepare the management system and the information the certification body asks for. We reply within one working day. Next, we arrange a short call or site visit and provide a written quote. Nachi Leong completed Lead Auditor courses for ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001.
ISO implementation with ZES starts from $2,288. Certification body audit fees are separate. Your final fee depends on your company size, nature of operations and the scope of work required. See ISO 9001 certification cost in Singapore.
Common questions
How many audit man-days does ISO 9001 need for 20 staff?
The ISO 9001 table starts at 3 audit days for 16 to 25 effective personnel, covering Stage 1 and Stage 2. It is a starting point, and the certification body records the basis for its final audit time.
Does travel time count as audit time?
Audit time can include planning, document review, interaction with personnel and report writing. Travel and breaks are not included in the on-site audit duration.
Can a certification body shorten the audit by working longer days?
No. MD 5 says the planned number of audit days shall not be reduced by programming longer hours per working day. An audit day is normally eight hours.
Do the same tables apply to ISO 27001 or bizSAFE audits?
No. MD 11 identifies separate documents that set audit time for ISO 27001. The bizSAFE Risk Management audit is under the SAC Auditing Organisation scheme and its audit man-days follow SAC CT 17.
Does an integrated audit always take fewer days?
No. The certification body calculates each standard first, then considers the level of integration and the auditors' qualifications. A reduction can be smaller or nil, and it shall not exceed 20% of the starting point.
How many audit days are surveillance audits?
During the first three-year cycle, each annual surveillance audit is about 1/3 of the initial audit time. It is unlikely to be less than one audit day, and the certification body sets the final time using current information.
Sources
- International Accreditation Forum, IAF MD 5:2023, 14 June 2023
- International Accreditation Forum, IAF MD 11:2023, 12 September 2023
- International Accreditation Forum, IAF MD 1:2023, 18 October 2023
- Singapore Accreditation Council, Certification Body Accreditation documents, checked 30 September 2026
About the author
Nachi LeongPrincipal Consultant, ZES Consulting · PSCMC, TÜV SÜD
One consultant. From start to finish. The consultant you meet is the consultant who stays with your project.
About NachiRelated guides
Related ISO guides.
Stage 1, Stage 2 and the certification audit process.
Read the guide ISO 9001ISO 9001 certification cost in SingaporeWhat to include when you set an ISO 9001 certification budget.
Read the guide Integrated systemsIntegrated management systems in SingaporeHow integration affects audit time across more than one standard.
Read the guide