Integrated Management Systems: Running ISO 9001, 14001 and 45001 as One

Plenty of businesses I work with hold ISO 9001, ISO 14001 and ISO 45001, yet run them as three separate systems: three manuals, three rounds of internal audits and three management review meetings. An integrated management system fixes that by running all three as one.

I’m Craig Willetts, founder of CAW Consultancy and a lead auditor across ISO standards for over 20 years. In this guide I’ll explain what an integrated management system is, why these three standards fit together so well, what you can share and what must stay separate, and how to set one up. I’ll also explain why 2026 is a particularly good moment to do it.

What is an integrated management system?

ISO describes a management system as “the way in which an organization manages the interrelated parts of its business in order to achieve its objectives”. An integrated management system (IMS) is one management system that meets the requirements of more than one standard.

The international accreditation rules for certification audits put it this way: “a single management system managing multiple aspects of organisational performance to meet the requirements of more than one management standard, at a given level of integration”.

That last phrase matters. Integration isn’t all or nothing. At one end, you have three separate manuals in the same folder. At the other, you have one set of processes, one approach to risk and one meeting cycle, with standard-specific controls plugged in where they’re needed. The further along that scale you are, the more you gain.

Why integration works: the harmonized structure

ISO’s management system standards are written to a common framework that ISO calls the harmonized structure. Standards built on it share identical clause numbers and titles, common terms and core definitions, and a common core text.

The rules behind it sit in the ISO/IEC Directives, ISO’s rulebook for writing standards. They were introduced in 2012 as “Annex SL”, which is still the name most people use. In the 2026 edition of the Directives, they appear as Annex Q, “Harmonized approach for management system standards”.

In practice, ISO 9001, ISO 14001 and ISO 45001 all follow the same main clauses:

• 4 Context of the organisation
• 5 Leadership
• 6 Planning
• 7 Support
• 8 Operation
• 9 Performance evaluation
• 10 Improvement

The new editions lean into this. ISO says ISO 9001:2026 adopts the latest harmonized structure, “making it easier to integrate ISO 9001 with other management system standards”. For ISO 14001:2026, ISO highlights the clear operational benefits of that alignment for organisations already using ISO 9001 or ISO 45001.

You can see the shared structure at work in the 2024 climate change amendments. ISO added the same climate change text to clauses 4.1 and 4.2 across a long list of management system standards at once, including all three.

If you’ve come across PAS 99, BSI’s old specification for integrating management systems, note that BSI withdrew it in 2022. The harmonized structure is now the reference point.

What an integrated management system can share

Most of the system can be shared across all three standards:

• Context and interested parties. One review of the issues affecting the business and what clients, staff, regulators and neighbours expect.
• Leadership, roles and policy. One leadership commitment, one set of responsibilities and one combined policy covering quality, environment and health and safety.
• Risks and opportunities. One method and one register, with quality, environmental and safety risks assessed consistently.
• Objectives. Set, resourced and tracked together.
• Competence, training and awareness. One training matrix and one induction.
• Communication and document control. One way of creating, approving and controlling documents and records.
• Internal audit. One audit programme and auditors who can cover all three standards.
• Management review. One meeting, one agenda, one set of minutes.
• Nonconformity and corrective action. One log and one root cause method.
• Change management. One process for planning changes. ISO 9001:2026 strengthens its requirements on planning changes, and ISO 14001:2026 introduces a formalised approach to managing change (clause 6.3), so a single change process now works harder for you.

What stays standard-specific

Some requirements belong to one standard only. These are the parts integration must never water down.

Quality (ISO 9001)

Customer communication, determining and reviewing requirements for your products and services, design and development, control of external providers, delivery of the product or service, release, control of nonconforming outputs and customer satisfaction.

Environmental (ISO 14001)

Identifying your environmental aspects and their impacts, determining your compliance obligations, preparing for and responding to potential environmental emergencies, and taking a life cycle perspective. ISO says the 2026 edition reinforces the connection between environmental aspects, compliance obligations and actions, so your aspects register and legal register need to drive real controls, not sit in a drawer.

Occupational health and safety (ISO 45001)

Hazard identification and risk assessment, worker participation, emergency planning and incident investigation. Worker participation is the element I most often see thinned out in an integrated system. Keep it visible, with real records of how workers have been consulted and involved.

The benefits of an integrated management system

• Less paperwork. One set of documents instead of three, with fewer contradictions between them.
• Less management time. One internal audit programme and one management review instead of three.
• Better decisions. A single view of risk means quality, environmental and safety impacts are weighed together.
• Combined certification audits. Accreditation rules allow a certification body to audit your system against two or more standards at the same time. Where your level of integration justifies it, the total audit time can be reduced, but by no more than 20% from the combined starting point. It’s a ceiling, not a guarantee.

