Can ISO 27001 be integrated with ISO 9001 and ISO 22301 in one audit?
Yes, ISO 27001 can be audited together with ISO 9001 or ISO 22301, because the standards share the Annex SL high-level structure. ISO/IEC 27001:2022 uses the same clause numbering, identical subclause titles, common terms and core definitions as other management system standards, which is why a single management system can be built to meet more than one of them. A certification body can then run an integrated audit, but it sets the audit time from the level of integration it finds, not from a fixed discount. If your organization already holds ISO 9001 or ISO 22301, or a customer or regulator now asks for ISO 27001, start by deciding how far you want the documentation, management reviews, internal audits and policies to be shared across the standards.
The split of responsibilities matters before any audit is booked. Your organization owns its controls, its risk treatment decisions and its Statement of Applicability. An implementation partner such as DeployOpen can prepare the systems, configurations and evidence that show those controls operating, and can help map existing ISO 9001 or ISO 22301 records onto the ISO 27001 clauses. Neither the partner nor your internal team can issue the certificate. Only an accredited certification body does that, and it is the body, not your consultant, that decides whether the integration is credible and how much audit time it needs.
Ask the certification body early how it will handle the integration, and get the answer in writing. Confirm which standards it will audit together, how it will verify the declared level of integration at stage 1, and whether one of its auditors is qualified for each standard. Ask how it will treat a nonconformity against one standard that also affects another, since that can change the scope of remediation. Also confirm the accreditation status of the body through the IAF CertSearch database before you sign anything, because an integrated audit only counts if the certificates it produces are accredited.
How A.5.30 ICT readiness connects ISO 27001 to business continuity
A.5.30 ICT readiness for business continuity is one of the 11 controls new in the 2022 edition of Annex A, and it sits in the organizational theme beside A.5.7 (threat intelligence) and A.5.23 (information security for use of cloud services). It asks the organization to plan, implement, maintain and test the ICT readiness needed to meet its business continuity objectives. The control does not define a continuity program of its own. It reaches into the ISO 22301 business continuity management system the organization may already run, which is why the two standards are usually audited and maintained together. Read the control wording in the standard itself, since the words matter more than any summary, and treat the recovery plans your organization actually owns as the primary evidence.
The ISO 22301 business impact analysis is the working input. It identifies which activities matter most, how long each can be disrupted and which systems, suppliers and data each activity depends on. From that analysis come the recovery objectives for those systems. Recovery time and recovery point objectives are the figures an assessor will ask you to trace back to the BIA. The ICT evidence then shows that the platforms, backups, failover arrangements and restoration procedures can meet those objectives. Ask your team whether each objective in the BIA has a named system, a documented recovery procedure and a recorded result from the most recent test, because a gap in any one of those links is the usual finding.
Exercises close the loop. Tabletop walkthroughs, partial failovers and full restoration tests produce the records that show ICT readiness is tested rather than assumed. Assessors typically look for the test scope, the results, the gaps found and the corrective actions raised afterwards. The control owner is the organization, not the implementation partner or the certification body. Your leadership decides the recovery objectives and accepts the residual risk, and your operations staff run the tests. An outside partner can build the evidence trail, but it cannot make those decisions for you or sign off that the readiness is adequate.
Choosing a level of integration for your organization
Full integration runs ISO/IEC 27001 and the other standard, such as ISO 9001 or ISO 22301, as one management system with one documentation set. A single team owns the policies, the risk and objectives process, the management review and the internal audit programme, and each clause of each standard maps to a named section of that shared system. This model suits organizations where the same people and processes already serve every standard, but it puts the most weight on the integration design itself.
- Shared documentation: one manual or document set, with one document control procedure and one register of records.
- Single management review: one meeting covers information security, quality or continuity inputs and outputs.
- One internal audit programme: auditors check all standards in the same cycle, and findings are logged once.
- Common risk process: one risk register supports the ISMS and any continuity or quality risk assessments.
- Record ownership: a central management system owner, often in the compliance or quality function, maintains the records.
At stage 1, the certification body checks that the declared level of integration matches what the documents actually show. Confirm with the certification body how it will verify integration before you commit to this model.
