Pricing

How our work is priced.

Every Kellwick engagement starts with a defined scope. We confirm your requirements, deliverables, timeline and exclusions before providing a fixed-price proposal. Fees depend on the work required, not a generic package or hourly estimate - so we do not publish standard fees, and every engagement, including the Mini Gap Review, is individually quoted.

Discuss your requirements Service Finder: five questions

Scope and fixed price agreed in writing before work beginsMini Gap Review fee credited in full toward a readiness assessment commissioned within 30 daysNo lock-in, no surprise line items

Start from what you need

Four kinds of work. Start from the one you need.

Each links to the page that explains the work and its scope. The fee for your engagement appears in your written proposal.

Independent audits

Internal, supplier and integrated-system audits, one-off or as a programme. Quoted by standards, sites and audit days.

Individually quoted after scoping

Explore service and scope

Implementation & certification readiness

From a fixed-scope Mini Gap Review to a scoped implementation project for ISO 27001, ISO 9001, ISO 42001 or an integrated system, individually quoted.

Individually quoted after scoping

Explore service and scope

Ongoing management

Managed ISMS, QMS, AIMS and integrated systems on a monthly retainer with a defined capacity, plus surveillance preparation.

Individually quoted after scoping

Explore service and scope

vCISO, GRC lead & regulatory readiness

Fractional security and governance leadership, and readiness work for DORA, NIS2, NIST CSF 2.0, SOC 2 and security questionnaires.

Individually quoted after scoping

Explore service and scope

Kellwick fees exclude applicable taxes, certification-body fees, travel and third-party services. Scope and fixed price are confirmed in writing before the engagement starts.

The pricing model

How each kind of work is priced

Fixed scope means defined work and deliverables; a fixed price is the written fee confirmed after scoping. The price does not change unless the scope does.

Mini Gap Review: A fixed-scope review, typically one to two working days subject to scope: your top blockers and the next step. Individually quoted after a short scoping conversation; the fee is credited in full toward a readiness assessment commissioned within 30 days.
Independent audit: A separate assurance engagement, quoted by standards, processes, sites and audit days, and whether evidence is collected onsite or remotely.
Assessment: A one-off review - gap, readiness or framework assessment - quoted by standard and scope: entities, sites and how much of the system already exists.
Implementation: A scoped project, phased where that helps, with each phase priced before it starts.
Regulatory and framework advisory: DORA and NIS2 applicability and readiness, and NIST CSF 2.0 assessments, quoted by entities, regulated services, existing controls and the depth of the remediation roadmap.
Ongoing management: A monthly retainer with a stated capacity in advisory days, and the standards and entities it covers.
vCISO and Fractional GRC Lead: A monthly retainer built around the mandate, capacity and reporting cadence agreed in the proposal.
Integrated management systems: A multi-standard quote: shared elements priced once, standard-specific requirements priced for each standard.

What moves the price

Scope, not headcount

Employee numbers alone say little about the work. A quote is built from:

Country and market - delivery economics differ between, for example, the Western Balkans, Cyprus, the wider EU, Switzerland and North America
Framework and standards in scope, and whether they are integrated
Number of legal entities and locations
Delivery model - remote or onsite - and travel
Maturity of the existing management system
Regulations that apply - DORA, NIS2 or sector rules
Specialist resourcing - AI governance or financial services expertise
Timing - deadlines set by a certification body, customer or regulator

What a Kellwick quote covers - and what it does not

Our quote is for Kellwick consulting and internal audit fees only. Listed separately, or paid by you to others:

Certification body fees - Stage 1, Stage 2, surveillance and recertification audits, quoted and invoiced by the accredited certification body you choose.
Independent third-party examinations - for example a SOC 2 report, issued and invoiced by a licensed CPA firm.
Travel - quoted at cost for onsite work, agreed before it is incurred.
Taxes - VAT or other applicable taxes, added according to where you are invoiced.
Third-party software and services - compliance platforms, laboratory testing, penetration testing.

Kellwick does not issue certificates and never sells one as an output of its work. Certification decisions are made only by accredited certification bodies.

Retainer terms

How the monthly retainers work

Unused capacity does not roll over to the next month.
Work beyond the agreed capacity needs a written scope extension.
A new framework, entity or major audit deadline can change the price.
Client dependencies, approvals and evidence delivery sit outside the guaranteed delivery window.
Retainers do not include certification-body costs.
Capacity is stated in advisory days. It is a guide for planning the work, not a promise of unlimited deliverables.
A retainer assumes a current baseline. Where none exists, onboarding or a gap assessment is scoped before the retainer starts.
An internal audit of work we operate for you is performed by an independent auditor and scoped separately.

How a quote is produced

1
Describe your requirements
Tell us the standard or framework, the entities and locations involved, any deadline and what prompted the work. No confidential documents are needed at this stage.
2
Confirm the scope
A short scoping conversation settles what is in and out of scope, the deliverables, the delivery model and the timeline.
3
Receive a written proposal
You receive the agreed scope, deliverables, exclusions and a fixed price in writing. Work starts only once you accept it.

The quickest way to an informed proposal is the Mini Gap Review or the free readiness self-assessment. Both tell you roughly where you stand before you commit to a larger piece of work.

Kellwick is an independent consulting and internal audit practice, not a certification body. We prepare you for certification and supervision; we do not perform them and cannot guarantee an outcome.

Not sure which one you need?

Tell us what you need, which standards, how many sites and any deadline. We will confirm the right starting point and send a written proposal with a fixed price.

Discuss your requirements

Scope, not headcount

Employee numbers alone say little about the work. A quote is built from:

Country and market - delivery economics differ between, for example, the Western Balkans, Cyprus, the wider EU, Switzerland and North America

Framework and standards in scope, and whether they are integrated

Number of legal entities and locations

Delivery model - remote or onsite - and travel

Maturity of the existing management system

Regulations that apply - DORA, NIS2 or sector rules

Specialist resourcing - AI governance or financial services expertise

Timing - deadlines set by a certification body, customer or regulator

What a Kellwick quote covers - and what it does not

Our quote is for Kellwick consulting and internal audit fees only. Listed separately, or paid by you to others:

Certification body fees - Stage 1, Stage 2, surveillance and recertification audits, quoted and invoiced by the accredited certification body you choose.

Independent third-party examinations - for example a SOC 2 report, issued and invoiced by a licensed CPA firm.

Travel - quoted at cost for onsite work, agreed before it is incurred.

Taxes - VAT or other applicable taxes, added according to where you are invoiced.

Third-party software and services - compliance platforms, laboratory testing, penetration testing.

Kellwick does not issue certificates and never sells one as an output of its work. Certification decisions are made only by accredited certification bodies.

How the monthly retainers work

Unused capacity does not roll over to the next month.

Work beyond the agreed capacity needs a written scope extension.

A new framework, entity or major audit deadline can change the price.

Client dependencies, approvals and evidence delivery sit outside the guaranteed delivery window.

Retainers do not include certification-body costs.

Capacity is stated in advisory days. It is a guide for planning the work, not a promise of unlimited deliverables.

A retainer assumes a current baseline. Where none exists, onboarding or a gap assessment is scoped before the retainer starts.

An internal audit of work we operate for you is performed by an independent auditor and scoped separately.