Integrated ISO 9001 + 14001 + 45001: One System, Three Certificates — When It Costs Less and Works Better

Short answer: An integrated management system runs ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (safety) as one system — one set of documents, one internal audit programme, one management review. You still receive three separate certificates, one per standard. And the saving is real but smaller than most vendors claim: the accreditation rule caps the audit-time reduction at 20% of the summed audit days.

If you run a factory, a construction firm or a warehouse, you probably already feel the drag. Three certificates on the wall, three folders of procedures, three audit visits a year, three management review meetings that cover the same ground with different slides. Each system was built at a different time, usually by a different person, and nobody ever joined them up. That is the exact problem an integrated management system — an IMS — is meant to solve. The question is not whether integration helps. It does. The question is how much it helps, and where it stops helping. Both answers are more modest than the sales pitch.

What an integrated management system actually is

An IMS is a single management system that meets the requirements of two or more ISO standards at once. In the combination most Indian manufacturers and contractors ask about, those standards are ISO 9001:2015 for quality, ISO 14001:2015 for environment, and ISO 45001:2018 for occupational health and safety.

Integration works because the three standards were deliberately built on the same skeleton. ISO calls it the Harmonized Structure — earlier, Annex SL. All three follow the same ten-clause layout, the same Plan-Do-Check-Act rhythm, and the same core ideas: understand your context, lead from the top, plan around risk, support the system with people and documents, run operations under control, check performance, improve. Clause 9.3, management review, is clause 9.3 in all three. That shared skeleton is what makes one system possible at all.

Think of it like a control room. Three separate systems are three control rooms in three buildings, each with its own operator, its own logbook and its own alarm panel — all watching the same factory. An integrated system is one control room with three dials on the same panel. The dials still measure different things. Quality, environment and safety do not become the same subject. But one operator reads them together, one logbook records what happened, and one meeting reviews all three.

There is also a formal framework for this, if you want one. PAS 99:2012, published by BSI, is the "Specification of common management system requirements as a framework for integration". It collects the requirements the standards share, so you meet them once instead of three times. What PAS 99 does not do matters as much: it does not replace ISO 9001, 14001 or 45001. Each standard keeps its own discipline-specific requirements, and those still have to be met in full.

One system, three certificates

This is the first thing vendors leave fuzzy, so let me state it plainly. An integrated system does not produce one merged certificate. Your certification body issues a separate certificate for each standard — three certificates, three scopes, three expiry cycles that usually run together because the audits run together.

That is a feature, not a defect. A buyer who asks for ISO 14001 wants to see an ISO 14001 certificate with an environmental scope that covers your site and your activities. A combined document with no standard named on it would be worthless in a tender. If you ever need to check whether a certificate handed to you is genuine, the verification steps are the same for each certificate — body on the accreditation list, scope matched, number checked.

Scopes can also differ between your three certificates. Your quality scope might cover all three plants while your safety scope covers only the two where the hazardous work happens. An integrated system has to carry those differences honestly, not paper over them with one blanket scope statement.

What merges, and what must stay separate

Integration is a merging exercise with a hard limit. The shared machinery merges. The discipline depth does not.

The right-hand column is where thin integrations fail. An auditor who finds a one-page aspects register for a chemical plant, or a hazard list copied from a template with your company name pasted in, will not be comforted by your beautiful integrated manual. A system that is lean on paper but shallow in its discipline detail is worse than three separate systems that each do their job. I have seen that sentence in an auditor's guidance note, and it is the truest line in this whole subject.

The saving, honestly stated

Now the number everyone wants. Vendor blogs in this space routinely claim integration cuts compliance cost by 30 to 40%, and I found one claiming up to 60%. Those figures come from consultancy marketing pages, not from any rule. The rule that actually governs what a certification body may do is IAF MD 11:2023, the International Accreditation Forum's mandatory document for audits of integrated management systems. It says, in plain terms:

First, the certification body calculates the audit time for each standard separately. Then it adds them together to get a starting figure. Then it adjusts that figure for how genuinely integrated your system is. And where the adjustment is a reduction, it shall not exceed 20% of the starting figure. Every requirement of every standard must still be audited. The reduction is capped, and the justification must be documented.

Here is what that means in days, with round illustrative numbers. Suppose your audit times work out at 2 days for quality, 1.5 days for environment and 2 days for safety. Added together, that is 5.5 days. A 20% reduction takes off 1.1 days, leaving 4.4 — which audit-day practice rounds to 4.5 days. You saved one audit day, not two or three. Across a three-year certification cycle with annual surveillance visits, that saving repeats, and it is real money — auditor fees, travel, and your own team's time in the room. But it is a 20% ceiling on audit time, not a 40% cut to your total cost of compliance.

The rest of the saving is genuine but unquantifiable in advance, and any consultant who gives you a fixed percentage for it is guessing. One document set instead of three means one round of updates when a procedure changes. One audit programme means your engineers prepare once instead of three times. One management review means one meeting, not three. Those savings depend on how messy your current setup is. A company running three genuinely separate systems with three consultants will save far more than a company whose "three systems" are already one folder with three covers.

