Integrated ISO management systems: when mid-market plants should stack 9001 + 14001 + 45001

This page is a buying guide. It is for operations, quality, and EHS leads at mid-market plants who are deciding whether ISO 9001, ISO 14001, and ISO 45001 belong on one certification-body (CB) programme this cycle — and how to write that request so every registrar quotes the same object.

It is not the standards desk. Sequencing quality → security → AI lives on the integrated path and the 9001 → 27001 → 42001 chapter. Do not treat those pages as an RFQ. This page does not republish how to write the outbound pack, what a quote should include, or multi-site scope. It does not invent prices, day-rate totals, accreditation identifiers, or audit-day tables.

The question here is narrower: when does stacking 9001 + 14001 + 45001 make an honest RFQ, when does it make a messy one, and what has to sit on the pack so day counts stay comparable. If the room is only choosing between ISO 9001 and ISO 14001 this cycle, and 45001 is not on the table, use the 9001 vs 14001 comparison. If the room is choosing between ISO 9001 and ISO 45001 this cycle, and 14001 is not the argument, use the 9001 vs 45001 comparison. If the room is choosing between ISO 14001 and ISO 45001 this cycle, and 9001 is not the argument, use the 14001 vs 45001 comparison. If the room is choosing between ISO 14001 and ISO 50001, energy management is not a fourth mark on this stack: use the 14001 vs 50001 comparison. If the room is choosing between ISO 9001 and ISO 22000 for a food, beverage, ingredient, or food-contact packaging plant, food safety is not a fourth mark on this stack: use the 9001 vs 22000 comparison. Come back here when all three belong on one programme.

1. What “integrated” means for a mid-market plant

“Integrated” is a management-system word. Salespeople use it as a discount word. Those are not the same job.

For a plant, an integrated management system (IMS) means the work is one system:

• One set of documented information for the clauses that Annex SL already shares — context, leadership, planning, support, operation, performance evaluation, improvement.
• One internal-audit programme with quality, environment, and OH&S modules, not three calendars that never meet.
• One management review that can see product nonconformities, environmental aspects, and incidents in the same room.
• Named owners who actually run aspects, legal obligations, hazards, and customer quality — not a quality manager who inherited three binders the week before Stage 1.

You will still often receive three certificates. Integration is not a promise that the stationery collapses. It is a promise that the audit programme is designed as one object: which clauses are sampled once, which technical requirements are sampled separately, who the lead auditor is, and how the three-year cycle is staffed.

The opposite pattern is three certificates bolted together:

• Three document-control procedures that disagree about the same work instruction.
• An EMS legal register nobody opened since the consultant left.
• An OH&S incident process that lives in HR while quality CAPA lives in a different tool.
• Three closing meetings because the CB sent three specialists who never read each other’s notes.

That pattern can still produce accredited certificates. It cannot produce an integrated quote you can compare. If the system is three systems, say so on the pack and buy three programmes — or fix the system before you invite a CB to pretend otherwise.

A mid-market test that usually holds:

You probably have an IMS	You probably have three bolted programmes
Quality and EHS share document control, CAPA, and the management-review agenda	Each standard has its own “manual” and its own owner who does not sit in the other’s review
Aspects, hazards, and process risks are maintained by people who walk the floor	The aspects list and the hazard register were written for a Stage 1 pack and have not moved
Internal audit samples a coating line for quality and solvent control and PPE in one visit plan	You schedule “the 14001 week” as if it were a different company
The same legal entity, the same producing sites, the same shifts	Sister badges on the door, different payroll, one hoped-for certificate

Integrated is the first column. The second column is not a moral failing. It is a reason not to ask five bodies to quote an IMS they will not find.

2. When stacking 9001 + 14001 + 45001 makes sense

Stack the three operations standards on one CB programme when the customer, the sites, and the ownership already point that way. Not because a brochure lists all three.

Customer EHS portals. Primes, OEM supplier quality, and export questionnaires increasingly store 14001 and 45001 next to 9001. If the portal will not let you ship without the EHS pair, this cycle is an operations-stack buy. Write the three standards on the pack. Do not run a 9001-only RFQ and “add EHS later” in a side email the other bodies never see.

Multi-site manufacturing that already shares procedures. Two plants, a warehouse, and a coating line under one quality/EHS function is the classic IMS object. The producing map is the same map: receiving, process, dispatch, contractors on the floor. Sampling logic can be designed once if the system actually reaches every location. How to write that map is multi-site certification scope. This page only needs the buying consequence: if the sites are one system, the RFQ is one IMS programme, not three site lists.

