Integrated management systems · several standards, one system, one audit programme
Integrated management system consulting: several standards, one system your people run.
Sterling brings ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 50001 and other management system standards into one system on the harmonised structure they share: one policy framework, one risk method, one internal audit and one management review, audited as one programme by an accredited body. We ensure successful certification for our clients.
- Start from nothing, or merge the separate systems and certificates you already hold into one
- One engagement team, one Effivity workspace and one all-inclusive proposal, whichever combination of standards you choose
- The Sterling Promise: 100% on-time completion, 100% success, 8,100+ client engagements. Sterling does not certify; an accredited body audits and decides
- One system, not three bindersShared policies, risk method, document control, audits and review, with each standard's specific controls added where they belong.
- Audits planned as one programmeThe certification body plans one audit across your standards, and every finding is traceable to the standard it concerns.
- Less duplication for your peopleOne internal audit, one management review and one corrective action process in place of a set for each standard.
- Room for the next standardThe common core stays in place; a new standard adds its own requirements instead of a parallel system.
Which standards integrate
Bring together the standards you hold and the ones you are now asked for.
Most ISO management system standards share the harmonised structure: identical clause numbers and titles for clauses 4 to 10, with common text and core terms, so context, leadership, planning, support, performance evaluation and improvement can be written once. The standards below are the ones clients most often bring into one system. Tell us which you hold and which you are now asked for.
- ISO 9001Quality management
- ISO 14001Environmental management
- ISO 45001Health & safety
- ISO/IEC 27001Information security
- ISO 50001Energy performance
- ISO 22000Food safety
- ISO 22301Business continuity
- ISO/IEC 27701Privacy information
- ISO/IEC 20000-1IT service management
- ISO 37001Anti-bribery
- ISO/IEC 42001AI management
- ISO 28000Supply chain security
- All standards & frameworksThe full catalogue, with sector schemes
Programmes we run most often
The combinations clients ask for most.
Each has its own page: what the programme covers, who does what, and how one plan carries every standard to its own independent outcome.
- ISO 9001 + ISO 14001 + ISO 45001Integrated QHSE
- ISO 9001 + ISO 45001Integrated quality and safety
- ISO 9001 + ISO/IEC 27001Integrated quality and information security
- ISO 9001 + HACCPQuality and food safety
- HACCP + GMPFood safety
- ISO/IEC 27001 + PCI DSSInformation security and card data
- ISO/IEC 27001 + SOC 2Security for global customers
- ISO/IEC 27001 + PCI DSS + SOC 2Security, card data and assurance reports
- ISO/IEC 27001 + HIPAAInformation security and US health data
- ISO/IEC 27001 + PCI DSS + HIPAASecurity, card data and health data
- ISO/IEC 27001 + SOC 2 + HIPAAHealth technology and services
- ISO/IEC 27001 + PCI DSS + SOC 2 + HIPAAFull assurance for service providers
- PCI DSS + HIPAACard data and health data
- PCI DSS + SOC 2 + HIPAAUS healthcare and payments clients
- SOC 1 + SOC 2Assurance reports for service organisations
The engagement, step by step
One plan that builds the shared core once, then adds each standard.
Every Sterling engagement runs on Sterling OS™: five stages, each with deliverables, decision owners and a weekly working session with your engagement team. Integration work sits under Revise™, the part of Sterling OS™ for new standard integration and multi-standard integrated management systems, delivered at the Design™ or the Drive™ level of support.
- 01
Scope and integration map
At the startWhat happens
We confirm each standard and edition, the activities and sites, and any certificates you already hold, with their bodies and audit dates. Then every requirement is reviewed once and sorted: common to all your standards, shared by some, or specific to one. What already works is kept as the base.
You receive
- Agreed scope for each standard and for the integrated system
- Integration map of common, shared and standard-specific requirements, with the gaps
- Implementation plan with owners, milestones and a single audit calendar
Your side
A project owner with authority across quality, HSE, IT or energy, and the owners of any existing systems at the table.
- 02
Build the common core
Early in the programmeWhat happens
The elements every standard requires are written once with your managers: context and interested parties, one policy framework, one method for risks and opportunities, objectives, document control, competence, communication, internal audit, management review, and nonconformity and corrective action. The 2024 climate amendments to clause 4.1 of ISO 45001, ISO/IEC 27001, ISO 50001 and others are answered once.
You receive
- Integrated manual or system description, cross-referenced to each standard
- One set of core procedures and registers, running in Effivity
- Awareness e-learning for your people from Sterling Academy
Your side
Managers agreeing one way of working where each system used to have its own.
