Do you offer ISO 9001 on its own?

No. Goldline's practice is information security and AI governance. Where a business only needs ISO 9001 it is better served by a quality consultant, and Goldline will say so on the diagnostic.

We already hold ISO 9001. Does that make ISO 27001 quicker?

Usually, because the shared clauses, the document control and the audit and review cycle already exist; the diagnostic reads your current system and says what carries across.

Can one audit cover both?

That is the certification body's decision; many offer an integrated audit where they are accredited for both standards.

Does Goldline audit ISO 9001?

No. Goldline prepares and reviews; an independent, accredited body assesses. Goldline never audits a system it built.

EXTENSION TO AN ISO 27001 PROGRAMME

ISO 9001 and ISO 27001 on one management system.

Manufacturers, engineering firms and logistics businesses are often asked for both. The two standards share the same clause structure, so the second certificate does not need a second system. Goldline builds ISO 27001 as a Sprint programme and extends it to cover ISO 9001 where you already hold it or need it.

Book the free diagnostic See every price

What the two standards share

Both ISO 9001:2026 and ISO/IEC 27001:2022 follow the Harmonized Structure for ISO management system standards (ISO 9001:2026 adopts the latest version of it). Clauses 4 to 10 cover context, leadership, planning, support, operation, performance evaluation and improvement. One scope statement, one set of policies, one document control, one internal audit programme and one management review can serve both, with the quality-specific and security-specific parts added where each standard requires them.

Framework reference: ISO 9001

One management review

One agenda, with the required inputs for both standards.

One internal audit programme

One plan covering both sets of requirements.

One document and record control

One system of control, with two sets of records.

What stays different

ISO 9001

Customer requirements, product and service realisation, design and development where it applies, supplier control and customer satisfaction measurement, including clause 8 and the quality objectives.

ISO 27001

The information security risk assessment and treatment, the Statement of Applicability and the Annex A controls.

The shared half is built once. The two different halves are built to their own standard.

How it runs

Diagnostic

Which standard you hold, which you are asked for, and whether an integrated build saves you time.

Build

ISO 27001 and ISO 9001 built together as an Integrated Sprint, as published on the pricing page.

Assessment

Your certification body audits both. Goldline prepares, an independent body certifies. Where one body is accredited for both standards, an integrated audit is usually possible, which the body confirms.

Price

£12,500 plus VAT, fixed, as an Integrated Sprint, for a single legal entity, up to 50 people in scope, one site or cloud hosted. A larger or multi-entity scope is scoped on the free diagnostic. Goldline does not sell ISO 9001 on its own.

All prices exclude VAT.

See every price

Common questions

Bring your ISO 9001 certificate and the request for ISO 27001.

Book the free diagnostic