Overlapping procedures you already run. Document control, competence, internal audit, management review, nonconformity and corrective action, change control, contractor control. If those processes already serve quality and EHS, an integrated audit is sampling work you do. If they only serve 9001 and the EMS/OHSMS are a consultant ZIP file, you do not have a stack. You have a 9001 certificate and a future project.

One owner who can staff the programme. Integration fails in mid-market plants when quality owns the RFQ and EHS is “the plant manager’s other job.” Aspects, legal registers, monitoring, incident investigation, worker participation, and emergency preparedness are not clauses you can borrow from the quality manual the week before Stage 2. If a named person (or a small named team) already runs those, stacking is efficient. If not, stacking is a finding generator.

Same legal entity, same producing work. The certificate names a company, not a brand on the reception sign. When one entity operates the plants you want on the wall, one IMS programme is the honest product. When two entities share a campus and only one of them follows your documented information, they should not share this certificate.

Typical plants that should stack this cycle: an assembly shop whose portals already store EHS next to 9001; a coatings or chemicals operation where aspects and hazards are not optional chapters; a multi-site manufacturer that already runs one internal-audit programme; a firm that already holds 9001 and has been operating 14001/45001-shaped processes long enough that Stage 1 would find evidence, not a plan.

Stacking is a programme design. It is not a way to make the invoice look smaller. Integrated audits follow their own rules (buyers usually meet this as IAF MD 11 on top of MD 5 duration). A smaller total day count can be the right design when processes are genuinely shared. An unexplained smaller count is a warehouse, a night shift, or an aspects list that quietly left the pack.

3. When not to stack them

Do not put 14001 and 45001 on the RFQ to look thorough. Do not keep them off the RFQ to look cheap. Write the programme you can staff and that a customer actually requires.

Tiny single-site, 9001-only gate. A one-building job shop whose bid forms name ISO 9001 and nothing else does not need an IMS theatre. Buy 9001. Run environmental and safety as operational discipline if that is already your culture. Add certified EMS/OHSMS when a portal, an insurer, or a genuine risk profile requires the mark. Three standards on a twenty-person site with one quality coordinator is how Stage 1 becomes a documentation project.

A forced 27001-only gate. If the customer that is blocking revenue wants an ISMS, that is a trust-stack buy. Padding the same RFQ with 14001 and 45001 because “we should do IMS” mixes two site maps and two competence needs. The plant list for quality is often not the information-security map. Keep the operations stack off that pack unless EHS is also a named requirement this cycle.

Immature EHS ownership. No aspects and impacts that a supervisor would recognise. No legal-obligations register that legal or EHS actually maintains. No hazard identification that matches the floor. No incident learning that reaches management review. No worker participation you could show an auditor without staging it. That is not an integrated programme. It is 9001 plus two future standards. Write 9001 (and only 9001) on this RFQ, and put a date on when EHS ownership will be real.

Different legal entities that should not share a certificate. A sister machine shop on the same campus, a JV coating line, a 3PL warehouse with your parts and their system, a sales company that invoices in a different country. Shared parking is not a shared management system. If documented information, internal audit, and management review cannot reach that badge, it is out of this certificate. Forcing it onto an IMS pack under-scopes someone else’s work or over-scopes yours.

Leave fashionable EHS off the pack: “customers might ask” is not a scope. Leave a consultant-written IMS nobody runs off the pack as evidence — disclose who implemented the system; do not send the binder as if the floor had seen it. Leave “we’ll add 27001 onto the IMS week” off as a method; those standards belong later, or on a second pack.

If you are unsure, default to fewer standards, honestly scoped. You can extend. You cannot un-omit a wastewater skid after Stage 1 without added days.

4. How one RFQ / scope pack keeps day counts honest

Unlike packs produce unlike day counts. That is true for one standard. It is louder for three.

The outbound artifact is still one page, sent once, to every body on the shortlist. How to write that page — checklist, what to leave out, copy-ready outline — is how to build a registrar RFQ / scope pack. How to read the reply — cycle table, days by stage, travel, integration method — is what a CB quote should include. This section is only what an IMS pack must add so those two chapters still work.