Partial integration shares the governance layer and keeps the technical controls in separate, standard-specific records. Typically the policies, objectives, management review and some internal audit activity are common, while operational procedures such as incident response runbooks, backup test logs or vulnerability scan records are kept by the teams that run them. This model fits organizations where the security and continuity teams have different tools, owners and cadences.
- Shared governance: one policy framework, one set of objectives and one management review forum.
- Separate technical records: ISMS control evidence such as access reviews and continuity test results sits in its own register.
- Cross-referenced processes: shared procedures, such as document control or nonconformity handling, point to the standard each record serves.
- Shared audit scheduling: internal audits may be combined by theme, but each standard keeps its own findings and evidence.
- Record ownership: governance records belong to the management system owner, while technical records belong to named control owners.
At stage 1, the certification body looks for a clear statement of which elements are shared and which are separate, and for evidence that the shared elements really cover both standards. Ask how the body will treat the level you choose when it sets audit time.
Separate systems keep each management system with its own documentation, reviews and audit programme, and link them through a cross-reference map. This is the simplest model to explain to a certification body, and it is common where the standards are owned by different functions or where one standard is new. The cost of this model is duplication: the same risk, supplier or training content may need to be maintained in more than one place.
- Separate documentation: each standard has its own manual, procedures and record set.
- Separate management reviews: each system is reviewed on its own agenda, even if attendees overlap.
- Separate internal audits: each standard has its own audit plan and auditors.
- Cross-reference map: a controlled table links shared topics, such as supplier risk or document control, to the relevant clauses in each standard.
- Record ownership: each system owner maintains its records, and one person keeps the cross-reference map current.
At stage 1, the certification body checks that each system stands on its own and that the cross-reference map is accurate and kept up to date. Confirm with the certification body whether separate audits will be scheduled separately, since that affects how much time each audit needs.
How certification bodies set and reduce integrated audit time
When a certification body audits ISO 27001 alongside another management system standard, it does not simply audit once and bill less. The method in Global ACI-TECH-3-008 (M) sets a calculated starting point, caps the reduction and ties any saving to how well the systems are integrated and who is qualified to audit them.
Calculate time for each standard
The certification body first works out audit time for each standard on its own, as if each were audited separately. For an ISO 27001 and ISO 22301 combination, that means two separate calculations before anything is combined. Ask the body to show both figures and the basis for each, because every later reduction starts from their sum.
Cap the reduction at 20%
After the separate figures are added, the body may adjust the total downward, but the reduction may not exceed 20% of that sum. Treat the cap as the most an integrated audit can save, not as a target. A quote that assumes the maximum reduction without a documented level of integration should prompt questions.
Shared meetings and one report
The document lists the time savings that come from running one audit. These include a single opening meeting and a single closing meeting, one integrated report instead of separate reports, optimized logistics, and fewer audit team meetings. Each is a real saving of effort on both sides, so ask which of them the body has already built into its plan.
Auditing common elements once
Elements shared by both systems, such as document control, internal audits, management review and the policy and objectives set, can be audited at the same time rather than twice. Your integrated documentation is what makes this possible. If each standard keeps its own document register and review cycle, expect the body to audit those elements separately and reduce less.
Level of integration in Annex 1
Annex 1 links the size of the reduction to how integrated the system is. The factors include integrated documentation, management reviews, internal audits, policy and objectives, processes, improvement and responsibilities. Before stage 1, document which of these are shared and which run separately, because the body will confirm that declared level during the stage 1 audit.
Auditor qualifications and nonconformities
The reduction also depends on how many standards each auditor is qualified for. Each standard must be covered by a team competent for it as a whole, led by a team leader competent in at least one. The body must also consider whether a nonconformity against one standard affects the other, so ask who is qualified for each standard and how cross-standard findings will be handled.
What happens in an integrated ISO 27001 audit from stage 1 to certificate
The sequence turns a declared level of integration into an audit plan, a stage 1 decision, a stage 2 assessment by a competent team, resolved nonconformities and an independent certification decision.
Declare the level of integration before the audit
The organization decides which management system standards share one system, such as ISO/IEC 27001 with ISO 9001 or ISO 22301, and records how far the documentation, management reviews, internal audits, policies, objectives, processes, improvement activities and responsibilities are combined. The organization owns this declaration, and an implementation partner can help document it, but the certification body is the party that tests it. Done means a written statement of the integration level and the standards in scope, ready to hand to the certification body before the application is accepted.