Those rules were set by the International Accreditation Forum in IAF MD 11 and, since IAF’s work passed to Global Accreditation Cooperation Incorporated (Global ACI), have been reissued as Global ACI-TECH-3-008. They describe what real integration looks like: an integrated documentation set, management reviews that consider overall business strategy, and integrated approaches to internal audits, policy and objectives, system processes, improvement mechanisms, and management support and responsibilities. That list makes a useful self-check.

Common pitfalls

• Integrating the paperwork but not the practice. A merged manual sitting on top of three separate ways of working isn’t integrated, and an auditor will spot it quickly.
• Losing the specialist parts. Aspects, compliance obligations, hazard assessments and worker participation get thinned out in the name of simplicity.
• One giant register nobody can use. Combine methods, not necessarily every list.
• Mismatched editions. You may currently be running different editions of each standard. Keep a simple cross-reference showing which clauses each process satisfies.
• Assuming integration automatically cuts audit fees. It depends on how integrated your system really is.
• Everything resting on one person. Spread ownership so the system survives holidays and staff changes.

How to set up an integrated management system, step by step

1. Gap analysis. Compare what you already do against all three standards and note where processes are duplicated.
2. Agree the scope. Decide which sites, activities and standards are covered.
3. Build the shared core. Context, interested parties, policy, roles, risks and opportunities, and objectives.
4. Add the standard-specific modules. Customer requirements and service delivery for quality; aspects, compliance obligations and emergency preparedness for environment; hazards, worker participation and incident investigation for health and safety.
5. Merge the supporting processes. Document control, training, communication, corrective action and change management.
6. Run it. Use the system day to day so there’s real evidence for each standard.
7. Audit and review once. Carry out an integrated internal audit and a single management review covering all three.
8. Book an integrated certification audit. Tell your certification body your system is integrated so it can plan the audit on that basis.

Why 2026 is the right time for an integrated management system

The timing has rarely been better.

• ISO 14001:2026 was published on 15 April 2026 and ISO 9001:2026 on 16 September 2026.
• Transition deadlines are confirmed. Global ACI has set three-year transitions. Organisations certified to ISO 14001:2015 have until 30 April 2029, and those certified to ISO 9001:2015 have until 30 September 2029. The transition can take place at a scheduled surveillance or recertification audit, or at a separate transition audit.
• ISO 45001 is under revision. The draft new edition has completed its international ballot, and ISO expects it to replace ISO 45001:2018 in the first half of 2027.

If you’re reworking two of your three standards anyway, do it once, as an integrated system, and build it so the new ISO 45001 slots in when it’s published. Where your certification body agrees, you may also be able to line up the transitions so they’re covered in the same audit visit.

Frequently asked questions

What is an integrated management system?

An integrated management system is one management system that meets the requirements of more than one standard, such as ISO 9001, ISO 14001 and ISO 45001. Instead of three manuals and three audit cycles, you run shared processes for policy, risk, objectives, documents, audits and reviews, with standard-specific controls added where they’re needed.

Can ISO 9001, 14001 and 45001 be audited together?

Yes. Accreditation rules allow a certification body to audit an integrated system against two or more standards at the same time. If your system is fully integrated, the total audit time can be reduced by up to 20% compared with the combined time for each standard. The reduction isn’t automatic; it depends on your level of integration.

When do I need to move to ISO 9001:2026 and ISO 14001:2026?

Under Global ACI’s transition rules, organisations certified to ISO 14001:2015 have until 30 April 2029, and those certified to ISO 9001:2015 have until 30 September 2029. The transition can happen at a scheduled surveillance or recertification audit, or at a separate transition audit. Check your certification body’s own timetable.

Should I wait for the new ISO 45001 before integrating?

No. ISO 45001:2018 is already designed to integrate with other ISO management system standards, so you can integrate now. ISO expects the revised edition to replace the 2018 version in the first half of 2027. A well-built integrated system makes that update easier, because the shared processes won’t need rebuilding.

Is an integrated management system worth it for a small business?

Usually, yes. In small businesses the same few people tend to run everything, so one set of processes, one audit programme and one management review saves them the most time. The standards apply to organisations of any size, so an integrated system for a small firm can be lean and practical.

Talk to CAW Consultancy about your integrated management system

Whether you’re starting from scratch or merging three existing systems, CAW Consultancy can build an integrated management system around how your business actually works. Our tri-standard package for ISO 9001, ISO 14001 and ISO 45001 starts from £1,799 ex VAT. That’s for consultancy only: certification audit fees are paid separately to the certification body, from £595 with a non-UKAS-accredited certification body and from £1,500 with a UKAS-accredited one.

We build systems within 48 hours, typically deliver within 72 hours, and have kept a 100% audit pass rate for over 20 years, including UKAS-accredited audits. Call 01257 824481 or visit www.cawconsultancy.co.uk.