Management System Certification to ISO Standards – Single or Integrated

What is management system certification?

ISO describes a management system as the way an organisation manages the interrelated parts of its business in order to achieve its objectives – whether those concern product and service quality, environmental performance, health and safety at work, information security or energy use. A management system standard sets out what such a system must do: leadership takes responsibility, objectives are set, risks and opportunities are assessed, processes are controlled, results are measured and weaknesses are corrected.

In certification, an independent certification body audits your system against these requirements and confirms the result in writing with a certificate. ISO develops the standards but does not certify organisations or issue certificates itself. Certification is voluntary – every standard can be used without it – yet many organisations seek it because customers, contracting authorities or tenders ask for third-party evidence.

What counts in an audit is not whether a document exists. Two questions are assessed separately: is a requirement addressed in your organisation, and can you show that the arrangement is actually followed in practice? A procedure that exists only on paper convinces an auditor no more than good practice for which there is no evidence at all.

Which standards CERTUNION certifies

CERTUNION International is an independent certification body. It audits management systems to the standards listed below, and each standard has its own page covering requirements, process and frequently asked questions. ISO 14001 and ISO 9001 were both republished in 2026 – ISO 14001:2026 in April and ISO 9001:2026 in September. What has changed, and what it means for existing certificates, is explained on the two standard pages.

• ISO 9001 – quality management: customer focus, controlled processes and continual improvement
• ISO 14001 – environmental management: environmental aspects, compliance obligations and environmental performance
• ISO 45001 – occupational health and safety: identifying hazards, reducing risks, involving workers
• ISO/IEC 27001 – information security: protecting the confidentiality, integrity and availability of information
• ISO 50001 – energy management: measuring and improving energy performance
• ISO 18788 – management system for private security operations

The Harmonized Structure behind ISO management system standards

ISO management system standards share a common framework, the Harmonized Structure – formerly known as the High Level Structure and defined in Annex SL of the ISO Directives. The standards use the same clause sequence, much identical core text and common terms and definitions. Anyone familiar with one standard quickly finds their way around the next, and shared requirements can be met once for all of them.

Since February 2024, a climate action amendment has applied to more than 30 management system standards, including ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001 and ISO 50001. In clause 4 you determine whether climate change is a relevant issue for your management system and take into account that interested parties may have climate-related requirements. A dedicated climate programme is only needed where the issue is relevant to you.

Clauses 1 to 3 of each standard cover scope, normative references and terms. The requirements themselves sit in clauses 4 to 10, which follow the Plan-Do-Check-Act cycle:

• Clause 4 – Context of the organisation: internal and external issues, interested parties, scope
• Clause 5 – Leadership: top management commitment, policy, roles and authorities
• Clause 6 – Planning: risks and opportunities, objectives, planning of changes
• Clause 7 – Support: resources, competence, awareness, communication, documented information
• Clause 8 – Operation: operational planning and control
• Clause 9 – Performance evaluation: monitoring and measurement, internal audit, management review
• Clause 10 – Improvement: nonconformity, corrective action, continual improvement

Integrated management systems: several standards, one system

An integrated management system (IMS) meets the requirements of two or more standards within a single system, instead of maintaining separate manuals, procedures and audits for each. The Harmonized Structure makes this practical: policy, objectives, risks and opportunities, control of documented information, competence, internal audit, management review and corrective action are organised the same way in every standard and can be handled together.

Common combinations are quality, environment and health and safety (ISO 9001, 14001 and 45001), quality and information security for IT and service companies (ISO 9001 and ISO/IEC 27001), and environment and energy for energy-intensive operations (ISO 14001 and 50001). In 2026 ISO published a new edition of its practical guide to integrated management systems. It describes integration in three steps – prepare, connect, integrate – built around five essential elements: governance, risks and opportunities, compliance management, operations, and performance evaluation and improvement.

Integration does not mean that every requirement is the same. Each standard keeps its technical core: environmental aspects in ISO 14001, hazard identification and worker participation in ISO 45001, the Annex A controls in ISO/IEC 27001, the energy baseline and performance indicators in ISO 50001. A good IMS joins up what is shared and keeps what is specific clearly visible.