- 03
Add each discipline's requirements
Alongside the coreWhat happens
Each standard then adds only what is specific to it: quality planning and control of outputs for ISO 9001, environmental aspects and compliance obligations for ISO 14001, hazard identification, the hierarchy of controls and worker participation for ISO 45001, information security risk treatment and the Statement of Applicability for ISO/IEC 27001, the energy review and energy performance indicators for ISO 50001.
You receive
- Discipline registers: aspects, hazards, information security risks or energy uses, as your scope requires
- Operational procedures that cover every applicable standard in one place
- Records in Effivity with the evidence tagged to each standard
Your side
Process owners in the weekly session, and the combined procedures put into daily use.
- 04
Integrated internal audit and management review
Before the certification auditWhat happens
One internal audit programme covers every standard, with auditors competent in the disciplines they audit and each finding traced to the standard or standards it concerns. A finding against a common element is corrected once, for the whole system. The management review then takes the inputs each standard requires in a single meeting that records decisions and actions.
You receive
- Integrated audit programme, checklists and report
- Management review record covering the inputs of every standard in scope
- Certification body proposals compared and accreditation checked for each standard
Your side
Management in the review, and your trained auditors on the audit.
- 05
Integrated certification audit
The audit windowWhat happens
An accredited certification body plans an audit of the integrated system: it works out the audit time for each standard, adjusts it for how far the system is integrated and for its complexity, and traces each finding in the report to its standard. Certificates held with different bodies or on different cycles are brought together as agreed with the body.
You receive
- Stage 1 and Stage 2 preparation for standards new to certification, and for any scope extension
- Support with the response to findings until the body decides
- The Sustain™ calendar: one cycle of surveillance, internal audit and review for the whole system
Your side
Your people doing their jobs as usual, answering for every discipline they work in.
Who does what
Choose how much of the work Sterling carries.
Design™ gives your team the structure, templates, workshops and coaching to integrate the systems itself. Drive™ has Sterling consultants carry the integration work with your system owners. They are alternatives, not phases: the software, the training, the accountability and the all-inclusive proposal work the same way in both.
| Task | Design™ guided | Drive™ fully managed |
|---|---|---|
| Scope, integration map and plan | Sterling with your system owners | Sterling with your system owners |
| Common core: policy, risk method, document control | Together your team drafts on Sterling's templates, Sterling reviews | Sterling with your managers |
| Merging existing procedures and records | Your team coached in the weekly session | Sterling consolidated from your current systems |
| Discipline registers: aspects, hazards, security risks, energy uses | Your team coached discipline by discipline | Sterling populated with your data |
| Effivity configuration and data migration | Sterling one workspace for every standard | Sterling one workspace for every standard |
| Putting the combined controls into daily use | Your team with guidance in the weekly session | Your team Sterling checks the evidence |
| Integrated internal audit | Together your trained auditors, Sterling facilitates | Sterling conducted for you across every standard |
| Management review | Your management Sterling prepares the inputs | Your management Sterling prepares and facilitates |
| Certification decision for each standard | The independent, accredited certification body never Sterling | |
Which model suits you? Where a quality, HSE or IT lead can give the integration some hours each week, Design™ is the usual choice. Where several mature systems must be merged against a deadline, or nobody has that time, Drive™ is. The discovery call settles it.
What you receive
Everything an integrated system needs. Nothing charged separately.
- Integration map and gap analysis reportEvery requirement of every standard in scope, sorted into common, shared and specific, with each shortfall given an owner and a date.
- Implementation plan and audit calendarMilestones, responsibilities, the weekly sessions and one target window for the certification audit.
- Integrated system documentationOne manual or system description, core and discipline procedures, forms and records on Sterling's template sets, cross-referenced to the clauses of each standard.
- Effivity workspace, configuredDocuments, registers, audits, actions, training and management review for every standard in one place, included at no additional cost.
- Trained peopleAwareness e-learning for everyone, practitioner learning for system owners and internal auditor training for your audit team, as applicable to your standard, with Certificates of Completion.
- Integrated internal audit and reviewOne audit programme, checklists and report with findings traced to each standard, corrective actions closed on evidence and one management review record.
- Certification readinessBodies compared and their accreditation checked for each standard, audit arrangements agreed with the body, and support until each certificate is issued.
- The Sustain™ calendarA year-ahead plan for surveillance, internal audits, refreshers, new-hire training and edition transitions across every standard.
Effivity · included with the engagement
Your system runs in software from the first workshop.
Effivity is the ISO and GRC automation platform built by the Sterling group and used in 50+ countries. Your consultant configures it within the agreed scope, so evidence accumulates as people do their work and the certification auditor reviews a live system rather than a binder. Sterling consulting clients get their subscription included with the engagement, at no additional cost.
