Integrated Management Systems in Australia: Combining Two or More ISO Standards

Plenty of Australian businesses end up holding more than one ISO certification. Run as separate systems, that means separate sets of paperwork, separate internal audit programmes and a lot of duplication. I regularly walk into businesses with two or three near-identical document-control procedures that contradict each other in small ways, simply because they were written by different people at different times. An integrated management system (IMS) brings them together into one.

What is an integrated management system?

An integrated management system combines two or more management system standards into one coherent system with shared processes, documentation and governance, instead of separate silos. The classic Australian combination is QSE: ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (safety), or any two of the three. Just as common now are ISO 27001 (information security) alongside ISO 9001, and ISO 42001 (AI management) alongside ISO 27001, which is the natural pairing once you are governing AI and the data it runs on.

Why the standards fit together

Since 2015, ISO management system standards share a common framework: the harmonised structure (formerly Annex SL). They use the same high-level clauses: context, leadership, planning, support, operation, performance evaluation and improvement. Much of the system is therefore identical whichever standards you are working to, and that is exactly what makes integration possible. In practical terms, once you have written a good document-control or internal-audit procedure, you have written it for every standard in the system at once. There is no quality version and security version, just one.

Two standards we work with are exceptions. ISO 13485, the medical device quality standard, still follows the older ISO 9001:2008 clause layout, so its clause numbers do not line up with the harmonised structure. ISO/IEC 17025 is not a management system standard at all: it sets requirements for laboratory competence, is assessed for accreditation (by NATA in Australia) rather than certification, and puts its management system requirements last, in clause 8. That clause lets a laboratory either meet a short set of requirements directly (Option A) or rely on a management system that meets ISO 9001 (Option B), which is the usual route into an integrated system. Both integrate well, but they need a map: one set of processes, cross-referenced to each standard’s clause numbers. Our ISO 13485 and ISO 17025 pages cover how that works.

Both ISO 9001 and ISO 14001 now have 2026 editions, and they are at different stages in Australia. AS/NZS ISO 9001:2026 was published on 18 September 2026, so that transition is live. ISO 14001:2026 was published internationally in April 2026, but Standards Australia has not adopted it, so AS/NZS ISO 14001:2016 remains current and there is nothing to transition to yet. If you run an integrated system, that split matters: plan the two transitions as one piece of work rather than sequentially, because the shared backbone clauses get touched once and the renumbering has to be applied consistently across the whole system. See what changed in ISO 9001:2026 and what changed in ISO 14001:2026 and where Australia stands, each with a free transition checklist.

Benefits of an integrated management system

• One set of core processes: document control, internal audit, management review, corrective action and risk management are shared, not duplicated for each standard.
• Less duplication and paperwork: a single system manual and aligned procedures.
• Lower audit cost: certification bodies can run combined audits, reducing audit days and fees.
• Better decisions: leadership sees performance across every standard in the system side by side, in one management review, rather than in separate meetings nobody has time for.
• A stronger culture: one consistent way of working instead of competing systems.

What’s shared and what stays specific

The “backbone” clauses are integrated once. The technical, risk-specific requirements stay distinct. A good IMS integrates the common parts and keeps the specialised parts clear:

Where the safety clauses fold into the shared processes

Some ISO 45001 requirements look separate but sit naturally inside processes you already run once:

• Management of change. ISO 45001 puts it at clause 8.1.3, with a safety focus. In an IMS it belongs in one change process alongside ISO 9001 clause 6.3, which has more in it since the 2026 revision, so a change is assessed for quality, safety and environmental impact at the same time.
• Procurement. ISO 45001 clause 8.1.4 covers procurement, contractors and outsourcing. It merges with ISO 9001 clause 8.4, so one supplier and subcontractor process covers both quality and safety controls.
• Internal audit. Rather than three audit programmes, plan your audits in one IMS calendar, based on risk, recent changes and previous results, alongside management review and your other routines.
• Corrective action. Clause 10.2 is common text, so run one improvement register for complaints, defects, nonconformities and incidents, filtered by standard when you need a view.

Integrated management system certification: single or separate?

You can certify an integrated system through one certification body that audits all standards together in a combined audit. That usually means fewer audit days, lower fees and a single surveillance schedule, rather than separate audits for each certificate. You still receive a certificate for each standard, but from one system.

