Management Systems and Assurance
Hypergility Ltd holds ISO/IEC 27001, ISO 9001, ISO/IEC 42001, Cyber Essentials and Cyber Essentials Plus. We run the same disciplines for clients. Our fees are published, not quoted.
HG-FEE-14 · Issued 1 June 2025 · Effective from 1 June 2025 · All fees exclusive of VAT
What we do
Build.
Gap analysis, documented information, risk methodology, Statement of Applicability. Taking an organisation from wherever its current documentation leaves it to audit-ready.
Audit.
Full-cycle internal audit programmes against clauses 4–10 and applicable Annex A controls. Audit plan, fieldwork, written reports, findings log.
Close.
Root cause analysis and corrective action for nonconformities raised by any party — certification body, internal audit, or the client.
Run.
Retained monthly service where we hold the management representative role and report to the board.
Certify.
Initial certification through to recertification three years later, with the internal audit programme running underneath it the whole way.
Why buy this from us
We hold what we help you get.
Hypergility Ltd is certified to ISO/IEC 27001, ISO 9001 and ISO/IEC 42001, and holds Cyber Essentials and Cyber Essentials Plus. Every process we build for you is one we run ourselves and get audited on.
Our fees are published.
You can see what this costs before you speak to anyone. No scoping call to get a number, no discovery process to establish what you will pay.
Fixed fees buy a deliverable, not elapsed time.
A gap analysis costs what the gap analysis costs. If it takes us longer than we expected, that is our problem rather than yours.
Findings are priced per finding.
You know what a difficult audit costs before you have one. The rate is the same whether the nonconformity came from your certification body, your internal audit, or from us.
One system, not three.
We operate 27001, 9001 and 42001 as a single integrated management system. Where your standards overlap we build shared processes and shared evidence, rather than three sets of paperwork saying the same thing in different words.
We will not promise you a certificate.
The certification body decides, not us. What we will do is make sure nothing in your management system is the reason they say no.
Fee schedule
Day rates
Minimum half day charged at 60%.
Principal Consultant
Lead Auditor / Lead Implementer. Certification body liaison, board reporting, major nonconformity root cause.
£1,350
per day
per day
Senior Consultant
Management system design, risk assessment, audit programme delivery.
£1,150
per day
per day
Consultant / Internal Auditor
Scheduled internal audit, control testing, corrective action tracking.
£1,000
per day
per day
Compliance Analyst
Documented information, evidence collation, register maintenance.
£850
per day
per day
ISO/IEC 27001:2022 — Information security management
Gap analysis and readiness assessment
Clauses 4–10 and all Annex A controls tested against current state. Written findings report with prioritised remediation plan.
£5,750
per engagement
per engagement
ISMS build — full documented information set
Scope statement, policy suite, SoA, risk methodology, and all mandatory records. Extends and brings into conformity an existing documented set where one is in place.
£9,600
per engagement
per engagement
Policy suite review and refresh
Existing ISMS. Version control, clause traceability, and reissue of superseded documents.
£5,450
per engagement
per engagement
Internal audit programme — annual
Full-cycle programme covering clauses 4–10 and all applicable Annex A controls. Audit plan, fieldwork, reports, and findings log.
£7,350
per engagement
per engagement
Risk assessment and treatment plan
Build or rebuild. Asset and threat register, scoring methodology, treatment decisions, residual risk acceptance.
£4,150
per engagement
per engagement
Certification audit support
Stage 1 and Stage 2 attendance, certification body liaison, evidence marshalling.
£3,750
per engagement
per engagement
Management review facilitation
Per cycle. Agenda, input pack, facilitation, and minuted outputs meeting clause 9.3.
£1,250
per cycle
per cycle
ISO 9001:2015 — Quality management
QMS gap analysis
Process mapping against clauses 4–10 with written findings and remediation plan.
£3,750
per engagement
per engagement
QMS build — documented information set
Quality policy, objectives, process definitions, and mandatory records for a first certification.
£7,050
per engagement
per engagement
Documented information review and update
Existing QMS. Currency check, version control, and reissue.
£3,500
per engagement
per engagement
Internal audit programme — annual
Full-cycle programme across all QMS processes. Audit plan, fieldwork, reports, and findings log.
