In brief: An Integrated Management System (IMS) brings together in a single structure the ISO 9001 (quality), ISO 14001 (environment), and ISO 45001 (occupational health and safety) standards. Instead of three separate systems that overlap, you have common documentation, a single team managing it, and in many cases a single audit. The technical key that makes this possible is the high-level structure (Annex SL) shared by all ISO management standards. This article covers what it integrates, why it fits, what advantages and challenges it brings, and how to implement and certify it step by step.
What is an Integrated Management System (IMS)?
An Integrated Management System is the way to manage several disciplines — quality, environment, and occupational safety, for example — within a single working framework, with shared policies, processes, records, and responsibilities where it makes sense to share them. The underlying idea is simple: many of the things one ISO standard requires are also required by another. If you need to document who is responsible for what, how you control your documents, how you manage nonconformities, or how you conduct internal audits, you do not need to write that three times.
In practice, when I talk about an IMS with a client I am almost always referring to the combination of ISO 9001, ISO 14001, and ISO 45001, because these are the three most widely adopted management standards and because they cover three fronts that coexist in virtually any organisation: the quality of what you deliver, your environmental impact, and the safety of the people who work with you. An IMS is not a new certificate or a separate standard. It is a way of organising work so that those three certifications can coexist without duplicating effort.
Which standards does an IMS integrate?
The three standards that form the core of most integrated systems are these:
ISO 9001 (quality)
This is the quality management standard. It focuses on keeping your processes under control, on customer satisfaction, and on continuous improvement of what you do. For a deeper look, I wrote a complete guide on ISO 9001 covering the full implementation and certification process.
ISO 14001 (environment)
This is the environmental management standard. It is used to identify and control the environmental aspects of your operations (waste, consumption, discharges, emissions) and to comply with the legislation that applies to you. You will find the detail in my guide on ISO 14001, and if you are unsure which of the two to choose I clarify the difference between ISO 9001 and ISO 14001.
ISO 45001 (occupational health and safety)
This is the occupational health and safety management standard. Its objective is to prevent injuries and deterioration of workers' health through hazard identification and occupational risk assessment. It is worth noting that ISO 45001 replaced the former OHSAS 18001, which is now obsolete. If you still hold a certification based on OHSAS, migrating to ISO 45001 is the natural next step.
Why these standards can be integrated
The reason these three standards fit together so well is not coincidence. All ISO management system standards share the same backbone, known as the high-level structure (also called Annex SL or, in its more recent version, the harmonised structure). That structure defines the same ten clauses for any management standard: organisational context, leadership, planning, support, operation, performance evaluation, and improvement, among others.
This means that clause 7 of ISO 9001 (resources, competence, documentation) requires essentially the same as clause 7 of ISO 14001 and ISO 45001. The leadership and management commitment requirements are common. Nonconformity and corrective action management follows the same logic across all three. When two or more standards share 60 to 70 per cent of their skeleton, building a unified system stops being a trick and becomes the sensible approach.
There is another layer that is also common: risk-based thinking. All three standards ask you to identify risks and opportunities — they just each look at their own. ISO 9001 looks at risk to quality and the customer, ISO 14001 looks at environmental risk, and ISO 45001 looks at risk to people's safety. Integrating them gives you something valuable: an organisation-wide risk view in a single analysis, rather than three partial snapshots.
Comparison of the three standards
| Aspect | ISO 9001 | ISO 14001 | ISO 45001 |
|---|---|---|---|
| What it manages | Quality | Environment | Occupational health and safety |
| Main objective | Customer satisfaction and process improvement | Reducing environmental impact and legal compliance | Preventing workplace accidents and illness |
| Who it protects or benefits | Customer and organisation | The environment and community | Workers |
| Core control element | Processes and product/service | Environmental aspects | Hazards and occupational risks |
| Common structure | High-level structure (Annex SL): same 10 clauses and risk-based approach | ||
| Origin | Revisions since 1987 | Since 1996 | Replaces OHSAS 18001 |
Advantages of having an integrated system
When I help a business move from three standalone systems to one integrated system, these are the advantages that stand out most:
- Single documentation. One integrated policy, a single manual or set of common procedures, one document control system. No more three versions of the same procedure that did not say the same thing.
- One audit. Both internal and external audits can be planned on a combined basis. Instead of three audit weeks per year, the auditor reviews the common requirements once and then addresses what is specific to each standard.
- Fewer duplications. Shared records, joint management review meetings, one nonconformity process. Less paperwork and less time wasted maintaining parallel systems.