ISO & GRC softwareSterling Academy · included with the engagement
Your people learn the standard, not just the forms.
E-learning with practice checkpoints, a final exam and a numbered Certificate of Completion for each learner, verifiable online, with progress by department for the certification audit. Sterling consulting clients get preferential course access and special pricing, including complimentary awareness training for their people as part of the engagement.
Contact us about Academy accessHow we price
One all-inclusive proposal. Every component visible. No surprises, ever.
The investment in an integrated system depends on which standards are in scope, which are already implemented or certified, how far your existing systems overlap, the sites, the headcount and the current maturity of your processes. That is why every Sterling proposal is built for your organisation rather than read from a price list. The way the proposal works stays the same.
- One all-inclusive proposal for Sterling's work, software and learning. Consulting, Effivity and Sterling Academy access in one figure; the fee does not move when the work takes longer than we planned.
- Certification-body fees identified separately. The body's audit days, travel and surveillance arrangements are shown as their own line, so the full programme cost is comparable across proposals.
- Payment milestones tied to deliverables, not to the calendar: the gap analysis report, the documented system, the internal audit, the certificate.
- Deliverables, responsibilities, assumptions and exclusions in writing, and nothing to sign to receive the proposal.
To prepare your proposal we need
- The standards in scope, and which of them you already hold certificates for
- The certification bodies and audit dates of any current certificates
- The activities and sites to be covered
- Approximate headcount
- Your deadline, or the customer or tender date behind it
That is enough for a scoped, all-inclusive proposal from a Sterling consultant in your region. There is no need to prepare a manual first.
Request a scoped proposalA Sterling consultant replies within one working day.
Standards
Standards this service covers
- ISO 9001ISO 9001 certification consulting: a quality management system built with your people, evidence prepared and support until an accredited body certifies you.
- ISO 14001ISO 14001 certification consulting: aspects, impacts and compliance obligations controlled, with support until an accredited body certifies you.
- ISO 45001ISO 45001 certification consulting to prevent work-related injury and ill health, with an OH&S system built with your people and audit-ready, in 60+ countries.
- ISO/IEC 27001ISO/IEC 27001 certification consulting: an ISMS built with your people, evidence prepared, and support through Stage 1, Stage 2 and surveillance audits.
- ISO 22301ISO 22301 certification consulting to keep delivering through disruption: impact analysis, continuity plans and exercises, prepared for an accredited audit.
- ISO 50001ISO 50001 certification consulting for measured, normalised energy performance improvement, with the data to prove it at an accredited certification audit.
- ISO 22000ISO 22000 certification consulting: PRPs, a validated hazard control plan, traceability and recall readiness, built with your teams for an accredited audit.
- ISO 37001ISO 37001 certification consulting: proportionate anti-bribery controls to prevent, detect and respond, built with your teams and ready for an accredited audit.
- ISO 37301ISO 37301 certification consulting: one compliance management system for your obligations and commitments, with evidence ready for an accredited audit.
- ISO/IEC 20000-1ISO/IEC 20000-1 certification consulting for IT services delivered to agreed requirements: incident, change, capacity and supplier control, audit-ready.
Don’t be fooled by certification scams
Sterling against the alternatives.
The market offers four ways to a certificate. Three of them leave you with a system that does not run, a certificate that fails a customer's check, or both. This is what each route actually gives you.
| What you get | Template kit, do it yourself | "Certified in 10 days" seller | Body-shopping consultant | Sterling |
|---|---|---|---|---|
| A system built around your operation | Only if your team has the time and the expertise | No: a template with your name on it | Depends on the individual assigned | Yes, with your process owners, on Sterling's template sets |
| Your people trained | Not included | Not included | Sometimes, at extra cost | Included: awareness, practitioner and internal auditor training |
| Software to run the system | Paid for separately | None | Paid for separately | Effivity, included at no additional cost |
| Internal audit and management review before the audit | If you know how | A formality, if at all | Usually | Always, with findings closed on evidence |
| Certificate from an accredited body | Your choice | Often not accredited, or not for your scope | Usually | Always: accreditation checked before you sign |
| Who is accountable if the audit goes badly | You | Nobody | The individual, if still available | Sterling, under the Sterling Promise, until you are certified |
| Fee transparency | Kit price only | One invoice for consulting and certificate | Day rates, open-ended | One all-inclusive proposal; certification-body fees shown separately |
| After the certificate | On your own | Gone | Another contract | Sustain™: surveillance, internal audits, refreshers, transitions |
Sterling's position. Sterling does not certify. We consult, train and prepare you; an independent, accredited body audits and decides. We do not sell certificates without implementation, and we tell you when an offer you have received is one. All ten warning signs of shortcut certification · How to check any ISO certificate
Client experience
On the record: what clients say about working with Sterling.
