Six standards. Six areas of business governance. One coordinated management system.
Organisations today are expected to deliver consistent quality, maintain reliable IT services, protect business operations, secure information, respect personal data and manage the risks associated with artificial intelligence. These responsibilities are closely connected, but many companies still manage them through separate policies, procedures, departments and audit programmes.
This can create unnecessary duplication, additional administrative work and gaps between departments.
An Integrated Management System (IMS) provides a more organised approach. It allows an organisation to manage common business processes through a coordinated framework while retaining the specific controls and requirements of each applicable ISO standard.
For technology companies, IT service providers, SaaS businesses, BPO organisations and enterprises handling sensitive information, integrating the following six standards can provide a practical management framework:
- ISO 9001 for Quality Management
- ISO/IEC 20000-1 for IT Service Management
- ISO 22301 for Business Continuity
- ISO/IEC 27001 for Information Security
- ISO/IEC 27701 for Privacy Information Management
- ISO/IEC 42001 for Artificial Intelligence Management
This guide explains how these standards work together, what can be integrated, how implementation can be planned and what organisations should consider before proceeding towards certification
What is an Integrated Management System?
An Integrated Management System is a coordinated framework that combines the requirements of two or more management system standards into a common organisational structure.
Instead of maintaining separate arrangements for quality, IT services, business continuity, information security, privacy and artificial intelligence, an organisation can integrate common processes such as leadership, policy, risk management, objectives, competence, documentation, internal audits, management reviews and continual improvement.
The organisation must still address the specific requirements of every standard. Integration does not mean removing individual controls or treating all six standards as identical.
The objective is to establish one practical management framework with clearly defined responsibilities, measurable performance and appropriate evidence of implementation.
1. Why are organisations moving towards an Integrated Management System?
As organisations grow, their operational responsibilities also increase. A technology company may have a quality management system for customer satisfaction, an IT service management system for service delivery, an information security system for protecting business information and a business continuity system for handling disruptions.
When these systems are developed independently, similar activities may be repeated.
For example:
- The quality team maintains one risk register.
- The information security team maintains another risk register.
- The business continuity team conducts a separate risk assessment.
- The IT service team maintains its own operational procedures.
- The privacy team prepares separate documentation for personal data.
- The AI governance team develops another set of policies and controls.
Some of these activities need separate technical assessments, but they can often follow a common governance process.
An integrated approach helps management establish a common direction and coordinate these activities.
Common problems with separate management systems
1. Repeated documentation
Different departments may prepare separate policies, procedures, templates and records for similar management activities.
2. Unclear responsibilities
When responsibilities are not coordinated, teams may assume that another department is handling a particular risk or requirement.
3. Multiple audit activities
Separate audit programmes can increase the time required from employees and management.
4. Limited visibility for senior management
Management may receive separate reports on quality, information security, IT services and business continuity without a consolidated view of organisational performance.
5. Difficulty maintaining the systems
When several systems operate independently, changes in business processes, technology and customer requirements can be difficult to manage consistently.
What changes with an integrated approach?
An IMS establishes a common management framework. It gives management a consolidated view of objectives, risks, responsibilities, performance and improvement activities.
The organisation can use common processes wherever requirements are compatible, while maintaining the technical controls needed for each standard.
2. Understanding the six ISO standards
Each of the six standards addresses a different business requirement. Before planning integration, management should understand what each standard is intended to achieve.
ISO 9001:2026: Quality Management System
The History and Evolution of Total Quality Management
ISO 9001 provides a framework for managing quality, customer requirements, operational processes and continual improvement. The current edition is ISO 9001:2026, which organisations should consider when establishing or updating their quality management system. Popular standards+1
For a technology company, quality management is not limited to checking the final software product. It also involves how requirements are understood, projects are planned, services are delivered, customer feedback is handled and problems are corrected.
Important areas include:
- Understanding customer and applicable requirements
- Establishing quality objectives
- Managing operational processes
- Monitoring customer satisfaction
- Controlling nonconformities
- Evaluating supplier performance
- Conducting internal audits
- Reviewing performance and improvement opportunities
Example: A software development company can use ISO 9001 to establish a consistent process for project requirements, software delivery, customer feedback, issue management and service improvement.
Within an IMS, quality management can provide the overall process governance framework for the other management systems.
