Integrating ISO 9001 with ISO 14001 and ISO 45001: one management system, one document set, one audit

What one system means in practice

Three certificates can rest on three parallel systems: three manuals, three coordinators, three review meetings about the same people. Or they can rest on one: one policy, one process map, one document control, one audit programme, one management review and one corrective action route, with environmental and safety controls built into the processes where the work happens. The accreditation rules treat integration as a matter of degree, from separate systems run side by side to one that shares documentation, elements and responsibilities. ISO 9001:2026 states in its introduction that it follows the harmonised approach to make such integration easier.

The harmonised structure the three standards share

Annex SL of the ISO/IEC Directives requires ISO's management system standards to use a common skeleton, now called the harmonised structure and formerly the high level structure: one clause order, shared titles, identical core text and common terms. The requirements sit in clauses 4 to 10.

• 4 Context of the organisation: issues, interested parties, scope.
• 5 Leadership (in ISO 45001, Leadership and worker participation): commitment, policy, roles.
• 6 Planning: risks and opportunities, objectives.
• 7 Support: resources, competence, awareness, communication, documented information.
• 8 Operation: operational planning and control.
• 9 Performance evaluation: monitoring, internal audit, management review.
• 10 Improvement: nonconformity, corrective action, continual improvement.

ISO 9001:2026 and ISO 14001:2026 follow the current version of the structure, while ISO 45001:2018, amended in 2024, follows the earlier one, so a few sub-clause numbers differ; ISO expects a revised ISO 45001 in the first half of 2027. Organise the system by process, not clause number, and renumbering never touches it.

What stays specific to each standard

Quality: customers and product or service requirements

ISO 9001 examines whether what you deliver matches what was agreed. Its own content lies mainly in clause 8: requirements for products and services, design and development, external providers, production and service provision, release and nonconforming outputs. Customer focus and satisfaction run through the rest.

Environment: aspects and compliance obligations

ISO 14001 requires what your activities, products and services do to the environment. It turns on two registers: environmental aspects and impacts, assessed with a life cycle perspective to find the significant ones, and compliance obligations, the legal and other requirements you are bound by or adopt. Controls, emergency preparedness and the evaluation of compliance follow from them.

Occupational health and safety (OH&S): hazards, workers and contractors

ISO 45001 requires who could be harmed and what prevents it: ongoing hazard identification and risk assessment, the hierarchy of controls, management of change, and control of contractors and outsourced work. Consultation and participation of workers, non-managerial workers included, has no counterpart in the other two, and its improvement clause covers incidents too.

Mapping table: one shared requirement, three applications

Where a row reads alike, write the process once; where it differs, the difference belongs inside that process.

One document set, one internal audit programme, one management review

The document set

Write shared processes once: document control, competence, communication, change, internal audit, management review, incidents and corrective action. Keep one policy, but check that it carries every commitment each standard expects; a combined policy that drops worker consultation or pollution prevention fails the standard that asked for it. Keep registers apart where methods differ, though one legal register by site can serve environment and OH&S. ISO 9001 does not require documents to follow its clause numbers; our documentation guide sets out its minimum.

The internal audit programme

Plan by process and site so that one trail runs through all three: at dispatch, the order check, the packaging waste and the lifting risk are one conversation. The team needs every discipline between its members, and sampling should favour significant aspects, high-risk work and customer-critical processes; see our internal audit guide.

The management review

One meeting serves all three if the agenda carries every required input: customer satisfaction and product conformity; compliance evaluation and significant aspects; incidents, worker consultation and legal compliance. Our management review guide covers the record.

The combined audit: how certification bodies plan it

ISO 19011 calls an audit of several management systems at one organisation a combined audit. Accredited certification bodies plan it under IAF MD 11, which speaks of the audit of an integrated management system and asks at application how far your documents, system elements and responsibilities are shared.

• Audit time. The body adds the time each standard would need alone, then adjusts: down for genuine integration, for staff who can answer on more than one standard and for auditors competent in several; up for added complexity. The rules limit the reduction and require the reasons to be recorded.
• The team. Competence is judged for the team as a whole, across each technical area of each standard. Check that the body is accredited for all three in your sector; see choosing an ISO 9001 certification body.
• The visits. A standard certified for the first time still needs Stage 1 and Stage 2; if ISO 9001 is already certified, ask whether the new standards can join its next surveillance visit.
• The findings. One integrated report, each finding traceable to its standard. A nonconformity against a shared requirement applies to the whole system; a standard-specific one, to that standard only.

Auditor days fall because shared processes are no longer examined three times, but the larger saving is your own: one preparation and, once the cycles align, one visit a year, as our surveillance and recertification guide explains.

Adding ISO 14001 and ISO 45001 to a certified ISO 9001 system

If you hold ISO 9001, the frame exists; what remains is content and reach.

1. Extend context, interested parties and scope to the environment, workers and contractors, and set each certificate's scope.
2. Build the aspects register, the hazard register and one legal register by site, consulting workers from the start.
3. Widen policy, objectives, competence, communication, change, emergencies and incidents.
4. Retrain internal auditors, then complete one integrated audit cycle and management review.
5. Ask a certification body accredited for all three to plan the combined audit.

Integrating ISO 9001, ISO 14001 and ISO 45001: questions buyers ask