ISO 27001 + ISO 9001 · Coaching & internal audits, integrated · Remote delivery, UK and beyond
ISO 27001 and ISO 9001 together: one system, one audit, one price
The two standards share the same management system backbone. Build or audit them as one integrated system and save 15% against doing them separately.
Integrated coaching £5,450. Integrated internal audits £3,750. Fixed fees, no day rates.
Why one integrated system beats two
ISO 27001 and ISO 9001 are built on the same high-level structure. Clauses 4 to 10 of both standards ask for the same things: the context of your organisation, leadership and policy, risk-based planning, competence and awareness, documented information, internal audit, management review and continual improvement. Run as two separate systems, you write two policies, hold two management reviews, run two internal audits and answer the same auditor questions twice.
Run as one integrated management system, you do each of those once. Where the standards differ, they sit alongside each other: ISO 27001 adds the information security risk assessment, the Statement of Applicability and the Annex A controls; ISO 9001 adds customer requirements, product and service delivery, and the measurement of customer satisfaction. Our ISO 9001 vs ISO 27001 guide sets out the overlap clause by clause.
Certification bodies offer integrated audits too, with shared audit days across the common clauses, so the saving carries through to your certification invoice and to every surveillance visit after it.
What we offer
For new builds and rescues
Integrated Coaching Programme
£5,450 + VAT, fixed fee
£6,450 if bought separately
- Structured coaching sessions covering both standards, from nothing to audit-ready
- One set of integrated templates: shared policies, one risk approach, one set of records
- Unlimited email and video support between sessions
- Review of your key documents and records for both standards
- Risk-based internal audit across both
- A vetted list of certification bodies that audit both standards together
- Pass guarantee: if you do not pass, we fix it free
All delivered remotely. Most integrated builds complete within 90 to 120 days.
For certified or certifying businesses
Integrated Internal Audit
£3,750 + VAT, fixed fee
£4,450 if bought separately
- One audit programme covering both standards
- Common clauses audited once, with evidence mapped to both
- All 93 ISO 27001 Annex A controls tested
- Deep-dive sessions on your key operational processes for ISO 9001
- Findings report and nonconformity log for each standard, in the format your certification body expects
- Close-out meeting to agree priorities
- Questions updated for ISO 27001:2022 and ISO 9001:2026
All delivered remotely. Most integrated audits complete within three to four weeks.
Already hold one of the standards? Adding the second to an existing, working system is a smaller job than starting from scratch. Tell us which you hold on the discovery call and we will price the addition accordingly. Micro organisations with three or fewer people get 20% off either option.
Who you will be working with
Alan Parker, ISO 27001
Certified ISO/IEC 27001:2022 Lead Auditor and CISMP, with around 30 years in IT governance and information security. Alan leads the ISO 27001 side: the risk assessment, the Statement of Applicability and the Annex A controls. He has taken UK and international SMEs through certification, most within 90 days.
Fiona Parker, ISO 9001
BSI-qualified ISO 9001 Lead Auditor who spent six years running a certified integrated management system (ISO 9001, 14001 and 45001) before auditing other people’s. Fiona leads the ISO 9001 side and knows first-hand how an integrated system behaves under a certification auditor.
Two people, one roof. You get one point of contact, one set of documents, and two specialists who have both sat on the auditor’s side of the table.
How it works
- Discovery call (30 minutes, free). We establish what you hold already, what your customers or tenders are asking for, and whether an integrated approach fits. If one standard is the priority, we will say so.
- Scope and plan. One scope statement covering both standards, one plan, one timetable, worked back from any certification date you already have.
- Build or audit. Coaching sessions or audit sessions run on your diary, with the common clauses handled once and the standard-specific work alongside.
- Certification. We point you to certification bodies that run integrated audits, and the pass guarantee applies to both standards.
Minimal Viable Compliance, times two
Integrated does not mean bigger. We build and audit the leanest system that genuinely satisfies both standards and passes an accredited certification audit, so that you will actually keep it running afterwards. If a document does not earn its keep under either standard, it goes.
Why Iseo Blue
We specialise in helping small businesses
They can move faster and implement change quicker. We like that.
Minimal Viable Compliance
We build and audit lean systems. If a document doesn’t earn its keep, it goes.
Genuinely independent
Your certification auditor will ask about internal audit independence; you’ll have a good answer.
Fixed fees, always
You know the cost before we start. No day rates, no scope creep.
Both standards, one roof
ISO 27001 and ISO 9001, coached or audited, separately or together.
We don’t make ourselves ‘sticky’.
We show you how to build, implement and support your own QMS.
Frequently asked questions
Can one management system really cover both ISO 27001 and ISO 9001?
Yes. Both standards follow the same clause structure (the ISO Harmonized Structure), so one scope, one policy framework, one risk-based planning process, one internal audit programme and one management review can serve both. The standard-specific requirements, such as the Annex A controls for ISO 27001 and product and service delivery for ISO 9001, sit alongside the shared core.
Can we be certified to both at the same time?
Yes. Most UKAS-accredited certification bodies offer integrated audits, where the common clauses are audited once and the auditor days are shared. That reduces the certification fee as well as the disruption, and the same applies to surveillance and recertification visits.
Do we get one report or two?
For the integrated internal audit you get a findings report and nonconformity log for each standard, because that is what each certification auditor will ask to see, built from one set of audit sessions.
Which standard should we start with?
Whichever your customers are asking for. If a tender or a larger client is driving it, that decides. If you have a free choice, ISO 9001 is usually the lighter build and ISO 27001 the one more buyers insist on. We will give you a straight answer on the discovery call.
We already hold one of them. Is the bundle still relevant?
The bundle price assumes both standards are built or audited together. If you already hold one, adding the second is usually a smaller job, and we price it on that basis rather than at the bundle rate.
How long does the integrated coaching programme take?
Most integrated builds complete within 90 to 120 days of booking, depending on how much of your time you can give it. You set the pace; we keep the momentum.
Are the prices fixed?
Yes. Fixed fees, agreed before we start, plus VAT. No day rates and no scope creep. Micro organisations with three or fewer people get 20% off.
Ready to talk?
Book a free 30-minute discovery call. We will look at what you hold, what you need, and whether integrating the two is the right move for you.