Organizations implementing multiple ISO management systems sometimes end up with separate procedures, separate audits, separate meetings and even separate teams for each standard.

ISO 9001 may be managed by the Quality Department. ISO 14001 may sit with Environmental personnel, while ISO 45001 is managed by the Safety and Health team.

This can work — but as the number of management systems increases, duplication can also increase.

An Integrated Management System (IMS) provides another approach.

Instead of managing each ISO standard as a separate system, an IMS brings their common requirements and business processes together into one coordinated management framework.

For organizations implementing ISO 9001, ISO 14001 and ISO 45001, integration can make the management system simpler, more practical and better connected to the way the business is actually managed.

Key Takeaways

An effective Integrated Management System can help organizations:

• combine common ISO requirements into one management framework;
• reduce duplicated procedures and records;
• conduct integrated internal audits;
• combine management review activities;
• coordinate risks, objectives and improvement actions;
• improve collaboration between Quality, Environmental and OH&S functions;
• reduce the administrative burden of maintaining several ISO systems; and
• make ISO requirements part of normal business management.

However, integration does not mean forcing everything into one procedure or one document.

A good IMS integrates what makes sense while retaining standard-specific controls where they are necessary.

What Is an Integrated Management System?

An Integrated Management System combines two or more management systems into a coordinated framework.

A common combination is:

ISO 9001 – Quality Management System (QMS)
Focuses on consistently meeting customer and applicable requirements and improving customer satisfaction.

ISO 14001 – Environmental Management System (EMS)
Focuses on managing environmental aspects, compliance obligations and environmental performance.

ISO 45001 – Occupational Health & Safety Management System (OH&S MS)
Focuses on managing OH&S risks and opportunities, preventing work-related injury and ill health, and improving OH&S performance.

Organizations may also integrate other management systems, depending on their needs, such as:

• ISO 50001 Energy Management;
• ISO 37001 Anti-Bribery Management;
• ISO/IEC 27001 Information Security Management; or
• other applicable management system standards.

The objective is not simply to place several ISO certificates under one heading.

A genuine IMS looks at how the organization’s management processes can satisfy multiple requirements without unnecessary duplication.

Why Can ISO Management Systems Be Integrated?

Modern ISO management system standards use a common Harmonized Structure.

This provides common clause areas such as:

• Context of the Organization
• Leadership
• Planning
• Support
• Operation
• Performance Evaluation
• Improvement

Because of this common structure, many management processes can be integrated.

For example, ISO 9001, ISO 14001 and ISO 45001 all require organizations to consider their context, interested parties, responsibilities, objectives, competence, documented information, performance evaluation, internal audits, management reviews and improvement.

The subject matter differs, but the management mechanism is often similar.

That creates opportunities for integration.

What Can Be Integrated?

Consider an organization separately certified to ISO 9001, ISO 14001 and ISO 45001.

Without integration, it might maintain three separate processes for activities that are fundamentally similar.

An IMS can simplify this.

The result can be a leaner and more manageable system.

However, integration should always be practical.

What Should Remain Specific?

Not everything should be combined simply for the sake of integration.

Some requirements are highly specific to individual standards.

For ISO 9001, examples include:

• customer requirements;
• design and development;
• control of production and service provision;
• product/service release; and
• control of nonconforming outputs.

For ISO 14001, examples include:

• environmental aspects;
• compliance obligations;
• life-cycle perspective;
• environmental operational controls; and
• environmental emergency preparedness.

For ISO 45001, examples include:

• hazard identification;
• OH&S risk assessment;
• consultation and participation of workers;
• elimination of hazards and reduction of OH&S risks; and
• OH&S emergency preparedness.

These processes can operate within the same overall management framework without being artificially combined into one generic procedure.

Integration should simplify the system — not make it harder to understand.

A Practical Example: Internal Audit

Internal audit is a good example of where integration can create value.

An organization operating three separate systems may conduct:

• an ISO 9001 internal audit;
• an ISO 14001 internal audit; and
• an ISO 45001 internal audit.

