Home › ISO Knowledge Hub › Harmonized Structure & Annex SL
Harmonized Structure & Annex SL
Understand how ISO management system standards share a common architecture, and how to connect leadership, planning, support, operations, evaluation and improvement across quality, environment, occupational health and safety, and information security.
This independent practical guide explains the familiar Annex SL name alongside the current ISO/IEC Directives, Part 1:2026 Annex Q terminology, with a clause overview, an integrated management architecture and a six step implementation pathway.
01. Understanding the Harmonized Structure
The Harmonized Structure (HS) is a common architecture used in many ISO management system standards (MSS). It supports consistent clause sequences, shared terminology and compatible management processes. It simplifies integration, but does not make all standards interchangeable.
- Common architecture: Familiar themes for context, leadership, planning, support, operation, performance evaluation and improvement.
- Common core: Compatible wording and defined terms where applicable, with discipline specific additions.
- Management value: One system of ownership, decisions and improvement can address several standards without multiplying procedures.
- Important limit: Each adopted standard still needs its own applicability review and specialist evidence.
02. The Ten Clause Framework at a Glance
The common sequence helps teams orient themselves across standards. Clauses 1 to 3 establish a publication’s scope, references and vocabulary; Clauses 4 to 10 provide the principal management system themes. The descriptions below are editorial summaries and are not the licensed normative wording.
03. Common Language, Core Terms and Discipline Specific Meaning
A consistent vocabulary reduces translation errors between teams. Define terms in a controlled IMS glossary, then record where a specialist definition, legal interpretation or control method must be retained.
COMMON Context & interested parties
One method can collect internal/external issues and stakeholder needs, while separate teams assess quality, environmental, worker and security implications.
TAILORED Risks & opportunities
Use one governance rule for evaluation and action approval, but different technical assessments where hazard, environmental aspect or information security methods are required.
TRACEABLE Documented information
Use shared version control and retention governance, while preserving evidence types needed for each discipline, such as inspection records, exposure assessments or a Statement of Applicability.
Do not presume terms have exactly the same operational meaning in every standard. Confirm definitions and any permitted deviations against the controlled copies of applicable editions.
04. PDCA and Risk Based Thinking Across an IMS
Plan → Do → Check → Act provides a useful process improvement lens. Organizations can coordinate the cycle at enterprise level and retain technical requirements for every domain. The PDCA diagram below is a teaching model rather than an official ISO figure.
PLAN Plan
Understand context and interested parties; set objectives, risk approaches, responsibilities and controls for every discipline.
DO Do
Implement shared operating processes alongside task specific quality checks, environmental controls, OH&S safeguards and security measures.
CHECK Check
Review performance data, compliance outcomes, incidents, audit findings and stakeholder feedback using suitable domain specific competence.
Act: Improve both the common system and individual safeguards
Resolve nonconformities, review effectiveness, update risk controls, resources and objectives, and feed insights into management review. Keep accountability for specialist risks visible even when reporting is integrated.
05. Integrated Management Architecture: Shared and Specialist Layers
A workable IMS integrates what is truly common and preserves what remains specialist. The diagram is a practical organization design model, not a mandatory ISO configuration.
Integrated scope · leadership accountability · policy commitments · context review · objectives and management review
Process owners · change management · competence · documented information · internal audit · corrective action · common performance reporting
06. Shared Processes vs. Specialist Controls: Integration Matrix
Use a clause to process crosswalk to decide which workflows can be shared and which requirements demand distinct methods. The following examples are indicative; they do not constitute a conformity assessment.
On smaller screens, swipe horizontally to view the complete table.
| Management area | Common process opportunity | Specialist obligation to preserve | Typical evidence |
|---|---|---|---|
| Context & scope | Consolidate stakeholder analysis, site map and management system boundaries. | Retain distinct application boundaries, issues and controls for each standard. | Approved IMS scope; stakeholder register; boundary rationale |
| Leadership & planning | Use one leadership forum, decision log, owner model and coordinated objectives. | Keep obligations on worker consultation, environmental impact, product conformity and security risk. | Policy approvals; specialist risk registers; assigned objectives |
| Competence & information | Common training administration, document control and awareness campaigns. | Keep job specific competence criteria and evidence for regulated activities. | Training matrix; controlled documents; qualifications |
| Operational control | Share procurement, contractor oversight, change and incident escalation interfaces. | Maintain controls for product/service, environment, occupational hazards and information security. | Inspection records; permits; control operation logs; SoA |
| Evaluation & improvement | One audit programme, management review schedule and corrective action workflow. | Use competent domain specific audit criteria and legally required monitoring. | Audit evidence; compliance evaluation; action effectiveness |
When obligations conflict, escalate the issue to the accountable specialist and leadership rather than weakening a control to obtain artificial uniformity.
07. Scope and Applicability of an Integrated System
Integration does not require identical certification boundaries. Define legal entities, locations, activities, outsourced interfaces and products/services separately for each selected standard; then decide where shared governance genuinely applies.
- Determine scope: Identify common sites and processes, plus specialist sites/activities.
- Confirm applicability: Compare each requirement to actual services, activities and external obligations.
- Document exceptions: Give an evidence based rationale where the relevant standard permits non applicability.
- Maintain traceability: Map each control to its process owner, site, standard and evidence.
Illustrative scope statement
“The integrated governance framework covers design, procurement, manufacturing and after sales support conducted at the defined operating locations, with quality, environmental and occupational health and safety requirements applied according to their respective documented system scopes and controlled outsourced processes.”
