How to integrate ISO 9001, ISO 14001 and ISO 45001, step by step from three systems to one

Home / Integrated Management Systems course / How to integrate

Integrated management systems, step by step

By Mthokozisi Nkosi, ASC Food Safety Consultants, 6 November 2026

Integration fails in two predictable ways. Some sites staple three manuals together and call it an IMS, so nothing changes except the cover page. Others force everything into one method, so the environmental aspects get scored like customer complaints and the OH&S hazards lose the hierarchy of controls. The plan below avoids both. It is the plan ASC’s integrated course teaches, set out in the order you would do it on a real site. If you want the definitions first, read what an integrated management system is. If you are building one standard on its own, see how to implement ISO 14001 or how to implement ISO 45001.

Step 1. Run one gap assessment against all three standards

Take every harmonized structure clause from 4.1 to clause 10 and record, for each of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, the status and the evidence. Show the ISO 45001 clause number wherever it differs, for example management of change in 8.1.3 instead of 6.3, and worker consultation in 5.4. One gap assessment shows you what already works for one standard and can be extended, which is usually more than people expect, and what has to be built from nothing.

Step 2. Plan the project backwards from the combined Stage 2 date

Pick the week you want the combined Stage 2 audit, then work backwards. Certification bodies usually expect at least one full cycle of internal audits and a management review before Stage 2. That is their practice rather than a requirement of the standards, but ISO/IEC 17021-1 has Stage 1 check that internal audits and management reviews are planned and performed, so in effect it sets your calendar. The case site in ASC’s course, a food plant of 400 people that holds FSSC 22000 and no other certificate, plans it like this.

Your dates will differ with the size of the site and how much time the process owners can give, but the shape holds. The run period is what most plans underestimate.

Step 3. One context, one scope, one process map

Write one register of internal and external issues, marked against the standards each one affects, and one list of interested parties with what each requirement becomes under each standard. A retailer’s demand is a quality requirement. A municipality’s trade effluent permit is a compliance obligation. A labour broker’s workers are workers for ISO 45001, whatever their contract says. Then write one scope statement, with any ISO 9001 applicability decisions justified, and one set of process cards that carry quality controls, environmental aspects and OH&S hazards side by side. Finish with one responsibility matrix that includes the legal appointments, such as the section 16(2) assignments under the OHS Act.

Step 4. One policy that keeps every commitment

None of the three standards requires a separate policy document. Each requires a set of commitments, and an integrated policy has to keep all of them by name. Test yours against this list before anyone signs it.

The last two are the ones that fall out first when a quality policy is stretched to cover the other standards. A certification auditor will look for them by name.

Step 5. One register for risks, aspects and hazards, and one legal register

Put quality risks and opportunities, environmental aspects and OH&S hazards on one page with shared IDs and owners. Keep a method for each. Aspects need significance criteria, including abnormal and emergency conditions. Hazards need a risk assessment and controls chosen by the hierarchy of controls. Quality risks need their own criteria, often likelihood and consequence, because ISO 9001 sets no method. Our guides to aspects registers and significance scoring and to HIRA registers that hold up show each method.

Then build one register for statutory and regulatory requirements, compliance obligations, and legal requirements and other requirements, with an owner and an evaluation frequency for each line. On a South African site the environmental lines come from NEMA and the specific environmental management Acts, the National Water Act, municipal by-laws and permits. The OH&S lines come from the OHS Act 85 of 1993, its regulations and the COID Act. The quality lines come from the product law the site answers to, which on a food site includes the food premises hygiene regulations R638 of 2018, the foodstuffs labelling regulations and the Legal Metrology Act 9 of 2014 for the quantity in the pack. Where FSSC 22000 sits beside the IMS, as it does on the course’s case site, the food safety system needs the same food law lines, so keep one list that both systems use.

Step 6. Objectives on one plan

Put quality, environmental and OH&S objectives on one plan. Tie each to a policy commitment, and give it an indicator, resources, an owner, a date and a statement of how the result will be evaluated. One plan makes it obvious when one discipline has five objectives and another has none.

Step 7. Support, competence and documents

Run one competence matrix, one awareness programme, one communication plan and one document control. Go through the existing documents and decide for each one whether to keep it, merge it or retire it. Most sites that integrate end with fewer documents than they started with, which is the point.

