Integrated Management Systems explained: ISO 27001, ISO 22301 and beyond
Many organisations maintain multiple management systems to ensure consistency, compliance, and continual improvement across their operations. But if each system is managed in silos, it is easy for things to get messy. Processes overlap, documents multiply, and teams can end up working at cross purposes. That’s where an Integrated Management System (IMS) can make life easier. In this blog we will look at the pros and cons of integrated management systems.
You’ll learn the benefits and challenges of Integrated Management Systems, and provide practical guidance on implementing an IMS. We’ll use the example of integrating ISO 27001 (Information Security Management) and ISO 22301 (Business Continuity Management) as a common real-world example, although the approach and considerations we’ll discuss can be applied to a range of management systems and for that reason, you’ll also see us refer to others, such as ISO 9001.
What is a management system?
Before we get into integration, let’s define what we mean by a management system. A management system consists of policies and associated documents, including processes, procedures and templates that are adopted by an organisation to make sure they can carry out the tasks that are required to achieve ongoing compliance with the relevant ISO standard. These systems provide a systematic approach to dealing with an organisation’s activities and procedures.
Common management systems include:
- ISO 9001 for Quality Management
- ISO 27001 for Information Security Management
- ISO 22301 for Business Continuity Management
- ISO 42001 for AI Management
- ISO 14001 for Environmental Management
- ISO 45001 for Occupational Health and Safety
Each of these systems has its own focus but they all follow a similar structure, since the introduction of the High-Level Structure (HLS) by the International Organisation for Standardisation (ISO). We’ll discuss this HLS later in this blog and explore why this is so useful for integrating compatible management systems.
Why integrate management systems?
When organisations have multiple management systems operating separately, they often face challenges like:
- Duplicate documentation and processes
- Conflicting priorities and requirements
- Increased administrative burden
- Higher costs for implementation and maintenance
- Higher certification costs
- Confusion among employees about which management system to refer to
- Inconsistency in the way management systems are implemented across the organisation, particularly in areas such as information classification, document control, and overall system governance.
It’s worth noting that integration is not always the right approach. In large or highly complex organisations, different management systems may be owned by different teams with separate priorities and resources. In these cases, full integration may create unnecessary complexity, and a partially integrated approach, where only some elements are combined, may be more effective.
You can read our guide to combining integrated management systems in our recent blog post.
Benefits of an Integrated Management System (IMS)
Streamlined documentation and processes
One of the biggest benefits of an IMS is the reduction in paperwork and procedures. Instead of having a separate document control procedure, internal audit programs, or management review meetings for each system, they can be consolidated. For example, if you are consolidating ISO 22301 and ISO 27001, you can have one document control procedure that covers documentation for both areas. This is of course true again if you were to integrate another management system later (such as ISO 9001). Streamlining this way reduces duplication and simplifies the procedure for employees to understand and implement.
Cost efficiency of an integrated management system
Integration can save significant costs in several areas:
- Lower certification fees – many certification bodies offer package deals for integrated assessments (though you will still receive a separate certificate for each standard)
- Reduced audit effort – management clauses are assessed once across all compatible systems rather than multiple times
- Fewer internal audits – a single internal audit programme can cover all integrated standards
- Fewer management reviews – leadership meetings can be consolidated to review performance across the entire IMS
- Integrated risk management – a single risk register and methodology can cover multiple systems
- Decreased administrative overhead – fewer resources needed to maintain documentation and processes
- Optimised training – employees can be trained on multiple standards at once
Read our guide to ISO consultancy costs to learn more
Holistic risk management
An integrated approach encourages organisations to look at risks as a whole, rather than in separate silos. This wider perspective makes it easier to spot connections and potential clashes between different areas.
For example, a quality improvement modification (ISO 9001) might, unintentionally, create an information security vulnerability (ISO 27001). An integrated system makes it simpler to notice and resolve such inconsistencies while they are not yet problems.
This being said, it is important not to lose sight of standard-specific requirements, such as the need to assess information security risks against confidentiality, integrity, and availability (C, I & A). An integrated system should still preserve these focus areas.
Enhanced organisational culture
Integration also helps to develop a unified culture, within which quality, security, continuity and other areas of priority are seen as complementary elements of good business practice rather than separate, autonomous projects.
The result is higher staff motivation and more awareness on the employees’ part of how they contribute to company objectives.
Streamlined compliance
An integrated system simplifies adherence to various standards. Changes can regularly be applied across the entire framework rather than requiring adjustments to multiple individual systems.
Challenges of Integrated Management Systems
Initial Complexity
Setting up an integrated system involves aligning various standards and processes, which can be more intricate than establishing a standalone system. But if carried out carefully with planning and coordination, this phase can become an excellent opportunity to create a more efficient and streamlined approach upfront.
Short-term resource demand
The initial steps taken to merge systems can require additional time, effort, and specialised expertise. This is typically a temporary challenge though, and once aligned, day-to-day management becomes significantly easier.
Balancing specific requirements
Creating an Integrated Management System demands careful attention to ensure that the distinct needs of each standard are addressed properly. The focus is on maintaining clarity across all areas while still enjoying the benefits of integration.
