Integrated Management Systems: Coordinate Processes, Preserve Expertise

An integrated management system (IMS) brings related management disciplines into one coordinated way of working. It may cover quality, environmental management, occupational health and safety, or information security. Integration connects responsibilities, processes and reviews while retaining the specialist requirements of each discipline. Its purpose is practical coordination, rather than simply combining several manuals into one file.

What does integration mean in practice?

An organization may have separate procedures for approving documents, assessing suppliers, training employees and reviewing corrective actions. When each management system repeats these activities independently, employees can receive overlapping instructions and face several review schedules.

Integration brings the shared activities together. It identifies the process owner, establishes a consistent method and connects the work to everyday operations. Specialist controls remain where the subject requires them. A common document approval process, for example, can support both a safety procedure and an information security procedure without making their technical contents identical.

There is no single standard called “ISO IMS” that replaces every applicable standard. The term describes an integrated approach to management. ISO explains that its Harmonized Structure (HS) helps organizations operate a system that addresses more than one management system standard.

Which activities can be shared?

Common administrative processes are often a useful starting point. Document control, internal audit scheduling, management review arrangements and corrective action tracking can be coordinated. The level of integration should reflect the organization’s activities and the requirements it needs to meet.

• Documents and records: maintain clear versions, permissions and storage locations so employees can find current instructions.
• Responsibilities: identify who owns each process, who contributes and who can approve a change.
• Competence and awareness: connect common learning needs and specialist training to the work people perform.
• Audit and improvement: coordinate reviews and follow up findings without repeatedly requesting the same evidence.

A shared audit schedule does not mean that every auditor is competent in every discipline. The audit team still needs the knowledge required for its assignment. Similarly, a combined management review should give each relevant subject enough attention to support meaningful decisions.

What must remain specialized?

Different disciplines examine different risks and use different evaluation methods. Occupational safety considers hazards affecting people at work. Information security considers risks affecting information. An organization may record both in a common platform, but a single generic checklist will not necessarily address their specialist requirements.

Performance measures also need distinct definitions. A combined dashboard can show several disciplines together, but each measure needs a data source, an owner and a clear interpretation. Higher customer satisfaction does not demonstrate better workplace safety. Fewer workplace incidents do not demonstrate stronger information security.

The same principle applies to corrective action. A common tracking system can show responsibility and progress, while the investigation and verification methods depend on the issue being addressed.

An illustrative example: approving a supplier

Consider an organization managing quality, safety and information security. A new supplier might otherwise complete three separate onboarding reviews. An integrated process can collect the shared business information once, then route specialist questions to the appropriate reviewers.

Procurement considers the ability to deliver the required service. Safety specialists assess relevant workplace requirements. Information security specialists consider the proposed access to systems or information. The final decision follows defined acceptance criteria and approval responsibilities.

This is a hypothetical illustration, not a reported ATMACSS project. Suppose the supplier meets quality and price expectations but requests access to information it does not need to deliver the service. A positive commercial assessment does not cancel the security concern. The access scope is revised, a specialist checks the controls, and the decision follows the approved authority. An unresolved concern goes to an authorized decision-maker within applicable requirements; integration does not provide a route around them.

One decision record can show each specialist assessment, approval conditions and the decision owner. Conditions are reviewed when the service, location or type of accessible information changes. Shared information is requested fewer times, while specialist evidence remains available to those who need it.

How do the systems connect?

How can an organization begin?

Start with scope: which activities, locations and management systems are included, and where are their boundaries? A quality management system may cover the whole organization while an information security management system covers a particular service. Keep those boundaries explicit so shared documentation does not imply that every activity belongs to every system.

Next, map each standard’s requirements to processes, responsibilities and evidence. A simple matrix can support this work; it is a suggested organizing tool, not a mandatory format. It reveals which arrangements can be shared, which need specialist treatment and which requirements have no assigned owner.

Pilot the change in one process, update instructions and authority, and explain what employees must do differently. Use Plan–Do–Check–Act (PDCA): plan the route, try it, examine the evidence and results, then correct weaknesses. Verification includes appropriate internal audit. Management review addresses the issues, resources and decisions needed while keeping specialist accountability clear.

How can you tell whether integration helps?

Compare performance before and after implementation using consistent definitions. In the supplier example, measures could include time from a complete application to the decision, repeated information requests, and approvals needing reassessment because evidence was missing. Monitor decision quality alongside speed: faster decisions with more inappropriate approvals are not an improvement.

Integration may reduce rework, repeated audits and time spent updating documents, but it does not guarantee lower costs. Designing the process and training employees require initial effort, and specialist checks may remain necessary. Give each key performance indicator (KPI) a baseline, target, data source and owner, then decide whether the process merits wider use.

Common mistakes to avoid

Combining manuals without changing daily work creates an appearance of integration. Other problems include applying one assessment method to unlike risks, losing specialist accountability, or treating document volume as evidence of maturity. A system should be understandable to the people using it and proportionate to the organization’s complexity.

Another mistake is expanding the scope before the responsibilities are clear. Adding more standards does not automatically create more value. The organization needs to understand why each discipline belongs in the system and how it relates to its objectives.

Does an IMS need a separate certificate?

Integration describes how the management systems work together; it does not remove the requirements of each standard within its scope. Organizations can implement the systems and benefit from them without seeking certification, subject to any applicable contractual or legal obligation. Where certification is sought, an external certification body assesses defined scopes against specified requirements. Audits for several standards may be coordinated, but the audit arrangement or certificate documentation does not remove any standard’s requirements. ATMACSS provides consultancy for management system implementation and certification readiness; the certification decision belongs to the certification body.

Test one shared process before expanding integration

Choose an activity that crosses the selected disciplines, such as supplier approval. Record the information collected once, the specialist checks and the person who authorizes the outcome. Then trace a representative case through the proposed process. Can each reviewer find the current evidence? Does an unresolved specialist concern prevent an inappropriate approval?

Compare the result with the previous arrangement. Look for conflicting instructions, duplicate requests and decisions without an owner. A shorter form is useful only if it retains the information needed for a sound decision. Test an exception as well as a routine case, such as a supplier requesting access outside the agreed scope.

This is a practical editorial suggestion, not a prescribed ISO test. Record the weaknesses found, assign corrective work and check the revised process before extending it to other activities. Keep specialist reviewers involved when deciding whether the shared arrangement is sufficient. A successful pilot shows how that process works; it does not prove that every requirement across the whole management system has been met.

Explore ATMACSS services for ISO implementation and certification readiness . Scope, deliverables and terms are defined in the proposal and agreement.