Integrated Management System: ISO 9001 + 27001

An integrated management system runs ISO 9001 and ISO 27001 as one set of processes with one documentation structure, one audit programme and one management review, rather than two parallel systems that duplicate each other. The saving is real but it is not where most people expect it — the shared clauses are the management-system machinery, not the subject matter, so integration cuts administration and audit days rather than the substantive work of either standard. This guide sets out exactly which parts merge, which must stay separate, and what integration costs to set up.

Why the two standards share machinery

Both standards are built on the harmonised structure that ISO uses across its management system standards — the common framework that gives them the same clause skeleton from Clause 4 to Clause 10. That is why the ISO 9001 and ISO 27001 requirements for internal audit, management review, documented information and corrective action look so similar: structurally, they are the same requirement applied to a different subject.

The practical consequence: you can hold one process for each of those, applied to both systems, rather than two.

What genuinely merges

Area	Merges?	What one merged version looks like
Scope statements	No	Two scopes. The QMS scope and the ISMS scope are frequently different — see below
Context and interested parties (Clause 4.1/4.2)	Mostly	One context analysis, with quality and security issues both recorded. Climate change sits here too — see the Clause 4.1 climate change guide
Leadership and policy	Partly	One leadership commitment; usually two policies, because a quality policy and an information security policy say different things
Risks and opportunities	Partly	One risk register with a source column. The ISO 27001 information-security risk assessment is a distinct, more formal exercise — see ISO 27001 risk assessment
Objectives	Yes	One objectives register covering both
Competence, awareness, communication	Yes	One training matrix, one awareness programme, one communication plan
Documented information / document control	Yes	One document control process — see ISO 9001 document control
Operational planning and control	No	Genuinely different subject matter
Monitoring and measurement	Partly	One measurement framework, different metrics
Internal audit	Yes	One audit programme covering both — the biggest single saving
Management review	Yes	One meeting, one agenda covering both sets of required inputs
Nonconformity and corrective action	Yes	One NCR process — see the non conformance report template

Read down the "yes" column and you have the shape of an integrated system: one document control process, one training matrix, one audit programme, one management review, one corrective action process. Those five are most of the administrative weight of running either standard.

What must stay separate

Two scopes. This is the most common integration mistake. The QMS scope typically covers what you deliver to customers; the ISMS scope covers the systems and information you need to protect, which may be narrower, wider, or simply different. Forcing them to match either over-scopes the ISMS — expensive — or under-scopes it, which fails the customer requirement you were certifying for.

The Annex A control set. ISO 27001's Statement of Applicability has no ISO 9001 equivalent. It is the document your auditor will spend most time on and it is entirely ISMS-side — see the Statement of Applicability guide and the free Annex A controls checklist.

Information security risk assessment. ISO 9001's risks-and-opportunities thinking is broader and less formal. ISO 27001 requires a defined, repeatable information security risk assessment with a risk treatment plan behind it. You can hold both in one register; you cannot do one exercise.

Operational controls. Quality controls and security controls address different failure modes. There is no meaningful overlap and no saving to chase.

Where the savings actually come from

Three places, in order of size.

1. Audit days. One certification body auditing both standards in one visit costs less than two visits. The shared clauses are audited once, and the auditor is on site once. This is the largest and most reliable saving, and it repeats every surveillance year. Our ISO 9001 certification cost breakdown and the ISO 27001 cost guide cover the underlying numbers.

2. Internal audit effort. One programme, one auditor competence set, one set of reports feeding one management review. The ISO 9001 audit schedule template and the ISO 27001 internal audit guide cover both sides; an integrated programme is one document, not two.

3. Documentation maintenance. Halving the number of document control processes, training matrices and review cycles is a small saving each year and a large one across a three-year cycle.

Where the saving is not: the substantive work of either standard. Integration does not reduce the number of Annex A controls you have to implement, and it does not reduce the records your QMS has to generate.

What integration costs to set up

Building an integrated system from two existing separate systems is a real project — typically restructuring documentation, merging two audit programmes, and rewriting two management review agendas into one. Budget days, not hours.

The cheap moment to integrate is at the start, when you are implementing the second standard. Building the second system inside the first is much less work than merging two mature ones.

If you already hold ISO 9001 and are adding ISO 27001, build the ISMS on your existing document control, training and audit machinery from day one rather than standing up a parallel set. ISO 27001 without a consultant covers what that build actually involves, and ISO 27001 compliance for small businesses sets out the route.

Certification: one body, one visit

Integration only produces the audit saving if one certification body audits both. Check the body is UKAS-accredited for both standards and for your sector — accreditation is granted by standard and scope, and a body accredited for ISO 9001 in your sector is not automatically accredited for ISO 27001 in it. The UKAS directory of accredited organisations shows what each body is accredited for.

Choosing an ISO 9001 certification body covers the wider comparison, and the dual-scope check belongs on that list.

One timing note if you hold ISO 9001: ISO 9001:2026 published on 16 September 2026 and replaces ISO 9001:2015 + Amendment 1:2024 over a transition period, so an integration project started now should build against the structure you will be transitioning to rather than the one you are leaving. The ISO 9001:2026 transition plan covers the sequencing.

Practical takeaway checklist

1. Keep two scope statements — do not force them to match
2. Merge document control, training, awareness and communication into one process each
3. Run one internal audit programme covering both standards
4. Hold one management review with an agenda covering both sets of required inputs
5. Use one corrective action process and one NCR form
6. Keep the information security risk assessment as a distinct exercise, even in a shared register
7. Keep the Statement of Applicability entirely ISMS-side
8. Integrate at the start of the second implementation, not after both are mature
9. Use one certification body accredited for both standards in your sector
10. Confirm the integrated audit is quoted as one visit, not two

If you are still deciding whether you need both, ISO 9001 vs ISO 27001 sets out which one your situation actually calls for.

This article is for general informational purposes only and does not constitute legal, regulatory, or professional compliance advice. Clause-level integration decisions depend on your specific scopes and certification body. Neither ISO 9001 nor ISO 27001 is a legal requirement in the UK. Verify integrated audit arrangements with your UKAS-accredited certification body.