Integrated QHSE management system in Morocco: a guide for factories

What is an integrated QHSE management system, in practice?

It is a single management system that meets ISO 9001 for quality, ISO 14001 for the environment and ISO 45001 for occupational health and safety at the same time. You will also hear IMS, QHSE system or QSE system, the French acronym used in Morocco. In a factory, you recognise it by four things: one policy, one process map, one document control system and one management review, all owned by the same management team.

The definition that counts for certification is the one set by Global ACI (Global Accreditation Cooperation Incorporated), the organisation that has taken over the role of the IAF, the International Accreditation Forum, in accreditation. Its mandatory document Global ACI-TECH-3-008, version 1.0 issued on 10 July 2026 and in application since 28 August 2026, carries over IAF MD 11 without any substantive change. It describes a range: from a “combined system” that adds separate management systems for each standard, to an integrated management system that shares in a single system its documentation, its management system elements and its responsibilities.

Two consequences follow. Integration is a matter of degree: the certification body measures it, and no manual can simply declare it. And it exempts you from nothing: under the same document, all applicable requirements of each standard are audited. Integrating means handling once what is shared and keeping, for each standard, what belongs to it alone.

Our integrated QHSE management system page sets out our eight-step method. This guide looks at it from the factory’s side: where to start, what to merge, who decides, and how to prepare for the combined audit.

Why do ISO 9001, ISO 14001 and ISO 45001 lend themselves to one system?

Because they share the same clause architecture: context, leadership, planning, support, operation, performance evaluation, improvement. Practitioners often call it the HLS, for High Level Structure. The Global ACI transition documents use the official terms: alignment with Annex SL and the Harmonized Structure.

According to those documents, ISO 9001:2026 and ISO 14001:2026 align with Annex SL and with resolution 16/2025 of the ISO Technical Management Board (TMB), and revise their terms and definitions to align with the Harmonized Structure. For ISO 14001:2026, Global ACI even lists among the clarifications of Annex A the alignment with strategy, business processes and the integrated management system approach. ISO 45001:2018 remains the only edition in force: the ISO/TC 283 committee has confirmed its revision and does not expect it before 2027.

ISO 45001:2018 already shares this architecture: the joint IAF and ISO communiqué of 22 February 2024 lists it among the management system standards that received, in 2024, the two climate change statements added to the text of the Annex SL Harmonized Structure.

The 2026 editions bring the texts even closer on two subjects that shape an integrated system:

• planning of changes: ISO 14001:2026 adds a clause 6.3, and ISO 9001:2026 expands its own (how the effectiveness of changes will be monitored and evaluated, communication of the changes, review of their results). A single change process can therefore examine a new production line from all three angles;
• management review: ISO 9001:2026 adds changes in the needs and expectations of relevant interested parties (clause 9.3.2 c), and ISO 14001:2026 adds sub-clauses under its clause 9.3.

The detail of the changes is in our articles on what changes in ISO 9001:2026 and on ISO 14001:2026.

Where should your factory start, given what is already certified?

With a review of what exists, then four management decisions. The path depends mostly on what is already certified.

The four decisions to take before writing a single line:

1. Scope. The site, its workshops, stores, utilities, treatment plant and outsourced activities: ideally the same for all three standards.
2. Editions. ISO 9001:2026 and ISO 14001:2026 for any new project: according to Global ACI, initial certifications to the 2015 editions end on 31 October 2027 for ISO 14001 and on 31 March 2028 for ISO 9001. ISO 45001:2018 for health and safety.
3. Target level of integration. The whole management layer or only part of it: the target is set against the seven Global ACI criteria presented below.
4. The owner. A member of top management who arbitrates when quality, environment and safety pull in different directions, and a QHSE manager who runs the system.

In the integrated system projects we support, the fourth decision is the one most often underestimated. An integrated system forces trade-offs: line speed against a machine lockout, yield against waste volume, a customer deadline against an evacuation drill. Without a named arbiter, these conflicts come back at every meeting.

What should you merge, and what should you keep separate?

Merge the management layer; keep the underlying analyses separate. In between, many elements can be merged in their form while keeping content specific to each standard.

What stays separate does so for good reason: each analysis has its own method. A single “QHSE risk” matrix loses the environmental significance criteria and the hierarchy of controls for health and safety. The right set-up is a shared treatment of the system’s risks and opportunities, fed by three distinct analyses.

Two processes benefit particularly from integration in a Moroccan factory.

• Contractors. Maintenance, industrial cleaning, waste collection, transport: a single contractor assessment covers the quality of the service, its licences (a hazardous waste collector’s, for example) and its safety rules on site, permits to work included.
• Management of change. A new chemical, a new machine or a change of supplier goes through a single process, with three systematic questions. ISO 9001:2026 and ISO 14001:2026 deal with it in their clause 6.3, ISO 45001:2018 in its operation chapter.

The method for building the cross-reference matrix and merging documents is detailed in our article on the ISO 9001, 14001 and 45001 cross-reference matrix and merging internal audits.

What governance keeps an integrated system alive?

A management team that decides, process owners responsible for all three issues, a QHSE manager who runs the system, and legal bodies linked to it. This is the part no document template provides.

Moroccan law sets part of this governance. The safety and hygiene committee (comité de sécurité et d’hygiène, or CSH) is the joint employer and employee body that the Moroccan Labour Code, Law No. 65-99, requires from 50 employees. According to our reading of the official text, published in Arabic, the committee is mandatory from 50 employees (Article 336), its membership is set by law (Article 337) and its tasks also cover the protection of the environment inside and around the company (Article 338). It meets at least once a quarter (Article 339) and draws up an annual report on how risks have evolved (Article 342). Outside Morocco, check what the local labour law requires.

The integrated system does not replace this committee: it uses it. Its annual report becomes an input to the management review, its investigation minutes feed the action register, and its members take part in the risk assessment of their workshop.

The rhythm that works in an industrial SME:

• a monthly QHSE item at the management committee, on a single dashboard;
• a management review that covers all three fields and is tied to the company’s budget and plan;
• an internal audit programme that takes each process through all three angles at least once per cycle.

When the QHSE function has no full-time holder, it can be filled part-time, with a designated deputy: see outsourced QHSE.

How is an integrated system certified?

Through a combined audit, conducted under Global ACI-TECH-3-008, which every accredited certification body must apply for clause 9.1.6 of ISO/IEC 17021-1, the accreditation standard for certification bodies. The rules start before the audit.

• Application. Your file describes the level of integration: documents, management system elements, responsibilities. The certification body must inform you that the audit time based on this declared level may be adjusted.
• Audit time. The body calculates the time for each standard separately, adds them up, then adjusts. The reduction takes into account the integration, the ability of your personnel to answer questions on more than one standard and the availability of multi-standard auditors; it never exceeds 20% of the total. The complexity of an integrated audit may instead increase it. The calculation and its justification are documented.
• The team. As a whole, it is competent for each standard and each technical area; the team leader is competent in at least one of the standards.
• Stage 1. The team confirms the level of integration, and audit time is revised if needed.
• The audit and the report. All applicable requirements of each standard are audited. The report can be integrated or separate; each finding is traceable to its standard or standards.
• Nonconformities. The body considers the impact of a nonconformity found against one standard on compliance with the others.
• The cycle. At surveillance and recertification, the body confirms that the level of integration has not changed.

What this means for a factory: integration that is written but not lived is paid for at stage 1, and a system that falls apart after certification is paid for at surveillance. The calculation is detailed in our article on combined audit cost and duration.

For a site certified to the 2015 editions, the combined audit is also the natural moment for the transitions to ISO 9001:2026 and ISO 14001:2026: the relevant deadlines are in our article on the integrated management system in 2026-2027.

Choose a certification body accredited for all three standards in your sector. In Morocco, the Ministry of Industry and Trade publishes, on its online documents page, lists of management system certification bodies accredited to NM ISO/IEC 17021-1, the Moroccan adoption of the international standard. Elsewhere, check the accreditation body named on the certificate. We recommend no certification body: we prepare your system for any accredited one.

The form of the certificates issued after a combined audit, one per standard or one joint certificate, is not set by Global ACI-TECH-3-008: ask the question in your request for quotation.

How can you check that your system is really integrated?

By scoring it against the seven criteria the certification body will use. Annex 1 of Global ACI-TECH-3-008 characterises an integrated management system by an integrated documentation set, including work instructions to a good level of development; management reviews that consider the overall business strategy and plan; an integrated approach to internal audits, to policy and objectives, to system processes and to improvement mechanisms; and integrated management support and responsibilities. The certification body decides the percentage level of integration based on the extent to which your system meets these criteria, taking into account the auditees’ ability to respond to multi-aspect questions.

Your self-assessment before stage 1:

• One document base, with work instructions that bring together quality, environment and safety.
  
• One management review, tied to the company’s plan and budget.
  
• One internal audit programme, with findings traced to each standard.
  
• A signed QHSE policy and objectives cascaded by process.
  
• One process map, each process with its three issues and a named owner.
  
• One register of corrective and improvement actions, with root cause analysis.
  
• QHSE responsibilities written into the job descriptions of supervisors and managers, not only into the QHSE manager’s.
  
• An up-to-date environmental analysis and occupational risk assessment, each with its own method.
  
• Operators able to explain the quality, environmental and safety points of their workstation.
  
• A level of integration described honestly in the application file.
  

Process owners, supervisors and internal auditors need training on all three standards. Our ISO standards and management systems training covers the integrated system, ISO 9001:2026, ISO 14001:2026, ISO 45001:2018 and internal auditing. For Moroccan companies, courses written into the training plan may qualify for the special training contracts (CSF) of the OFPPT, Morocco’s Office for Vocational Training and Work Promotion (Office de la formation professionnelle et de la promotion du travail), under the rates and ceilings of the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014); consulting and audits remain at the company’s expense, and we promise no amount (see CSF and OFPPT funding).