Put on the pack, in language a quoting manager will not have to decode:

• Which standards and editions, named. 9001:2015, 14001:2015, 45001:2018 — only the ones in this cycle. “ISO and EHS later” is not a programme.
• Which standards apply at which site. A warehouse may be in the QMS and EMS and barely in OH&S, or the reverse. A design office may be in 9001 and out of 14001. Write the matrix. Do not let every CB invent a different one.
• Which processes are shared. Document control, internal audit, management review, CAPA, competence, contractor control. Shared means sampled once in an integrated design. If a process is not actually shared, say so — otherwise one body will reduce days for integration and another will audit it three times.
• Which processes are standard-specific. Environmental aspects and life-cycle perspective. OH&S hazard identification, worker participation, incident investigation. Quality process control, customer property, design if you have it. These are not “the IMS clauses.” They are why a generic QMS auditor is not an EMS/OHSMS team.
• Sites, headcount bands, shifts, central function. Same rules as any pack. Headcount is a band per site, not a company-wide about-page number. Night shift still exists when the IMS includes a process that runs at night.
• Legal entity the certificates should name, and any sister company that must stay off them.
• Who owns EHS versus quality, by name or role. If they are the same person, say so. If they are not, say who attends management review for which standard.
• Existing certificates and whether this is initial, surveillance-shaped, or a transfer.
• Whether 27001 or 42001 is this cycle. If it is not, write “later” and a recheck date. Do not leave a blank the salesperson will fill with a fashionable add.

Ask each body to restate that matrix in the proposal: sites used, standards per site, shared versus separate processes, integration method in one sentence, days by stage and year, on-site versus remote split, travel policy. You are not asking for a single number. You are asking for a designed programme you can line up next to two others.

What the pack must not do:

• A day-count target dressed up as a requirement. “Keep this under X days because we are integrated” teaches the salesperson what to omit.
• A different EHS story for the famous brand. The global TIC name does not get a tidier aspects list.
• A request for a price with no site-by-standard matrix. Duration starts from effective personnel, complexity, and scope. IAF MD 5 is the usual starting point for QMS, EMS, and OHSMS duration; MD 11 is the usual reference for how integration changes that design. Your job is to see the justification in writing, not to guess a number this site will not publish.
• The whole IMS binder. Quoting managers will not mine your quality manual for the second shift.

If two replies used different buildings or a different standard-per-site map, stop scoring. Send the same pack back. That is not a price fight. That is two programmes.

5. Auditor competence and scheduling (qualitative)

An integrated programme is only as honest as the people who walk the floor.

Competence is a team design, not a logo. ISO/IEC 17021-1 and the related competence requirements ask the CB to put auditors on work they can actually sample. A lead who lives in 9001 and has never stood at a wastewater skid, a solvent still, or a lock-out point is not an IMS lead. A safety specialist who has never sampled a customer-complaint process is not a three-standard lead either. What you want in the proposal is a sentence about how the team is built: QMS + EMS + OHSMS competence on the visit, technical experts where your processes are not generic, language of the work, not the language of the sales office.

Do not ask for CVs of named auditors as a substitute for that sentence. Named people move. The method should not.

Scheduling is a plant constraint, not a CB courtesy. Integrated visits are efficient when quality, environment, and OH&S can be sampled in one window without staging a second shutdown. They are a problem when:

• Inventory week, peak season, or a customer shutdown already owns the only quiet fortnight.
• Worker interviews for 45001 need a shift the quality interviews never see.
• The legal-obligations walkthrough needs EHS and maintenance, who are not in the quality opening meeting.
• One site can take visitors and another cannot (union rules, visitor badges, classified work, IT access for evidence).

Write those constraints on the pack. A body that cannot live with your inventory week should no-bid. A body that “fits you in” without reading the window is a weak proposal.

Remote versus on-site is per activity, not a vibe. Documented-information review can often be remote. Process sampling at a coating line, a press, or a warehouse dock is usually not. Worker participation evidence for 45001 is hard to fake well on a video link and easy to fake badly. Say what you will and will not allow, by site type. Do not hope every CB guesses the same split. The dedicated chapter is remote vs on-site ISO audits.

This directory will not invent a “typical IMS day count.” Duration is calculated from your headcount bands, complexity, sites, and the integration method the CB can justify. If two CBs differ by a large number of days on the same pack, one of them dropped a process, a shift, a warehouse, or the integration reduction. Ask for the assumptions. That conversation belongs with quote anatomy, not with a blog number.

6. Adding 27001 or 42001 later — do not force them into the first IMS RFQ

The operations stack and the trust stack are different buys.

9001 + 14001 + 45001 samples plants, warehouses, contractors on the floor, aspects, hazards, and customer process control. ISO/IEC 27001 samples information assets, risk treatment, and a Statement of Applicability that has to be true. ISO/IEC 42001 samples AI governance — where models are approved and monitored — and assumes you can already talk about information risk without theatre.