Confirm the scope and audit plan with the certification body
The certification body reviews the declared integration, the ISMS scope and the other standards' scopes, then plans the audit. Under the Global ACI integrated audit rules, it calculates audit time for each standard separately, adds the results, and only then adjusts the total, with any reduction capped at 20% of that sum. Ask the body to show how it reached its figure, which factors moved it, and which auditors are qualified for which standards. Done means a written audit plan that names the team and the standards it covers.
Complete the stage 1 review and confirm the integration
Stage 1 is the document and readiness review. Under the two-stage structure described in European Accreditation FAQ 32.4, the certification body checks the documented system and the readiness of the organization for stage 2, and for an integrated audit it must also confirm the declared level of integration. The output, described in European Accreditation FAQ 32.5, is a stage 1 report that identifies areas of concern and sets the readiness conditions for stage 2. Done means a stage 1 report that the organization has reviewed and resolved, or has a dated plan to resolve.
Set the interval between stage 1 and stage 2
The interval between the two stages is agreed with the certification body, and it must allow the organization to address the stage 1 findings. European Accreditation FAQ 49.3 explains how the body sets this interval. Ask the body how it applies the interval to an integrated audit, how it treats findings from stage 1 that affect more than one standard, and whether any document changes will need a further review. Done means a confirmed stage 2 date and a list of stage 1 items closed before it.
Run stage 2 with a competent integrated team
Stage 2 is the on-site or remote assessment of how the integrated system works in practice. The opening meeting sets out the plan, and the closing meeting presents the results, as described in European Accreditation FAQ 32.6. The integrated team must be competent for each standard as a whole, led by a team leader competent in at least one of them. Auditors test common elements such as document control, management review and internal audit once for all standards, which is where most of the time savings come from. Done means audit evidence for each standard, collected in one integrated report.
Handle nonconformities and corrective action
Each nonconformity is recorded against the standard it concerns, and the certification body considers whether it affects the other standards in the integrated system. The organization analyzes the root cause and submits corrections and corrective actions within the time the body sets, as covered in European Accreditation FAQ 36.14. The auditor verifies the action before a certification decision is made. Done means every nonconformity has an accepted correction, a verified corrective action and an updated record showing the evidence reviewed.
Make the certification decision and issue the certificate
The certification body, not the consultant or the auditor who ran the audit, makes the certification decision based on the audit report and the closure of nonconformities. The body then issues certificates for the standards that were met, with the scope and integration stated as the body determines. Confirm that the certificate and its scope can be checked in the IAF CertSearch database, which ISO still points to for accredited certificates. Done means an issued certificate, verified in the public register, that starts the three-year certification cycle described in European Accreditation FAQ 51.7.
What an integrated audit team must be competent in
When a certification body audits ISO 27001 together with ISO 9001 or ISO 22301, the audit team has to cover each standard in full, not just the parts that overlap. The cards below set out what that competence requirement means in practice and what to ask a certification body before you sign.
Competence for each standard as a whole
Global ACI-TECH-3-008 requires every member of an integrated audit team to be competent for each standard as a whole. A auditor who knows ISO 27001 well but has only a general view of ISO 22301 does not meet that test for the business continuity side. Ask the certification body to name, for each auditor, which standards they are qualified to audit.
A team leader with at least one standard
The audit team must be led by a team leader who is competent in at least one of the standards in the integration. The leader runs the opening and closing meetings, manages the integrated report and decides how findings are recorded. Confirm which standard your lead auditor holds and whether that person has audited ISO 27001 before.
Cross-standard nonconformity review
The certification body must consider whether a nonconformity against one standard affects the other. For example, a gap in the ISO 22301 business impact analysis could weaken the ISO 27001 risk assessment that depends on the same asset list. Ask how the body records and reviews such findings and whether one finding can close both certificates.
Stage 1 confirmation of integration level
Where ISO 27001 is audited with another standard, the stage 1 audit must confirm the declared level of integration. Integrated documentation, shared management reviews and joint internal audits all count toward that level. Prepare a short written description of how the systems are integrated so the auditors can test it at stage 1.