ISO/IEC 20000-1:2018: IT Service Management System
ITSM Analytics Dashboards & Reporting | Techknomatic
ISO/IEC 20000-1 specifies requirements for establishing, implementing, maintaining and continually improving an IT Service Management System (SMS). The current requirements edition is ISO/IEC 20000-1:2018, with Amendment 1:2024 on climate action changes. Management System Standards list+1
IT service providers need structured processes to manage services throughout their lifecycle.
The standard addresses areas such as:
- Service planning and management
- Service catalogue management
- Service level management
- Incident and service request management
- Problem management
- Change management
- Release and deployment
- Configuration and asset management
- Service availability and continuity
- Service performance evaluation
Example: A managed IT service provider supporting multiple customers can use ISO/IEC 20000-1 to establish consistent service desk processes, service-level monitoring, incident escalation and change control.
When integrated with ISO 9001, the organisation can align service quality, customer satisfaction and IT service performance.
ISO 22301:2019: Business Continuity Management System
What is Business Continuity? A Complete Guide | Pronto Recovery
ISO 22301 provides requirements for establishing and maintaining a Business Continuity Management System (BCMS). The current published requirements edition is ISO 22301:2019. Management System Standards list
Businesses depend on people, technology, infrastructure, suppliers and information. An unexpected disruption affecting any of these areas can interrupt important operations.
ISO 22301 helps organisations prepare for such situations and establish arrangements to continue delivering priority products and services.
Important areas include:
- Business Impact Analysis (BIA)
- Business continuity risk assessment
- Identification of critical activities
- Recovery strategies
- Business continuity plans
- Incident response arrangements
- Testing and exercising
- Performance evaluation and improvement
Example: If a data centre supporting customer applications experiences a major outage, the organisation should have defined recovery arrangements, responsibilities, communication procedures and service restoration priorities.
Within an IMS, business continuity arrangements can be aligned with IT service management and information security incident response.
ISO/IEC 27001:2022: Information Security Management System
IT-Sicherheit im Mittelstand: Der vollständige Leitfaden 2025
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). The current edition is ISO/IEC 27001:2022, including Amendment 1:2024. Popular standards+1
Information security is important for organisations that manage customer information, business records, intellectual property, financial data, software systems and cloud infrastructure.
The standard requires an organisation to assess information security risks and determine appropriate controls.
Important areas include:
- Information security policies
- Risk assessment and treatment
- Asset management
- Access control
- Human resource security
- Supplier security
- Incident management
- Business continuity-related security
- Security monitoring
- Internal audits and corrective action
Example: A SaaS company storing customer information in cloud infrastructure needs to manage access permissions, security incidents, supplier risks, system vulnerabilities and information protection.
ISO/IEC 27001 can also support the security requirements of IT service delivery under ISO/IEC 20000-1.
ISO/IEC 27701:2025: Privacy Information Management System
DL Tech — Consultoría Estratégica en Ciberseguridad y Cumplimiento
ISO/IEC 27701:2025 specifies requirements and guidance for a Privacy Information Management System (PIMS). The 2025 edition is a standalone management system standard, rather than only an extension to ISO/IEC 27001. Management System Standards list
Organisations handling personal information have responsibilities that go beyond general information security.
They need to understand what personal data they collect, why they collect it, how it is processed, where it is stored, who can access it and how it is retained or disposed of.
Important areas include:
- Personal information processing activities
- Privacy roles and responsibilities
- Privacy risk assessment
- Data subject rights and related processes
- Privacy policies and procedures
- Processor and third-party management
- Personal data retention and disposal
- Privacy incident management
- Monitoring and continual improvement
Example: An organisation providing cloud-based HR software may process employee names, contact details, salary information and other personal data for its customers. It needs appropriate privacy governance for these processing activities.
ISO/IEC 27701 can be integrated with ISO/IEC 27001 to coordinate information security and privacy controls. However, privacy management and information security management remain distinct disciplines.
ISO/IEC 42001:2023: Artificial Intelligence Management System
IASEAI’26 Part 6: Technical-Institutional AI Accountability | by Kevin O’Shaughnessy | Medium
ISO/IEC 42001:2023 specifies requirements for establishing, implementing, maintaining and continually improving an Artificial Intelligence Management System (AIMS). Popular standards+1
Organisations developing, providing or using AI systems need to consider how those systems are governed and managed.
