The person building/maintaining your system is paid as a specialist. Their formation is a five-day course. You are covering the gap between what expertise costs and what was delivered — every year, at market rate, for a discipline nobody studied.

You paid for two things: a management system and a certificate. Only the certificate arrived — and only if the audit went well. A real management system was never built, and the price you agreed to never reflected its absence.

A system that runs itself costs nothing to maintain. Yours doesn’t, so someone must be paid to keep the documents current — a consultant on retainer, or a hire. That cost was never quoted. It recurs for as long as you hold the certificate.