Integrated Management System (IMS) for ISO 9001, ISO 14001, and ISO 45001: Annex SL Architecture, IAF MD 11 Audit Calculation, and 6-Month Roadmap

An Integrated Management System (IMS, often referred to in industry as a QHSE system) is a single operational governance architecture that satisfies the requirements of ISO 9001 (Quality Management), ISO 14001 (Environmental Management), and ISO 45001 (Occupational Health and Safety) simultaneously. When a manufacturing plant, construction contractor, or logistics operator builds those three standards as isolated silos in three separate departments, administrative friction builds up fast: three disconnected risk registers, three internal audit schedules, three conflicting document control procedures, and three separate external certification visits every year.

Most companies move to an IMS for hard commercial reasons. International engineering and construction tenders financed by the EBRD or World Bank, automotive and machinery supply contracts, and European export tenders routinely require bidders to hold all three certificates at once. In multi-standard implementation projects delivered by Ekontrol engineers, merging the three standards onto a shared core cuts total procedural documentation by 55-65% and reduces external certification auditor-days by up to 20% under International Accreditation Forum (IAF) rules.

In Ukraine, the legal framework governing conformity assessment and accredited certification bodies is established by the Law of Ukraine No. 124-VIII "On Technical Regulations and Conformity Assessment". The national standards DSTU ISO 9001:2015, DSTU ISO 14001:2015, and DSTU ISO 45001:2019 are identical adoptions of the international texts. Certification bodies auditing IMS conformity under ISO/IEC 17021-1 are accredited by the National Accreditation Agency of Ukraine (NAAU), a signatory to the multilateral recognition arrangements of the European co-operation for Accreditation (EA MLA), while issued certificates can be verified worldwide through the official IAF CertSearch database.

You don't have to force ISO 9001, ISO 14001, and ISO 45001 together artificially; they were engineered to snap together via Annex SL of the ISO/IEC Directives (officially renamed the Harmonized Structure - HS in 2021, and widely known as the High-Level Structure - HLS). Before Annex SL existed, quality, environmental, and safety standards used completely different clause numbers, conflicting definitions, and incompatible corrective action workflows. Today, every modern ISO management system standard shares the exact same 10-clause architecture.

Mapping Annex SL Across the PDCA Cycle

Clauses 1 to 3 (1. Scope, 2. Normative references, 3. Terms and definitions) are introductory. All auditable requirements live in Clauses 4 through 10, structured around the Deming Plan - Do - Check - Act (PDCA) cycle:

• Context, Leadership, and Planning (Plan - Clauses 4, 5, 6): understanding internal and external context issues (4.1), needs and expectations of interested parties (4.2), IMS scope boundaries (4.3), process interactions (4.4), leadership commitment and worker participation (Clause 5), plus risk assessment, environmental aspects, occupational hazards, compliance obligations, and measurable objectives (Clause 6);
• Support and Operation (Do - Clauses 7 and 8): managing infrastructure, measurement traceability, competence, awareness, communication, and documented information (Clause 7), paired with operational planning and discipline-specific process controls (Clause 8);
• Performance Evaluation (Check - Clause 9): monitoring, measurement, analysis, and statutory compliance evaluation (9.1), a unified internal audit program per ISO 19011 (9.2), and an integrated management review (9.3);
• Improvement (Act - Clause 10): incident and nonconformity investigation, root cause analysis, and corrective actions / CAPA (10.2), driving continual system improvement (10.3).

Because Clauses 4, 5, 7, 9, and 10 share verbatim core text across all three standards, over 70% of your administrative procedures only need to be written once. For deep dives into each individual standard, see our complete ISO 9001 guide, ISO 14001 certification guide, and complete ISO 45001 guide.

When designing an IMS, your goal is to unify every shared management mechanism while preserving the discipline-specific operational requirements where certification auditors look closely (such as life-cycle perspective in ISO 14001 or non-managerial worker consultation under Clause 5.4 of ISO 45001).