£5,050
per engagement
per engagement
Management review facilitation
Per cycle. Agenda, input pack, facilitation, and minuted outputs meeting clause 9.3.
£1,250
per cycle
per cycle
ISO/IEC 42001:2023 — AI management system
AIMS gap analysis
Clauses 4–10 and Annex A controls. AI system inventory and impact assessment baseline.
£6,350
per engagement
per engagement
AIMS build — documented information set
Policy suite, AI system register, impact assessment methodology, and mandatory records.
£12,150
per engagement
per engagement
Internal audit programme — annual
Full-cycle programme covering clauses 4–10 and applicable Annex A controls.
£7,600
per engagement
per engagement
Integrated management system — ISO/IEC 27001 and ISO 9001 operated as one system
Integrated policy suite refresh
Single harmonised document set serving both standards. Removes duplication and conflicting clause references.
£8,000
per engagement
per engagement
Integrated internal audit programme — annual
One audit calendar covering both standards. Shared fieldwork where clauses align, separate reporting.
£11,200
per engagement
per engagement
Annex SL alignment and harmonisation
Clause-by-clause mapping across standards, common process architecture, shared evidence model.
£5,750
per engagement
per engagement
Certification cycle programmes
Priced per standard, per cycle stage
ISO certification runs on a three-year cycle. Initial certification covers Stage 1 and Stage 2 and produces the certificate. Surveillance audits follow in each subsequent year, and a full recertification audit closes the cycle. Surveillance is lighter than initial certification, but recertification examines every clause and every applicable control in depth, with documented evidence that each has been operating — not merely that it exists. A working internal audit programme is a precondition, not an optional extra. Taken together, the years that follow initial certification are roughly three times the engagement of getting certified in the first place, and we price them that way.
Initial certification support — to first certificate
Stage 1 readiness review, Stage 2 attendance, certification body liaison, first-year internal audit programme, first management review cycle, and coordination of findings closure. Produces the certificate.
£10,900
Full cycle programme — surveillance and recertification
The remainder of the three-year cycle. Two surveillance audits attended, recertification audit attended, internal audit programme operating in every year, management review each cycle, and a continuously maintained evidence pack. Every clause and every applicable control tested for operation, not existence.
£32,700
Additional standard — initial certification
Per additional standard certified on the same programme. Reflects shared fieldwork where clauses align.
£5,450
Additional standard — full cycle programme
Per additional standard maintained on the same three-year programme.
£16,350
Nonconformity remediation — priced per finding, whoever raised it
Major nonconformity — closure
Per finding. Root cause analysis, corrective action design, implementation support, and closure evidence pack.
£2,900
per finding
per finding
Minor nonconformity — closure
Per finding. Corrective action, implementation, and closure evidence.
£1,100
per finding
per finding
Observation or opportunity for improvement
Per item. Disposition, rationale, and record.
£500
per item
per item
Post-audit rectification
Priced per activity, for majors requiring more than closure
A major nonconformity blocks certification and must be closed before the certificate is issued, usually within ninety days. Where closure needs no more than root cause analysis and corrective action, it is priced as a single item under HG-NC-01. Where it needs controls designed, processes rebuilt or evidence reconstructed, the work below is priced per activity so you can see what you are buying. Choose one route per finding — a finding priced under HG-NC-01 is not also priced here.
Root cause investigation
Per finding. Structured investigation to the underlying cause, with a written statement of cause and contributing factors.
£1,200
per finding
per finding
Control design and implementation
Per control. Designing a control that closes the finding, implementing it, and confirming it operates.
£1,850
per control
per control
Process redesign and re-documentation
Per process. Rebuilding a process that failed audit and reissuing its documented information.
£2,350
per process
per process
Evidence pack rebuild
Per control area. Reconstructing the evidence record where existing evidence was absent, incomplete or rejected.
£1,450
per control area
per control area
Closure verification re-audit
Per finding. Independent re-test that the corrective action works, with a closure evidence pack for the certification body.
£1,100
per finding
per finding
Certification body resubmission and liaison
Per submission. Preparing and submitting the closure pack and handling the assessor's response.
