In short
An integrated management system is a single system that meets the requirements of two or more ISO standards: it is not a separate standard or certificate.
Integration is possible because ISO management system standards share the harmonized structure set out in Annex SL: same clauses, same core text, common terms.
Context, policy, risks, documents, internal audits, management review and corrective action can be managed once, while each standard's specific requirements stay traceable.
Under IAF MD 11 the integrated audit time starts from the sum of each standard's time and can be reduced by no more than 20%, based on the integration confirmed at Stage 1.
The most common mistakes are declaring integration that does not exist and unifying so much that specific requirements get lost.
ISO standards share the same structure. Managing them together means one internal audit, one management review and fewer duplicate documents. That is the idea behind an integrated management system: a single system that meets the requirements of several standards, instead of parallel systems with different manuals, owners and deadlines.
The problem almost always shows up the same way. A company achieves ISO 9001, then a customer asks for ISO 14001, then ISO 45001 or ISO/IEC 27001 comes along. Each certification brings its own procedures, its own forms and its own internal audit, and after a few years you find yourself running three systems that rarely interact: the same information recorded in three places, three management reviews in three different months, three people chasing the same evidence.
In this guide you will see what an integrated management system is, why ISO standards can be integrated, what practical benefits it brings, how the certification audit works when there is more than one standard, and how to build the system step by step, with a practical example and the mistakes to avoid. If you need the basics on standards, certificates and audits first, start with our guide on what ISO certifications are.
What is an integrated management system?
An integrated management system is a single system that meets the requirements of two or more management system standards. It is not a standard in its own right and there is no "integrated certificate" with its own requirements: it is a way of organising the work.
The clearest definition comes from the certification world. The mandatory document IAF MD 11, which accredited bodies apply to audits of integrated systems, describes it as one management system that manages several aspects of an organisation's performance to meet the requirements of more than one standard. Quality, environment, health and safety, information security: different areas, managed with the same framework of policies, processes, responsibilities and controls.
Combined system or integrated system: the difference
The same IAF document makes clear that integration is not "yes or no" but a scale. At one end is the combined system, which is simply the sum of separate systems built for each standard: perhaps certified together, but with distinct documents, responsibilities and tools. At the other end is the truly integrated system, in which documentation, system elements and responsibilities are managed within a single structure.
Between the two extremes there are many shades, and IAF calls them the "level of integration". According to IAF MD 11, a system is more integrated the more it shares certain elements: a single set of documentation, including work instructions where needed; a management review that takes account of the company's overall strategy; an integrated approach to internal audits, to policy and objectives, to processes and to improvement mechanisms (corrective action, measurement); and unified management support and responsibilities. It is a useful list for you too, because it tells you exactly where to look when you assess how integrated your system is today.
Which standards can be integrated
In theory, any management system standard. In practice, the most common combinations in SMEs are quality and environment (ISO 9001 and ISO 14001), often joined by ISO 45001 for health and safety: the classic quality, environment and safety system. In digital companies, or those that handle data on behalf of clients, ISO 9001 is instead paired with ISO/IEC 27001.
Standards such as ISO 50001 (energy), ISO 22301 (business continuity), ISO 37001 (anti-bribery) or ISO/IEC 42001 (artificial intelligence) can also be part of the same system. The choice does not depend on which standards "go well together", but on what customers, tenders and your sector ask of you. ISO itself, in the handbook The integrated use of management system standards, stresses that the integrated approach applies to any management system standard, not just ISO ones.
Why can ISO standards be integrated?
ISO management system standards integrate easily because they share the same backbone: the harmonized structure. It is a common model defined by ISO itself, which every technical committee must follow when it writes or revises a certifiable management system standard.
The harmonized structure is set out in Annex SL of the ISO/IEC Directives, Part 1 (Consolidated ISO Supplement), the rules that govern ISO's technical work. It provides identical clause numbers in the same sequence, identical clause titles, identical core text and common terms and definitions. The ISO directives state explicitly that this approach is also intended for organisations that choose to operate a single system, "sometimes called integrated", able to meet several standards simultaneously.
