Home › ISO Knowledge Hub › Integrated Management Systems
Integrated Management Systems (IMS)
Build one coordinated management framework across multiple ISO standards. Compare shared clauses, retain standard specific controls, and follow a practical implementation roadmap.
Understanding an Integrated Management System
An IMS coordinates two or more management systems through shared leadership, governance, processes and records while preserving the distinct requirements of each standard. ISO's Harmonized Structure (HS) makes comparison easier because many management system standards share a common clause sequence and core terminology.
- ISO 9001: Quality and customer outcomes
- ISO 14001: Environmental management and environmental obligations
- ISO 45001: Occupational health and safety and worker participation
- ISO/IEC 27001: Information security risk and control management
Integration principle: Coordinate the management processes that are genuinely shared; never assume a common clause number removes discipline specific obligations.
Practical starting point: A combined context analysis, integrated scope, governance model and requirements to process map.
ISO Clause Integration Matrix
Compare the common management system themes in Clauses 4 to 10, then see the additional emphasis of each selected ISO standard. This educational crosswalk is a planning aid, not a reproduction of normative text or a substitute for a licensed edition.
7 IMS clause groups in view; 4 standards selected.
On mobile, swipe sideways to view all table columns.
| Clause / Area | Shared Requirements & Standard Focus | Integration Action | Typical Evidence |
|---|---|---|---|
| Clause 4 Context of the organization |
Common IMS approach: Define organizational issues, interested parties, an integrated scope and interacting processes. Selected standard focus: ISO 9001: Quality context, customer expectations and scope of the QMS. ISO 14001: Environmental conditions, compliance obligations and EMS scope. ISO 45001: Workers, interested parties, work activities and OH&S scope. ISO/IEC 27001: Information security context, interfaces and ISMS scope. |
One context review, a documented IMS scope and a common process map. | Scope; context log |
| Clause 5 Leadership |
Common IMS approach: Align governance, integrated policy commitments, responsibilities and accountability. Selected standard focus: ISO 9001: Customer focus, process ownership and quality responsibilities. ISO 14001: Environmental protection and leadership commitments. ISO 45001: Worker consultation and participation, plus OH&S leadership. ISO/IEC 27001: Information security governance, accountability and policy. |
One leadership framework with standard specific policy commitments. | Policy; RACI |
| Clause 6 Planning |
Common IMS approach: Coordinate risks, opportunities, objectives, changes and assigned actions across the IMS. Selected standard focus: ISO 9001: Product and service quality risks and opportunities. ISO 14001: Environmental aspects, compliance obligations and environmental objectives. ISO 45001: Hazard identification, OH&S risks, opportunities and obligations. ISO/IEC 27001: Information security risk assessment, treatment and security objectives. |
Common risk methodology with specialist registers and treatment plans. | Risk / objective logs |
| Clause 7 Support |
Common IMS approach: Coordinate resources, competence, awareness, communications and control of documented information. Selected standard focus: ISO 9001: Competence and evidence of conformity for quality activities. ISO 14001: Environmental competence, communications and documented information. ISO 45001: Worker awareness, competence and OH&S communications. ISO/IEC 27001: Security awareness, specialized skills and controlled ISMS information. |
Shared document control, training plan and competency framework. | Document / training logs |
| Clause 8 Operation |
Common IMS approach: Manage shared operational planning and controlled execution while retaining specialist safeguards. Selected standard focus: ISO 9001: Customer requirements, design, suppliers, production and service controls. ISO 14001: Life cycle perspective, operational controls and emergency preparedness. ISO 45001: OH&S hazard controls, change, contractors and emergency response. ISO/IEC 27001: Risk treatment, information security controls and Statement of Applicability. |
Integrated process controls plus distinct environmental, safety and security controls. | Control plans; SoA |
| Clause 9 Performance evaluation |
Common IMS approach: Integrate monitoring, management review and risk based internal audit planning. Selected standard focus: ISO 9001: Customer satisfaction, process performance and QMS evaluation. ISO 14001: Environmental performance, compliance evaluation and EMS audits. ISO 45001: OH&S performance, legal compliance evaluation and worker input. ISO/IEC 27001: ISMS effectiveness, security metrics and independent internal audit. |
Coordinated KPIs, an integrated audit programme and a unified review agenda. | KPI / audit pack |
| Clause 10 Improvement |
Common IMS approach: Operate a consistent approach to nonconformities, corrective actions, lessons learned and improvement. Selected standard focus: ISO 9001: Product or service nonconformity and customer related improvement. ISO 14001: Environmental nonconformity and performance improvement. ISO 45001: Incident, near miss and OH&S corrective action management. ISO/IEC 27001: Information security nonconformities and ISMS improvement. |
One CAPA workflow with subject matter ownership and impact checks. | CAPA / lessons |
No clause matches the current search. Select a different clause or clear the filters.
