The question is reasonable and it has no answer in the standard. ISO 9001:2015 requires internal audits at planned intervals, and clause 9.2.2 requires the programme to define frequency, methods, responsibilities, planning requirements and reporting, taking account of the importance of the processes concerned, changes affecting the organisation, and the results of previous audits. It does not say how long an audit takes, and neither does ISO 19011:2018, which gives guidance on managing a programme and conducting an audit but sets no hours for either. Duration is a design decision the organisation makes, which is why two organisations auditing the same standard against the same number of processes can differ by a factor of three and both be conforming.
Most of the confusion in the question is that it is two questions. Effort is the auditor’s calendar: how many days of work the audit takes. Elapsed time is the wall clock: how many weeks pass between the day the audit is scoped and the day the report is issued. The first is set by the auditor’s method. The second is set by everyone else’s availability, and it is usually two to three times longer than the first. A plan that quotes one number is answering half the question.
What follows is a range with its drivers, written as planning assumptions and argued from the method. It is not a benchmark. Nothing here is a measurement of a completed audit, and no table of durations from real engagements is offered, because none has been collected.
The drivers, and what each one moves
Six variables account for most of the variation. Each is a property of the audited system rather than of the auditor, which is why duration cannot be standardised across organisations.
Table 1. The six drivers of duration, and which of the two numbers each one changes. Source: the method set out in the quality-and-compliance pillar; the effect column is a planning assumption, not a measurement.
| Driver | What it changes | Low end | High end |
|---|---|---|---|
| Processes in scope | Effort, almost linearly: every process is a map row, a checklist section and a set of interviews | Three to four processes | Ten or more, or a whole system |
| Documents per process | Effort in the corpus and mapping phase, and elapsed time while documents arrive | Two or three per process | A procedure library, or paper records |
| Sites and shifts | Both: one site is one visit; three sites are three visits with travel between | One site, one shift | Several sites, continuous shifts |
| Evidence readiness | Elapsed time mostly. An audit waits for the register that cannot be found | Records retrievable in a day | Evidence reconstructed while the auditor waits |
| Findings and correction | Elapsed time after fieldwork: the reply window, the closing meeting, the actions | Two or three entries, answered in a week | A systemic finding that needs a redesign before it can be closed |
| Auditor capacity and independence | Elapsed time: who is available, and who is allowed to look at this process | A named auditor with no ownership of the process | One person, who also owns two of the processes in scope |
The fourth row is the one organisations underestimate. An internal audit is not slow because the auditor is slow; it is slow because evidence has to be produced by people who have other work. The audit sits in the gap between the request and the response, and that gap is a property of the organisation’s records, not of its auditor.
The sixth row is the one that cannot be bought away. Clause 9.2.2 requires auditors to be selected and audits conducted so that objectivity and impartiality are ensured, which means nobody audits their own work. In a small organisation with one quality manager, that constraint alone can add weeks while a second person is trained or borrowed.
A range, with its assumptions shown
Three planning profiles, each stated with the scope it assumes. They are ranges because the drivers move within each profile, and the width of the range is the honest part.
Table 2. Three planning profiles for an internal audit. Source: planning assumptions constructed for this piece; not a benchmark and not measured on any engagement.
| Profile | Scope assumed | Audit-days (effort) | Elapsed (weeks) |
|---|---|---|---|
| Small | Three processes, one site, one shift, records in a shared drive | 4–6 | 3–5 |
| Medium | Six processes, two sites, one named auditor | 9–14 | 6–10 |
| Whole system | Ten or more processes, several sites, a supplier interface | 20–35 | A quarter or more |
Two things about the table need saying plainly. The audit-days are the auditor’s days of work, not days on site; fieldwork is a fraction of the total, as the next section shows. And the elapsed figures assume a responsive organisation: evidence produced within a week of asking, a closing meeting within ten working days of the last interview, and a signer available when the report is ready. Where any of those assumptions fails, the elapsed time extends and the effort does not.
The ranges widen as the scope grows because the number of things that can go wrong grows with it. A three-process audit either has the records or does not; a ten-process audit has ten independent chances of a gap, and one gap in the evidence chain sets the calendar for the whole visit.
Where the audit-days go
The split matters because it determines what a shorter audit actually shortens. Effort divides roughly as follows, and the shares are conventions of the method rather than measurements of any particular audit.