£850
per submission
per submission
Cyber Essentials — NCSC scheme, IASME-administered
Cyber Essentials readiness and submission
Pre-assessment gap check, evidence preparation, self-assessment questionnaire support.
£1,850
per engagement
per engagement
Cyber Essentials Plus readiness and audit support
Technical remediation planning, device sampling preparation, assessor liaison.
£3,750
per engagement
per engagement
Retained services
Rolling monthly, 30 days' notice either side. Retained rates carry a premium over drawdown days, because what you are buying is guaranteed availability, continuity of context, and a named representative where the tier includes one — not a block of interchangeable days.
Maintain — one and a half days per month
Register upkeep, evidence collection, surveillance audit readiness.
£2,100
per month
per month
Operate — three days per month
Everything in Maintain, plus scheduled internal audit delivery and corrective action management.
£3,750
per month
per month
Lead — four and a half days per month
Everything in Operate, plus named management representative, board reporting, and supplier assurance response.
£5,450
per month
per month
Drawdown days
Advisory days bought in advance at a blended rate
Where work falls outside a published fixed-fee item, it is charged at the day rates above. Buying days in advance fixes a single blended rate across every grade, so senior time costs the same as junior time and there is nothing to scope or quote each time. Days are drawn in half-day increments and are valid for twelve months from purchase. Each drawdown is logged with the date, the hours, the person and the output.
Blended drawdown day rate
The mean of our four published day rates. Drawdown days are used against any grade at this rate — a Principal Consultant day and a Compliance Analyst day both draw one day from the balance.
£1,100
per day
per day
Five-day drawdown
Five days at the blended rate. Valid twelve months from purchase.
£5,500
Ten-day drawdown
Ten days at the blended rate. Valid twelve months from purchase.
£11,000
Twenty-day drawdown
Twenty days at the blended rate. Valid twelve months from purchase.
£22,000
Basis of pricing
One rate card, every client. These rates apply to all clients without exception, including group companies, related parties, and entities under common control or common directorship. We do not discount for connection and we do not uplift for it. Any engagement with a related party is contracted, scoped, delivered, evidenced, and invoiced on exactly these published terms.
VAT. All fees are exclusive of VAT. VAT is charged at the prevailing standard rate.
What a fixed fee includes. Scoping, delivery, the named deliverable, and one round of revision. Certification body fees, assessment fees, tooling, and licences are separate and paid by the client directly to the provider.
Nonconformity pricing. Charged per finding at the published rate regardless of who raised it — certification body, internal audit, or client. Findings are agreed and logged in writing before work starts.
Expenses. Work is delivered remotely by default. On-site attendance is charged at cost for travel and accommodation, agreed in advance. No mark-up is applied.
Out of hours. Work outside 08:00–18:00 on UK business days, where requested by the client, carries a 25 per cent uplift on the day rate.
Payment. Fixed-fee engagements are invoiced 50 per cent on signature and 50 per cent on delivery. Day rates and retainers are invoiced monthly in arrears. Terms are 30 days.
Evidence of delivery. Every engagement produces a dated deliverable and a delivery record. Both are retained and available to the client, their auditors, and their certification body on request.
Certification cycle pricing. Cycle programmes are priced per standard and cover the stages named. Certification body audit fees are separate and paid by the client directly to the certification body. A cycle programme does not guarantee certification; the certification body decides.
Market benchmarking. Rates are benchmarked against published supplier pricing on the UK Government's G-Cloud framework, the route through which public sector bodies buy these services. G-Cloud 14 ran from 29 October 2024 to 28 October 2026, so the same published rates applied throughout the period this schedule covers. The schedule is re-benchmarked on publication of the successor framework, expected in early September 2026. The full analysis is retained and available on request.
Drawdown days. Drawdown days are charged at a single blended rate of £1,100 per day, the mean of our four published day rates, and are drawn against any grade. They are valid for twelve months from the date of purchase and are drawn in half-day increments. Every drawdown is recorded with date, hours, person and output, and the balance is reported monthly.
Revision. This schedule is reviewed against published UK market pricing before each version is issued. Each version carries its issue date and its effective dates. HG-FEE-14 is the current version; superseded versions are retained at /services/management-systems/archive.
