PRACTICAL GUIDANCE
What this review is for
Review shared management processes together while keeping each standard’s specific obligations visible. An integrated audit follows how the organisation actually works across quality, environment, safety, security, privacy or AI governance.
Who this is for. For teams operating two or more management systems, consolidating duplicated controls, or checking whether an integrated system has preserved the specialist detail it needs.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Map the standards, editions, organisational boundaries and activities included in the proposed audit.
- Identify genuinely shared processes, such as document control, management review and corrective action.
- Keep distinct risk methods and technical obligations visible where integration would otherwise hide them.
- Trace cross-functional workflows, including procurement, change management and incident escalation.
- Report a finding once where appropriate, while identifying each applicable criterion and affected process.
Evidence to prepare
- Each management-system scope and a map of where their boundaries differ.
- An integrated or coordinated audit programme and responsibilities matrix.
- Shared policies, review arrangements and document-control processes.
- Standard-specific evidence, such as environmental aspects, safety controls or information-security risk treatment.
- Examples of changes or incidents involving several disciplines.
What the review is intended to produce
- A coverage matrix showing shared and standard-specific audit criteria.
- An integrated audit plan organised around operational processes.
- A report that connects cross-cutting issues without losing the relevant requirement.
- A consolidated action register with distinct specialist responsibilities.
- Recommendations on where coordination helps and where separate controls remain necessary.
How the work is structured
Map the real boundaries
Check which entities, sites and activities belong to each system. Similar policy wording does not prove equivalent scope.
Plan connected sampling
Choose workflows that expose handovers and dependencies. Add specialist sampling for matters that a general process audit cannot establish.
Evaluate shared and distinct controls
Test common arrangements once where the evidence supports it, while recording the conclusions needed for each applicable standard.
Assign clear ownership
Give cross-functional actions an accountable owner and named contributors. Integration should make decisions clearer, not leave them between departments.
Service boundaries
- Certification audits are carried out by independent certification bodies, ideally accredited by UKAS. ISOaudit does not issue certificates and is independent of ISO, UKAS and certification bodies.
- Integration does not automatically reduce certification audit time or produce a single certificate. Certification bodies determine their own arrangements and applicable reductions.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Which combinations are useful?
Quality, environment and occupational health and safety often share operational workflows. Security, privacy and AI governance can share information and technology controls. Suitability depends on your activities and system boundaries.
Can we replace every risk register with one?
A common register can help oversight, but it must preserve the different evaluation methods and information needed by each discipline. Combine only where clarity and control are maintained.
Do integrated audits require specialist competence?
Yes. Coverage of several standards does not remove the need for competence in the activities and technical subjects being assessed. The proposed team and scope should reflect those needs.
FICTIONAL WORKED EXAMPLE
Fictional example: sharing a process without losing specialist criteria
A fictional organisation uses one supplier-onboarding process for quality, information security and privacy. This educational scenario is not evidence of a real integrated system.
| Criteria to establish | Agree each management-system scope, applicable licensed criteria and relevant internal supplier rules. Shared document handling does not make the different risk questions interchangeable. |
|---|---|
| Evidence and sample | Trace a selected supplier through the common onboarding record and the distinct quality, security and privacy decisions. State the competence and access limitations of the review. |
| What the evidence shows | The fictional common form records commercial approval, but the evidence does not identify who considered the data-processing responsibilities. A shared approval does not establish that every specialist question was answered. |
| Next step | Locate or obtain the relevant decision, map it to the accountable owner and criteria, and preserve separate conclusions where needed. Check that any revised common workflow remains understandable to each discipline. |
An integrated internal audit does not automatically reduce certification days or establish competence across every specialist subject.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
- ISO: guidance on auditing management systems
- Global ACI: current technical documents for certification bodies
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.