An integrated management system (IMS) runs quality, environment and safety under one set of processes. To audit it, test the shared clauses once and the topic-specific requirements separately. This saves time and shows how the three systems interact, but the auditor needs competence in all three.
Last reviewed: 17 October 2026. Facts checked. This guide follows the published structure of ISO 9001:2015, ISO 14001:2015, ISO 45001:2018 and the guidance in ISO 19011:2018, which covers auditing more than one management system. These are paid documents and we have not reproduced their text. We have not stated any time savings or audit-day figures. Check the current editions and any amendments.
Edition note (17 October 2026). ISO 9001:2026 was published on 16 September 2026 and replaces ISO 9001:2015 after a transition of about three years. Sources give slightly different end dates (around September 2029), and the International Accreditation Forum and your certification body set the rules, so ask yours. ISO 14001:2026 was published in April 2026 with a similar three-year transition. This guide uses the 2015 clause structure, because we could not verify the 2026 clause numbering. If you audit to a 2026 edition, check each reference against it.
Why it works
ISO 9001, 14001 and 45001 share a common high-level structure of ten clauses (clauses 1 to 3 are introductory and 4 to 10 hold the requirements). The headings are: context, leadership, planning, support, operation, performance evaluation and improvement. Many core requirements use similar wording, such as internal audit, management review, document control, competence and corrective action.
So a company can run one document control process, one internal audit programme and one management review for all three. That is an integrated system. The standards do not require integration, but it is common.
Combined, integrated and joint audits
Terms vary, but ISO 19011:2018 uses these ideas:
- Combined audit: one audit of two or more management systems of one auditee.
- Joint audit: two or more audit organisations audit one auditee together.
- Integrated system: the company has merged its processes, so an audit looks at one process against all relevant requirements.
Which you use depends on how far the company has merged its systems.
What to audit once (shared)
| Shared requirement | Test once for all three |
|---|---|
| Context and interested parties | One analysis that covers quality, environmental and safety issues |
| Leadership and policy | Is there one policy or three, and do they cover each topic? |
| Roles and responsibilities | Are all three topics assigned? |
| Document and record control | One system, same rules |
| Competence and awareness | One training matrix covering all |
| Internal audit programme | One programme that covers all scopes |
| Management review | Inputs for all three topics |
| Nonconformity and corrective action | One log, with source tagged |
What to audit separately (topic-specific)
| Topic | Specific checks |
|---|---|
| ISO 9001 | Customer requirements, design, supplier control, release, customer satisfaction |
| ISO 14001 | Environmental aspects, compliance obligations, emergency preparedness |
| ISO 45001 | Hazard identification, worker participation, hierarchy of controls, incident investigation |
Use the topic guides: ISO 9001 checklist, ISO 14001 guide, and ISO 45001 checklist.
Plan by process, not by standard
A good integrated audit follows a process, for example purchasing or maintenance, and tests every relevant requirement as it goes. In purchasing you can check supplier quality (9001 clause 8.4), contractor safety (45001 clause 8.1.4) and environmental requirements for suppliers (14001 clause 8.1) in one conversation.
Steps:
- Map each process against the clauses of all three standards.
- Build one audit plan by process, with a note of which clauses each covers.
- Decide which auditors cover which topics. Add specialists where needed.
- Prepare one checklist with topic-tagged questions.
- Run one opening and closing meeting.
Method details are in how to run an ISO internal audit step by step.
Risks to manage
- Competence gaps. An auditor strong in quality may miss a safety issue. Use team members with the right competence.
- Dilution. Covering three topics in one audit can mean none gets enough depth. Check the audit programme gives each topic adequate coverage.
- Conflicting objectives. Cost, output, safety and environment can pull against each other. Look at how management resolves this and record it.
- Over-merging. If everything is one record, topic-specific records may be hidden. Make sure each requirement can still be found.
Reporting
Use one report with sections per topic, or a combined summary and an annex for each. Tag each finding with the standard and clause. Grade findings per the rules set in ISO audit nonconformities. Report cross-system issues. For example, a chemical spill is an environmental incident, a safety incident and perhaps a quality problem.
Certification of an IMS
You can often arrange a combined certification audit with one body, though each standard gets its own certificate. Ask your certification body how it handles combined audits and whether it adjusts audit time. See ISO certification audits explained.
Frequently Asked Questions
Do I need an IMS to hold three ISO certificates?
No. You can run three separate systems. An IMS reduces duplication but it is a choice.
What is the high-level structure?
The common ten-clause layout used by many ISO management system standards. It makes it easier to combine them.
Can one auditor audit all three?
Yes, if competent in all three topics and in audit method. Otherwise use a team with the needed competence.
Does a combined audit take less time?
It can reduce duplication in shared clauses, but each topic still needs adequate time. We have not given figures, since they depend on the company and body.
Should I tag findings by standard?
Yes. Note the standard and clause for each finding, so corrective action can be tracked against each certificate.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error