Step 8. Operational controls and one emergency plan

Set controls by process or area, with criteria and records, so the operator sees one set of instructions covering the product, the environment and his or her own safety. Write one emergency plan for people, the environment and continuity of supply, with realistic scenarios such as an ammonia release, a chemical spill reaching stormwater or a fire in the dispatch area, a drill plan and a list of who is trained. Bring contractors and management of change into the same controls.

Step 9. Monitor, audit, review and correct as one system

Monitor and measure for all three, and evaluate compliance with the legal register. Plan a twelve month programme of combined internal audits, with objectives, criteria and scope for each audit, and consult workers on the programme as ISO 45001 expects. On a South African site, health and safety representatives are also entitled under section 18(2)(f) of the OHS Act to take part in any internal health or safety audit, so plan for them. The ISO 9001:2026 Internal Auditor, ISO 14001:2026 Internal Auditor and ISO 45001:2018 Internal Auditor courses, R3 850 each on a limited period special, train the people who run those audits. Hold one management review whose agenda carries every input each standard requires, and check before the meeting which inputs are still empty. Take nonconformities, complaints, environmental incidents and OH&S incidents through one corrective action process, to root cause, extent and a checked corrective action, with workers involved in investigating incidents. One record is fine if it still gives you what the law asks for, such as the section 24 report and the Annexure 1 incident record under the OHS Act and its General Administrative Regulations, and the reports section 30 of NEMA requires after an emergency incident.

Step 10. Prepare for the combined certification audit

Choose a certification body accredited for all three standards, and ask how it audits combined systems under Global ACI-TECH-3-008, formerly IAF MD 11. It will decide the audit time, and how far that time can change with the level of integration, so do not budget on a saving nobody has offered you. Make sure the system is on the current editions. Initial certifications are to ISO 14001:2026 only from 31 October 2027, and to ISO 9001:2026 only from 31 March 2028. ISO 45001 is audited to the 2018 edition with Amendment 1:2024. Its revision is expected in 2027, and a transition period will be set when it is published. Our guides to the ISO 14001:2026 transition deadline and the ISO 9001:2026 transition plan go through each transition. If you will lead combined audits of suppliers or for a certification body, the ISO 9001:2026 Lead Auditor, ISO 14001:2026 Lead Auditor and ISO 45001:2018 Lead Auditor courses each cover integrated audits in Module 1.

We already hold ISO 9001. How do we add ISO 14001 and ISO 45001?

Start with the single gap assessment in Step 1. Then extend the shared processes you already run, document control, internal audit, management review and corrective action, so that they carry the environmental and OH&S requirements too. The aspects register, the hazard identification and risk assessment and the legal register are new work, and each keeps its own method. The worst move is to copy the quality procedures and change the word quality to environment.

The mistakes that show up at Stage 2

• A stretched quality policy with no commitment to eliminate hazards or to consult workers.
• One risk matrix forced onto aspects, hazards and quality risks.
• Two partial legal lists and a missing third.
• An audit programme that covers one standard properly and the other two in passing.
• Incidents, complaints and inspector’s notices still kept in separate logs.
• A management review agenda missing inputs that one standard requires.

Each of these is a finding waiting to be written, and each is easier to prevent in Step 3 or Step 4 than to fix in the month before Stage 2.

How the ASC course follows this plan

FS82 has you build the plan above in the IMS Workbench, one tab per output, on Mzansi Fresh Meals, a training case of a chilled ready meals plant in Kempton Park building one system beside its FSSC 22000 certificate.

Lesson 2.6 tests the integrated policy of Step 4 against every commitment by name. Three video proctored practical stages and a video proctored final test the judgements behind the tabs. Everything is marked automatically at 70 percent, with three attempts on every check, case study, practical stage and the final, and the games can be replayed as often as you like.

Questions people ask

Sources

• ASC Food Safety Training, Integrated Management Systems FS82, course page
• UKAS, publications update August 2026, Global ACI-TECH-3-008 replaces IAF MD 11
• Department of Standards Malaysia, ACB Circular 5/2026, transition to ISO 14001:2026
• Global ACI, documents library, transition documents for ISO 9001:2026 and ISO 14001:2026
• ISO, The integrated use of management system standards (IUMSS) handbook