Auditor qualifications for each standard
Annex 1 of the rules links any audit time reduction to how many standards each auditor is qualified for. An auditor qualified for only one standard may justify less reduction than a dual-qualified auditor. Request a written list of qualifications per auditor from the certification body before agreeing a quote, since the number of qualified auditors affects the total audit time.
Questions buyers ask about integrated ISO 27001 audits
Can ISO 27001 and ISO 9001 be audited in one visit?
Yes, where the certification body agrees to audit both standards together as an integrated management system. The supplied rules allow one integrated audit, which gives one opening meeting, one closing meeting, one integrated report and shared logistics. Each standard still has to be assessed in full, and the audit team must be competent for each standard as a whole. Ask the certification body early whether it runs integrated audits for your combination of standards, and who will lead the team. Shared document control and internal audits are the most common reasons the two audits can be combined without duplicated effort.
How does the level of integration change ISO 27001 audit time?
The level of integration drives how much time a certification body can save. Under Global ACI-TECH-3-008, the body calculates audit time for each standard separately, adds the figures together, and then adjusts the total. Any reduction may not exceed 20% of that sum. The adjustment depends on how far the organization has actually integrated its documentation, management reviews, internal audits, policy and objectives, processes, improvement activities and responsibilities, and on how many standards each auditor is qualified for. Two separate systems that only share a head office will earn little reduction. A single set of procedures with one review cycle will earn more. Confirm the figures with the certification body in writing before you commit.
Does ISO 22301 need certification to support control A.5.30?
No. Control A.5.30 asks the organization to plan and prepare ICT readiness for business continuity, based on continuity objectives and ICT continuity requirements. Nothing in the supplied sources requires ISO 22301 certification to meet that control. An organization can meet A.5.30 with its own tested continuity arrangements, and ISO 22301 is a management system standard that many organizations adopt as a structured way to do that work. Certification to ISO 22301 would be a separate decision with its own audit cycle. If a customer or regulator asks for ISO 22301 specifically, confirm the requirement in the contract or rule, because the supplied sources do not treat it as a prerequisite for A.5.30.
What must the organization provide before the stage 1 audit?
The organization must give the certification body enough documentation to test the design of the management system before the on-site work begins. In a two-stage initial audit, stage 1 reviews the documented management system, and the auditor confirms the declared level of integration. For an integrated audit, prepare a scope statement that covers every standard, a combined risk and opportunity approach, a Statement of Applicability for ISO 27001, the shared policies and objectives, and a record of internal audits and management review. Also name a point of contact and confirm which sites and processes are in scope. Stage 1 output should list any gaps the auditor expects you to close before stage 2. Ask the certification body what it expects in writing, since its checklist controls what it reviews.
Can one consultant cover ISO 27001, ISO 9001 and ISO 22301?
One consultant can coordinate the work across all three standards, but the depth of each standard matters more than the number of certificates. Each standard has its own requirements, and the auditor will test them separately. Ask the consultant to show evidence of practical experience with each standard, not just a general quality background. Also confirm that the consultant is independent of the certification body, because a consultant who designs the system and then audits it creates an impartiality problem. Ask who will own each deliverable, how the consultant will hand over the documentation, and whether the work can be reviewed by your own staff afterwards. Get the scope, deliverables and responsibilities agreed in writing before the work begins.
Can our own team run the integration without outside help?
Yes, if your team has the time, the competence in each standard and the authority to change processes across functions. Integration is mostly a design task: choose one set of documents, one review cycle and one internal audit programme, then map each standard's requirements to them. The cost of doing it internally is mainly staff time, which recurs as the system is maintained. Outside help adds cost, but it can shorten the design phase and reduce rework. Whichever route you choose, the organization owns the controls, the evidence and the decisions. An implementation partner can prepare systems and evidence, and only the independent certification body issues the certificate. Ask any partner for a fixed-scope written proposal before you decide.
