Industry
Clients ask consultancies, engineering firms and outsourcing providers for ISO 9001 delivery quality and ISO 27001 data protection - often both.
Consulting, engineering, outsourcing and business-services firms sell expertise and handle client information. Tenders ask for ISO 9001; client data handling and security questionnaires lead to ISO 27001. Run as one integrated management system, the two share governance, document control, internal audit and management review.
Sector risks
Engagement quality depends on who leads the work. ISO 9001 asks for the review points and competence records that make it consistent.
Client documents spread across personal devices, collaboration tools and email - the information security gap clients ask about first.
Separate ISO 9001 and ISO 27001 systems duplicate document control, audits and reviews for a small management team.
Evidence
Services
Delivery
Mostly remote; onsite days for multi-office firms or where the client prefers in-person interviews.
Last verified 16 October 2026 against Global ACI - ISO 9001:2026 transition and ISO - ISO 9001.
From the blog
How to decide whether to run ISO internal audits with your own people, an external auditor or a mix - compared on cost drivers, independence and competence.
Read →ISO 9001 & Quality ManagementWhat ISO 9001:2026 changes compared with the 2015 edition, what stays the same, and how to check your own QMS against the new text.
Read →Managed Systems & IMSA management review agenda that covers every required input and ends each item with a decision, an owner and a date - and the record auditors expect.
Read →Name the standard, the sites and the deadline. A specialist replies within one business day with a view on scope and whether the work is remote, onsite or both.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.