Reference note: Clause themes are simplified examples. Confirm the edition, complete requirements, applicability and control evidence through the ISO management system standards and ISO: Management Systems & Harmonized Structure.
Common Processes vs. Standard Specific Controls
Shared IMS Processes
- Unified governance: Context review, policies, accountability and objectives.
- Documented information: One version control procedure and central document register.
- Competence & communication: A coordinated plan with role specific modules.
- Internal audit: One risk based audit programme covering every selected requirement.
- Improvement: A common corrective action workflow, action tracking and review.
Controls That Require Specialist Treatment
- Quality: Product/service conformity and customer requirements.
- Environment: Aspects, impacts and applicable environmental obligations.
- OH&S: Hazards, worker consultation and risk reduction.
- Security: Information security risk treatment, control selection and SoA.
- Assurance: Suitable competence and evidence for each audit discipline.
IMS Documentation Architecture
A practical three layer documentation model keeps governance consistent and makes the specialist obligations traceable.
On mobile, swipe sideways to view all table columns.
| Layer | What It Contains | Document Owner | Typical Record |
|---|---|---|---|
| 01. Governance | IMS scope, policy, strategic risks, stakeholder needs, integrated objectives and leadership roles. | Top management / IMS lead | IMS policy; scope |
| 02. Shared Processes | Document control, competence, internal audit, management review, change and corrective action. | IMS coordinator / process owners | Audit programme; CAPA log |
| 03. Specialist Controls | Quality specific checks, environmental operational controls, OH&S safeguards and ISMS controls. | Functional control owners | Inspection; aspects; SoA |
7-Step IMS Implementation Roadmap
The roadmap turns clause mapping into implementation work packages. Steps can be tailored to your organization, maturity level and selected standards; do not treat them as prescribed certification phases.
On mobile, swipe sideways to view all table columns.
| Implementation Stage | Activities & Decisions | Expected Deliverables | Milestone |
|---|---|---|---|
| 01. Define scope & governance | Select the management standards, boundaries, sites and responsible owners. | IMS charter; combined scope; stakeholder map | Step 1 |
| 02. Complete baseline gap assessment | Assess current controls against every selected standard; distinguish shared from unique gaps. | Integrated gap report; prioritised action log | Step 2 |
| 03. Map common requirements | Connect clauses to existing processes, assign owners and identify integration opportunities. | Clause to process matrix; process map | Step 3 |
| 04. Design shared processes | Build common governance, document control, risk method and competence arrangements. | Integrated policy; process procedures; risk architecture | Step 4 |
| 05. Implement specialist controls | Embed operational controls for quality, environment, OH&S and information security as needed. | Site controls; SoA; instructions; training records | Step 5 |
| 06. Audit and assess effectiveness | Carry out competent, risk based audits covering both common and specialist requirements. | Integrated audit programme; findings; CAPA tracker | Step 6 |
| 07. Management review & improve | Review combined performance and obligations; approve resourcing and improvement actions. | IMS review minutes; KPI dashboard; improvement plan | Step 7 |
IMS Practical Guidance & Resources
Use the existing ISO Toolkits resource library to plan requirements, control documents, prepare audits and strengthen specialist controls.
Operational Control & Gap Analysis
Translate integrated process requirements into site level controls, responsibilities, operating instructions and evidence.
Document Control & Integrated Audits
Develop a requirements traceability matrix, one audit programme and standard specific audit evidence.
Extend Your IMS Across Domains
Extend shared governance into information security or other relevant fields without neglecting discipline specific requirements.
Further Reading & Verification
- ISO: Management System Standards
- ISO: Harmonized Structure Reference
- LRQA: Annex SL & Integrated Management Systems
- BSI: Integrated Management Systems Practical Guide
Certification is performed by independent certification bodies; the applicable standard edition and certification scope should be verified separately.