ISO 9001:2026 and ISO 27001 share a structure. But not identical requirements.

ISO 9001:2026 was published on 16 September with closer alignment to other ISO management system standards. What an integrated ISO 9001 and ISO/IEC 27001 system changes at certification, what it doesn't, and what the transition calendar means for organisations that run both.

When ISO published ISO 9001:2026 on 16 September 2026, one line in the commentary travelled further than the rest. BSI describes the updated Harmonized Structure as enabling closer alignment with other ISO management system standards - it names ISO/IEC 27001 among its examples - and says this can simplify integration and reduce duplication. For an organisation that holds, or plans to hold, both an ISO 9001 and an ISO/IEC 27001 certificate, the obvious reading is that the two have converged into something close to a single system.

That reading is half true, and the imprecision matters. A shared structure means the standards use the same high-level clause headings and common core text, so context, leadership, planning, support, operation, performance evaluation and improvement line up between them. It does not mean they share requirements. ISO/IEC 27001 still asks for an information security risk assessment, a risk treatment process and a Statement of Applicability; ISO 9001 asks for none of those. And it does not mean one audit produces one shorter outcome: audit time for an integrated system is calculated standard by standard, any reduction for integration is capped, and each standard is still assessed against its own requirements.

This article sets out what integration does and doesn't change when a certification body audits it, what the ISO 9001:2026 transition calendar means for organisations running both standards, and where Proks's own accredited scope currently stands. It isn't advice on whether to integrate; that decision, and how to carry it out, belongs to the organisation.

The dates that matter
‍

‍

What a shared structure does and doesn't mean

Same skeleton, different requirements

The common clauses are the part the standards share. The requirements that make each one what it is sit on top of that skeleton and are not interchangeable. An information security management system is built around risk assessment, risk treatment and the Statement of Applicability under clause 6.1.3; a quality management system is built around customer requirements and the provision of products and services. Neither standard asks the other's questions.

One point is easy to confuse: both standards now have an Annex A, and they do different jobs. ISO 9001:2026's new Annex A clarifies key terms and the intent of requirements. ISO/IEC 27001's Annex A is a reference set of 93 controls, which ISO/IEC JTC 1/SC 27's own auditing guidance describes as an aide-memoire for checking completeness rather than a list of requirements to satisfy.

Where processes can be shared - and where they can't

Several processes sit in the common part of both standards: documented information, internal audit, management review, corrective action. An organisation can run these once for both standards. Neither standard requires it, and a combined process still has to show that each standard's own requirements are met.

The information-security-specific parts can't be absorbed into a quality process. The risk assessment and treatment, the Statement of Applicability and the implementation of controls under ISO/IEC 27001 answer a different question from the risk-based thinking in a quality management system, which concerns risks to quality outcomes. ISO/IEC 27001 doesn't prescribe a single register for its risks, and nothing in ISO 9001 requires the two to be merged.

What a combined audit does and doesn't change

One audit programme, two sets of criteria

IAF MD 11 governs how a certification body applies ISO/IEC 17021-1 when it audits an integrated system against two or more standards, and it is explicit that all clauses of ISO/IEC 17021-1 continue to apply. The certification body calculates audit time for each standard separately, adds the results to reach a starting point, and then adjusts it using factors that reflect the level of integration, the ability of the organisation's personnel to answer questions across standards, and auditor availability.

The direction of the adjustment is not guaranteed. Where integration results in a reduction, MD 11 caps it at 20% of the starting point; where the integrated audit adds complexity, time can increase. Stage 1 is where the certification body confirms the level of integration it will work to, and the starting point and any justification for adjusting it are documented.

Separate standards, separate conclusions

An integrated audit still produces findings against specific standards, and each finding has to be traceable to the standard it relates to. A nonconformity under one standard is not confined to it: the certification body has to consider its effect on conformity with the other. The audit team as a whole must be competent in each technical area, and each standard has to be addressed by auditors who are competent in it.

Accreditation reflects the same separation. In Proks's DAkkS documents, quality management certification is accredited under DIN EN ISO/IEC 17021-3:2019 and information security management certification under DIN EN ISO/IEC 27006-01:2024-08. Different standards define what a competent audit looks like in each field.

Where an integrated system fits - and its limit

An integrated system is a way for an organisation to manage two sets of requirements through shared processes and shared responsibilities. It can reduce duplicated documentation where the work was genuinely duplicated, and it gives management a single view of how the organisation is run.