AI-related risks can include inaccurate outputs, bias, lack of transparency, inappropriate use of personal information, security vulnerabilities and insufficient human oversight.
Important areas include:
- AI policy and organisational objectives
- AI system inventory and lifecycle management
- AI risk assessment
- Impact assessment
- Data governance
- Transparency and accountability
- Human oversight
- Supplier and third-party management
- Monitoring and continual improvement
Example: A company developing an AI-powered recruitment platform needs to consider the data used by its system, potential bias, decision-making transparency, human oversight and the impact of AI-generated recommendations.
ISO/IEC 42001 provides a management framework for addressing these responsibilities.
3. How do these six standards work together?
The six standards are different, but their requirements can be coordinated through common organisational processes.
For example, an organisation can use one integrated approach for leadership, planning, risk governance, competence, documentation, audits and management reviews.
ISO identifies the Harmonized Structure as a common structure used by management system standards. This makes it easier for organisations to operate one integrated management system that addresses two or more standards simultaneously. Management System Standards list
The following table explains how the six standards contribute to the overall system.
| Business function | Relevant standard | Expected management outcome |
|---|---|---|
| Quality and customer satisfaction | ISO 9001 | Consistent processes and service quality |
| IT service delivery | ISO/IEC 20000-1 | Controlled and measurable IT services |
| Business resilience | ISO 22301 | Preparedness and recovery arrangements |
| Information security | ISO/IEC 27001 | Protection of information assets |
| Personal data privacy | ISO/IEC 27701 | Structured privacy governance |
| AI governance | ISO/IEC 42001 | Responsible management of AI systems |
Example of an integrated business process
Consider a Hyderabad-based SaaS company that provides cloud-based business applications to customers in India and overseas.
The company may need to address the following requirements:
- ISO 9001 helps manage customer requirements, software delivery quality and customer feedback.
- ISO/IEC 20000-1 helps manage IT services, service requests, incidents and service levels.
- ISO 22301 helps prepare for outages, infrastructure failures and other business disruptions.
- ISO/IEC 27001 helps protect customer information, business applications and IT infrastructure.
- ISO/IEC 27701 helps manage personal data processing and privacy responsibilities.
- ISO/IEC 42001 helps govern AI-based features, AI-related risks and human oversight.
These responsibilities are connected in daily operations.
For example, a security incident affecting a customer application may also become an IT service incident, create a privacy concern, affect service availability and trigger business continuity arrangements.
If every department works independently, the organisation may have difficulty coordinating the response.
An IMS can establish common incident reporting and escalation arrangements, with clear standard-specific procedures for security, privacy, IT service management and business continuity.
This is where integration becomes valuable.
4. What can be integrated across the six ISO standards?
Not every requirement can be combined into one procedure. However, several management activities can be coordinated.
| Common management activity | Integration opportunity |
|---|---|
| Organisational context | One coordinated assessment of internal and external issues |
| Leadership | Common management responsibility and governance |
| Policies | Integrated management policy with standard-specific commitments |
| Objectives | Coordinated objectives and performance indicators |
| Risk management | Common risk governance with specialised assessments |
| Competence | Shared training and competency management |
| Document control | Common document approval and version control |
| Internal audits | Integrated audit programme with requirement-specific audit criteria |
| Management review | Coordinated management review with separate performance inputs |
| Corrective action | Common nonconformity and corrective action process |
| Continual improvement | Consolidated improvement tracking |
What should remain standard-specific?
Integration should not remove the unique requirements of each standard.
For example:
- ISO 9001 needs quality-related operational controls and customer satisfaction monitoring.
- ISO/IEC 20000-1 needs IT service management processes.
- ISO 22301 needs business impact analysis and business continuity arrangements.
- ISO/IEC 27001 needs information security risk assessment and applicable security controls.
- ISO/IEC 27701 needs privacy-specific processes and personal information governance.
- ISO/IEC 42001 needs AI system governance and AI-related risk and impact assessments.
A common risk management procedure may support all six standards, but the organisation must still conduct the assessments required for each subject area.
This distinction is important during implementation and certification audits.
5. Step-by-step process for implementing an Integrated Management System
Implementing six standards together requires proper planning. Organisations should not start by preparing hundreds of documents. The first step is to understand the business, its existing processes and the requirements that need to be addressed.