The engineering matrix below maps Clauses 4 through 10 across all three standards, separating the 100% unified IMS core from standard-specific extensions.

A well-engineered IMS merges 100% of the administrative backbone (Clauses 4, 5, 7, 9, and 10) while keeping technical shop-floor controls in Clause 8 sharp and distinct. Let's look at how that split works on the ground.

Six Processes That Merge 100% into a Single Workflow

Never maintain separate procedures or parallel spreadsheets for these six system functions:

1. Context, Interested Parties, and QHSE Policy (Clauses 4.1, 4.2, 5.2): replace three separate wall declarations with one concise Integrated QHSE Policy signed by the CEO. Make sure it explicitly includes the mandatory clauses from all three standards: meeting customer requirements (ISO 9001), protecting the environment and preventing pollution (ISO 14001), and preventing work-related injury and ill health while consulting workers (ISO 45001).
2. Control of Documented Information (Clause 7.5): one standard operating procedure governing document numbering, version control, review/approval signatures, shop-floor distribution, and archive retention.
3. Competence, Onboarding, and Training Matrix (Clauses 7.2, 7.3): one master HR/QHSE training matrix tracking technical job qualifications, hazardous waste handling training, and mandatory occupational safety briefings.
4. Combined Internal Audits per ISO 19011 (Clause 9.2): one annual internal audit schedule. When your internal audit team inspects the welding shop or chemical warehouse, they use a single integrated checklist covering part dimensional tolerances and gauge calibration (9001), secondary containment drip trays and hazardous waste labeling (14001), plus local exhaust ventilation, PPE usage, hot-work permits, and LOTO locks (45001).
5. Integrated Management Review (Clause 9.3): one executive review meeting where leadership evaluates scrap rates, customer complaints, energy/waste KPIs, environmental permit compliance, Near Misses, and CAPA status in a single protocol.
6. Nonconformity, Incident Investigation, and CAPA (Clause 10.2): one centralized log using 5 Whys or Fishbone root cause analysis across quality defects, environmental deviations, and safety incidents.

What Stays Discipline-Specific in Clauses 6.1.2 and 8

Trying to blur Clause 8 into vague generic statements is a guaranteed way to fail Stage 2 certification. Each standard demands specific engineering controls on the shop floor:

• ISO 9001 Operational Controls (Clauses 8.2 - 8.7): customer contract review, engineering design and development verification/validation (8.3), incoming inspection, product Quality Control Plans (Control Plans), lot traceability, validation of special processes (such as welding, heat treatment, or coating), and quarantine of nonconforming product (8.7).
• ISO 14001 Operational Controls (Clauses 6.1.2, 8.1, 8.2): scoring Significant Environmental Aspects across normal operations, startup/shutdown, and emergency scenarios; applying a Life-Cycle Perspective (evaluating environmental impacts from raw material sourcing through production, transport, and end-of-life packaging disposal); managing air emission permits, water discharge limits, waste transfer notes, and practical chemical spill response drills (Spill Kits).
• ISO 45001 Operational Controls (Clauses 5.4, 6.1.2, 8.1.2 - 8.1.4): workstation hazard identification and strict application of the Hierarchy of Controls (ERICPD): 1) Elimination (physically removing the hazard), 2) Reduction / Substitution (replacing solvent-based paint with water-based or reducing manual lift weights), 3) Isolation / Engineering Controls (interlocked machine guards, light curtains, acoustic enclosures, extraction hoods), 4) Administrative Controls (Permit-to-Work systems for confined spaces or work at height, LOTO - Lockout/Tagout energy isolation during maintenance, safety signage, shift rotation), and 5) Personal Protective Equipment (PPE) as the last line of defense. Auditors will also interview floor workers directly to verify consultation and participation under Clause 5.4.

