Integrated ISO 9001, 14001 and 45001 Audits: What the Certification Body Checks

Many manufacturers hold certificates to ISO 9001, ISO 14001, and ISO 45001 and have them audited together. An integrated management system audit can save time, but it also exposes weak spots, especially in the EHS parts of the system when no dedicated EHS staff is in place.

Why Integration Works

All three standards follow the ISO Harmonized Structure: the same clause numbers and core text for context (4), leadership (5), planning (6), support (7), operation (8), performance evaluation (9), and improvement (10). That shared structure lets one set of processes, such as document control, internal audit, and management review, serve all three standards. The International Accreditation Forum's mandatory document IAF MD 11 sets rules for how certification bodies conduct audits of integrated systems.

What the Certification Body Checks Across All Three

• Context and interested parties (4.1, 4.2): including climate change considerations added by the 2024 amendments.
• Leadership commitment (5.1): can top management explain the policies and how the system supports business goals?
• Risks and opportunities (6.1): is there a single approach, and does it address quality, environmental, and safety risks?
• Internal audit (9.2): did audits cover all three standards and all processes within the planned cycle?
• Management review (9.3): were all required inputs for each standard considered?
• Corrective action (10.2): are nonconformities analyzed for root cause and closed effectively?

What Is Specific to EHS

• ISO 14001: environmental aspects and impacts, compliance obligations, and evaluation of compliance (9.1.2).
• ISO 45001: hazard identification, consultation and participation of workers (5.4), incident investigation (10.2), and evaluation of compliance (9.1.2).

Where Integrated Systems Fall Short

The quality side of an integrated system is often mature because it touches customers every day. The EHS side is more likely to fall behind: compliance evaluations not completed, worker participation not documented, or risk assessments not updated after changes. When the person responsible for EHS leaves, these gaps grow quickly.

Preparing

Review the last audit report and confirm previous findings are closed. Check that internal audits and management review covered every standard. Then walk the EHS-specific requirements with the people who own them today.

Related reading: Integrated EHSS Auditing and ISO 14001 vs ISO 45001.

How Compliance Fortress Solves This: The Exceleor Path

1. Discovery: understand the problem, measure where things stand today, and agree on what success looks like.
2. Define the engagement path: most organizations don't know the path. We do. A proven method, tailored to your situation.
3. Training: bring your people to a clear understanding of the requirements.
4. Implement and engage: carry out the work jointly, with your people involved from day one.
5. Verify: confirm the work was done and meets the requirement.
6. Validate: confirm the original problem is actually solved, measured against the success measures from Discovery.
7. Transfer ownership: we collaborate throughout, so your team can run it without us.
8. Sustain and grow: we stay close, check in, and catch the next need early. We're here to make sure you succeed.

Is this your situation? See how we approach it on the Integrated Audit Coming, No EHS Staff page, or request a Situation Review. You can also email [email protected].