Integrated management system audits

Why integrate

Many organisations hold several certifications: quality, environment and occupational health and safety in operational businesses, or information security, privacy and business continuity in technology and services. Run separately, each system has its own policy, risk register, internal audit and management review, and the same people are interviewed three times a year.

An integrated management system brings the common parts together. An integrated audit then assesses them together, with one plan, one audit team and one report, while still checking every requirement of every standard.

Integration also reduces the risk of contradictions, such as an environmental procedure that requires something the safety procedure prohibits. People follow one set of rules instead of reconciling three.

The shared harmonised structure

Integration is practical because ISO management system standards share a common high-level structure. It was first published as Annex SL and is now called the harmonised structure. It gives each standard the same clause numbers, many identical core requirements and common terms.

That means clause 9.2 is the internal audit requirement in ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and ISO 22301 alike. Where a standard adds requirements, it adds them inside that common frame.

• 4 Context of the organisation, including interested parties and scope.
• 5 Leadership, policy, roles and responsibilities.
• 6 Planning, risks and opportunities, objectives and changes.
• 7 Support: resources, competence, awareness, communication and documented information.
• 8 Operation.
• 9 Performance evaluation, internal audit and management review.
• 10 Improvement, nonconformity and corrective action.

Common combinations

Quality, environment and safety (ISO 9001, ISO 14001 and ISO 45001) is the most familiar combination, especially in manufacturing, construction and facilities services. The three share a process view of operations and often the same site managers.

In information-driven organisations the usual set is ISO/IEC 27001 with ISO/IEC 27701 and ISO 22301. ISO/IEC 27701 adds privacy information management to the information security system, and ISO 22301 adds business continuity, which overlaps with the ICT continuity controls in 27001 Annex A. Depending on the edition of 27701 you certify to, it is either an extension of your 27001 system or a standalone standard, so confirm this when you plan the programme.

Other combinations work on the same principle, such as ISO/IEC 20000-1 with ISO/IEC 27001 for IT service providers, or ISO 50001 alongside ISO 14001 for energy-intensive sites. In each case the shared clauses are audited once and the discipline-specific requirements are audited in full.

What can be shared

The more genuinely integrated your system is, the more the audit can combine. IAF guidance on integrated audits allows the certification body to reduce total audit time to reflect the level of integration, but only where the integration is real, not where separate manuals have been stapled together.

Integration does not require one large manual. It requires that people follow one way of doing each shared task, and that the records show it.

• One policy or a set of aligned policies signed off together.
• One method for context, interested parties and risks and opportunities.
• Shared document control, competence records and communication processes.
• One internal audit programme that covers every standard.
• One management review with inputs from each discipline.
• One corrective action process.

What stays separate

Each standard still has requirements that the others do not. Auditors check these specifically and need the relevant competence for each, so an integrated audit team usually includes people qualified in each standard and in your sector.

Integration also does not merge certificates. You may receive one certificate listing several standards or separate certificates, but each standard is a separate accredited certification with its own scope and its own record in our public register.

Audit time is also calculated per standard before any reduction for integration. Each calculation reflects the number of people, the sites and the complexity of activities within that standard's scope, and the reduction is applied to the combined total.

• ISO 14001: environmental aspects, compliance obligations and life cycle perspective.
• ISO 45001: hazard identification and worker consultation and participation.
• ISO/IEC 27001: the information security risk assessment and the Statement of Applicability.
• ISO/IEC 27701: processing of personally identifiable information as controller or processor.
• ISO 22301: business impact analysis and continuity plans and exercises.

Aligning the cycles

If your certificates were issued at different times, their three-year cycles will not line up. The usual approach is to align them at a recertification or by bringing one cycle forward, so that surveillance and recertification of all standards happen in the same audit. We agree the route at the planning stage so no certificate lapses in the process.

Alignment sometimes means a shorter first cycle for one certificate. That is a normal part of planning, and the decision and its reasons are recorded in your audit programme.

How an integrated audit runs

An integrated audit plan is organised by process rather than by standard. The auditors meet top management once to cover leadership, policy and objectives across all standards, then follow operational processes with the relevant specialist present. Shared support processes such as document control, competence and internal audit are examined once for all standards.

The report records findings against the specific clause of each standard. A single weakness can produce findings under more than one standard, for example a gap in contractor control that affects both environmental and safety requirements, and each is closed through the same corrective action.

Preparing for an integrated audit

Be honest about how integrated your system really is. A single management review meeting with three separate agendas is a start, not full integration. Make sure your internal audit programme shows coverage of every clause of every standard, and that your registers make it clear which requirement each entry relates to.

Tell us which processes and people are shared and which are discipline-specific. That lets us build an audit plan that interviews shared functions once and spends the saved time on the areas where each standard needs specific attention.

Check that your internal auditors are competent in each standard they audit. An internal auditor skilled in quality may need support to audit hazard controls or information security risks with the depth a certification auditor will apply.