Integrated management system audit: running ISO 9001, ISO 14001 and ISO 45001 audits together

What is an integrated management system audit?

An integrated management system audit is a single audit of an organisation whose quality, environmental and occupational health and safety systems share their processes, documents and people. The auditor picks a process, such as purchasing, maintenance or dispatch, and asks every relevant question of ISO 9001, ISO 14001 and ISO 45001 while standing in that process. The result is one plan, one set of interviews and one report, with each finding linked to the requirement it concerns.

ISO 19011 calls an audit of two or more management systems at one auditee a "combined audit". An integrated audit goes further, following the shape of a system that is already shared.

Building the shared system itself is covered in our guide to integrating ISO 9001 with ISO 14001 and ISO 45001.

Auditing by process, not by standard

A standard-by-standard audit questions the stores supervisor three times, about product identification, waste and manual handling. A process audit covers all three in one conversation, because that is how the supervisor actually works.

Start from the process map, pick a process, and list the requirements of each standard that land on it. Then follow one real order, permit or delivery through it; each record sampled answers several standards at once.

ISO 14001 references follow the 2026 edition; ISO 45001 references follow the 2018 edition with its 2024 amendment. Name the edition on every checklist question.

Designing one internal audit programme for three standards

Each standard has its own internal audit clause, 9.2, and each asks for the same things: audits at planned intervals, a programme that reflects the importance of the processes and the results of earlier audits, defined criteria and scope for every audit, objective auditors and results reported to management. Because the wording is common, one programme can satisfy all three, provided it proves coverage of each.

Rate importance on three axes

Give every process a rating for its effect on customers and product conformity, for the significance of its environmental aspects and for the level of its OH&S risks. Audit frequency follows the highest rating, not the average, so a process that is quiet for quality but hazardous for safety is still visited often.

Keep a coverage matrix

Beside the schedule, keep a grid of processes against the clauses of each standard. It shows the certification body, at a glance, that clauses unique to one standard, such as compliance obligations in ISO 14001 or worker consultation in ISO 45001, have been audited somewhere in the cycle and not lost inside the shared questions.

The method for planning, conducting and reporting each audit is the same as for ISO 9001 alone, set out in our ISO 9001 internal audit guide. What changes is the width of each audit, not its steps.

The audit team: competence across quality, environment and safety

None of the three standards names a qualification for internal auditors. Each requires the organisation to determine the competence people need and keep evidence of it, and each requires auditors to be objective and impartial. ISO 19011 gives guidance on what auditor competence includes and how to evaluate it.

In practice, few people are equally strong in all three disciplines, and that is acceptable. IAF MD 11 judges a certification body's team as a whole for each technical area of each standard, and the same logic works internally. Pair a quality auditor with a colleague trained in environment and safety, and let each lead the questions they know best within one trail.

Arrange the schedule so nobody audits their own work, and rotate auditors between departments over the cycle.

Running the audit on the day

Opening meeting, fieldwork and closing meeting stay the same; three habits make the fieldwork integrated.

• Walk before you sit. Accreditation guidance for OH&S audits (IAF MD 22) stresses observing work while it happens and touring the site. A walk-through at the start also shows environmental controls, housekeeping and product handling in their real state.
• One interview, several standards. When a team leader explains a task, ask how output is checked, what waste it creates and what could hurt someone doing it. Record which standard each answer serves.
• Sample once, test widely. A single work order can show the specification, the release check, the permit, the waste note and the training record of the person who did the job.

Tag every note with the standard and clause as you go. Sorting findings after the audit, from memory, is where integrated audits lose their accuracy.

Grading and reporting findings in one report

IAF MD 11 asks certification bodies for an integrated report in which every finding can be traced to the standard or standards it relates to. Adopt the same rule for internal audits and state, for each finding, the requirement and the edition.

The same document sets out how far a finding reaches. A nonconformity against a requirement common to all three standards, such as control of documented information or management review, applies to the whole integrated system. One against a requirement unique to a standard, such as the hierarchy of controls or life cycle perspective, applies to that standard alone.

Every finding then enters one corrective action process under clause 10 of each standard. For safety findings, remember that ISO 45001 frames that clause around incidents as well as nonconformities and expects worker participation in the investigation. How to write, grade and close findings is covered in ISO 9001 nonconformities: major, minor and how to close them.

When the certification body runs the integrated audit

At application, the body asks how far your documents, system elements and responsibilities are integrated, and it plans the audit time from that answer: it starts from the time each standard would need alone and adjusts it, with the reasoning recorded. The rules behind this are set out in IAF MD 11, whose current issue dates from 2023. Audit days and aligned cycles are covered in the integration guide.

What an integrated certification audit expects from you is evidence that your own audits were integrated too: one programme, one coverage matrix, one set of reports and one management review that considered the results across all three standards. A body that finds three separate internal audit files is likely to plan three separate audits, whatever the application form says.

Where integrated audits go wrong

• Checklists merged by stapling three together, so the audit is still run by standard.
• Findings recorded without a standard or clause, so nobody can tell which certificate they affect.
• Checklists still written to an old edition after one of the standards has been revised.

Integrated management system audits: questions buyers ask