Services
Integrated Management Systems
Combined certification audits for organisations running one integrated system across several ISO standards, applying IAF MD 11 principles.
- Assessment of the level of integration under IAF MD 11
- Audit time calculated for the combined system
- Alignment of certification cycles where practical
- Audit team with competence across the relevant standards
Overview
Combined audits for several ISO standards
Many organisations run quality, environmental, health and safety, information security or other requirements through a single integrated management system. Most ISO management system standards share a common harmonised structure, with similar clauses on context, leadership, planning, support, operation, performance evaluation and improvement, which makes integration practical. Running one system can reduce duplicated documents, meetings and internal audits, and gives management a single view of risks and performance across disciplines.
Where a system is genuinely integrated, an integrated audit assesses it against several standards at the same time. We apply the principles in IAF MD 11, which covers the application of ISO/IEC 17021-1 to audits of integrated management systems. It explains how audit time is calculated and when a reduction is appropriate, depending on the degree of integration and the competence of the audit team.
An integrated audit reduces duplication and disruption, with shared elements such as document control, internal audit and management review assessed once in a combined way. Each standard still receives sufficient attention, and separate certificates, or a combined certificate listing each standard, are issued so that customers can see exactly what is certified. Findings in the report are referenced to the relevant standard so that responsibilities for corrective action remain clear.
How it works
Integrated Management Systems, step by step
Every stage is planned and confirmed with you in advance, so your team knows exactly who is coming, when, and what they need to see.
- 1
Integration assessment
We review how far your system is integrated, including documentation, internal audit, management review, objectives and responsibilities, to determine audit time under IAF MD 11.
- 2
Programme alignment
Where certificates have different dates, we agree how cycles can be aligned so that the standards can be audited together.
- 3
Integrated audit
A team with competence across the standards audits shared and specific requirements in a single combined visit.
- 4
Reporting
You receive one report that identifies clearly which standard each finding relates to, supporting focused corrective action.
- 5
Certification
Independent decisions are made for each standard and certificates are issued showing the scope covered by each one.
- Organisations certified, or seeking certification, to two or more standards
- Businesses running quality, environment and safety as one system
- Technology firms combining ISO/IEC 27001 with ISO/IEC 20000-1 or ISO 22301
- Contractors asked for ISO 9001, ISO 14001 and ISO 45001 in tenders
- Groups looking to reduce audit days and disruption
Available for
Integrated Management Systems for every standard
This service is available for every standard we certify. Choose one to learn more.
Quality
ISO 9001:2026Quality Management
ISO 9001:2026 sets out the requirements for a quality management system. Published in September 2026, it replaces ISO 9001:2015 and keeps the same core approach. It asks an organisation to understand its context and interested parties, plan its processes around risks and opportunities, and show that it consistently provides products and services that meet customer and applicable statutory and regulatory requirements. It is the most widely used management system standard and applies to organisations of any size or sector, from sole manufacturers to national service providers.
- Meet tender and supplier requirements
- Consistent processes
- Fewer errors and complaints
- Risk-based planning
Environment & Energy
ISO 14001:2026Environmental Management
ISO 14001:2026, published in April 2026 to replace the 2015 edition, specifies the requirements for an environmental management system. It helps an organisation identify the environmental aspects of its activities, products and services, understand its compliance obligations, and manage significant impacts through planning, operational control and evaluation. The standard takes a life cycle perspective, so organisations consider stages they can control or influence, such as purchasing, transport, use and end-of-life treatment, as well as their own sites.
- Supply chain and tender credibility
- Structured legal compliance
- Control of significant impacts
- Resource and waste efficiency
Health & Safety
ISO 45001:2018Occupational Health and Safety Management
ISO 45001:2018 sets out requirements for an occupational health and safety management system. Its aim is to prevent work-related injury and ill health and to provide safe and healthy workplaces. The standard places strong emphasis on leadership, the consultation and participation of workers, hazard identification and the hierarchy of controls. It replaced OHSAS 18001 and follows the Harmonized Structure, so it integrates readily with ISO 9001 and ISO 14001.