At CK Associates, we recommend a structured implementation approach.
Step 1: Understand the organisation and define the scope
The organisation should first identify the business activities, departments, locations, services, technologies and processes that will come under the IMS.
For example, an IT company may include:
- Software development
- IT infrastructure management
- Cloud services
- Customer support
- Information security
- Data processing
- AI application development
- Business operations
The scope should be realistic and clearly documented. It should reflect the actual services and activities of the organisation.
Step 2: Conduct an integrated gap assessment
A gap assessment helps identify what the organisation already has in place and what needs to be developed or improved.
The assessment should cover all six standards.
For example:
| Assessment area | What should be checked? |
|---|---|
| Quality | Existing quality processes and customer feedback |
| IT services | Incident, change and service-level management |
| Business continuity | BIA, recovery plans and continuity testing |
| Information security | Security risks, controls and asset management |
| Privacy | Personal data inventory and privacy processes |
| AI governance | AI systems, risks, impact and accountability |
The output should be a gap assessment report with clear actions, responsibilities and priorities.
Step 3: Establish an integrated management policy
Senior management should establish an integrated policy that reflects the organisation’s commitment to quality, IT service performance, business continuity, information security, privacy and responsible AI management.
The policy should be communicated to employees and relevant stakeholders.
A single integrated policy can be used where appropriate, but it must address the commitments required by each applicable standard.
Step 4: Define responsibilities and accountability
Each management system needs clear ownership.
An organisation may appoint an IMS coordinator to monitor the overall implementation. However, specialist responsibilities should remain with people who understand the relevant operational areas.
For example:
| Responsibility | Suggested owner |
|---|---|
| Overall IMS coordination | IMS coordinator |
| Quality management | Quality manager |
| IT service management | IT service manager |
| Business continuity | Business continuity coordinator |
| Information security | Information security manager |
| Privacy management | Privacy lead |
| AI governance | AI system or AI governance lead |
| Management oversight | Top management |
In smaller organisations, one person may handle more than one responsibility. The important point is that accountability must be clear and supported by appropriate competence.
Step 5: Establish integrated risk management
Risk management is one of the most important parts of the implementation.
However, the organisation should not treat every risk as the same.
Consider the following examples:
- A software defect may create a quality risk.
- A prolonged service outage may create an IT service and business continuity risk.
- Unauthorised system access may create an information security risk.
- Improper handling of customer information may create a privacy risk.
- An AI model producing biased or unreliable results may create an AI governance risk.
A common risk management framework can be used to record, evaluate, assign and monitor risks. Specific risk assessment methods and treatment requirements must still be applied where required by each standard.
Step 6: Develop integrated documentation
Documentation should support actual business operations. It should not be prepared only for the purpose of passing an audit.
A practical documentation structure may include:
Level 1: Management system framework
- Integrated management policy
- IMS scope
- IMS objectives
- Roles and responsibilities
Level 2: Common procedures
- Document and record control
- Risk management
- Competence and awareness
- Internal audit
- Management review
- Nonconformity and corrective action
- Supplier management
Level 3: Standard-specific procedures
- Quality management procedures
- IT service management procedures
- Business continuity procedures
- Information security procedures
- Privacy management procedures
- AI governance procedures
Level 4: Operational records and evidence
- Risk registers
- Service records
- Incident reports
- Business continuity test results
- Security assessment records
- Privacy processing records
- AI system assessment records
- Training records
- Audit reports
- Management review minutes
The objective is to avoid unnecessary duplication while ensuring that all requirements are properly addressed.
Step 7: Implement the system across departments
Once the policies and procedures are established, they must be implemented in actual operations.
Employees should understand their responsibilities and follow the defined processes.
Implementation may include:
- Employee awareness sessions
- Department-specific training
- Risk assessment workshops
- Process implementation
- IT service monitoring
- Security control implementation
- Privacy awareness
- AI governance training
- Supplier evaluation
- Business continuity exercises
A documented procedure without operational evidence will not demonstrate effective implementation.
Step 8: Conduct internal audits
Internal audits help determine whether the management system is properly implemented and whether it meets the applicable requirements.
An integrated audit programme can be developed to cover all six standards.