Combined audits: certifying several standards in one audit

If you certify to more than one standard, a combined audit assesses them together: one audit plan, one audit team with the competence needed for each standard, coordinated dates. Shared processes such as management review, internal audit and document control are examined once, standard-specific requirements in a targeted way. This reduces coordination effort and disruption, because management and departments do not have to be available separately for each standard.

Each standard must still be met in its own right. A combined audit does not require a fully integrated system either: you can start with systems that grew separately and bring them together step by step. Nor do all standards have to come at once – another standard can be added later, ideally with audit dates aligned so that future surveillance audits can take place together.

ISO certification process, timing and cost

The certification audit compares your management system with the requirements of the standard and takes place on site or remotely. Auditors with industry experience review documented information, talk to management and staff, observe activities and sample records. ISO 19011, republished in 2026, provides the guidelines for auditing management systems. If nonconformities are found, you correct their causes and provide evidence; the certificate is issued once the audit has been passed. An optional pre-audit shows beforehand where your system still has gaps.

Once your management system is in place, the route from enquiry to certificate typically takes 4–8 weeks. The actual duration and the number of audit days depend mainly on headcount and sites, the complexity of your processes, the number of standards and the maturity of the system; a combined audit usually reduces the total effort for several standards.

With CERTUNION, certification to ISO 9001, 14001, 45001, 27001 and 50001 comes as an annual package together with the platform for your management system – for one standard or as an integrated system. There are three annual packages, priced per year: €789 for one standard (up to 25 employees), €1,499 for up to three standards (up to 100 employees) and €1,949 for all five standards (any number of employees).

The annual price includes the platform with all its modules and that year’s audit: the initial certification in the first year – we issue the certificate once the audit has been passed – and the surveillance audits in the second and third years. The contract runs for three years; in the fourth year, recertification follows at a 20% discount. All prices are exclusive of VAT and apply exclusively to business customers, not to consumers. Travel and accommodation costs for on-site audits are charged as incurred.

ISO 18788 is not part of the annual packages; we offer that certification separately. Your own effort to build and maintain the system is separate from the audit, and usually the larger part.

View the annual package price list (in German)

Requirements and documentation

Your system should have been running for a while before the certification audit. At least one internal audit and one management review should have taken place – every standard requires both in clause 9, and without them there is no evidence that the system monitors itself. The Harmonized Structure requires documented information for, among other things:

• the scope of the management system and the policy
• the objectives of the management system
• evidence of competence of people whose work affects performance
• operational control, to the extent needed to have confidence that processes are carried out as planned
• results of monitoring and measurement
• the audit programme and internal audit results
• results of management reviews
• nonconformities, actions taken and their results

Benefits – including for small and medium-sized businesses

A certified management system builds confidence among customers, contracting authorities and partners, makes tenders and supplier assessments easier and gives your organisation a clear framework: responsibilities are defined, risks are spotted early and mistakes lead to corrective action rather than repetition. ISO names more efficient use of resources, better risk management and the ability to deliver consistent products and services as benefits of an effective management system.

The same applies to small and medium-sized businesses on a smaller scale. The Harmonized Structure requires neither a manual nor a fixed amount of documentation; the extent may reflect size, activities and complexity. A small business can work well with a lean system: clear leadership, unambiguous responsibilities and a handful of well-maintained documents. The integrated approach pays off especially here – one system, one audit date, one management review for all standards.

The Certification Process

1. 01

   Enquiry

   Tell us, without obligation, which standards, sites, headcount and timeframe you have in mind – we clarify open questions in an initial conversation.

2. 02

   Analysis and package choice

   We analyse scope and size and check what can be audited together where several standards are involved; you choose the right annual package.

3. 03

   Pre-audit (optional)

   If you wish, a pre-audit shows before the certification audit where your management system still has gaps or room for improvement.

4. 04

   Certification audit

   The audit takes place on site or remotely – for several standards as a combined audit with a single audit plan.

5. 05

   Certificate

   Once the audit has been passed, we issue the certificate. It is typically valid for three years.

6. 06

   Surveillance

   Annual surveillance audits maintain the certificate and show that your system is effective and continues to develop.

Frequently asked questions