Those later standards often live at a headquarters, a development office, or a cloud estate the factory certificate never named. They need different auditor competence. They may need a second CB. Dual-CB programmes (a manufacturing-savvy registrar for the operations stack, a security-savvy body for ISMS/AIMS) are a common mid-market design. They are not a failure to pick a winner.

So:

• If 27001 or 42001 is twelve to twenty-four months out, write that as a later add on the IMS pack. Put a recheck date for live accredited scope. Do not ask five bodies to quote a fashionable line you cannot staff.
• If a customer is blocking revenue on 27001 now, that may be the first RFQ — and the EHS pair may wait. Do not glue them together to satisfy a slide about “one IMS.”
• If you truly want one CB for the full stack, the pack still names two maps: where quality and EHS work happens, and where information or AI work happens. Same campus is a fact. It is not a default.

The sequence, the recheck habit, and why skipping into 42001 is usually a missing ISMS live on the quality → security → AI path. This page only requires that you do not pad the first plant IMS RFQ with trust-stack standards you are not ready to operate.

ISO 22301, a business continuity management system, is a different buy from this plant stack and from a 27001 line. If the room is choosing between continuity and information security, use ISO 22301 vs ISO 27001.

7. Multi-site IMS caveats

If more than one location does work the certificates will claim, you have a multi-site programme whether or not you call it an IMS. The site chapter is multi-site certification scope. Do not paste it here. Three caveats belong on this page anyway.

The operations map often is the same map. Producing sites and warehouses usually sit in 9001, 14001, and 45001 together. Sampling can be designed once if the IMS is real. That does not make sampling a discount you write into the RFQ. Ask the CB to show the design: which sites this year, which next year, what happens when you add a location.

The central function is still one building — name it. The site that owns documented information, internal audit, and management review is visited on a different cadence than the sampled plants. In a healthy IMS that building is also where EHS records live. If quality lives at headquarters and the aspects register lives in a plant shared drive nobody audits, you do not have a central function. You have two. Write that, or fix it, before anyone counts days.

Do not use IMS language to hide a site. “We are integrated, so Dallas is represented by Cleveland” is not a method. Homogeneous processes can support sampling. A second process, a second shift, a wastewater plant, or a warehouse that ships certified work is still a site. Integration reduces duplicate clause sampling. It does not delete geography.

Temporary sites, exclusions, and sister-company badges are the same honesty tests as any multi-site pack. IMS does not relax them.

8. Decision checklist, then send one pack

Work top to bottom. If you cannot tick a row, that row is the programme — not a footnote for after kickoff.

1. Customer gate. Which marks does a portal, contract, or insurer actually require this cycle? 9001 only, 9001 plus EHS, or a 27001-only block that should not sit on this RFQ.
2. System, not stationery. Do quality, environment, and OH&S already share document control, internal audit, and management review — on the floor, not in a consultant file?
3. Ownership. Named quality owner. Named EHS owner (they may be the same person). Someone who can show aspects, legal obligations, hazards, incidents, and worker participation without staging a tour.
4. Legal entity. One company the certificates should name. Sister badges that must stay off them, written as exclusions or as a different programme.
5. Site-by-standard matrix. Every location, a headcount band, processes, shifts, which of 9001 / 14001 / 45001 apply. Central function marked.
6. Shared versus specific processes. What will be sampled once. What cannot be.
7. Constraints. Shutdown weeks, no-remote rules, languages, union or visitor access, the window you can staff.
8. Not this cycle. 27001 / 42001 later, with a recheck date — or a separate pack if they are the actual gate.
9. One pack, three to five bodies. Same page to every CB. Score replies on restated scope, integration method, competence, and planning window — not a single bottom-line number. How to build the set is the shortlist. How to choose at all is the selection method.
10. Verify the entity before you invite a body you cannot award (accreditation lookup). This site’s directory tags are editorial, not a live feed. One Dayton, Ohio profile publishes an ANAB scope that lists ISO 9001, ISO 14001, and ISO 45001 on three sector tables that are not the same length: Eagle Certification Group. A quality code on that issue is not an environmental line and is not an occupational health and safety line. Read the profile, then confirm the live schedule for each site.

If the stack is the honest product, submit that IMS pack with the Get quotes button below. Then open the directory and keep the shortlist to names you can actually award.

Do not send a thinner pack to the logo you already like. Do not collect numbers before the matrix is written. Do not treat the standards desk as a substitute for this RFQ. Sequence is a different chapter. This page is when the operations stack belongs on one programme, and how to ask for that programme without folklore.