The ISO manager reports that the company was very pleased with the implementation approach, and that the consultants guided it to a close integration of its existing systems with the additional requirements of ISO 9001, ISO 14001 and ISO 45001.
The management representative and ISO project manager observed deep domain knowledge, expertise in the ISO standards and a professional approach from the Sterling team, which made the QHSE standards simple and accessible for the company's staff.
The ISO and GRC in-charge writes that Sterling's deep understanding of ISO 9001 and ISO 14001 helped the company streamline its processes and align them with internationally recognised practice, and that the team's insights were essential in working through complex requirements.
The quality manager, who led the ISO 9001 and ISO 22000 project, writes that the consultants showed solid knowledge of the standards, kept a professional and cooperative approach throughout, and that the work was organised and steady with useful guidance at each stage.
Each account is drawn from a signed letter or e-mail on file and reported in our words, with the signatory's role and organisation attached; the original letters are available on request. Ask for references in your sector before you decide.
- 60+countries where Sterling has delivered certification
- 21countries with a Sterling office, eight regions, one coordinated team
- 2003the year the group began implementing ISO management systems; the same method, refined, since
- 8,100+client engagements across the group, from single-site SMEs to multinationals
FAQs
Questions clients ask before they engage us.
The answers for your own combination of standards come from the discovery call. These are the questions most integration projects begin with.
What is an integrated management system?
It is one management system that meets the requirements of two or more standards, in place of a separate system for each. Because ISO management system standards share the harmonised structure, context, leadership, planning, support, internal audit, management review and improvement are written once, and each standard adds its specific requirements, such as environmental aspects, hazard identification or information security controls. Integration is a matter of degree, from a combined system to a fully integrated one.
Which standards can be integrated into one system?
Any standards on the harmonised structure can share one system, including ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, ISO 50001, ISO 22301, ISO/IEC 20000-1, ISO 37001, ISO/IEC 42001 and ISO 28000; ISO/IEC 27701:2025 is now a standalone management system standard as well. ISO 13485 is the notable exception: it keeps the clause structure of ISO 9001:2008, so it can share document control, audit and review routines, but its requirements are mapped rather than aligned.
Do we get one certificate or one for each standard?
That depends on the certification body, not on your system. The accreditation rules for integrated audits, IAF MD 11, govern how the audit is planned, staffed and reported, not the format of the certificate, so some bodies issue one certificate naming several standards and others issue one per standard. What matters is that each certificate is accredited for its standard and scope, which we check with you before you sign with a body.
Does an integrated audit take fewer audit days?
Often, but not automatically. The certification body works out the audit time for each standard, then reduces it for the degree of integration and for people and auditors who can cover more than one standard, or increases it for complexity, and documents its reasoning. A genuinely integrated system gives the body grounds for a reduction; separate systems filed under one cover do not.
We already hold separate certificates. Can they be merged?
Usually, yes, but the order of work matters. We map the existing systems first and merge the common elements without breaking the evidence trail each certificate depends on. Where the certificates sit with different bodies or on different cycles, how to align them is agreed with the body that will conduct the integrated audit, and adding a standard to an existing certificate can be handled as a scope extension.
Should we implement the standards together or one at a time?
Together, when every standard is needed on a similar timescale; one at a time, when a customer or tender needs one certificate urgently. In the second case we build the first standard on the harmonised structure with a common core designed to take the others, so each later standard adds its own requirements instead of a parallel system.
What happens when one of the standards is revised?
The change goes into the part of the system it touches, and the rest stays as it is. ISO 14001:2026 was published on 15 April 2026 and ISO 9001:2026 on 16 September 2026, and ISO expects a revised ISO 45001 in the first half of 2027, so a QHSE system faces three transitions in quick succession. In an integrated system each one is a change to the core or to a discipline layer, assessed within the same audit programme.
Do the clause numbers line up across the standards?
Mostly, but not everywhere, which is why an integrated system is organised by topic rather than by clause number. In ISO 9001:2026 and ISO 14001:2026, clause 10.1 is continual improvement and 10.2 is nonconformity and corrective action; ISO 22301:2019 has them the other way round, and ISO 45001:2018 brings incidents into 10.2 and moves continual improvement to 10.3. The integrated manual carries a cross-reference to each standard.
Does Sterling certify the integrated system?
No. Sterling designs the integrated system, guides it into place, trains your people and prepares you for the audit; an independent certification body, accredited for each standard in scope, audits the system and decides on each certificate. We help you compare bodies, confirm that their accreditation covers every standard and scope you need, and support you through every finding until the body has made its decision.
Keep exploring
More Sterling services
Talk to a consultant
Plan one system for all your standards.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice