Integrated QHSE management system: ISO 9001, 14001 and 45001

What is an integrated QHSE management system?

It is one management system that meets several standards at once: ISO 9001 for quality, ISO 14001 for the environment and ISO 45001 for occupational health and safety. People call it an IMS, a QHSE system or a QSE system; the logic is the same.

The definition that matters is the one certification bodies apply. The mandatory Global ACI document on audits of integrated management systems (Global ACI-TECH-3-008, version 1.0 of 10 July 2026, in application since 28 August 2026) carries over IAF MD 11 with no substantive change, now that Global ACI has taken over the role of the IAF. It recognises every degree in between: from a "combined" system that simply adds separate systems together, to an integrated system that shares documentation, management system elements and responsibilities.

That level of integration is not a matter of wording. The certification body asks for it in the application, confirms it at stage 1 and uses it to calculate audit time. But the certificate is still about standards: the body audits every applicable requirement of each one. Integrating means handling once what is shared, not skipping what is specific.

Why do ISO 9001, ISO 14001 and ISO 45001 integrate so well?

Because they share the same architecture: context, leadership, planning, support, operation, performance evaluation, improvement. According to the Global ACI transition documents, ISO 9001:2026 and ISO 14001:2026 both align with Annex SL and ISO TMB resolution 16/2025, and revise their terms and definitions to follow the Harmonized Structure. ISO 45001:2018 follows the same clause logic, and ISO highlights, on the standard’s page, its alignment with other management system standards and the possibility of integrating it with them. Among the clarifications in Annex A of ISO 14001:2026, Global ACI even lists alignment with strategy, business processes and the integrated management system approach.

The texts of all three standards are paid: this page describes their requirements in our own words, without reproducing their numbering or wording.

Transition dates are on our ISO 9001 certification, ISO 14001:2026 and ISO 45001 pages. For an integrated system, the 2026 editions have three practical consequences.

• The same numbers do not mean the same thing. ISO 9001:2026 now splits risks and opportunities into three steps: determining them, addressing risks, addressing opportunities. ISO 45001:2018 places hazard identification and legal requirements in the same chapter, under numbers the quality standard uses for something else. A matrix built number against number mixes subjects up; we build it by subject.
• Planning of changes becomes one shared process. ISO 14001:2026 adds requirements on planning of changes; ISO 9001:2026 expands its own (effectiveness of changes, communication, review of results); ISO 45001:2018 deals with management of change in its operation chapter. One process can review a new line or a new chemical from all three angles.
• Management review gains new inputs. ISO 9001:2026 adds changes in the needs and expectations of relevant interested parties; ISO 14001:2026 also adds elements to its own. A single review covers both, plus the results of worker consultation expected by ISO 45001:2018.

Three parallel systems or one integrated system: what changes?

Integration removes duplicated management, not requirements.

For an industrial SME, the most visible gain is people: one QHSE manager, one legal compliance review, one action plan. The most lasting gain is consistency on the shop floor. In a fish cannery in Agadir, the cleaning instruction gives on one page the product and its dose, the protective equipment and where the wash water goes.

The limit is well known: environmental aspects and occupational risk assessment cannot be derived from a quality process, and worker participation cannot be delegated to the QHSE manager.

Which requirements are shared, and which remain specific to each standard?

The chapters are shared; the underlying analyses are not. The table only lists requirements presented on our ISO 9001, ISO 14001 and ISO 45001 pages or in the Global ACI documents; it does not replace reading the standards.

The full cross-reference, requirement by requirement, is built on the purchased texts of the three standards, with your system in front of you: it is one of the deliverables of our support.

National law sometimes draws the same link. In Morocco, the safety and hygiene committee also watches over environmental protection inside and around the company (Article 338 of the Labour Code).

Integrated QHSE management system: what is the 8-step method?

Eight steps, set out in our method below. Five elements make the integration: one process map, one document system, one audit programme, one management review and one improvement system. The standard-specific analyses plug into them.

Measure the level of integration first

We start from the criteria certification bodies use. Annex 1 of the Global ACI document characterises an integrated system by seven elements, and the certification body sets a percentage level of integration according to how far you meet them:

1. an integrated documentation set, including work instructions;
2. management reviews that consider the overall business strategy and plan;
3. an integrated approach to internal audits;
4. an integrated approach to policy and objectives;
5. an integrated approach to system processes;
6. an integrated approach to improvement: corrective and preventive action, measurement, continual improvement;
7. integrated management support and responsibilities.

Our review scores your system on these seven points as it actually runs, not as it is written.

One process map, not three

Each process carries its quality, environmental and OH&S issues, with a single owner. At a packaging manufacturer in Kenitra, the "purchasing and subcontracting" process covers supplier qualification, the permit of the waste collector and the requirements placed on maintenance contractors. The common mistake is to add an "environment process" and a "safety process" next to the others: the issues then stay outside the processes that create them.

One document system, in the teams’ language

One document control procedure, one master list, one numbering system. What makes the integration is work instructions that put the quality criterion, the preventive measure and the environmental instruction on the same page, in French, Arabic or English depending on the team.

One shared legal register

One register of environmental and OH&S compliance obligations, with an owner, the expected evidence and an evaluation frequency for each requirement. The national texts that apply in Morocco are presented on our ISO 14001 and ISO 45001 pages; elsewhere, the register follows the law of each country of operation.

One audit programme and multi-standard auditors

One annual programme, risk-based and following the ISO 19011 guidelines. Auditors follow a process end to end from all three angles, and each finding is traced to the standard or standards concerned: a chemical store without secondary containment touches both environmental emergency preparedness and operators’ chemical risk. In an SME, an outsourced internal audit secures independence (see audits and inspections).