Table 3. The six phases of an internal audit, their share of effort, and the illustrative days in a twelve-audit-day engagement. Source: the office’s method; shares are planning assumptions.
| Phase | Share of effort | Days in a 12-day audit | What the phase produces |
|---|---|---|---|
| Scoping and criteria | 5 per cent | 0.6 | The scope statement, the clause list, the named processes |
| Corpus and process-clause map | 20 per cent | 2.4 | The map, and the request for information |
| Checklist | 10 per cent | 1.2 | One row a requirement, with the record to look in |
| Fieldwork | 35 per cent | 4.2 | Evidence, or the record of its absence |
| Findings and closing | 20 per cent | 2.4 | The log, the closing meeting, the agreed actions |
| Report and verification | 10 per cent | 1.2 | The report, and the verification plan |
The shares add to 100 per cent, and the days to twelve: 0.05 × 12 = 0.6; 0.20 × 12 = 2.4; 0.10 × 12 = 1.2; 0.35 × 12 = 4.2; 0.20 × 12 = 2.4; 0.10 × 12 = 1.2, which is 0.6 + 2.4 + 1.2 + 4.2 + 2.4 + 1.2 = 12.0.
The distribution is the argument. Only 35 per cent of an audit is fieldwork, and fieldwork is the only phase that produces findings; everything before it is preparation and everything after it is writing. That is why an audit cannot be shortened from the fieldwork end without changing what it is: taking a day out of the 4.2-day fieldwork allocation removes nearly a quarter of the evidence-gathering, while taking the same day out of the map removes rows rather than questions.
It is also why the preparation is worth paying for. The map and the checklist together are 30 per cent of the effort and they determine whether the fieldwork asks the right questions. An organisation that shortens the preparation to get to the fieldwork sooner is buying a faster audit that finds less, and the finding it misses is usually a design gap — a clause no process carries — which is the most valuable thing the exercise produces.
The elapsed ten weeks
Effort and calendar diverge most sharply in the middle. A twelve-audit-day engagement over a six-process system with two sites takes about ten weeks, and the arithmetic of those weeks is worth seeing because almost none of them are the auditor’s.
Weeks one and two: scoping, the request for information and the corpus. Twenty-two documents arrive over two weeks, in batches, because they are held by four different people. Week three: mapping and the checklist. Weeks four to seven: fieldwork — 4.2 audit-days distributed across four weeks, because interviews are booked around operations, one week has a shutdown, and two of the six processes sit at the second site and require a day of travel each way. Week eight: findings drafted and sent, with a five-working-day reply window for the auditee. Week nine: the closing meeting and the report. Week ten: the report issued, and the management review scheduled into the following month.
2 + 1 + 4 + 1 + 1 + 1 = 10 weeks, holding 12 audit-days of work. The ratio is the point: the auditor is engaged for twelve days out of fifty working days, and the rest of the elapsed time is the organisation producing evidence, answering findings and convening meetings. No method shortens that, because the constraint is not the auditor’s throughput.
The verification does not fit inside those ten weeks at all. Clause 10.2 requires action on the cause and a review of the effectiveness of what was done, and the honest verification of a corrective action is the next audit’s look at the same evidence. An audit counted to the closing meeting ends at week nine; an audit counted to closure ends in the following cycle, months later. Both counts are legitimate and they answer different questions, which is why “how long” needs its endpoint stated.
What the drafting costs
The model calls are priced at the measured rate, not the catalogue: $0.00700 a call for deepseek-v4-flash on Base under exact with a short prompt, read from the live 402 challenge on 31 October 2026 outside the service’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC. The $0.00875 that circulates for this service is Qwen’s rate; it appears here only as the figure that circulates.
For the twelve-audit-day engagement above: twenty-two corpus extraction calls, one a document, $0.15400; seven mapping calls, $0.04900; six checklist calls, $0.04200; eight calls drafting fieldwork notes against the checklist rows, $0.05600; four calls drafting the findings log, $0.02800; three calls drafting the report, $0.02100; five calls working the auditee’s replies inside the five-day window, $0.03500; three rewrite passes after those replies, $0.02100.
The addition is 22 + 7 + 6 + 8 + 4 + 3 + 5 + 3 = 58 calls. At $0.00700 a call that is $0.40600, which is $0.03383 an audit-day across twelve days, $0.04060 an elapsed week across ten, and $0.06767 for each of the six processes.
Three bounds. At the circulated rate the same fifty-eight calls cost $0.50750, which is $0.10150, or 25 per cent, more. At the metered ceiling of $0.00955 — a long prompt under exact, or upto at max_tokens: 1000 — they cost $0.55390, which is $0.14790, or 36 per cent, more. The 0.50 USDC opening balance buys seventy-one calls at $0.00700, so one audit of this size uses fifty-eight and leaves thirteen, worth $0.09100.
The figure covers drafting only, and it is worth saying what it does not cover, because the temptation is to read a small number as a fast one. It does not include the corpus, which is a licensed copy of the standard and twenty-two client documents prepared as text rather than photographed pages. It does not include the twelve audit-days, the auditees’ hours or the travel to the second site. And it does not shorten anything: the drafting is not on the critical path, because the audit waits for evidence, not for text. The piece on audit programme planning costs preparation separately — eight calls an audit — and the two are different scopes rather than different rates; this one drafts a single audit end to end.
Where the range stops
The numbers above are planning assumptions, and the phrase is doing real work. They are built from the method — the phases, their shares, the drivers — and not from a set of completed audits. An organisation that plans on them will be wrong in some direction, and the drivers in Table 1 are the instrument for correcting the plan rather than the table.
Three further limits.
There is no benchmark here, and the absence is deliberate. Durations published by consultancies and certification bodies describe their own scopes, sample sizes and definitions of a day, and a table that mixed them would compare nothing to nothing. A number that is not comparable is worse than no number, because it invites a plan built on someone else’s scope.
The phases are a convention. Another auditor would split the work differently — some put the closing meeting inside the findings phase, some count the report with fieldwork — and the split changes the percentages without changing the twelve days. Read Table 3 as a way to allocate effort, not as a taxonomy of an audit.
And the range says nothing about quality. A four-day audit of three processes can be a better audit than a thirty-day audit of a whole system, because the second may be a reading exercise with a longer index. Duration measures the size of the surface covered, not the depth of the evidence, and only the findings log shows which one happened.
What the range cannot give is a date. A date comes from booking the fieldwork, which is why the next section is about the plan rather than the estimate.
The decision
Plan in audit-days and publish the elapsed weeks separately, because they are different commitments made to different people: the auditor’s days are a resourcing decision and the elapsed weeks are a promise to the auditee and to management.
Then make three bookings before the audit starts, rather than during it. Book the fieldwork dates against named interviewees, because interviews are the constraint and an unbooked interview slips by a week each time. Put the reply window in the audit plan — five working days from the findings being issued is defensible and anything shorter is a fiction — because the auditee has to know the clock before the findings arrive. And schedule the verification date in the programme at the same time as the audit date, because an audit counted only to its report has not tested whether anything changed.
The estimate that follows is a range, and it should be given as one. An organisation that asks for a single number is asking for a benchmark that nobody has measured; an organisation that asks for the drivers is asking the question the method can answer. The programme that carries those dates, and the checklist that turns the plan into questions, are the two instruments this estimate depends on.
Where this goes
- The pillar: x402.review/2026/10/31/quality-and-compliance/ — the job, the six artefacts and the certificate no agent issues
- The role: studio.x402.press/roles/iso_auditor — the agent, its parts and its running cost
- The service it buys: x402.press/services/deepseek/ — the canonical price, seven chains
- The review: x402.review/2026/10/31/deepseek-review/ — the measured handshake and what it does not promise
Method note
The price was read from the live 402 challenge on Base on 31 October 2026, outside DeepSeek’s weekday peak windows of 01:00–04:00 and 06:00–10:00 UTC; the catalogue figure of $0.00875 was checked against it, found to be Qwen’s rate, and is used here only where it is named as the figure that circulates. Every duration in this piece is a planning assumption: the three profiles, the phase shares, the twelve-audit-day build-up and the ten-week calendar are constructed from the method and have not been measured on any engagement. Clause references are to ISO 9001:2015 (9.2.2 for the programme and the selection of auditors, 10.2 for corrective action); ISO 19011:2018 is cited as guidance on the programme and on conducting an audit, and no figure in this piece is attributed to it. No benchmark table, no client, no engagement and no completed audit is described.
x402.review is written and edited by N.P. Vincent. The publication is connected to x402.press, which sells the services reviewed here; that interest is disclosed on every piece that touches a service, and it is stated here rather than left to inference.
Filed under Jobs
