ISO 9001, 14001, 45001 cross-reference matrix: merge docs and audits

Why start with documentation and internal audit?

Because they are two of the seven criteria that set your level of integration, and the first ones the auditor sees. Annex 1 of Global ACI-TECH-3-008, the mandatory document of Global ACI (Global Accreditation Cooperation Incorporated, the organisation that has taken over the IAF’s role in accreditation), lists first an integrated documentation set, including work instructions, then, among the other criteria, an integrated approach to internal audits. The certification body confirms this level at stage 1 and takes it into account when setting the time for the combined audit.

These two workstreams drive the others. A single document control system forces a single process map; a single audit programme forces a single action register. The overall framework, what to merge and what to keep, is in our guide to the integrated QHSE management system for factories in Morocco. Here is the step-by-step method.

Step 1: how do you take an inventory of the three systems?

One line per document, record or register, whichever standard created it. For each line: title, current code, original standard, owner, date of last revision, and one simple question: is it used? The inventory is taken on the shop floor as much as on the server: the instruction posted at the workstation is not always the one in the document base.

What you almost always find in a factory that has piled up certifications:

• two or three document control procedures, with different numbering systems;
• an environmental legal register and a health and safety register that do not cite the same texts;
• two emergency plans, with different assembly points or emergency numbers;
• three audit programmes and three action registers;
• quality instructions and safety instructions posted side by side, for the same task.

Step 2: how do you build the cross-reference matrix?

By subject, not by clause number. The numbers do not always match: according to the Global ACI transition document, ISO 9001:2026 splits its clause 6.1 into 6.1.1 (determining risks and opportunities), 6.1.2 (actions to address risk) and 6.1.3 (actions to address opportunities), whereas ISO 45001:2018 numbers this chapter differently, and it also covers hazard identification. A matrix built number against number mixes subjects up.

Extract from a working matrix (to be completed from the official texts):

The ISO 9001:2026 and ISO 14001:2026 numbers come from the Global ACI transition documents; for ISO 45001:2018, the extract sticks to the chapters of the common structure. The detailed cross-reference is built from the texts of the three standards.

The last column does the work: for each subject, it names an integrated system document and says whether the subject is shared, specific to one standard, or shared in form only. That is the column you will show the auditor when they look for where a requirement is addressed.

Steps 3 and 4: what do you do with each document, and how do you rewrite it?

Three possible decisions, taken with the owner of the process concerned.

• Merge what covers the same subject: document control, competence, management of change, internal audit, corrective action, management review, register of environmental and health and safety compliance obligations, emergency plan.
• Keep specific what has its own method: environmental aspects analysis, occupational risk assessment by work unit, review of customer requirements, product release.
• Withdraw what nobody uses, with the owner’s agreement, archiving it under the new procedure.

The rewrite follows an order. First the document control procedure and the master list, with numbering by process: the list shows, for each document, the standard or standards covered. Then the single registers. Finally the work instructions, which bring together on one page what the operator needs to know:

• the task and the quality criterion to meet;
• the hazards of the workstation and the protective equipment, taken from the risk assessment;
• the environmental instruction: sorting, where the effluent goes, what to do in the event of a leak;
• whom to call if something goes wrong.

They are written with supervisors and operators, in French or Arabic depending on the job in a Moroccan plant, or in the working language of the team elsewhere. For a factory moving to ISO 9001:2026, the new requirement on quality culture and ethical behaviour (clauses 5.1.1 and 7.3, according to Global ACI) belongs in the shared awareness programme, not in one more document.

Step 5: how do you build an integrated internal audit programme?

An annual programme, by process, risk-based in line with the ISO 19011 guidelines, with each process audited from all three angles. The audit follows the real work: receiving raw materials is looked at simultaneously as a conformity check, a hazardous handling operation and a possible spill point.

An illustrative programme for a medium-sized factory, to be adapted to your risks and your results:

Three rules make the difference.

1. A team that covers all three standards. Each internal auditor does not have to master them all; build pairs that combine specialisms. Global ACI applies the same logic to certification teams: the audit team as a whole must be competent for each standard.
2. Traced findings. Each finding cites the requirement and the standard or standards concerned. A drum of solvent stored without secondary containment next to a drain touches both environmental emergency preparedness and the operators’ chemical risk: one finding, two standards, one action.
3. Independence. Nobody audits their own work. In an SME with a small team, an outsourced internal audit provides that independence: see audits and inspections.

Step 6: how do you test the merger before the combined audit?

By running the merged system for at least one full cycle: every process audited under the new programme, actions followed up in the single register, then a single management review based on data from all three fields. A combined mock audit then simulates the certification body’s audit, under the same rules.

The most telling test happens at the workstation. Annex 1 of Global ACI-TECH-3-008 asks the certification body to take into account the auditee’s ability to respond to multi-aspect questions. Ask a line operator what they check on the product, what protection they wear and where their cleaning water goes: if they answer all three without hesitation, the merger is real.

Checklist before stage 1 of the combined audit:

• The inventory of the three systems is closed; each document has received a decision.
  
• The cross-reference matrix names an integrated system document for each subject.
  
• A single document control procedure and a master list numbered by process.
  
• Obsolete versions are removed from workstations and archived.
  
• A single register of environmental and health and safety compliance obligations, with a completed evaluation.
  
• Integrated work instructions are posted, in the teams’ language.
  
• The environmental analysis and the occupational risk assessment remain separate and up to date.
  
• A single internal audit programme has been carried out over a full cycle.
  
• Each audit finding is traced to its standard or standards and followed up in a single action register.
  
• A single management review has been held, with decisions, owners and dates.
  

Common mistakes to avoid: merging the occupational risk assessment and the environmental analysis into a single matrix; keeping three numbering systems “so as not to disrupt anything”; leaving all audits to the QHSE manager alone; presenting a shared manual while the registers remain separate.