- Prequalification and tenders
- Worker involvement
- Systematic hazard control
- Clear legal oversight
Information & Technology
ISO/IEC 27001:2022Information Security Management
ISO/IEC 27001:2022 specifies requirements for an information security management system (ISMS). It requires an organisation to assess information security risks to the confidentiality, integrity and availability of information, select controls to treat them and manage those controls through a continual cycle of monitoring and review. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Each organisation compares its chosen controls against Annex A and records the outcome in a Statement of Applicability.
- Answer security questionnaires
- Risk-based security
- Supports data protection duties
- Management oversight
Environment & Energy
ISO 50001:2018Energy Management
ISO 50001:2018 specifies requirements for an energy management system (EnMS). It requires an organisation to understand how it uses and consumes energy, identify significant energy uses, set an energy baseline and energy performance indicators, and plan actions to improve energy performance. Unlike some other management system standards, ISO 50001 requires an organisation to demonstrate continual improvement in energy performance itself, not only in the management system.
- ESOS compliance route
- Measured energy performance
- Focus on significant uses
- Cost control
Resilience & Governance
ISO 22301:2019Business Continuity Management
ISO 22301:2019 specifies requirements for a business continuity management system (BCMS). It helps an organisation prepare for, respond to and recover from disruptive incidents when they occur. The core of the standard sits in clause 8, which requires a business impact analysis and risk assessment, business continuity strategies and solutions, documented plans and procedures, an exercise programme and evaluation of business continuity capability. It follows the Harmonized Structure and integrates with other management system standards.
- Evidence for customers
- Clear recovery priorities
- Tested plans
- Understanding dependencies
Sector-specific
ISO 22000:2018Food Safety Management
ISO 22000:2018 specifies requirements for a food safety management system for any organisation in the food chain, from feed and primary production through processing, storage, transport, retail and food service, as well as packaging and equipment suppliers. It combines the Harmonized Structure management system clauses with HACCP principles from Codex Alimentarius, prerequisite programmes (PRPs) and interactive communication across the food chain. The standard uses two linked Plan, Do, Check, Act cycles: one for the management system and one for operational hazard control.
- Structured hazard control
- Applies across the food chain
- Management system discipline
- Communication across the chain
Sector-specific
ISO 13485:2016Medical Devices Quality Management
ISO 13485:2016 specifies requirements for a quality management system where an organisation needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements. It applies to manufacturers and to organisations involved in other stages of the device life cycle, such as design, distribution, installation, servicing, sterilisation and component supply. The standard places particular emphasis on risk management, process validation, traceability and regulatory reporting.
- Supports regulatory submissions
- Supply chain requirements
- Risk management throughout
- Validated processes
Information & Technology
ISO/IEC 20000-1:2018IT Service Management
ISO/IEC 20000-1:2018 specifies requirements for establishing, implementing, maintaining and continually improving a service management system (SMS). It covers the planning, design, transition, delivery and improvement of services to meet agreed requirements. Clause 8 sets out the operational processes, grouped into service portfolio, relationship and agreement, supply and demand, service design, build and transition, resolution and fulfilment, and service assurance. The 2018 edition follows the Harmonized Structure, which allows integration with ISO/IEC 27001 and ISO 9001.
- Procurement credibility
- Consistent service delivery
- Clear service agreements
- Controlled change
Information & Technology
ISO/IEC 42001:2023Artificial Intelligence Management
ISO/IEC 42001:2023 is the first international management system standard for artificial intelligence. It specifies requirements for establishing, implementing, maintaining and continually improving an AI management system (AIMS) within an organisation that develops, provides or uses AI systems. It requires AI risk assessment, AI risk treatment and AI system impact assessment, considering effects on individuals, groups and society. Annex A provides reference controls covering areas such as AI policy, resources, impact assessment, the AI system life cycle, data and third-party relationships.
