ISO 45001 vs 14001 vs 9001: One Integrated System (2026)

Running ISO 9001, ISO 14001 and ISO 45001 as three parallel systems means three document libraries, three internal audit programmes, three management reviews, and nonconformities with the same root cause raised three times. The standards are written to be combined, and the accreditation rules let a certification body audit them together. This guide shows how to build one integrated management system (IMS), what changed in 2026, and what integration does and does not save at certification.

Correction, 22 September 2026. An earlier version of this guide published certification cost bands by company size (for example $10k–$13k over three years for a 25-person site), said integrated certification saves 20–35%, and claimed, citing no one, a 40–60% cut in risk-register maintenance time, 4–9 months' payback on IMS software and 60–80% less administrative work. None had a source, and they are removed. The integrated-audit figure was also wrong: the accreditation rule caps the reduction at 20% of the combined audit time. The guide listed "the five most common nonconformities in IMS surveillance audits in 2024–2025" without a source; that section is now a checklist drawn from the requirements themselves. It said ISO 9001:2026 was "expected" and that ISO 14001's current edition was 2015: both 2026 editions have now been published. It said OHSAS 18001 was withdrawn in March 2021 without noting that the migration deadline for accredited certificates was extended to 30 September 2021. And it carried a vendor table that listed a commercial partner of this site first and named it, with one other vendor, as the practical choice for SMEs; that table was not based on a comparison and has been replaced (see below). If you relied on any of these, re-check against the sources in this version.

Why these three standards belong together

ISO's rules for management system standards define a harmonized structure: identical clause numbers in the same sequence, clause titles, text, common terms and core definitions. ISO 9001:2026 states that it applies this approach to support alignment and integration with other management system standards; ISO 14001:2026 states that it conforms to it; and ISO 45001:2018 describes the same approach under its earlier name, the high level structure.

For ISO 45001, ISO summarises the requirements as leadership commitment and worker participation, hazard identification and OH&S risk assessment, legal and other requirements, operational controls and emergency preparedness, training, awareness and competence, monitoring and performance evaluation, and continual improvement.

Transition deadlines for the two new editions

Global ACI, the single organisation that brought together the work of ILAC and the IAF and began full operations on 1 January 2026, has published transition requirements for both. They are mandatory for the accreditation bodies and accredited certification bodies that fall under its arrangement:

Transition can happen at a scheduled surveillance or recertification audit or at a separate transition audit. For an IMS, plan both transitions together so the shared elements change once. Our ISO 14001 implementation guide covers the environmental side of the 2026 edition, and the ISO 45001 internal audit checklist shows a clause structure that can be adapted for an integrated programme.

These two timetables cover ISO 9001 and ISO 14001 only. ISO 45001:2018 stays the edition to certify to today: the revision is still a draft, and the transition requirements cited here do not apply to it. When ISO publishes the new edition and Global ACI sets its own timetable, expect a third transition to plan. Until then, an organisation with all three certificates has two dates to manage and one to watch.

A worked timeline (illustrative). Take a site with ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 certificates, audited together every year. The deadlines above are the outer limits, not the plan. A sensible order is to fix the shared work first and the discipline-specific work second:

Ask your certification body, in writing, which of its audits it will use for each transition and what it will charge, because the days it needs are its own calculation (see the audit-time section below).

Climate change

In February 2024, ISO amended a number of its management system standards, including all three of these, so that each requires the organisation to determine whether climate change is a relevant issue (clause 4.1), and adds a note that relevant interested parties can have climate-related requirements (clause 4.2). The joint ISO/IAF communiqué says the overall intent of those clauses is unchanged and that the change is not meant to make, for example, a health and safety audit disproportionately about climate. ISO 45001 carries this as Amendment 1:2024. For ISO 9001 and ISO 14001, ISO's pages list the 2015 editions and their Amendment 1:2024 as withdrawn, so the 2026 editions are the current text. Record in your context register whether climate change is relevant and why.

Clause by clause: what to share

ISO 45001 states that clauses 4 to 10 contain its requirements. Clauses 4 to 7 have the same numbers and order in all three standards, and the same main titles except ISO 45001's clause 5; the other differences are shown below. Clause titles are taken from the public previews of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, which list subclauses up to clause 7 (for ISO 9001:2026, up to 7.1).

The shared rows are where one process can serve all three standards.

The shared risk register

One register can replace three, provided it keeps what differs between them.