The same department may therefore be audited three different times.

With an integrated approach, the auditor can assess the process once while considering relevant requirements from all three standards.

For example, when auditing a Purchasing Process, the audit can simultaneously consider:

Quality

• supplier selection and evaluation;
• purchasing specifications; and
• supplier performance.

Environment

• environmental requirements for suppliers;
• environmentally significant purchased products/services; and
• relevant life-cycle considerations.

OH&S

• contractor requirements;
• outsourced work risks; and
• applicable OH&S controls.

The audit becomes process-based rather than standard-based.

This can reduce disruption while providing management with a more complete view of how the process is performing.

A Practical Example: Management Review

The same principle can be applied to management review.

Instead of holding three completely separate meetings for Quality, Environmental and OH&S management systems, the organization can conduct an integrated management review.

A practical agenda could consider:

• changes in internal and external issues;
• interested-party requirements;
• achievement of objectives;
• customer performance;
• environmental performance;
• OH&S performance;
• audit results;
• compliance status;
• incidents and nonconformities;
• supplier performance;
• adequacy of resources;
• risks and opportunities; and
• opportunities for improvement.

Standard-specific inputs still need to be addressed.

The advantage is that top management can see one overall picture of organizational performance, rather than receiving information through disconnected management systems.

Integration Does Not Mean “One Manual for Everything”

One common misunderstanding is that an IMS requires one large manual covering every requirement of every standard.

It does not.

Organizations should design documentation around how their processes actually operate.

A practical IMS might contain:

Level 1 – Integrated Management Framework

Defines the overall management system, scope, policies, processes and responsibilities.

Level 2 – Integrated Business Processes

Common processes such as:

• document control;
• competency and training;
• risk and opportunity management;
• internal audit;
• corrective action; and
• management review.

Level 3 – Specific Operational Procedures

Processes requiring more detailed controls, such as:

• production control;
• environmental aspect assessment;
• HIRARC or OH&S risk assessment;
• emergency response;
• waste management; and
• contractor control.

Level 4 – Records and Forms

Evidence generated through implementation.

The principle should be:

Integrate where practical. Keep specific controls where necessary.

What Are the Benefits of an Integrated Management System?

1. Less Duplication

Organizations can avoid maintaining multiple procedures for essentially the same management activity.

2. More Efficient Internal Audits

Processes can be audited against multiple applicable requirements during the same audit.

3. More Effective Management Review

Top management can evaluate Quality, Environmental and OH&S performance together and make more coordinated decisions.

4. Clearer Responsibilities

Process owners can understand their responsibilities across the entire management system rather than seeing ISO requirements as separate departmental systems.

5. Better Risk Management

Quality, environmental and OH&S risks can be considered alongside wider business risks.

For example, purchasing a cheaper chemical may initially appear to create a cost saving.

However, an integrated assessment might identify:

• Quality: possible impact on product performance;
• Environment: increased hazardous waste;
• OH&S: increased worker exposure.

An IMS encourages the organization to consider the decision from several perspectives before implementation.

6. Better Use of Resources

Training, audits, meetings, documentation and improvement activities can be coordinated instead of duplicated.

7. Stronger Business Integration

Perhaps most importantly, an IMS can help move ISO management systems away from being “Quality’s system”, “Environment’s system” or “Safety’s system”.

There should ultimately be one business management system supporting different organizational objectives.

What Are the Common Mistakes When Developing an IMS?

Mistake 1: Combining Documents Without Integrating Processes

Putting three procedures into one file does not automatically create an Integrated Management System.

Integration needs to happen in actual processes, responsibilities and decision-making.

Mistake 2: Creating an Overly Complicated IMS Manual

Trying to explain every requirement of three standards in one large manual can make the system difficult for employees to use.

Documentation should support implementation, not become the objective itself.

Mistake 3: Treating Integration as a Quality Department Project

An IMS requires participation from process owners and management.

Purchasing, HR, Production, Engineering, Maintenance and other functions may all have responsibilities across Quality, Environmental and OH&S requirements.