The common clauses and what you can unify
After the introductory clauses (scope, references, terms and definitions), every standard built on the harmonized structure follows the same seven clauses. Here is what they contain and what you can manage just once.
Clause | What it requires (common text) | What you can unify |
|---|---|---|
4 Context of the organization | Internal and external issues, interested parties, scope | A single context analysis and a single register of interested parties |
5 Leadership | Top management commitment, policy, roles and responsibilities | An integrated policy and a single chart of responsibilities |
6 Planning | Risks and opportunities, objectives, planning of changes | A single risk assessment method and a single objectives plan |
7 Support | Resources, competence, awareness, communication, documented information | One document system, one training plan |
8 Operation | Operational planning and control | Processes described once, with each standard's specific controls |
9 Performance evaluation | Monitoring, internal audit, management review | One internal audit programme and a single review |
10 Improvement | Nonconformity, corrective action, continual improvement | A single register of nonconformities and actions |
What remains specific to each standard
The common structure does not make the standards identical. Each committee adds its own discipline-specific requirements to the core text, and these are what make the difference.
ISO 14001 requires you to identify environmental aspects and compliance obligations; ISO 45001 requires you to identify hazards and involve workers; ISO/IEC 27001 requires an information security risk assessment and a statement of applicability for the controls. These contents do not merge: they sit within the same framework. The risk register can be a single one, but with sections dedicated to environmental risks, health hazards and information risks, each assessed with the criteria the standard requires.
What practical benefits does an integrated system bring?
The main benefit is doing what is common just once. Fewer repeated activities, fewer documents to keep aligned, and a single view of risks and priorities for management.
One internal audit and one management review
The common text of the harmonized structure asks every standard for the same things: internal audits at planned intervals, a programme that sets their frequency, methods and responsibilities, auditors selected to ensure objectivity and impartiality, and results reported to management and retained as evidence. With an integrated system you can build a single internal audit programme covering all the standards, with checks organised by process rather than by standard. We cover this in detail in our guide to the ISO internal audit.
The same goes for the management review. The inputs set out in the common text are identical: status of previous actions, changes in context and interested parties, trends in nonconformities, monitoring and audits, and opportunities for improvement. Holding a single review means management looks at quality, environment and safety in the same meeting and takes consistent decisions, instead of approving three unconnected sets of minutes. You will find how to set it up in our guide to the management review.
Fewer duplicate documents, fewer contradictions
In separate systems the same information lives in several places: three document control procedures, three nonconformity forms, three training lists. When something changes, you have to remember to update everything, and sooner or later one version falls behind. It is one of the most common causes of audit findings.
With an integrated system there is one procedure for controlling documents, one nonconformity register, one competence matrix. Each piece of data has one place and one owner. The result is not just less paperwork: it is a system that is easier to explain to people, because those working in production do not need to know which procedure belongs to which standard.
More consistent decisions and less external audit time
An integrated system brings the links between topics to the surface. A change of supplier affects product quality, environmental impacts and perhaps data security: if you assess it once, from every angle, you avoid decisions that solve one problem by creating another.
There is also an effect on the certification audit. As you will see in the next section, IAF rules allow the certification body to reduce the overall audit time when the system is genuinely integrated. It is not automatic, but it is a tangible benefit for those who have done the work well.
How does the certification audit of an integrated system work?
When a certification body audits several standards at the same time, it carries out an integrated management system audit. The rules are set by IAF MD 11, which applies alongside ISO/IEC 17021-1 without replacing any of its requirements.
How audit time is calculated
According to IAF MD 11, the certification body first calculates the audit time needed for each standard, as if it were certified on its own. It then adds up the times to obtain a starting point. To this sum it applies factors that may increase or reduce it. Reducing factors include the degree of integration of the system, the ability of staff to answer questions covering more than one standard, and the availability of auditors competent in more than one standard. The factor that may increase it is the greater complexity of the integrated audit.