08. Integrated Governance, Accountability and Performance
The strongest integration opportunity is not a combined manual. It is a shared decision system with defined responsibilities for functions, cross functional interfaces and each technical discipline.
LEAD Executive governance
Set overall objectives, approve resources, resolve cross discipline trade offs and review performance and significant risks.
OWN Process owners
Manage end to end outcomes, operating controls, changes, competence and records across the organizational process map.
VERIFY Specialist control owners
Interpret domain requirements, approve technical controls and advise on statutory or contractual obligations.
09. Six Step Process Based Integration Roadmap
This six step roadmap is an ISO Toolkits planning model, not an official certification sequence. It complements ISO’s Integrated management systems: A practical guide, which groups integration into Prepare, Connect and Integrate. Read the ISO JTCG publication overview ↗
STEP 01 01. Establish the baseline
Confirm standards, editions, organizations and site boundaries. Map existing systems and mandatory obligations.
Output: Approved IMS charter and scope map.
STEP 02 02. Compare and map requirements
Connect Clauses 4 to 10 to actual processes; identify shared mechanisms and specialist controls.
Output: Requirements to process matrix; gap register.
STEP 03 03. Assign governance and ownership
Approve common policy, review cadence, process owners and specialist decision rights.
Output: RACI; governance terms; objectives.
STEP 04 04. Integrate selected processes
Align competence, documented information, procurement, audits, change control and improvements.
Output: Controlled processes; trained owners; common registers.
STEP 05 05. Embed specialist controls
Test site level quality, environmental, OH&S and information security controls within their relevant scopes.
Output: Operational records and specialist assessments.
STEP 06 06. Verify, review and improve
Perform competent integrated audits, check effectiveness, review leadership decisions and update the system.
Output: Audit results; corrective actions; management review decisions.
10. Practical Scenario: One Manufacturing Site, Multiple Disciplines
A component manufacturer operates quality inspections, chemical storage, maintenance, contractor work and IT supported production. Its previous quality, environmental and safety teams maintained separate document lists, supplier evaluations and corrective action logs.
- Integration decision: Appoint one process owner for supplier onboarding with technical reviewers for product, environmental and OH&S criteria.
- Shared control: Use a single supplier register, change notification channel and corrective action tracking route.
- Specific evidence: Retain product inspection reports, environmental storage permits/checks and contractor safety evidence under separate technical owners.
- Effectiveness review: Sample real purchase to delivery transactions and verify each discipline’s control remains effective.
Result to seek: Fewer repeated administrative steps, quicker escalation and a complete trail from requirements to operational evidence, not an assumed reduction in the level of control.
Failure modes worth preventing
- One universal risk scoring method applied indiscriminately to all technical hazards.
- A combined audit checklist that loses standard specific criteria and competent sampling.
- Combined KPIs that mask deteriorating environmental or worker safety performance.
- Unclear authority for exceptions, outsourced processes or site specific obligations.
11. Frequently Asked Questions
Common implementation questions about the harmonized approach and integrated system boundaries.
Are Annex SL and Annex Q the same thing?
Annex SL is the widely used historic designation associated with ISO’s harmonized management system approach. The ISO/IEC Directives, Part 1:2026 use Annex Q for the harmonized approach. Check the cited edition when discussing the authoritative framework.
Does Harmonized Structure make every ISO standard identical?
No. A shared clause framework and core terms improve compatibility, but each standard includes technical obligations and potentially additional requirements that must be reviewed in its applicable edition.
Can one audit programme cover multiple ISO management systems?
Yes, an integrated programme may cover multiple standards when audit criteria, sampling, competence, independence and reporting remain suitable for each audited scope.
Must all standards use the same risk matrix?
No. A common approval and escalation policy may be useful; the assessment method must suit each risk domain, regulatory obligations and the actual process.
Do integrated systems need one combined certificate?
Not necessarily. Certification arrangements and scopes depend on the selected standards and the independent certification body. Integrating management practices does not automatically combine certification scopes.
What is the role of Clauses 1 to 3?
They address a publication’s subject scope, normative references and terminology. The main management system requirements in many harmonized MSS are organized across Clauses 4 to 10.
Can a process owner manage controls from different standards?
Yes, where authority, competence and escalation routes are defined. Specialist personnel must retain accountability for technical interpretations and decisions requiring domain expertise.
Where should integration begin?
Begin with strategy, scope and process owners. Map existing governance, identify common mechanisms and preserve technical controls before rewriting procedures.
Is there a mandatory six step integration schedule?
No. The six step sequence here is an ISO Toolkits educational planning aid, not a prescribed standard or certification schedule.
How do we know integration is working?
Audit process effectiveness, review cross disciplinary outcomes and inspect traceable records. Look for less duplication without deteriorating quality, environmental, health and safety or security controls.
12. Official Sources, Further Reading and Next Steps
These sources describe the official harmonized approach and support responsible interpretation. Confirm the current ISO/IEC Directives and the applicable edition of each selected standard before developing audit criteria or claiming conformity.
Official ISO and ISO/IEC resources
Continue in the ISO Knowledge Hub & ISO Articles
Integrated Management Systems →
Use a detailed crosswalk and implementation resource library.
ISO Scope & Applicability →
Determine legal entities, sites, outsourced interfaces and specialist boundaries.
ISO Gap Analysis & Planning →
Turn requirement to process findings into owned actions and readiness checks.
Challenges of Integrated ISO Rollout Across Business Units →
Plan shared governance across organizational units without losing accountability.
Avoiding Duplicate Records in a Multi Standard System →
Reduce duplicate evidence while preserving traceability.
How to Sequence ISO Integration After Initial Certification →
Integrate progressively without destabilizing existing controls.