Mistake 4: Combining Everything

Some organizations go too far and attempt to combine processes that are fundamentally different.

Environmental aspect assessment and OH&S hazard identification, for example, have different purposes and methodologies.

They can be coordinated within one framework without necessarily becoming one assessment.

Mistake 5: Designing the System Around ISO Clauses

A management system should reflect how the organization operates, rather than forcing employees to work according to clause numbers.

Employees normally think in terms of:

Sales → Purchasing → Design → Production → Delivery

rather than:

Clause 4 → Clause 5 → Clause 6 → Clause 7 → Clause 8

A practical IMS should therefore be designed around the organization’s business processes.

How Do You Integrate Existing ISO Management Systems?

For organizations already certified to more than one ISO standard, integration does not need to happen overnight.

A practical approach is:

1. Map the existing systems

Identify all current procedures, processes, forms and responsibilities.

2. Identify common requirements

Determine where existing management systems already perform similar activities.

3. Remove unnecessary duplication

Start with obvious areas such as document control, training, corrective action, internal audit and management review.

4. Establish an integrated process framework

Define the organization’s key business and support processes.

5. Retain necessary standard-specific controls

Do not remove important Quality, Environmental or OH&S controls simply to achieve a cleaner-looking system.

6. Align responsibilities

Clarify who owns each integrated process.

7. Integrate internal audits

Move towards process-based auditing covering applicable requirements from multiple standards.

8. Integrate management review

Provide top management with a coordinated view of management-system performance.

9. Continually simplify

As the IMS matures, identify additional duplication and unnecessary documentation that can be removed.

Integrated Management System vs Combined Certification Audit

An organization should also distinguish between integrating its management system and the certification body’s audit arrangements.

An organization may have an integrated management system internally while its certification arrangements are structured differently.

Similarly, simply having ISO 9001, ISO 14001 and ISO 45001 audited during the same visit does not necessarily mean the organization’s management system is fully integrated.

The real question is:

How closely are the management processes actually integrated within the organization?

Certification arrangements should be discussed separately with the organization’s certification body.

Is an Integrated Management System Suitable for Every Organization?

IMS can be particularly useful for organizations that:

• maintain two or more ISO management systems;
• have significant duplication between existing systems;
• use the same process owners across multiple standards;
• want to simplify documentation;
• want to improve audit efficiency; or
• are implementing several ISO standards together.

However, there is no single IMS model that suits every organization.

A small company implementing ISO 9001 and ISO 14001 may need a relatively simple integrated framework.

A large manufacturing organization with complex environmental and OH&S risks may require significantly more detailed controls.

The IMS should therefore be designed around the organization’s size, processes, risks, complexity and business needs.

Integration Should Make the Management System Simpler

The purpose of integration should not be to produce an impressive IMS manual.

It should make the management system easier to understand, implement and maintain.

A useful test is to ask:

“Does integration make it easier for our people to manage the business?”

If the answer is no, the system may have been integrated on paper rather than in practice.

A well-designed IMS should reduce duplication while preserving the controls necessary to manage Quality, Environmental and OH&S performance.

Ultimately, organizations do not need three competing management systems.

They need one effective way of managing the business, with Quality, Environmental and OH&S requirements built into the relevant processes.

How Q+ESG Consulting Can Support Integrated Management Systems

Q+ESG Consulting supports organizations in Malaysia with the development, implementation and improvement of Integrated Management Systems involving standards such as:

• ISO 9001 Quality Management System
• ISO 14001 Environmental Management System
• ISO 45001 Occupational Health & Safety Management System
• ISO 50001 Energy Management System
• ISO 37001 Anti-Bribery Management System

Support can include:

• IMS gap assessment;
• management-system integration;
• integrated documentation development;
• process mapping;
• risk and opportunity management;
• integrated internal-auditor training;
• integrated internal audits;
• management-review enhancement; and
• certification readiness support.

Our approach is to build management systems around how the organization actually operates, rather than creating separate systems simply to satisfy individual standards.

Beyond Compliance. Real Impact.