The reduction has a precise limit: it cannot exceed 20% of the starting time. The certification body must document the calculation and the reasons. You declare the level of integration in your application for certification, but the auditors must confirm it during Stage 1, and the audit time can be revised if reality does not match what was declared. That is why it pays to describe the system as it really is. The check continues in later years too: at every surveillance and recertification audit, the certification body must confirm that the level of integration has not changed. You will find a full explanation of the two stages in our guide to the Stage 1 and Stage 2 certification audit.
Who carries out the audit and what happens with nonconformities
IAF MD 11 requires the audit team as a whole to have the competence required for each standard and each technical area, and the audit to be led by a competent Lead Auditor for at least one of the standards being audited. All applicable requirements of each standard must be audited: integration does not allow parts to be skipped.
The audit report can be a single report or separate reports for each standard, but every finding must be linked to the standard or standards it relates to. And there is a point many companies underestimate: the certification body must consider the effect of a nonconformity raised against one standard on conformity with the others. If your document control does not work, the problem is not just an ISO 9001 issue. Likewise, if one certification is suspended or withdrawn, the certification body must assess the impact on the others. Integration brings efficiency, but it also makes weaknesses more visible.
How to build an integrated management system step by step
The most effective way to build an integrated system is to start from what you already have and unify the common elements first, then the specific ones. There is no need to rewrite everything from scratch.
The steps to integrate the standards
This is the sequence that works in most SMEs.
Map what exists: for each standard already in place, list procedures, forms, registers, owners and deadlines, and note where the same information appears more than once.
Define the common scope: sites, activities and processes covered by each standard, because they do not always coincide.
Unify the elements of the harmonized structure: context, interested parties, policy, risks and opportunities, objectives, documents, competence, internal audits, review, nonconformities.
Place each standard's specific requirements within the common framework, without losing them: environmental aspects, hazards, information security controls.
Organise a single internal audit programme by process and a single management review.
Train people on the system as a whole, not standard by standard.
What to unify straight away and what to keep separate
The elements worth unifying first are those that create the most duplicates: document management, nonconformities and corrective action, internal audits, management review, training. They are identical in the common text and are almost always handled with different tools in separate systems.
Keep distinct, while still within the same system, the content that has its own criteria: the analysis of environmental aspects, the assessment of hazards, the ISO/IEC 27001 statement of applicability. Unifying does not mean watering down: each requirement must remain recognisable and traceable to its standard, because that is how the auditor will check it.
How Complaion helps you
Integrating several standards is above all a matter of method and order, and that is where Complaion works. A dedicated Lead Auditor supports your company: they analyse your existing systems, propose the path that best suits you (which standards to integrate, in what order, with what scope) and conduct the integrated internal audit, process by process, across all the standards in scope. The platform gathers evidence for all the standards in one place, manages documents, keeps the schedule of internal audits, reviews, training and surveillance audits, and helps you reach the audit with everything in order. It is the approach we use with more than 1,000 clients, many of whom manage more than one certification.
Example: a company moving from three systems to one
Take a 60-employee metalworking company, certified to ISO 9001 for years. A major customer asks it for ISO 14001, and to take part in some tenders it also needs ISO 45001. The first idea is to build two new systems alongside the existing one.
Before: three parallel systems
With three separate systems, the quality manager runs the quality manual, the environmental consultant keeps a register of environmental aspects in a separate file, and the health and safety officer updates the risk assessment document on their own schedule. There are three internal audits, in three periods of the year, with the same departments questioned three times. The management review takes place three times, and the owner signs three sets of minutes that never refer to one another.
The typical result is that the same nonconformity appears in one register and not in the others. A paint supplier is qualified for product quality, but nobody checks the safety data sheets or how the empty containers are disposed of. At the audit, the auditor spots the contradiction.