- Evidence of responsible AI governance
- Structured risk and impact assessment
- Clear roles and accountability
- Life cycle controls
Resilience & Governance
ISO 37001:2025Anti-Bribery Management
ISO 37001 specifies requirements for an anti-bribery management system. It helps an organisation prevent, detect and respond to bribery, whether by the organisation, its personnel or business associates acting on its behalf, and bribery of the organisation. Requirements include an anti-bribery policy, top management and governing body oversight, an anti-bribery compliance function, bribery risk assessment, due diligence, financial and non-financial controls, gifts and hospitality controls, and processes for raising and investigating concerns. The second edition, ISO 37001:2025, was published in February 2025.
- Supports adequate procedures
- Risk-based controls
- Due diligence on third parties
- Clear governance oversight
FAQs
Integrated Management Systems: your questions
What makes a management system integrated?
An integrated system uses shared processes and documentation to meet the requirements of more than one standard. Typical indicators include a single set of documented information, combined internal audits, one management review covering all standards, joint objectives and consistent responsibilities. The more of these elements are shared, the higher the degree of integration.
Does an integrated audit take less time?
It can. IAF MD 11 allows a reduction in total audit time where the system is integrated and the audit team is competent across the standards. The reduction depends on the level of integration and is calculated from the time that would be required for each standard separately. A system that is only partly integrated will see a smaller reduction.
Which standards can be combined?
Any of the management system standards we certify can be combined where they apply to the same organisation and scope, for example ISO 9001, ISO 14001 and ISO 45001, or ISO/IEC 27001 with ISO 22301 and ISO/IEC 20000-1. Some sector standards have specific rules, which we will explain when planning the audit.
Will we receive one certificate or several?
This depends on your preference and the standards involved. Many customers prefer separate certificates for each standard, because tender documents often ask for them individually. Each certificate states its own scope, which may differ between standards where, for example, a site is covered by one standard but not another.
Our certificates have different expiry dates. Can we still integrate?
Yes, over time. Cycles can be aligned by bringing forward a recertification audit or by adjusting the timing of surveillance so that standards are audited together. Alignment must stay within the rules of ISO/IEC 17021-1, so we will agree a practical plan with you rather than changing dates in a single step.
Are scopes the same for every standard?
Not necessarily. An integrated audit can cover standards with different scopes, for example where ISO/IEC 27001 covers only the IT function while ISO 9001 covers the whole organisation. Each certificate states its own scope and, where relevant, its sites, so customers can see exactly what each standard covers.
Do we have to integrate to have several certificates?
No. You can hold several certificates with separate systems and separate audits. Integration is a choice that suits some organisations better than others. Where systems are separate, audits can still be scheduled together for convenience, although the time reduction available for integrated systems will not apply.
Can you help us integrate our existing systems?
We cannot design or implement integration for organisations we certify, as that would be consultancy and would compromise impartiality. We can explain how IAF MD 11 assesses integration and how this affects audit time. The decisions on how to combine processes and documentation rest with your own team or an independent adviser.
Certificate verification
Check a Hexa certificate
Need to know whether a supplier's certificate is current? Customers, buyers and other interested parties can ask us to confirm the details held in our records.
We confirm the organisation name, certificate number, ISO standard, certified scope, status, and issue and expiry dates.
More services
Explore our other services
- Initial CertificationIndependent Stage 1 and Stage 2 certification auditsLearn more
- Surveillance AuditsAnnual audits that keep your certificate validLearn more
- Recertification AuditsRenew your certificate for a further three-year cycleLearn more
- Certificate TransferMove an existing accredited certificate to HexaLearn more
- Pre-assessmentAn optional readiness check before certificationLearn more
- Management System TrainingPublic awareness and internal auditor coursesLearn more
- Certificate VerificationConfirm a Hexa certificate is genuine and currentLearn more
Start your certification
Get a fixed, three-year certification quote
Tell us about your organisation and the standards you need. We will confirm audit days, scope and dates in writing, with no obligation.