One operating system, several standards

PRACTICAL GUIDANCE

The starting point

An integrated management system can connect common governance and evidence while preserving the distinct requirements of quality, environment, health and safety, information security, privacy or AI management.

Choose integration for a practical reason

ISO management system standards use a harmonised structure that supports integration. That shared architecture does not make the standards interchangeable or remove their subject-specific requirements.

Our recommended starting point is the work people perform. If the same team manages suppliers across quality, security and privacy, a coordinated supplier process may reduce duplicated requests and conflicting decisions. If the activities, owners or boundaries differ, a single combined form may add complexity instead. Integration should make decisions easier to understand and evidence easier to follow.

Identify what can be shared

Potential common processes include document control, competence, internal audit planning, management review, corrective action and change management. Define the shared process once where that is practical, then show how each standard’s needs are addressed.

For example, a common corrective action system can record findings from several standards while keeping the relevant requirement, cause, owner and effectiveness test visible. A combined management review agenda can support coordinated decisions, provided important subject-specific information is not lost in a short generic discussion.

Keep the different risk questions visible

Quality, environmental, health and safety, security, privacy and AI assessments ask different questions. Our recommendation is to share underlying facts while preserving the appropriate assessment method and expertise.

A new cloud service might change delivery performance, information security, privacy and AI-related risks. One change record can coordinate the work, but a single numerical score may conceal different consequences and decision authorities. Record who reviewed each relevant question and how conflicts were resolved. Do not assume that one person is competent to assess every discipline.

Build an evidence map rather than duplicate documents

A practical mapping table can connect each requirement or internal criterion to the responsible process, owner and evidence location. The purpose is traceability, not to reproduce copyrighted standards text.

Test the map with a real example. Follow a supplier approval, product change or incident through the system and ask whether each relevant perspective is visible. Use links to controlled records instead of copying the same evidence into several folders. Where access restrictions differ, preserve them rather than making sensitive material available to everyone involved in the integrated system.

Plan audits around competence and coverage

A combined audit can examine more than one management system together. Integration does not remove the need for suitable competence, sufficient evidence or clear criteria for each conclusion.

Our suggested internal audit plan identifies shared processes and the subject-specific work that still needs examination. Discuss any combined certification programme with the certification body. Do not assume a fixed reduction in audit time or cost simply because documentation is integrated; the applicable rules and the actual degree of integration need assessment.

Start with one process and learn

A manageable first project is often a shared process with obvious duplication, such as supplier review or corrective action. Agree owners, align terminology, map the relevant requirements and run a pilot on a small but representative sample.

Ask users whether the change reduces repeated work without hiding important decisions. Check that records remain understandable to someone outside the project. Expand only after resolving the practical issues. A single large manual is not the goal; a coherent way of operating and improving the organisation is.

Related guidance and practical next steps