However, auditors must have suitable knowledge of the requirements being audited. A single audit schedule does not mean that every auditor is qualified to assess every technical area.
The audit should identify:
- Nonconformities
- Areas requiring improvement
- Ineffective controls
- Missing records
- Process implementation gaps
- Opportunities for improvement
Step 9: Conduct management review
Top management should review the performance and effectiveness of the IMS.
The review should consider relevant inputs such as:
- Achievement of management system objectives
- Customer feedback
- IT service performance
- Business continuity testing
- Security incidents and risk treatment
- Privacy-related performance
- AI system monitoring and governance
- Internal audit results
- Corrective actions
- Supplier performance
- Resource requirements
- Improvement opportunities
Management review should result in clear decisions and action plans.
Step 10: Prepare for certification audits
Once the systems are implemented and the required audit and management review activities have been completed, the organisation can proceed with certification planning.
Certification bodies will assess the applicable standards against the agreed scope.
The organisation should confirm the certification arrangements, audit programme, scope and applicable editions with its selected certification body.
6. Documentation checklist for the six-standard IMS
The following is a practical planning checklist. It is not a substitute for a clause-by-clause review of the applicable standards.
IMS documentation review checklist
Interactive
Use this checklist to track documents and records that need to be reviewed during implementation.
Common IMS documentationIntegrated management system scopeIntegrated management policy and objectivesOrganisational context and interested partiesRoles, responsibilities and authoritiesDocument and record control procedureIntegrated risk management procedureCompetence and awareness recordsInternal audit programmeManagement review recordsNonconformity and corrective action procedure
ISO 9001 quality managementCustomer requirement reviewQuality objectives and performance monitoringOperational process controlsCustomer feedback and complaintsSupplier evaluation and monitoringNonconformity and improvement records
ISO/IEC 20000-1 IT service managementService management scope and service catalogueService level agreements and monitoringIncident and service request managementProblem and change managementConfiguration and release managementService availability and performance records
ISO 22301 business continuityBusiness Impact AnalysisBusiness continuity risk assessmentBusiness continuity strategiesBusiness continuity plansIncident response and communication arrangementsBusiness continuity exercises and test reports
ISO/IEC 27001 information securityInformation security risk assessmentRisk treatment planStatement of ApplicabilityInformation security policies and proceduresAsset and access management recordsSecurity incident and monitoring records
ISO/IEC 27701 privacy managementPersonal information processing inventoryPrivacy roles and responsibilitiesPrivacy risk assessmentsController and processor arrangements, where applicablePrivacy notices and proceduresPersonal data retention and disposal records
ISO/IEC 42001 AI managementAI management system scope and policyAI system inventoryAI risk assessmentAI impact assessment, where applicableAI objectives and governance responsibilitiesAI system monitoring and human oversight records
The actual documentation requirements depend on the organisation’s scope, activities, risks and the editions of the standards being implemented.
7. How long does it take to implement six ISO standards?
The implementation timeline depends on the organisation’s size, number of employees, existing management systems, business complexity, technology environment and level of operational readiness.
A company that already has ISO 9001 and ISO/IEC 27001 may need less implementation work than an organisation starting all six systems from the beginning.
The following is an indicative planning model, not a guaranteed certification timeline.
| Implementation stage | Indicative period |
|---|---|
| Initial assessment and scope finalisation | 1 to 2 weeks |
| Gap assessment and implementation planning | 2 to 3 weeks |
| Documentation and system design | 3 to 5 weeks |
| Process implementation and training | 4 to 8 weeks |
| Internal audits and corrective actions | 2 to 3 weeks |
| Management review and certification preparation | 1 to 2 weeks |
Some activities can run in parallel. Others require sufficient implementation evidence before the next stage.
For a reasonably prepared organisation, a coordinated implementation may take approximately 3 to 6 months. Complex organisations, multiple locations or significant gaps may require additional time.
The certification body’s audit scheduling and certification decision process should also be considered separately.
8. What determines the cost of an integrated ISO certification project?
There is no single fixed price for implementing six standards. The cost depends on the actual scope and implementation effort.
The major cost factors include:
1. Employee strength
Larger organisations may need more training, interviews, process reviews and audit preparation.
2. Number of locations
Organisations operating from multiple offices, data centres or delivery locations may require additional assessment and implementation effort.
3. Existing certifications
Companies with established ISO systems may be able to reuse suitable processes and evidence after checking their adequacy against the new requirements.
4. Technical complexity
AI development, cloud infrastructure, sensitive personal information, outsourced IT services and critical business operations can require specialised assessment.
5. Documentation and implementation requirements
The amount of work depends on the maturity of existing processes and the gaps identified.
6. Certification audit fees
Certification body charges depend on factors such as scope, employee numbers, audit duration, locations and the applicable certification rules.
A proper gap assessment is the best starting point for estimating the consulting effort and certification-related costs.
9. Can all six ISO standards be certified together?
Organisations can plan an integrated implementation and coordinate certification activities for multiple management system standards.
However, there are important points to understand.
- Each standard has its own requirements.
- Each certification scope must be clearly defined.
- The certification body must be competent and accredited for the relevant standards and scope.
- Audit planning and audit duration must follow applicable certification requirements.
- Certification decisions must address conformity with each applicable standard.
An integrated audit may be possible where the certification body supports it and the relevant requirements are met. It should not be assumed that one certificate automatically covers all six standards.
The organisation should verify the certification body’s accreditation scope and certification arrangements before finalising the project.
10. Why should IT and technology companies consider this integrated approach?
Technology organisations increasingly depend on connected processes. Quality, IT services, business continuity, security, privacy and AI governance affect one another.
A weakness in one area can create problems in another.
Consider a company that provides an AI-powered cloud application.
If the application becomes unavailable, customers may raise service complaints. If the outage is caused by a cyberattack, information security procedures may be activated. If personal information is exposed, privacy incident processes may also apply. If the company cannot restore the service within the required period, business continuity arrangements become important.
This is why a coordinated management approach is useful.
Key business benefits
Better management visibility
Management can review the performance of multiple systems through coordinated reporting and management review.
Improved process consistency
Common procedures help departments follow a more consistent approach to documentation, responsibilities and corrective actions.
Better risk coordination
Risks affecting quality, IT services, business continuity, security, privacy and AI can be reviewed in a connected manner.
Improved customer confidence
A properly implemented management system can help demonstrate that the organisation follows defined processes and monitors important business risks.
More effective audit planning
Integrated audit planning can reduce unnecessary duplication while ensuring that each standard receives appropriate coverage.
Stronger business governance
Management gets a structured way to monitor responsibilities, performance, compliance obligations and improvement activities.
These benefits depend on proper implementation. Simply obtaining certificates without maintaining the systems will not deliver the intended operational value.
11. Important considerations for Indian organisations
Companies operating in India should consider the legal, contractual and regulatory requirements applicable to their business.
For example, organisations processing personal information should assess their obligations under India’s Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, including their phased commencement provisions.
The organisation should identify which provisions are applicable to its activities and the relevant commencement dates. ISO/IEC 27701 certification can support privacy management, but it does not automatically establish compliance with every legal requirement.
Similarly, organisations using AI should consider applicable laws, customer contracts, sector-specific requirements and the risks associated with their AI systems.
The IMS should therefore be designed around both the applicable ISO requirements and the organisation’s actual legal and contractual obligations.
12. How CK Associates supports integrated ISO implementation
Implementing six standards together requires more than preparing documents. It requires an understanding of how the organisation operates and how the requirements of different management systems can be brought together.
CK Associates provides ISO management system consultancy and implementation support to organisations across Hyderabad, Telangana and PAN India.
With more than 20 years of experience and 450+ certification projects, our approach focuses on developing management systems that are practical, properly documented and suitable for the organisation’s operations.
Our implementation support covers:
- Initial discussion and requirement assessment
- Integrated gap assessment
- Scope definition and implementation planning
- Management system documentation
- Process design and implementation support
- Employee awareness and training
- Risk assessment and control planning
- Internal audit support
- Management review preparation
- Certification audit coordination
- Corrective action support
- Surveillance audit support
We work with organisations to integrate the requirements of ISO 9001, ISO/IEC 20000-1, ISO 22301, ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001 into a coordinated management system.
Our focus is to ensure that the management system is understood by employees, followed in actual operations and supported by appropriate records and evidence.
13. Frequently Asked Questions
1. What is an Integrated Management System in ISO?
An Integrated Management System combines the requirements of two or more ISO management system standards into one coordinated framework. It allows organisations to manage common processes such as leadership, risk management, documentation, internal audits and management reviews through an integrated approach.