One management review and one improvement system

The review brings together customer satisfaction, significant aspects, compliance evaluation, accidents and near misses, and the results of worker consultation; where a safety committee exists, its annual report becomes a natural input. Customer complaints, audit findings, near misses and discharge exceedances then enter the same action register, with the same root cause method.

Is your integrated system ready for a combined audit?

• One process map, each process with its Q, H&S and E issues and a named owner.
  
• A signed QHSE policy and objectives cascaded by process.
  
• One document control system and master list for the whole system.
  
• Up-to-date environmental aspects and occupational risk assessments, each with its own method.
  
• One register of compliance obligations, with a completed evaluation.
  
• One internal audit programme, with findings traced to each standard.
  
• One corrective action system, with root cause analysis.
  
• One management review, with decisions, owners and dates.
  
• A level of integration described in the certification application and demonstrable at stage 1.
  

How does a combined QHSE certification audit work?

In one go, by a team covering all three standards, under rules every accredited certification body must apply. Global ACI-TECH-3-008 is mandatory for applying the requirements of ISO/IEC 17021-1, the accreditation standard for certification bodies, to audits against several management system standards. It covers the audit of a management system against two or more standards conducted at the same time: the combined audit. A precondition: the certification body must be accredited for all three standards.

The time saving comes from concrete efficiencies listed by Global ACI: one opening and one closing meeting, one integrated report, optimised logistics, fewer team meetings, and common elements such as document control audited once. A grid crosses the level of integration with the team’s multi-standard competence; at 20% integration it grants no reduction at all. In the document’s example, three auditors cover three standards, one qualified for all three, one for two and one for one: the competence ratio used is 50%. Time is saved by real integration, not by negotiating the quote.

Before you sign, ask the certification body for: its accreditation for all three standards in your sector; the audit time calculation and its justification; the qualifications of each auditor; the report format; where the ISO 9001:2026 and ISO 14001:2026 transition audits fit in the combined cycle; and the form of the certificates issued, one per standard or a single certificate, which Global ACI-TECH-3-008 does not set.

In Morocco, the Ministry of Industry and Trade publishes, on its online documents page, lists of management system certification bodies accredited to NM ISO/IEC 17021-1, with their scopes, dated 2020 and 2021. Elsewhere, check the accreditation body named on the certificate. We recommend no certification body: we prepare your system for any accredited one.

Can other standards join the system, such as ISO 22000 or ISO 50001?

Yes, on the same foundation. Global ACI lists ISO 22000, ISO/IEC 27001 and ISO/IEC 20000, alongside ISO 9001 and ISO 14001, among its examples of standards used as audit criteria, and refers each standard to its own audit time rules, such as ISO 22003-1 or ISO/IEC 27006. Its document also applies to sector schemes unless their rules prohibit it. A food site certified to ISO 22000 can share the ISO architecture with ISO 9001 and ISO 14001.

The FSSC 22000 Version 7 scheme itself states that it allows integration with ISO-based management system standards, including quality, environment and health and safety, and lists IAF MD 11 on audits of integrated management systems among its references. When the FSSC 22000 audit is combined or integrated with other food safety audits, the report states the total duration of the combined audit, which is longer than for FSSC 22000 alone and sufficient to cover all its requirements.

ISO 50001, ISO/IEC 27001, ISO 22301 or ISO 37001 plug into the same process map: see QHSE and ISO systems.

In what order should you integrate, with ISO 45001 still to change?

Build on the editions in force, without waiting. ISO’s technical committee confirmed the revision of ISO 45001 in late 2023 and expects it in 2027; the transition period has not been set. For a site certified to the 2015 editions of ISO 9001 and ISO 14001, the transition is the right moment to integrate: one gap review, one documentation update, one round of internal auditor training.

Which mistakes make an integrated system fail?

They share one root cause: integration on paper, not in practice.

• Merging the analyses. A single "QHSE risk" matrix loses environmental significance criteria and the hierarchy of controls.
• Integrating on paper only. One manual, but three teams and three action plans: the certification body sees it at stage 1 and revises audit time.
• Confusing clause numbers. From one standard to another, the same number does not always cover the same subject: cross-reference by subject.
• Forgetting the workers. For OH&S, the auditor interviews workers’ representatives and operators.
• Relying on one person. If the QHSE manager leaves, all three standards slip together.

Who runs the integrated system day to day?

Top management owns it, process owners run it, the QHSE manager coordinates it. Without a full-time QHSE manager, the role can be filled part-time, with a designated deputy and monthly reporting in your Inspirra client portal: see outsourced QHSE. The system can be run on Normativa, the self-service compliance platform built by Solvitas, ACG’s start-up studio; dashboards and digital management of the system fall under diagnostic and transformation.

How do you train the teams and fund the training?

Our ISO standards training covers the integrated QHSE system, ISO 9001:2026, ISO 14001:2026, ISO 45001:2018, internal auditing to ISO 19011 and CQI / IRCA-certified Lead Auditor courses, delivered with approved training partners, on site, in public sessions or remotely through OmniLearn, in French, Arabic or English, with Spanish and Portuguese on request. For Moroccan companies, in-person courses in the training plan may qualify for OFPPT special training contracts (CSF), under the rates and ceilings in force; distance learning is not eligible, and consulting and certification audits remain at the company’s expense. These rules come from the CSF procedures manual of May 2006, amended by amendment No. 2 of 2 June 2014 (in French): rates apply to the cost excluding VAT. The GIAC may support training engineering, under its procedures manual, up to 100,000 DH per year per company. Points specific to your file are confirmed with OFPPT, on its CSF page, or with the competent GIAC. We never promise an amount: see CSF and OFPPT funding.