Broader audit scope
Integrated audits cover a wider range of aspects simultaneously, requiring auditors who are knowledgeable in multiple standards. While this may require more preparation, it ensures a comprehensive evaluation of the system. It is also worth noting here that in many cases this is not really an issue, since many ISO standards (or rather those that would typically be integrated) share many of the same broad clauses and so many auditors are comfortable with the approach in auditing them together.
Adjustment to change
Transitioning from separate systems to an integrated one may involve an adjustment period, particularly if changes to the IMS mean changes to departmental processes. Allowing open communication, effective training, and early involvement of staff can significantly ease this transition.
How to integrate ISO 27001 and ISO 22301 in practice
Common elements
The High-Level Structure (HLS) found within these ISO standards allows them to share several common elements suitable for integration. Aside from a few unique subclauses specific to each standard, the below are shared clauses and make up a substantial foundation of any management system:
- Context of the organisation
- Leadership and commitment
- Planning
- Support (including resources, competence, awareness, communication, and documentation)
- Performance evaluation (including monitoring, measurement, internal audit, and management review)
- Improvement
Management system integration approach
A practical method for integrating these systems may involve:
Gap analysis
Conduct a thorough gap analysis to find out current processes, documentation, and practices for each of the standards. Compare areas for commonalities, differences, and integration points. Any improvement opportunity may be recorded as such in your Continual Improvement Plan.
View your ISO gap analysis consultancy options.
Combined risk assessment
Develop a risk assessment methodology that covers both business continuity and information security risks. Many organisations will already have a risk register for information security risks, for example, so there’s no need to work from scratch here – use what you already have and build upon it.
Integrated documentation
Develop a combined documentation structure that meets the requirements of both standards, including:
- An integrated manual outlining how the organisation complies with both standards
- Common procedures for shared processes (document control, internal audits, corrective actions, etc.)
- Standard-specific procedures and work instructions where necessary
Combined internal ISO audits
Create an integrated audit programme that measures compliance with both standards simultaneously. This significantly reduces the audit burden on those who carry them out.
Unified Management Review
Conduct management reviews that examine the performance of both systems together, enabling leadership to view the bigger picture in a single hit and make decisions that benefit the organisation as a whole.
Collaborating with UKAS Accredited Certification Bodies
When looking for certification of your integrated management system through UKAS-accredited certification bodies, think about the following:
Selecting the appropriate certification body
Ensure that your chosen certification body is accredited for all the standards intended for integration. You can read our helpful guide on choosing an ISO certification body here.
Certifying individual standards and integrated systems
You don’t need to wait until all management systems are individually certified before integrating them. It is entirely possible to integrate two uncertified systems and have the integrated management system certified in one go; you’ll simply receive separate certificates for each standard.
If you already have a certified management system, you can also integrate an uncertified one, provided you align its implementation with the surveillance or recertification audit of the certified system.
In some cases, organisations integrate a certified management system with an uncertified one without seeking certification for the latter. While possible, this can complicate audit planning and is best discussed with your certification body to confirm the best approach.
Surveillance and recertification
Discuss the surveillance audit schedule, planning for recertification of all standards while ensuring compliance with every requirement of each standard.
Key considerations when implementing an IMS
Certification body coverage
Make sure your certification body can cover all the standards you intend to integrate. Otherwise, you may need to switch providers or run dual audits, which can temporarily increase costs.
Scope of integration
Not every element needs to be integrated. Some organisations choose a “partial integration” approach to keep certain systems separate where it makes sense to do so.
Best practice tips for integrating ISO management systems
Based on experience working with organisations implementing integrated management systems, we would recommend considering these practical suggestions:
- Start with Clear Objectives
Define what success looks like for your organisation before embarking on the integration journey, and guide your decisions based on primary objectives such as efficiency, cost savings, or better risk management. - Take a Phased Approach
Consider a step-by-step strategy, beginning with simpler things like document control and defining responsibilities before moving on to more complex areas. - Engage SMEs
Successful integration requires input from experts in each management system area. Put together a cross-functional team including representatives from relevant departments. - Provide Training
Ensure that staff understand both the individual standards and the integrated approach and what it means for them in a practical sense. - Avoid Over-Integration
Not every element needs to be integrated. Some components are standard-specific and should remain distinct, and understanding this is where using a subject matter expert like Evalian to guide you through the process can be invaluable.
Conclusion
While there may be some groundwork and initial effort required to get it right, Integrated Management Systems have significant benefits in efficiency, cost-effectiveness, and risk management. For organisations thinking about integrating ISO 27001 and ISO 22301 (or any other couple, such as ISO 27001 and 9001), making use of the shared High-Level Structure is a suitable starting point.
With appropriate planning and the use of SMEs and experienced certification bodies, organisations can develop systems aligning to both standards’ specifications while keeping duplication to a minimum and maximising general efficiency. The key to successful integration is the right balance being struck – integrating where value is being delivered while ensuring the specific focus and specifications for each standard are preserved where necessary.
Need help with Integrated Management Systems or ISO certification support?
If you are thinking of gaining ISO accreditation, we’re here to help wherever you are on your decision path.
We can help with an initial workshop, carry out a full gap analysis, help you with integrating ISO 27001, support your ISO project or manage your management system for you. Learn more about Evalian’s ISO consultantcy services from the experts themselves: ISO Consultancy Video
View our ISO Consultancy services