2. Can ISO 9001, ISO 20000-1, ISO 22301, ISO 27001, ISO 27701 and ISO 42001 be integrated?
Yes. Organisations can integrate the common management system requirements of all six standards while maintaining their individual technical and operational requirements.
3. Is ISO 9001:2026 the latest edition?
Yes. ISO 9001:2026 is the current edition as of November 2026. Organisations planning new implementations should consider the 2026 edition. Existing certificate holders should review the applicable transition arrangements with their certification body. Popular standards+1
4. Is ISO 27701 a standalone certification?
Yes. ISO/IEC 27701:2025 is a standalone Privacy Information Management System standard. Organisations can implement it as a standalone management system or integrate it with ISO/IEC 27001 where appropriate. Management System Standards list
5. What is the difference between ISO 27001 and ISO 27701?
ISO/IEC 27001 focuses on information security management, including protecting information assets and managing information security risks. ISO/IEC 27701 focuses on privacy information management and the handling of personal information. Both address important but different management requirements.
6. Does ISO 42001 apply only to companies developing AI software?
No. ISO/IEC 42001 can be relevant to organisations that develop, provide or use AI systems. Its applicability depends on the organisation’s AI-related activities, scope and responsibilities.
7. Can one integrated policy cover all six standards?
Yes, an organisation can develop one integrated management policy if it adequately addresses the commitments and requirements of all six standards. Supporting standard-specific policies or procedures may still be necessary.
8. Can one internal audit cover all six ISO standards?
An integrated internal audit programme can cover all six standards. However, the audit criteria must address each standard separately, and auditors must have the appropriate competence to evaluate the relevant requirements.
9. How long does it take to implement an integrated management system covering six standards?
A reasonably prepared organisation may require approximately 3 to 6 months. The actual timeline depends on organisational size, existing systems, operational complexity, implementation gaps and certification audit scheduling.
10. Is an integrated certification cheaper than obtaining six separate certifications?
Integration can reduce duplicated consulting, documentation and audit preparation activities. However, certification fees depend on the certification body’s audit requirements, scope, employee strength, locations and applicable accreditation arrangements. Cost savings should be assessed against the actual project scope.
11. Is an integrated management system suitable for small and medium-sized IT companies?
Yes. An IMS can be designed according to the size, activities, risks and complexity of an organisation. Small and medium-sized companies can benefit from a well-planned system without introducing unnecessary administrative procedures.
12. Does ISO certification guarantee compliance with all legal requirements?
No. ISO certification demonstrates conformity with the applicable management system standard within the certified scope. Organisations must separately identify and meet their applicable statutory, regulatory and contractual obligations.
Conclusion: Build a stronger management system through integration
Managing quality, IT services, business continuity, information security, privacy and artificial intelligence separately can create additional work and make coordination difficult.
An Integrated Management System provides a structured way to bring these responsibilities together.
By integrating ISO 9001, ISO/IEC 20000-1, ISO 22301, ISO/IEC 27001, ISO/IEC 27701 and ISO/IEC 42001, organisations can establish common management processes while maintaining the specific controls required by each standard.
The real value of integration is not the number of certificates an organisation obtains. It is how effectively the management system supports daily operations, manages risks, improves performance and builds customer confidence.
If your organisation is planning to implement multiple ISO standards, start with an assessment of your existing processes and identify where integration makes practical sense.
CK Associates can support your organisation throughout the integrated ISO implementation and certification preparation process.
Planning to Integrate Multiple ISO Standards?
Let us help you establish a practical Integrated Management System covering quality, IT services, business continuity, information security, privacy and AI governance.
CK Associates
sirish.kaza@ckassociates.biz
+91 98853 07909
20+ Years of Experience | 450+ Certification Projects | PAN India Consultancy
About the author
Sirish K is the Founder and Lead ISO Consultant at CK Associates, Hyderabad. With more than 20 years of experience in ISO management system consultancy and 450+ certification projects, he supports organisations in establishing, implementing and improving management systems across multiple industries.
His areas of work include Quality Management, IT Service Management, Information Security, Business Continuity, Privacy Information Management, AI Management Systems and Integrated Management Systems.
Website: CK Associates
