Integrated management system

Integrating is not adding up. A company with ISO 9001, ISO 14001 and ISO 45001 certified separately usually carries three manuals, three internal audit calendars, three management reviews and three risk matrices that say similar things in different words. An integrated management system (IMS) brings together the part all three standards require alike (context, leadership, planning, support, performance evaluation and improvement) and keeps separate what is specific to each: customer satisfaction in 9001, environmental aspects in 14001, hazard identification in 45001.

This is possible because, for more than a decade, ISO management-system standards have not each been written their own way. They share the same skeleton: what the 12th edition (2021) of the ISO/IEC Directives, Part 1 established as the harmonized structure (formerly the high level structure, or Annex SL), a structure later editions have kept, with the same clauses 4 to 10, the same core terms and much of the same wording. ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 share that skeleton, and so do ISO/IEC 27001:2022 and ISO 50001:2018: which is why a well-built IMS is never limited to three standards: it can be extended.

In practice, integrating means a single manual, one context and interested-parties matrix, one risk-and-opportunity matrix that covers all three approaches, one internal audit programme and one management review where quality, environment and occupational safety are dealt with together. The certification body can audit all three standards in a single visit, with a real but bounded time saving set by a mandatory International Accreditation Forum document (IAF MD 11), not by how fast anyone wants to go.

Integrating dilutes no standard. 45001 still requires its hierarchy of controls under clause 8.1.2, 14001 its identification of significant environmental aspects, 9001 its customer focus. What changes is where each thing lives: policy, document management, change management and the non-conformity and improvement cycle are sustained once for all three, and each standard adds its own chapter on top of that common base.

Starting here isn't always the right move. If the company is only pursuing one standard, or is transitioning the one it already holds to the 2026 edition, the starting point is that standard on its own; our ISO 9001:2026 transition and ISO 14001:2026 transition pages cover that case. An IMS makes sense once the company already has, or is about to implement, more than one certifiable system.

At Summum Calidad we design the integrated system's architecture, train the team and coordinate the audit with the ENAC-accredited certification body of your choice. We've supported ISO implementations in Castilla y León and the Canary Islands since 2007, with close to 200 certifications accompanied; the certificate is issued by the certification body, we build the system. For the step-by-step detail, our blog covers what an integrated management system is and how 9001, 14001 and 45001 are integrated, including a 120-day plan.

The harmonized structure, clause by clause

Integration isn't a sales trick: it reflects that ISO 9001, ISO 14001 and ISO 45001 have shared the same regulatory skeleton for years, the harmonized structure (formerly the high level structure, or Annex SL) introduced by the 12th edition (2021) of the ISO/IEC Directives, Part 1 and kept in later editions, valid for every management-system standard. Clauses 4 to 10 are common in title and largely in wording; what changes is the technical content each standard hangs on them.

This split is what makes it possible to keep a single manual without losing the detail each standard requires: the common part lives once, each standard's technical part lives within that same structure.

What the three standards actually share

Sharing a clause doesn't mean sharing it word for word. What an integrated system genuinely unifies is this:

• Integrated policy: a single document covering quality, environmental and occupational safety commitments, instead of three separate statements.
• Interested parties and context matrix: customers, suppliers, authorities, workers and community, with their relevant expectations per standard.
• Risk-and-opportunity matrix: a single register that distinguishes each risk's origin but is reviewed in the same cycle.
• Management of change (6.3): a relevant change (production line, supplier, facility) is assessed once from all three angles.
• Non-conformity and corrective action: a common procedure, with each finding traced to the standard it affects.
• Internal audit and management review: one programme and one meeting, not three.

What isn't integrated is the specific technical content: 45001's hazards, 14001's environmental aspects or 9001's design control each keep their own analysis, within the same common structure.

The integrated audit: what IAF MD 11 allows

The time an integrated audit takes isn't freely negotiable: it's set by IAF MD 11:2023, a mandatory document of the International Accreditation Forum for certification bodies. The calculation starts by adding the time to audit each standard separately (T = A + B + C, clause 2.1.1) and is adjusted for three factors: the system's real level of integration, staff's ability to answer for more than one standard, and the availability of auditors competent in several at once.

The limit is explicit: where there is a reduction, it cannot exceed 20% of the starting point (clause 2.1.2). It's not an automatic discount for requesting an IMS; the certification body confirms the declared level of integration at the stage 1 audit. The document distinguishes a "combined system" (standards coexisting with separate documentation) from a genuine "integrated system" (which shares documentation and responsibilities): the more real the integration, the greater the room for adjustment.

From 9001, 14001 and 45001 to ISO/IEC 27001 or ISO 50001: how to extend it

The IMS doesn't have to stop at three standards. ISO/IEC 27001:2022 (information security) and ISO 50001:2018 (energy management) share the same harmonized structure, so adding them reuses the manual, the context matrix and the management review cycle already built. Each standard's own part is added on top: information asset risk analysis and Annex A controls for ISO 27001, or the energy review and performance indicators (EnPIs) for ISO 50001.

Extending doesn't mean rebuilding the system: it's audited as a scope extension within the existing certification cycle, under the same IAF MD 11 criteria as the initial integration. If your already-integrated system is also transitioning to the 2026 edition of a base standard, it's worth planning both changes together: the ISO 9001:2026 transition and the ISO 14001:2026 transition touch exactly the part an IMS shares.