It does not entitle an organisation to a shorter audit, a single combined outcome, or a lighter version of either standard's requirements. Whatever time reduction applies is calculated by the certification body from the level of integration it actually finds, and it is capped at 20% of the combined starting time.

Checking claims - and who can audit both

Any claim of certification, integrated or not, is worth checking the same way: ask for the accreditation certificate rather than the marketing claim, and check the accreditation body's public register - DAkkS, UKAS, ANAB, RvA and equivalents - for each standard and edition actually covered. A body accredited for ISO 9001:2015 is not accredited for ISO 9001:2026 on the day the new edition appears; its own accreditation body has a scope-extension process to complete first, on the calendar above.

Proks Certification GmbH is DAkkS-accredited under the parent accreditation D-ZM-21201-01-00. Our ISMS scope, DAkkS document D-ZM-21201-01-02 (valid from 17 November 2025), covers DIN EN ISO/IEC 27001:2024-01, the German and European adoption of ISO/IEC 27001:2022. Our QMS scope, D-ZM-21201-01-01 (valid from 1 April 2026), lists DIN EN ISO 9001:2015.

Proks does not yet hold accredited scope for ISO 9001:2026 and cannot yet issue accredited certificates against it. Global ACI requires accreditation bodies to be ready to assess against the new edition by 31 March 2027 at the latest; certification bodies' scope extensions follow on that schedule, not on a single date for the whole market.

Proks's role is also deliberately different from that of a consultant. ISO/IEC 17021-1 requires a certification body, together with any part of the same legal entity and any entity under its organisational control, to remain impartial, and prohibits offering management-system consultancy alongside certification. We can explain what each standard requires and clarify audit findings; we do not design an integrated system, decide which processes to combine, or prepare a client's documentation. That separation is part of what makes an accredited certificate worth relying on.

What an accredited audit looks at in an integrated system

• Shared processes such as internal audit and management review are assessed against each standard's requirements separately, and the audit records which standard each finding relates to.
• Information-security-specific elements - including risk assessment, risk treatment, the Statement of Applicability and the implementation and effectiveness of applicable controls - are assessed against ISO/IEC 27001.
• Quality-management-specific elements are assessed against ISO 9001.
• The level of integration itself is confirmed at Stage 1 and documented, because it feeds the audit time calculation and the composition of the audit team.
• The ISO 9001 transition can, under Global ACI's requirements, take place during a scheduled surveillance or recertification audit or through a separate transition audit. Whether a given audit also covers ISO/IEC 27001 is a scheduling matter between the organisation and its certification body; the two certification cycles do not have to line up.

Why the distinction is worth holding onto

A shared structure is a reason to look again at where two management systems duplicate each other. It is not a reason to expect either standard to ask less. The organisations that get value from running both are the ones whose decisions about quality and information security are consistent with each other, and that consistency is something an independent assessment of each standard can test.

The ISO 9001:2026 transition gives organisations that hold both certificates a natural point to review how the two systems relate, within a transition period that runs to 30 September 2029. What an integrated system should look like is for the organisation to decide. What each standard requires, and whether it is met, is what a certification body assesses.

If you hold or are considering both ISO/IEC 27001 and ISO 9001 certification and want to understand Proks's accredited scope, certification process or audit stages, get in touch.

Sources

• ISO/IEC 27001:2022, clause 6.1.3 and Annex A
• ISO Technical Committee ISO/TC 176/SC 2, "ISO 9001:2026 has been released!" news item
• BSI, "BS EN ISO 9001:2026 is here: Celebrating 30 years of quality management," 16 September 2026
• Global ACI, "Global ACI Publishes Transition Requirements for ISO 9001:2026" (ref. Global ACI-TECH-3-TR 2029-09-30), 16 September 2026
• IAF MD 11:2023 (Issue 3), Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems, iaf.nu
• ISO/IEC JTC 1/SC 27/WG 1, "Auditing Practices Note - Annex A" (N3297)
• ISO/IEC 17021-1:2015, clause 5.2.5, as summarised by European Accreditation
• DAkkS, accreditation scope documents D-ZM-21201-01-00, D-ZM-21201-01-01 and D-ZM-21201-01-02 (Proks Certification GmbH)

Last reviewed: 7 November 2026. Proks's accredited scope is stated as published in DAkkS documents D-ZM-21201-01-01 and D-ZM-21201-01-02 on that date and will change as accreditation transitions. This article is not accreditation, audit, or legal advice, and does not recommend a particular management system design.

‍