Should you integrate, or wait?

Integrate now if three things are true. You already hold at least two of the three certificates, or you are buying two or more together. Your sites and teams overlap — the same plant, the same supervisors, the same contractors. And your buyers or tenders ask for more than one of the three, so the certificates work as a set.

Wait if your first system is still shaky. If your ISO 9001 certificate is six months old and your team still treats it as the consultant's paperwork, folding two more standards into it will not strengthen it — it will spread the same weakness wider. Wait too if your sites run very differently: a head office plus a remote plant with its own safety regime may be better served by separate systems with a shared document-control habit, rather than a forced single manual. And wait if one of the three disciplines exists only on paper in your company today. Integration cannot create an environmental practice or a safety culture. It can only organise the ones you already have.

A useful test: can your plant head explain, without notes, how a single change — say, a new chemical on the line — gets checked for quality, environmental and safety impact before it goes live? If yes, your organisation is ready to integrate. If that question produces three different answers from three different people, fix that first. The system follows the habit, not the other way round.

How to build one, in order

Start from your strongest existing system, not from a blank page. If quality is your mature system, it becomes the backbone; environment and safety requirements get woven into its processes rather than bolted on as separate chapters.

First, map the overlap honestly. Lay the three standards' clause structures side by side and mark what is already shared — document control, internal audit, management review, corrective action — and what is discipline-only. Second, write one integrated manual that describes your real processes, with the discipline-specific registers and controls referenced inside them, not appended as annexes nobody reads. Third, merge the audit programme: audit by process, not by standard. When you audit procurement, you check it against quality's supplier controls, environment's supplier requirements and safety's procurement controls in the same visit. Fourth, hold one management review covering all three standards, with separate targets reported inside it. Fifth, run one internal audit cycle across the whole integrated system before the certification body arrives, so the gaps surface on your timetable, not theirs. Sixth, ask the certification body for a combined audit — Stage 1 and Stage 2 covering all three standards in one programme — and confirm the audit days in writing, with the IAF MD 11 reduction shown in the quote.

That last step matters commercially. If a certification body's quote for a combined audit shows no reduction at all against three separate audits, ask why. If it shows a reduction far beyond 20% of the summed days, ask what rule permits it. The 20% cap is your negotiating anchor in both directions.

Five mistakes that hollow out an integrated system

One, merging the covers but not the content — a single manual that still contains three separate procedures saying slightly different things. Two, thinning the discipline depth to make the file look tidy, especially the aspects register and the hazard list. Three, a single scope statement that hides real differences between what each certificate covers. Four, letting one discipline's champion run the whole system, so safety becomes a paragraph in a quality manual. Five, treating the combined audit as a discount exercise rather than a design exercise — the saving follows from genuine integration, and auditors test integration at Stage 1. A system integrated only in its table of contents will be priced as three separate audits anyway.

What it costs in India

On ComplyKart's current consultancy pricing, each of the three standards sits at the same tiers: ₹9,999 for the Standard tier (up to 25 employees) and ₹19,999 for Growth (26 to 100 employees), consultancy only. The three Standard tiers add up to ₹29,997 by simple arithmetic — that is the sum of three published prices, not a combined package price, and a genuinely combined engagement is quoted as one scope. Certification-body audit fees sit on top, at actuals, and they are where the IAF MD 11 reduction lands: fewer audit days means a smaller audit fee, within that 20% ceiling. ISO 9001 certification, ISO 14001 certification and ISO 45001 certification each carry their own process and documents, and the compliance fee calculator helps put the filing and certification costs side by side before you commit.

Do not buy integration for the percentage. Buy it because one control room beats three, because your team will actually use a system they only have to open once, and because a buyer reading your three certificates will see one organisation behind them instead of three filing cabinets. The saving is real. It is just smaller, and more honest, than the brochure says.

Frequently asked questions

Do I get one certificate for an integrated management system?
No. You run one system and one audit programme, but your certification body issues a separate certificate for ISO 9001, ISO 14001 and ISO 45001, each with its own scope. A single merged certificate naming no standard would not satisfy a tender or a buyer.

How much audit time does integration actually save?
Under IAF MD 11:2023, the certification body adds the audit days for each standard, then may reduce the total by at most 20% where integration is genuine. On an illustrative 5.5-day total, that means 4.5 days — one day saved, not two or three.

What is PAS 99?
PAS 99:2012 is BSI's specification of the management-system requirements that standards have in common, designed as a framework for integration. It helps you build one system, but it does not replace ISO 9001, 14001 or 45001 — each standard's own requirements still apply.

Can I integrate if I only hold one certificate today?
Yes, and it is often the cheapest moment to do it: adding a second or third standard to a system that is already integrated is a smaller piece of work than building a separate system later. But if your first system is still fragile, strengthen it before you widen it.

Does integration change my surveillance audits?
No, the cycle stays the same: annual surveillance visits across a three-year certificate life, then recertification. What changes is that each visit covers all three standards together, so the 20% audit-time logic applies to surveillance days as well as to the initial certification audit.