How to check a certification body and its accreditation
ISO does not certify organizations. Certification bodies do, and an integrated ISO 27001 and ISO 9001 or ISO 22301 certificate is only worth what the accreditation behind it covers. Accredited ISMS certification bodies operate to ISO/IEC 17021-1:2015 together with ISO/IEC 27006-1:2024, and IAF MD 29:2024 required them to apply that combination to all clients by 31 March 2026. Before you sign, ask the body to show that its accreditation includes the 27006-1 requirements and the specific standards in your integrated system, not only a general management system scope.
Since 1 January 2026, Global ACI has assumed the roles of the IAF and ILAC. ISO still directs readers to the IAF CertSearch database for checking accredited certificates, so search it by the body's name and by the certificate holder's name, then compare the listed standards and scope with the certificate you were given. A mismatch in the standard list, the scope wording or the site list is a finding to resolve before stage 1, not after the certificate is issued.
For each standard in the integrated system, confirm in writing which accreditation applies and what it covers. Ask whether the body is accredited for ISO/IEC 27001 and for ISO 22301 or ISO 9001 separately, and whether its audit team members are qualified for each standard. Under Global ACI-TECH-3-008, the body must calculate audit time per standard, and any reduction for integration may not exceed 20% of the combined total, so a quote that shows a large unexplained discount is worth questioning. Keep the written confirmations with your management system evidence.
How DeployOpen prepares an integrated system for audit
The sequence below takes an integrated ISO 27001 and ISO 9001 or ISO 22301 system from a written scope to an evidence pack the organization can hand to its certification body, with the decisions left where they belong.
Agree the integrated scope in writing
Before any work starts, DeployOpen and the client agree in writing which standards the integrated system covers, which sites, business units, systems and suppliers fall inside the boundary, and how far the standards are integrated. The client names an accountable owner for each standard. The scope document lists the deliverables, the exclusions and the client's responsibilities, and the client signs it. This document is the reference for every later step and the first thing the certification body will ask to see at stage 1.
Map shared processes and documentation
DeployOpen reviews the existing policies, procedures and records for each standard and identifies the common elements: document control, management review, internal audit, corrective action, objectives, responsibilities and improvement. Duplicated documents are merged into one controlled set with clause-level cross-references, so each requirement points to a single process owner. The output is a mapping register that the client approves, showing where one document serves more than one standard and where a separate control is still needed.
Build technical controls and ICT readiness evidence
On self-hosted open-source platforms in the client's own cloud accounts, data centers or air-gapped networks, DeployOpen configures the technical controls that ISO 27001 Annex A requires, including the ICT readiness controls that support business continuity under A.5.30. This covers backup configuration, recovery environments, failover tests and monitoring. Each control is recorded with its configuration, its owner and the logs or test results that show it operates. The step closes when the client has reviewed the evidence and confirmed that the records match the environment as it runs.
Run and record internal audits
DeployOpen plans an internal audit programme that covers both standards in a single schedule, so common elements such as document control and records are sampled once. Auditors follow the client's procedures, record findings with evidence references and raise corrective actions where needed. Internal audit results are handed to the client's management, who decide on corrective actions. The step is complete when the audit plan, the audit reports and the corrective action log are filed and the client's internal auditors have signed off the results.
Prepare management review inputs
DeployOpen compiles the inputs that top management reviews for each standard, such as performance against objectives, audit results, incident and continuity test outcomes, supplier performance and changes in the context of the organization. The client's leadership holds the review, records its decisions and assigns actions. The output is a single set of minutes, with decisions traced to each standard, so the certification body can confirm that management reviewed the integrated system rather than separate parallel systems.
Assemble the evidence pack
DeployOpen gathers the evidence into an index that links each requirement and control to its policy, procedure, configuration record, log extract or test report, and its named owner. The pack shows the declared level of integration and where the standards share evidence. It is delivered to the client as a controlled document set, and the client checks a sample of entries against the live systems. The step closes when the index is complete and the client accepts it as its own record.
Hand over and confirm remaining client ownership
DeployOpen delivers a written handover that lists what the organization must still own: the policy approvals, risk decisions, the Statement of Applicability, staff competence, supplier contracts, the operation of controls after handover and the management review cycle. The client confirms receipt in writing. DeployOpen does not issue audit reports, attestations or certificates. The certification body audits the integrated system, decides on certification and sets the audit time, and the organization should confirm its requirements directly with that body.