After: a single system
With an integrated system, the company has a single policy for quality, environment and safety, a single context analysis, and a risk register with separate sections for process risks, environmental aspects and health hazards. Supplier qualification becomes a single assessment with quality, environmental and safety criteria. The internal audit programme is organised by process: when the internal auditor visits the paint shop, they check quality controls, waste management and the use of protective equipment in the same round.
The management review becomes one meeting a year with a single set of minutes, in which the owner sees complaints, consumption, injuries and near misses together. The certification audit can be carried out in a single visit, with the time calculated under IAF rules according to the level of integration actually achieved.
What mistakes should you avoid when integrating several standards?
The most common mistake is thinking that integrating means putting documents in one folder. A combined system with a shared index is still a combined system, and the auditor will notice at Stage 1.
Declaring integration that does not exist
Declaring a higher level of integration in your application than the real one does not pay off. IAF MD 11 requires the level to be confirmed at Stage 1 and the audit time to be revised if necessary. It is better to describe the system honestly and let integration grow over time, cycle after cycle.
Losing the specific requirements
The second mistake is the opposite: unifying so much that you erase what each standard specifically requires. An "integrated risk assessment" that does not contain significant environmental aspects or the hazard assessment is a leaner system only on the surface. At the audit, each finding is linked to its standard, and an uncovered requirement remains a nonconformity even if the system is elegant.
The other recurring mistakes are practical. Integrating everything in one go, instead of element by element. Entrusting the system to a single person with no clear owners for environment and safety. Forgetting that the scope can differ for each standard: one site may be covered by ISO 9001 but not by ISO 45001, and the system must make that clear.
How Complaion helps you manage several standards in one system
An integrated management system lets you spend less time on duplicates and more on what matters: one internal audit, one management review, one register for risks, documents and actions. But it takes method, especially when standards are added one at a time.
With Complaion you have a dedicated Lead Auditor who knows your company, assesses the systems you already have and proposes the path that best suits your needs, from the order of the standards to the scope. The platform gathers evidence for all the standards in one place, manages documents, keeps the schedule and prepares the audits, while the internal audit is conducted by your Lead Auditor. More than 1,000 clients already work this way.
Want to understand how to integrate the standards you already hold with the ones you need? Contact us to discuss your case and get a tailored quote.
Frequently asked questions about integrated management systems
What is an integrated management system?
An integrated management system is a single system that meets the requirements of two or more management system standards, for example ISO 9001, ISO 14001 and ISO 45001. Policy, risks, documents, internal audits, review and corrective action are managed once, while each standard's specific requirements remain recognisable. It is not a separate standard: it is a way of organising the system.
Is there a certification for the integrated system?
There is no ISO "integrated system" standard with its own requirements. You obtain certification to the individual standards, which can be assessed through an integrated audit by the same certification body, at the same time. The report can be a single one, but each finding remains linked to the standard it relates to.
Which ISO standards can be integrated?
All management system standards built on ISO's harmonized structure, such as ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 50001, ISO 22301, ISO 37001 and ISO/IEC 42001. The most common combination is quality, environment and safety, but the choice depends on what customers, tenders and your sector ask of you.
Is an integrated audit shorter?
It can be, but it is not automatic. According to IAF MD 11, the certification body adds up the audit times of the individual standards and may reduce them based on the level of integration and the auditors' competence, up to a maximum of 20%. The level of integration is verified at Stage 1.
Can I add a new standard to a system that is already certified?
Yes, and it is the most common case. You start from the common elements already in place, such as documents, internal audits, review and corrective action, and add the specific requirements of the new standard. The scope must be defined for each standard, because the sites and activities covered may differ.
Do I need an internal auditor for each standard?
Not necessarily. The common text requires internal audits to be carried out objectively and impartially by competent people. One internal auditor can cover several standards if they have the necessary competence, or you can form a small team with complementary skills and a single audit programme.
If I lose one certification, do I lose the others too?
Not automatically. IAF MD 11 requires that, if one certification is suspended or withdrawn, the certification body assesses the impact on the others. In an integrated system many elements are shared, so a serious problem in a common process can have consequences for several standards.