• One register, discipline tags. Tag every entry as quality, environment and/or OH&S. A defective valve on a chemical line can be all three.
• Keep discipline-specific criteria. The concepts are not the same. ISO 45001 defines OH&S risk as the combination of the likelihood of a work-related hazardous event or exposure and the severity of the injury and ill health it can cause (clause 3.21), while ISO 14001 works with environmental aspects and their impacts. Use one register and one workflow, but do not force one scoring scale onto all three.
• One owner per entry, accountable across disciplines.
• One review cadence, set by your own risk criteria and tied to one management review.

Software requirements for a unified IMS

If each discipline runs its own platform, you may have separate master data, separate audit trails and integrations to maintain between them. A platform for an IMS should let you demonstrate, with your own records:

• Single document control serving all three standards;
• One risk register with discipline tagging and discipline-specific assessment criteria;
• One nonconformity and corrective-action workflow, with root-cause analysis (see the nonconformance management software page and the non-conformance entry);
• One audit programme covering internal, supplier and certification audits, with every finding traceable to the clause of each standard;
• One competence matrix with role-based requirements and expiry;
• One incident pipeline for quality defects, environmental events and OH&S incidents;
• A management review pack assembled from the data above;
• Cross-discipline reporting, for example injury rates, customer complaints and energy or emissions data on one view.

Demonstrate the shared IMS workflow

Use the QHSE software comparison to identify documented scope. In every demonstration, change one controlled procedure, identify the quality, environmental and safety processes affected, update competence requirements, record a nonconformity and reject its first corrective-action closure.

Ask which modules, roles and interfaces are included and who validates the configuration. Shared records should preserve the distinct requirements of each discipline. Use the linked comparison’s published inclusion rule and the same evidence checks for every qualifying product. Sponsored placements are additional and labelled; commercial status does not determine organic eligibility.

Questions to put to any vendor about the 2026 editions. Treat the answers as claims to verify in a demonstration, not as facts about the product:

1. Which edition of each standard do the supplied templates, audit checklists and clause cross-references refer to, and how are they updated when an edition changes?
2. Can a record carry a clause reference to more than one edition at once, so that a finding raised during the transition period stays traceable?
3. Can the context register and the risk register be tagged by discipline without separate copies?
4. How is the climate-relevance decision recorded, and who can edit it?
5. Is the ISO 45001 revision handled as a configuration change by the customer or as a vendor release, and what is the notice period?
6. Which integrations, such as document storage or identity management, are included and which are separate modules?

For wider evidence on how vendors document these areas, see the site's capability map, the audit-trail and document-control study (the capability gap), and the ISO management software guide. The glossary entries for ISO 9001, ISO 14001, ISO 45001 and management review set out each term's primary source.

Updated 27 September 2026: the two authored product examples were replaced with a repeatable evaluation task; this is not a comparative product test.

Checks before an integrated certification audit

These come from the requirements and the accreditation rules, not from a survey of audit findings.

1. The policy covers each standard. Each of the three has its own policy subclause (5.2). One integrated policy is fine, provided it meets the commitments each subclause requires.
2. The register covers every discipline. If one function led the integration, check that the others are fully represented: environmental aspects and OH&S hazards, not only quality risks.
3. Worker consultation is evidenced. ISO 45001 has a clause on consultation and participation of workers (5.4). Under Global ACI-TECH-3-016, the audit team must interview employees' representatives with OH&S responsibility, the management with legal responsibility for OH&S and the personnel who monitor employees' health, and those groups are to be invited to the closing meeting.
4. Coverage is provable. In an integrated audit, the certification body must audit all applicable requirements of each standard in scope, and each finding must be traceable to the standard it relates to (Global ACI-TECH-3-008, 2.3 and 2.4). Keep a coverage matrix for your internal audit programme that shows the same thing.
5. Management review addresses all three. TECH-3-008 lists management reviews that consider the overall business strategy and plan as a mark of integration. The minutes should show inputs and outputs for each standard.
6. OH&S legal compliance has been evaluated. Before an OH&S certificate is granted, you must be able to show, through your own evaluation of compliance, that you meet the legal OH&S requirements that apply to you. Where you are not yet compliant, an implementation plan allows certification only exceptionally, on evidence that the plan will be completed on time and that OH&S risks are controlled in the meantime (TECH-3-016, Appendix A, A.2.2–A.2.4).

What integration saves at certification

Neither ISO nor this site sets certification fees. Accredited certification bodies calculate audit days under mandatory rules. The rules do not set fees, so ask each body to show how its fee is built: the days, its day rate, travel and any other items in its proposal.