How many auditor-days and how much budget does a combined IMS audit actually save compared to three separate audits? Accredited certification bodies don't guess audit duration. They are legally bound by two mandatory documents from the International Accreditation Forum: IAF MD 5 (Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems) and IAF MD 11 (Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems).

Four-Step Engineering Formula Under IAF MD 5 and IAF MD 11

Certification bodies calculate combined IMS audit duration ($T_{\text{IMS}}$) using a four-step mathematical procedure:

1. Determine Effective Number of Personnel ($N_{\text{eff}}$) and Risk/Complexity Category per IAF MD 5: start with total headcount within the certification scope (including permanent on-site contractors). Where large groups of workers perform identical repetitive tasks (such as packaging line operators, drivers, or security staff), IAF MD 5 permits a justified reduction to calculate Effective Headcount. Next, look up baseline auditor-days ($t_1, t_2, t_3$) in Tables QMS 1 (ISO 9001), EMS 1 (ISO 14001), and OH&SMS 1 (ISO 45001) based on the industry's environmental complexity and OH&S risk class (High, Medium, or Low).
2. Calculate Starting Baseline Sum ($T_{\text{base}}$): sum the individual audit durations of all three standards: $T_{\text{base}} = t_{\text{ISO 9001}} + t_{\text{ISO 14001}} + t_{\text{ISO 45001}}$.
3. Score Two Integration Axes Under IAF MD 11:
   • Axis A: Level of Integration of the Client's Management System (0% to 100%) - scored across integrated documentation, unified Management Review, single internal audit program with multi-standard internal auditors, unified policy/objectives, and integrated risk/CAPA processes;
   • Axis B: Ability of the Certification Body Audit Team to Perform an Integrated Audit (0% to 100%) - determined by how many auditors on the team hold multi-disciplinary qualification across two or all three standards.
4. Apply the Integration Reduction Factor (up to 20%): plotting Axis A against Axis B in the IAF MD 11 figure yields the audit time reduction percentage $\Delta R_{\text{IMS}}$, capped at a maximum of 20% of $T_{\text{base}}$. The final combined audit time is: $$T_{\text{IMS}} = T_{\text{base}} \times (1 - \Delta R_{\text{IMS}})$$

Worked Calculation Example for a 120-Employee Manufacturing Plant

Here is the exact IAF MD 5 and IAF MD 11 audit time calculation for a Ukrainian machinery or metalworking plant with an effective headcount of 120 employees (Medium Complexity/Risk category).

Once your ISO 9001 + ISO 14001 + ISO 45001 core is running on Annex SL, plugging in specialized industry standards takes a fraction of the effort of a standalone build. Because document control, competence matrices, internal auditing, and CAPA are already unified, sector extensions attach as operational modules:

1. Food & Agribusiness: Plugging in ISO 22000 and FSSC 22000

Since its 2018 revision, ISO 22000 (and the GFSI-benchmarked FSSC 22000 scheme built on top of it) follows the exact same Annex SL Clauses 4 to 10 structure. When a grain terminal, oilseed crushing plant, or dairy processor adds ISO 22000 to an existing QHSE system, Clauses 4, 5, 7, 9, and 10 merge directly into the IMS core, while Clause 8 expands to house the HACCP food safety module: Prerequisite Programs (PRPs per ISO/TS 22002-1), hazard analysis, Operational PRPs (OPRPs), and Critical Control Points (CCPs).

2. Testing & Calibration Laboratories: Connecting ISO/IEC 17025 (Option B)

Industrial manufacturers frequently operate in-house quality control laboratories or environmental testing labs accredited by NAAU to ISO/IEC 17025. While ISO/IEC 17025:2017 uses a five-section layout (Clauses 4 to 8: Impartiality & Confidentiality, Structural, Resource, Process, and Management System requirements), Clause 8.1.3 explicitly provides Option B: a laboratory that is part of a larger organization certified to ISO 9001 automatically fulfills the management system clauses (8.2 to 8.9) of ISO/IEC 17025 through the plant's existing IMS procedures. Your lab team shares the plant's document control, internal audit schedule, CAPA log, and management review, freeing metrologists to focus on method validation, proficiency testing, and measurement uncertainty.