What a combined audit looks like

Here is an illustrative combined internal audit plan for a business of around 40 people holding ISO 9001, ISO 14001 and ISO 45001. Each session covers the shared requirements once, then the requirements specific to each standard.

The same structure works for the external audit. Certification bodies can reduce total audit time for a genuinely integrated system under IAF MD 11, the international rules for auditing integrated management systems, which is where most of the fee saving comes from. Our internal audit service runs combined audits like this one.

Who owns what

• Top management owns the policy, objectives and resources for the whole system. Every one of these standards puts that in clause 5, and it cannot be delegated.
• One system owner, often the quality, safety or compliance manager, owns the shared processes: document control, internal audit, corrective action and the management review.
• Specialist owners keep the technical parts: hazard identification, worker consultation and incident investigation for safety; aspects and compliance obligations for environment; the risk assessment and Statement of Applicability for information security.
• Process owners own their processes once, whichever standard a requirement comes from. If three standards point at purchasing, the purchasing owner still owns one process.

The test is simple: every requirement has one named owner. If you find two people who each think the other one has it, that is where the integration has gone wrong.

Scope cautions

• Scopes do not have to match. Your ISO 27001 scope might cover one platform while ISO 9001 covers the whole business. That is fine, as long as each scope statement says so clearly.
• Exclusions work differently. ISO 9001 lets you declare a requirement not applicable with a justification. ISO 14001 and ISO 45001 have no equivalent, and ISO 27001 handles control exclusions through the Statement of Applicability.
• Sites and contractors. A site or activity inside the safety scope but outside the quality scope needs to be visible in the audit plan, or it will be missed.
• Do not integrate away the detail. A combined risk register works only if it still shows environmental aspects, hazards and information security risks against their own criteria.
• One certification body is simplest, but check it is accredited for every standard and for your industry sector before you commit.

Two common pathways

Quality, environment and safety. ISO 9001, ISO 14001 and ISO 45001 are the most common combination for contractors, manufacturers and service businesses bidding for government and tier-one work. Our cost guides for ISO 9001, ISO 14001 and ISO 45001 show what each adds.

Information security and AI. ISO 27001 and ISO 42001 share the same structure and much of the same risk process. Our guide to how ISO 42001 and ISO 27001 fit together explains the overlap, and the ISO 27001 and ISO 42001 cost guides set out what each costs on its own and together.

Is an integrated management system right for you?

An IMS makes sense if you already hold, or plan to hold, two or more certifications, or you run several of these functions as overlapping responsibilities. If you only need one standard, a single system is simpler. One caveat worth knowing: integrating a mature, well-run system with a neglected one is not a shortcut to fixing the neglected one. Integration exposes the weak parts rather than hiding them, which is useful, but plan for it.

How Streamline can help

We design integrated management systems around whichever combination you actually need: a QSE system across ISO 9001, ISO 14001 and ISO 45001, ISO 27001 sitting alongside ISO 9001, or ISO 42001 with ISO 27001 where AI governance now rides on top of information security. Whatever the mix, you get one practical system your team uses, prepared for a single combined certification audit. The result is less duplication, lower ongoing cost and a system that supports the business rather than sitting beside it.

Integrated management systems: FAQs

Which standards can be integrated?

Any of the modern ISO management system standards, because they share the same harmonised structure. In practice that usually means a QSE system (ISO 9001, ISO 14001 and ISO 45001, or two of the three), ISO 27001 alongside ISO 9001, or ISO 42001 alongside ISO 27001.

How many standards can you combine?

There is no upper limit. Two is the most common starting point, three is normal, and more is workable where the business actually carries that much risk. The constraint is usually how much the organisation can absorb at once, not the standards themselves.

Do you get one certificate or several?

Usually a separate certificate for each standard, but issued from one integrated system and a single combined audit.

Is an IMS cheaper than separate systems?

Generally yes over time: shared processes and combined audits reduce both the internal effort and the certification body’s fees.

Speak with an experienced ISO auditor

Email hello@streamline.business or call us. You’ll deal directly with an experienced ISO auditor who’ll tailor a practical approach to your business. You’re also welcome to get in touch via our contact page.