Each standard is calculated first. Global ACI-TECH-3-004 (it states that it is based on the IAF document MD 5; issued 10 July 2026, implemented 28 August 2026, according to the Global ACI document list) sets a starting point for each of ISO 9001, ISO 14001 and ISO 45001 from the effective number of personnel in scope. Each standard also has its own category: the risk posed by failure of the product or service for quality, and the complexity of the environmental aspects or OH&S risks for the other two. Our ISO 45001 cost guide reproduces more of the OH&S table.

Initial audit, stage 1 plus stage 2, in audit days, for ISO 14001 and ISO 45001:

Source: Global ACI-TECH-3-004 (M), version 1.0, Tables EMS 1 and OH&SMS 1, reproduced in part with acknowledgement to Global ACI.

The day counts for the shared categories are the same. What differs is which category you fall into: the environmental category follows the nature and gravity of your environmental aspects, the OH&S category the nature and severity of your OH&S risks. The document's example sector lists (Tables EMS 2 and OH&SMS 2) show where they diverge:

• Hot and cold forming and metal fabrication: high for OH&S; low for EMS where there is no surface or other chemical treatment.
• Healthcare and hospitals: high for OH&S, medium for EMS.
• Hotels: medium for OH&S, low for EMS.
• Civil construction and demolition: high for both.

The certification body decides your categories from your actual activities and can move you up or down.

Then the integration rule applies. Under TECH-3-008 (2.1.1 and 2.1.2, and Figure 1 in Annex 1), the certification body adds the three figures together and may reduce the total, or increase it for the added complexity of an integrated audit, according to how integrated your system is, whether your people can answer questions on more than one standard, and whether its auditors are qualified in more than one. Any reduction cannot exceed 20% of the combined starting figure, and on the document's chart 20% is reached only at the top of both scales. The body confirms your level of integration at stage 1 and keeps checking it through the cycle.

A worked example. This is a sample calculation from stated assumptions, not a quote. Assume a single-site metal fabrication business with no surface or chemical treatment and 125 effective personnel, the top of a band, so the table values apply without interpolation (TECH-3-004 treats the bands as a continuum, so a headcount lower in the band gives lower figures). TECH-3-004's example lists (Tables QMS 2, EMS 2 and OH&SMS 2) put basic metals and fabricated products at medium quality risk, which takes the Table QMS 1 time, and put hot and cold forming and metal fabrication at low environmental complexity and high OH&S complexity. The starting points are 7 days for ISO 9001, 5.5 for ISO 14001 and 11 for ISO 45001, a combined 23.5 days for stage 1 plus stage 2. With the maximum 20% integration reduction and no other adjustment, the integrated initial audit would be 19 days (23.5 × 0.8 = 18.8, rounded to the nearest half day). Applying TECH-3-004's proportions (about one third a year for surveillance and about two thirds for recertification, clauses 5 and 6) to that total gives roughly 6.5 days of surveillance a year and about 12.5 days at recertification. Your certification body decides the categories and adjustments and must show you its calculation as part of the contract (TECH-3-004, clause 4.4).

Multi-site organisations can have sites sampled rather than all audited, where sites perform very similar processes. Under Global ACI-TECH-3-001, the initial sample is at least the square root of the number of sites, rounded up. Not every organisation is eligible, and certification bodies must restrict sampling where risk or complexity makes it inappropriate. For OH&S, Global ACI-TECH-3-016 adds that sampling is not appropriate where sites do not cover the same activities, processes and OH&S risks. Where sampling is not used, each new site must be audited before it is added to the certificate (TECH-3-001, 6.2.3).

If you cannot do them all at once: which first

Integration works best when it is designed in from the start, but budget or team capacity may force a sequence. Between ISO 14001 and ISO 45001, start where your largest exposure is.

Start with ISO 45001 if:

• your work is in a sector TECH-3-004 lists as an example of high OH&S complexity, such as construction, mining, oil and gas extraction, metal fabrication or the transport of dangerous goods;
• your recordable injury rate is above the published rate for your industry (see our TRIR guide for how to compare against BLS figures);
• clients or insurers are pressing you to demonstrate safety management;
• you have had a serious incident recently. Once certified, a serious OH&S incident can prompt a special audit by your certification body (Global ACI-TECH-3-016).

Start with ISO 14001 if:

• your significant environmental aspects, such as the emissions, discharges or waste streams your permits regulate, are a larger exposure than your OH&S risks;
• you hold environmental permits or face compliance obligations that need a managed process;
• customers are sending environmental questionnaires or supplier requirements that a management system would answer. If you start now, build to ISO 14001:2026 and ask your certification body when it will certify to it.