3. Biofuels, Grain Export & Circular Polymers: Aligning with ISCC EU / ISCC PLUS

For Ukrainian exporters of rapeseed, corn, soybeans, biodiesel, and recycled polymers supplying the European Union, sustainability and greenhouse gas (GHG) certification under ISCC (International Sustainability and Carbon Certification) is a commercial entry ticket. Operating certified ISO 14001 (energy, fuel, fertilizer, and waste tracking across the life cycle) and ISO 45001 (safe handling of crop protection chemicals, PPE, worker rights, and emergency readiness under ISCC Principle 4) covers roughly 70% of the audit evidence required for ISCC, leaving only Mass Balance bookkeeping and lot-specific $\text{CO}_2\text{-eq}$ calculations.

To take an organization from scattered departmental rules to a certified IMS without disrupting production, Ekontrol structures IMS implementation projects across a 6-month engineering schedule. That timeline gives your team enough runway to design the unified procedures, train operators, and accumulate 2 to 3 months of genuine operational records before the Stage 2 certification audit.

The table below outlines the month-by-month engineering roadmap for deploying ISO 9001, ISO 14001, and ISO 45001 together.

Even though Annex SL makes integration straightforward in theory, we regularly see four practical mistakes that derail combined audits on day one:

1. Stapling three separate manuals under one cover page. If a company keeps three separate document numbering systems, three disconnected risk matrices, and three separate internal audit schedules, slapping a title page that says "Integrated Management System" on the binder won't fool an auditor. During Stage 1, the lead auditor will score your integration level near 0% under IAF MD 11 and revoke the 20% audit time reduction.
2. Overlooking Clause 5.4 of ISO 45001 (Consultation and Participation of Workers). In ISO 9001 and ISO 14001, top-down communication of policies and work instructions is sufficient. ISO 45001 requires two-way participation of non-managerial workers in identifying workstation hazards, selecting PPE, investigating Near Misses, and reviewing process changes. Missing documented proof of worker consultation is one of the most frequent triggers for a Major Nonconformity.
3. Writing an office-only Environmental Aspects Register without a Life-Cycle Perspective (Clause 6.1.2 of ISO 14001). Listing "office paper and fluorescent bulbs" while ignoring boiler flue emissions, paint booth solvents, compressor oil condensate, and post-consumer packaging disposal won't pass an ISO 14001 audit. Auditors cross-check your aspects register against utility bills, air emission permits, and hazardous waste transfer manifests.
4. Holding certificates with three different certification bodies. You can unify your internal procedures regardless of who issued your existing certificates, but you cannot get a combined audit or an IAF MD 11 discount if three different bodies audit you on separate dates. Consolidate your certificates under a single accredited body via an IAF MD 2 certificate transfer at your next surveillance or recertification window.

Choosing the right path to implement and certify ISO 9001, ISO 14001, and ISO 45001 depends on what you already have running on the floor:

• If you already run a certified ISO 9001 system: don't rebuild from scratch. Start with a diagnostic gap audit against ISO 14001 and ISO 45001. You'll keep 100% of your existing document control, training, internal audit, and CAPA procedures, and simply bolt on the environmental aspects, life-cycle controls, and occupational health and safety modules.
• If you need two or three standards from scratch for an upcoming tender or export contract: launch a single unified IMS implementation project. Writing the Annex SL core once cuts total implementation effort by 40-50% compared to three back-to-back projects.
• If your internal team has drafted the IMS and your certification audit is approaching: bring in our lead auditors for certification audit support to verify your IAF MD 11 integration evidence, drill process owners, and defend your system during Stage 1 and Stage 2. To get a tailored auditor-day calculation and project timeline for your facility, reach out via our contact page.