ISO

Integrated Management System Build

Not three consultants, three manuals and three audits. One system, one project, one person running it.

12–20 weeks

gap analysis to certificate

£10k–£30k

fixed after the gap analysis

1

system, audit programme and management review

One system, not three

Since the standards moved to a common structure, most of what they ask for is the same question asked three times. Build them separately and you write all of that three times over, maintain three sets of records, run three internal audit programmes and host three certification visits a year. Build them together and you define it once.

The parts that genuinely differ stay separate, because they should. Everything else runs as one.

Clause areaISO 9001ISO 14001ISO 45001
Context of the organisation — including climate changeSharedSharedShared
LeadershipSharedSharedShared
Risk and opportunitySharedSharedShared
Planned change managementSharedSharedShared
Competence and awarenessSharedSharedShared
Documented informationSharedSharedShared
Internal audit · management review · improvementSharedSharedShared
Customer requirements and product conformitySpecific——
Aspects and impacts, environmental legal register—Specific—
Hazard identification, worker participation——Specific

The 2026 revisions of 9001 and 14001 both embedded climate change in context and both use the harmonised structure - so the shared rows are more shared than they were a year ago. The proportion you write once has gone up.

Which version do you build to?

Right now the three standards are at three different points in their revision cycles, and a build that ignores that is a build with rework already owed.

StandardStatus todayWe build to
ISO 14001 Status todayPublished
2026 version published April. 2015 certificates must transition by April 2029.
We build to2026. No reason to build to 2015 any more.
ISO 9001 Status todayPublishing September
Certification bodies certify against 2015 until the transition rules land.
We build toThe 2026 structure, certified against 2015. The changes are known; designing them in now costs nothing.
ISO 45001 Status todayCommittee draft
2018 current. Revision expected around 2027.
We build to2018. The draft is two stages from final. Do participation properly and the transition will be small.

The 12 to 20 week timeline

Length varies with size and how much already exists. A typical three-standard build for a 120-person manufacturer runs like this.

1234567891011121314151617181920
Gap analysis and designWeeks 1–3
BuildWeeks 4–10
EmbedWeeks 11–14
Internal audit and management reviewWeeks 15–17
Certification — Stage 1 and 2Weeks 18–20
│ Week 6 — certification body booked. “We start that conversation around week 6, not week 18.”

Embed is the phase most consultancies compress, and it is the phase that decides whether the certificate still means anything in two years. Training, toolbox sessions, the system in live use - worked in blocks with your team rather than handed over as a finished folder.

What's included

1

3

5

7

9

11

13

Gap analysis. Two to three days on site against every standard in scope. Written report and a fixed quote before you commit.

Process map - how the business actually runs, drawn with your managers rather than at them.

Aspects and impacts register for 14001, scored honestly against your real processes.

Legal and compliance register across all three disciplines, current at handover.

Objectives and KPIs tied to numbers your board already looks at.

Internal auditor training for two to four of your people, so the programme survives without us.

Certification body support: choosing a UKAS-accredited body, quote comparison, and on site for Stage 1 and Stage 2.

2

4

6

8

10

12

Scope, context and interested parties, in your language rather than lifted from a template.

Risk and opportunity register across quality, environmental and OH&S, built from the risk assessments you already run.

Hazard identification and risk assessment for 45001, built on your existing assessments.

Documented information - the minimum the standards require that also works in practice.

Internal audit programme designed, scheduled, and the first full cycle run alongside you.

Management review — the first one facilitated, with an agenda you can reuse.

What it costs

£10,000 to £30,000, fixed, agreed after the gap analysis.

What moves the number:


Standards in scope

One or two

→

All three


Sites and headcount

Multiple sites, around 500


Existing documentation

Internal resource

Single site, around 50

A quality system with decent bones

Someone who can carry work between visits

→

→

→

Starting close to nothing


Nobody


The gap analysis is £900 on its own and is credited against the build if you go ahead. Certification body fees are separate - typically £4,000 to £9,000 across a three-year cycle for a business this size. We'll help you compare quotes.

The fee is fixed once the gap analysis is done. If the project takes longer than we estimated, that is our problem, not an invoice.

Single standard or integrated?

If you only need
One standard, for one customer
£4,000 – £10,000

Do one standard. The ISO 9001, ISO 14001 and ISO 45001 pages cover those.

If you have
Two or more on the horizon
£10,000 – £30,000

Integrate. Especially when:

  • Customers are asking for environmental or safety credentials alongside quality
  • You have limited internal resource to run parallel systems
  • You already hold one standard and are adding a second

After certification

Certificate
Month 0
Surveillance
12 months
Surveillance
24 months
Recertification
36 months

Systems drift between those visits, and drift turns up as findings. Most clients move onto a retainer at handover — usually Active at £500 a month or Embedded at £1,050 — covering internal audits, legal register updates, corrective actions and certification body liaison. It costs less than the annual panic, and it's the reason our clients' surveillance audits are quiet.

You are not obliged to. The system is built to be run by your own people and we train them to run it. We'd rather say up front that maintenance is real work than let you discover it at the first surveillance visit.

Who this is for

Manufacturers, logistics operators and industrial engineering firms between £10m and £100m turnover, usually 50 to 500 staff, in one of these positions:

—


—


—

—

A tier-one customer or a tender has made certification a condition of supply

You hold one standard and need a second or third without tripling the admin

An acquisition has left you with two part-systems and no single version of the truth


A cheap templated implementation didn't survive its first audit


Common questions.

It starts with a gap analysis

Two to three days on your site, a written report, and a fixed quote. You'll know what the build costs before you commit to it - and the report is worth having even if you go elsewhere.

Where we work. Greater Manchester and the North West as standard: Manchester, Bolton, Bury, Stockport, Rochdale, Oldham, Preston, Blackburn, Warrington and Trafford. Appointments elsewhere in the UK where the travel works for both sides.