Pursue both in parallel if you have the budget and a dedicated QHSE lead, you already run ISO 9001, major clients require both, or you can design one integrated system from the start, which is what makes the integrated-audit reduction possible.

A phased IMS rollout

We do not attach months to these phases, because we have not collected project durations. The order is what matters.

1. Gap analysis and design. Assess against all three standards, build the clause map above, decide the scope, and choose any platform.
2. Documentation. Migrate documents into one controlled library.
3. Registers. Build the shared context register and the shared risk register; retire the old ones.
4. Workflows. Consolidate nonconformity, corrective-action and incident workflows, and train users.
5. Internal audit. Run one combined internal audit programme against the coverage matrix and close the findings.
6. Management review and booking. Hold an integrated management review, then book the certification audit, declaring your level of integration on the application.

Frequently asked questions

Can I be certified to ISO 9001, ISO 14001 and ISO 45001 in one audit? Yes. TECH-3-008 governs audits of a management system against two or more standards at the same time. The audit is led by a team leader competent in at least one of the standards, the team as a whole must be competent for each, and reports can be integrated or separate. Ask each certification body whether it will issue one certificate or one per standard.

Do I need separate manuals for each standard? No. The accreditation rules describe an integrated management system as one sharing single system documentation, management system elements and responsibilities, and list an integrated documentation set as the first mark of integration (TECH-3-008, 1.2 and Annex 1).

We still hold OHSAS 18001. Is that valid? No. The migration period for accredited OHSAS 18001 certificates ended on 30 September 2021, after the IAF extended it because of COVID-19. Certify to ISO 45001.

How does climate change feature in an IMS in 2026? Each standard requires you to determine whether climate change is a relevant issue for your management system, and notes that interested parties can have climate-related requirements. Record the decision and the reasoning in your context register. The standards ask you to determine relevance, not to assume it either way.

Does ISO 45001 cover mental health? Yes. ISO 45001:2018 defines injury and ill health as adverse effects on a person's physical, mental or cognitive condition (clause 3.18), and ISO 45003:2021 gives guidelines for managing psychosocial risk within an ISO 45001 system.

Can software replace the IMS manager? No. Software can support routine administration such as document control, audit scheduling, corrective-action tracking and management review packs. We do not give a percentage, because we have not found a measurement that separates the software's effect from the rest of the programme.

What is the difference between an IMS and QHSE? An IMS is the management-system architecture: TECH-3-008 defines it as a single management system that meets the requirements of more than one management system standard. QHSE is the functional discipline, the team and its practices. An IMS is how a QHSE function can operate as one.

Should I integrate ISO/IEC 27001 (information security) too? You can. ISO/IEC 27001:2022 applies the same Annex SL structure, and TECH-3-008 lists it among its examples of management system standards that serve as audit criteria. Whether you should depends on whether your clients or your own information-security risks call for it.

How long after go-live should I expect a return? We do not publish a payback period. Estimate it yourself from the hours your team spends today on audit preparation, document control and chasing corrective actions, multiplied by a fully loaded hourly rate, against the platform's quoted cost including implementation.

Next steps

If you are still running three parallel systems, start with the gap analysis and clause map above. Then use the QHSE Software Buying Guide, score vendors with the Features Checklist, and shortlist with the Vendor Shortlist Template.

Smaller organisations can start with our EHS Software for SMEs 2026 guide.

Sources

• ISO: ISO 9001:2026, ISO 14001:2026, ISO 45001:2018, and the first editions ISO 9001:1987 and ISO 14001:1996
• ISO: ISO/IEC Directives, Part 1, Consolidated ISO Supplement, Annex SL (harmonized structure)
• ISO and IAF: joint communiqué on the climate change amendments to management system standards, 22 February 2024
• Global ACI: transition requirements for ISO 14001:2026 and for ISO 9001:2026
• Global ACI: TECH-3-004, audit time, TECH-3-008, integrated management system audits, TECH-3-016, OH&S management system certification and TECH-3-001, multi-site certification
• IAF: launch of Global ACI on 1 January 2026 and FAQ on the extended OHSAS 18001 migration deadline

Corrected 23 September 2026: statistics without a primary source were sourced, labelled as examples or removed, and the standards and accreditation rules cited now link to their official texts.

Updated 24 September 2026: merged the sourced sections of ISO 14001 vs ISO 45001: Which Should You Implement First?

Updated 4 October 2026: standards, transition dates, Global ACI documents and the audit-time tables were re-checked against ISO's and Global ACI's own pages. The ISO 45001 revision status was added, the transition timeline and a vendor question list were added, and the description of Global ACI's origin was narrowed to what its announcement says.