- Global risk view. Quality, environmental, and safety risks are analysed in the same exercise. That helps management see the full picture and prioritise better, because sometimes a decision that improves quality worsens safety — and integration surfaces that earlier.
- More consistent messaging. Teams no longer receive contradictory instructions from three separate managers. There is one system and one way of working.
I do not want to sell you only the positives, so I will also tell you the challenges.
The challenges of integration
Integration is neither free nor immediate. These are the obstacles I encounter most often:
- The start-up costs more. Redesigning three systems to merge them into one requires greater initial effort than maintaining each separately. The savings come later, not in the first month.
- You need profiles that understand all three areas. Quality, environment, and occupational risk prevention are disciplines with their own regulations. Whoever manages the IMS must be comfortable across all three or rely on specialists.
- Risk of diluting specifics. If integration is done poorly, you can end up with a system so generic that it loses the detail each standard demands. For example, the occupational risk assessment under ISO 45001 has its own legal requirements that cannot be simplified to fit a common template.
- Resistance to change. People who have managed their quality system for years may view merging it with environmental and safety management with suspicion. Managing that change is as important as the documentary side.
How to implement an IMS step by step
- Initial diagnosis. I review what is already in place. Many organisations come to me with ISO 9001 implemented and want to add the other two. I compare the current situation with the requirements of all three standards and identify the real gap.
- Context and stakeholder analysis. Since all three standards ask for the same thing in clause 4, this analysis is done once for the whole system: who are your customers, neighbours, workers, and regulators, and what does each expect.
- Legal requirements identification. Here each standard goes its own way. You compile quality legislation where applicable, environmental legislation, and occupational risk prevention legislation. This is one of the points where keeping things separate matters most.
- Integrated risk assessment. Environmental aspects, occupational hazards, and process risks are identified. Each with its own method, but within the same analytical framework to get the full picture.
- Common documentation design. Integrated policy, objectives, shared procedures (document control, internal audit, nonconformities) and the specific ones each standard requires.
- Implementation and training. The system is brought to the workplace. People need to know what changes in their daily work, because an IMS that only lives in a folder is useless.
- Internal audit. Before contacting the certification body, you verify that the system is working. If you want to understand this phase well, I recommend my guide on ISO internal auditing.
- Management review. Management reviews the system's results and decides on improvements. In an IMS, this review is joint for all three standards.
If you prefer not to go through this alone, this is precisely the kind of project for which I offer ISO consultancy to ensure integration goes right the first time.
The integrated audit and certification
Once the system is running, certification follows. It is carried out by an independent external certification body, which must be accredited. In Spain that accreditation is granted by ENAC. Having a body accredited by ENAC is what gives your certificate validity and recognition, so it is worth confirming before signing a contract.
The certification audit for an integrated management system runs in two stages. In stage 1 the auditor reviews your documentation and checks you are ready. In stage 2 the auditor visits your premises and verifies that what the paperwork says is actually happening on the ground. The great advantage of an IMS is that this audit can be combined: the auditor evaluates common requirements once and then spends the remaining time on what is specific to each standard. This typically reduces audit days compared to certifying all three separately.
After the initial certification, which is valid for three years, there are annual surveillance audits and a renewal audit at the end of the cycle. The integrated logic is maintained here too, which lightens the maintenance burden year after year.
Common mistakes when building an IMS
- Copy-paste between standards. Integration is not duplicating the same text with the word "quality" replaced by "environment." Each specific requirement has its reason for being and must be respected.
- Forgetting your own legal requirements. Environmental and occupational risk prevention legal compliance cannot be treated lightly. These are obligations that exist whether or not you hold the certificate.
- Building a system only for the auditor. If the IMS is not used day-to-day and only gets dusted off the week before the audit, it adds nothing and it shows.
- Jumping to integration without a diagnosis. Rushing to merge three systems without knowing what parts you have leads to rework. The initial diagnosis saves many hours.
- Choosing a certification body without recognised accreditation. A certificate from a body not accredited by ENAC may not be accepted when a client or a public tender requires it.
Conclusion
An integrated management system combining ISO 9001, ISO 14001, and ISO 45001 lets you manage quality, environmental impact, and worker safety with a single set of documentation, a complete risk view, and in many cases a single audit. The initial effort is greater, but the time savings and coherence you gain afterwards more than compensate. If you are considering integrating your systems or starting with all three at once, tell me your situation and we will find the shortest path together.