شارك هذا المقال
ISO 9001, ISO 14001 and ISO 45001 can be certified in a single audit against a single management system, and that is how most organizations holding all three arrange it. The standards share a common high-level structure, so leadership, competence, documented information, internal audit and management review are sampled once across the whole system rather than three times. Each standard's own subject matter is still audited in full against its own clauses, and the certification decision is taken for each standard on its own file. An integrated audit shortens the path through the clauses the three standards hold in common. It does not reduce three standards to one set of evidence.
What is shared, and what is not
The shared part is the frame around the system. Clauses 4.1 and 4.2 are worded almost identically in all three, which is why the February 2024 climate change amendment landed in the same place in each of them. Clause 5 leadership, 7.2 competence, 7.5 documented information, 9.2 internal audit, 9.3 management review and 10.2 nonconformity and corrective action are common ground, and ISO 45001 extends that last one to incidents. One internal audit program covering all three standards, one competence matrix and one management review meeting are all normal, and they are audited once.
The standard-specific part is where an integrated system is most often thin. ISO 14001 requires environmental aspects and impacts determined under clause 6.1.2, compliance obligations identified under 6.1.3, and those obligations evaluated under 9.1.2. ISO 45001 requires hazard identification under 6.1.2, the hierarchy of controls under 8.1.2, and, under clause 5.4, consultation and participation of non-managerial workers, which auditors verify by interviewing those workers directly rather than by reading the procedure that says it happens. ISO 9001's clause 8 covers design and development, control of externally provided processes, and production and service provision, and none of it appears in the other two standards.
The finding auditors raise
The common failure is a single risk register. An organization integrates its system, builds one table of risks and opportunities under clause 6.1, and enters supplier delay, staff turnover, a diesel spill and working at height in it side by side. ISO 9001's clause 6.1 is satisfied by that. ISO 14001's clause 6.1.2 is not, because environmental aspects have to be determined against the organization's activities, products and services and the impacts they cause. ISO 45001's clause 6.1.2 is not either, because hazard identification has to be ongoing and has to reach routine and non-routine work, the organization of work itself, and past incidents. The finding is written against the specific clause of the specific standard, so one register that fails both produces two nonconformities.
The second one is the management review. Clause 9.3 lists the inputs top management has to consider, and the environmental and OH&S standards each add their own to that list. A review agenda carried forward from a quality-only system and never extended arrives at the audit with no record that OH&S incident data, worker consultation or the results of compliance evaluation were considered. One meeting is enough. Its minutes have to show all three subjects.
A third one is narrower and catches experienced systems. Where the internal audit program is integrated, the audit plan behind it has to show that each standard's clauses were covered across the cycle, and that the internal auditors were competent for the standard they audited. A quality manager auditing the OH&S elements of the system without demonstrable OH&S competence is a clause 9.2 finding, not a clause 7.2 one.
What integration does not change
Audit duration still follows from the standard, the headcount, the number of sites and the processes in scope, collected in an informative questionnaire before any proposal is issued. Combining standards changes that arithmetic, so ask for it to be worked both ways at quotation stage, and read the audit plan when it arrives. It is issued in advance, and it names which sites, shifts and processes will be audited against which standard.
The scope wording does not have to be identical across the three certificates. A contractor might hold ISO 9001 across the whole business and ISO 45001 for project sites only. Whoever asks you for a certificate reads each scope on its own, so check each one against the work you are bidding for rather than assuming the widest of the three applies to all.
The certificates also keep their own three-year cycles. Where a second or third standard is added part-way through an existing cycle, ask how the cycles will be aligned before you sign, because two unaligned cycles mean two audit visits a year for the rest of the term instead of one. The audit sequence for each new standard is the one described in how certification works: Stage 1, Stage 2, then surveillance in each of the two following years.
Our accreditations from EIAC and ANAB cover [ISO 9001, ISO 14001 and ISO 45001], additonally [ISO 22301] from EIAC (/en/certifications), and those are the three we can certify. Where an integrated system also runs to a standard outside them, that part is certified by another body, and we say so at quotation stage rather than stretching a scope to fit the enquiry.