Combining ISO 9001 with other certifications

Many organisations need more than one certification. A construction company wants ISO 9001  and VCA. An IT company wants ISO 9001 and ISO 27001 . Thanks to the High Level Structure  of modern ISO standards, you can combine these in one integrated system.

Why combine ISO 9001 with other standards?

Benefits

• Less duplicate work: Many parts overlap (policy, objectives, audits, management review)
• Lower costs: Combined audits cost less than separate audits
• One system: Employees only need to learn one system
• Better integration: Quality, environment and safety belong together

Drawbacks

• More complex implementation: You have to set up more at once
• More knowledge needed: You have to understand several standards
• Greater impact when things go wrong: If the system fails, it affects everything

The High Level Structure: why combining ISO 9001 is easy

Since 2015, all major ISO management system standards have the same structure: the High Level Structure (HLS) . This makes combining much simpler.

Clause 8 is the only one that differs per standard. It sets out the specific requirements for quality, environment, information security, and so on.

Popular combinations with ISO 9001

ISO 9001 + ISO 14001 (Quality + Environment)

This is the most common combination. Many organisations that work with suppliers and government bodies need both.

Sectors where this is common:

• Construction and infrastructure
• Manufacturing
• Logistics
• Facility services

Read more about this combination on the page combining ISO 14001 and ISO 9001.

ISO 9001 + ISO 27001 (Quality + Information security)

Popular with IT companies, software developers and organisations that handle sensitive data.

Sectors where this is common:

• IT and software
• Financial services
• Healthcare
• Government and semi-government bodies

ISO 9001 + VCA (Quality + Safety)

Standard in sectors where physical safety is critical. Note: VCA is not an ISO standard, but it has its own structure.

Sectors where this is common:

• Construction
• Petrochemicals
• Industry
• Installation technology
• Cleaning

ISO 9001 + ISO 45001 (Quality + Occupational health and safety)

ISO 45001  is the ISO standard for occupational health and safety. It follows the HLS, so it combines better than VCA.

Combining ISO 9001 + 14001 + 45001 (KAM or QHSE)

The best-known combination of three standards is ISO 9001  (quality), ISO 14001 (environment) and ISO 45001 (occupational safety). Together they form a KAM system (Kwaliteit, Arbo, Milieu, the Dutch for quality, health and safety, and environment), called QHSE in English. All three follow the High Level Structure , so most clauses overlap.

In an integrated management system (IMS), you write those shared clauses once. Only clause 8 is filled in differently for each standard. The table below shows, per clause, what is shared and what stays specific to a standard.

For clause 8, each standard keeps its own course. Quality covers customer requirements and delivery, environment covers environmental aspects, and safety covers hazards and risks on the work floor.

What does combining three standards save?

The gain lies in the shared clauses and in one combined audit. Below is an indication. Treat it as a guideline, not a quote.

Apart from audit days, it also saves internal work: one policy document, one audit schedule and one management review instead of three. For exact costs, see the page costs and timeline.

Other common combinations of three standards:

• ISO 9001 + ISO 14001 + VCA (in construction)
• ISO 9001 + ISO 27001 + ISO 14001 (IT with a sustainability focus)

What is a combined audit for ISO 9001?

If you hold several certifications, you can choose combined audits.

Benefits

• Cost savings: One auditor, fewer days, lower travel costs
• Efficiency: One audit instead of two or three separate ones
• Less disruption: Employees are not “disturbed” several times a year

How does it work?

The certification body sends an auditor (or a team) who is certified for all standards. The audit takes longer than a single-standard audit, but less time than separate audits added together.

Example duration:

Conditions

• All certifications with the same body (or bodies that work together)
• Auditors must be qualified for all standards
• Timing must match (certification cycles often do not run in sync)

Practical tips for integrating ISO 9001 with other standards

1. One policy, several aspects

Instead of separate policies for quality, environment and safety, create one integrated policy:

POLICY [COMPANY NAME]

We deliver [products/services] that meet the expectations of our
customers, with respect for people and the environment.

Our core values:
- Quality: We deliver what we promise
- Safety: Nobody gets hurt by our work
- Environment: We minimise our impact on the environment
- Improvement: We learn and get better

This policy is supported by measurable objectives.

[Name of director]
[Date]

2. One context analysis

Extend your context analysis with all aspects:

3. Integrated risk assessment

Use one format for risks, but categorise them:

4. One internal audit

Plan audits so that you check all standards at the same time. Use a checklist that covers all requirements.

5. One management review

Discuss quality, environment and safety in one meeting. Extend the agenda with standard-specific topics.

Step by step: extending ISO 9001 with an additional standard

If you already have ISO 9001 and want to expand:

1. Decide which standard: Look at customer requirements and business needs
2. Gap analysis: What do you already have? What is missing?
3. Plan the extension: Which additional documentation? Which processes need changing?
4. Implement: Add the new parts to your existing system
5. Internal audit: Audit the extended system
6. Certification: Extension audit or combined audit

What do multiple certifications cost alongside ISO 9001?

Indications for SMEs (10-50 employees)

More information

• ISO 9001 step-by-step plan - How to start
• Costs and timeline - Detailed cost overview
• ISO 14001 - Environmental management
• ISO 27001 - Information security
• VCA - Safety