IMS Implementation: A Clear 7-Step Plan for 2026

IMS implementation — building one management system to hold ISO 9001, ISO 14001 and ISO 45001 at once — succeeds or fails on a decision most organizations never make explicitly: what level of integration they are building. The harmonized structure makes the three standards share seven of ten clauses almost word for word, so a single manual, a single risk process, a single audit programme and a single management review are possible. But “possible” is not “done”, and an IMS whose procedures still say “quality” in one folder and “safety” in another will be treated by a certification body, under IAF MD 11, as a combined system rather than an integrated one — with the audit time to match. This guide sets out a seven-step IMS implementation plan, from the integration decision to the first integrated review, with what each step produces and where the three standards diverge.

Before step one: what the three standards share

ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018 are built on the harmonized structure — ten clauses, with context, leadership, planning, support, operation, performance evaluation and improvement in the same places. Clauses 4, 5, 7, 9 and 10 are largely common; clause 6 shares the risk-and-opportunity logic but adds environmental aspects and compliance obligations (14001) and hazard identification with the hierarchy of controls (45001); clause 8 is where the standards diverge most, because operational control of quality, environment and safety are different jobs. Our guide to Annex SL and the ten harmonized clauses covers the shared skeleton; the practical consequence for IMS implementation is that roughly two-thirds of the system can be built once.

The seven steps of IMS implementation

Step 1: Decide the level of integration, and write it down

IAF MD 11 defines a management system as anything from “a combined system adding separate management systems for each set of audit criteria” to “an Integrated Management System, sharing in single system documentation, management system elements, and responsibilities”, and it judges the level of integration on markers: an integrated documentation set including work instructions, management reviews that consider the overall strategy and plan, an integrated approach to internal audits, to policy and objectives, to system processes, to improvement mechanisms, and integrated management support and responsibilities. Decide which markers you will meet and record the decision — it is what the certification body confirms at stage 1 and what sets the audit duration. Our guide to IMS certification cost covers the 20% cap on the reduction.

Step 2: Map the clauses and the existing systems

Build a clause matrix: one row per requirement in each standard, one column each for 9001, 14001 and 45001, and a column for the existing document or process that meets it. Most organizations implementing an IMS already hold one certificate, usually ISO 9001, so the matrix shows what the quality system already covers, what needs extending, and what is new. The gaps cluster predictably: environmental aspects and compliance obligations, hazard identification and worker consultation, emergency preparedness across all three, and evaluation of compliance.

Step 3: Build the common core once

One integrated policy — or one policy document with quality, environmental and OH&S commitments — one context and interested-party analysis, one scope statement, one risk and opportunity process, one competence and awareness process, one documented-information procedure, one audit programme, one nonconformity and corrective action process, one management review. Each is written to satisfy all three standards and cross-referenced to all three clauses. Our guide to the IMS manual covers the document that ties the core together.

Step 4: Add the standard-specific processes

These are built as separate procedures inside the same system, using the common core’s registers and forms where they fit — the risk and opportunity register carries aspects and hazards as typed entries; the compliance register carries environmental and OH&S legal requirements together; emergency preparedness is one plan with environmental and safety scenarios.

Step 5: Run the system and generate records

Certification bodies audit records, not plans. Three months of operation is the practical minimum before a stage 1 audit: objectives set and tracked, aspects and hazards assessed, legal register populated and compliance evaluated, training delivered, incidents and nonconformities raised and closed, and the integrated policy communicated. The records prove the integration markers exist in practice.

Step 6: Audit it as one system

One internal audit programme covering all three standards, with auditors competent in all three or teams that are, and one report with each finding traceable to the standard(s) it concerns — the same rule MD 11 applies to certification audits. Our guide to the combined internal audit covers the checklist and the traceability.

Step 7: Review it as one system

One management review with an agenda that runs the common inputs once and the standard-specific inputs — customer, environmental, OH&S — as their own items, with decisions, owners and a conclusion on suitability, adequacy and effectiveness per standard. Our guide to the integrated management review sets out the twelve-item agenda. Book the certification body after this review has happened, not before.

Timeline and effort

The ranges are typical project durations, not standard requirements. What compresses them is the common core — the parts written once — and what extends them is clause 8, where the standards do different jobs and each needs its own operating evidence.

Where IMS implementation goes wrong

1. Integration by binder. Three sets of procedures in one folder, each still naming its own standard. MD 11 calls this a combined system; the audit takes as long as three.
2. A quality-shaped IMS. Built by extending the QMS, it treats environment and safety as chapters. Worker consultation (45001 clause 5.4) and compliance obligations (14001 clause 6.1.3) get missed because the QMS never had them.
3. One risk register with no typing. Quality risks, environmental aspects and OH&S hazards need different assessment methods — significance criteria for aspects, the hierarchy of controls for hazards. One register is right; one method is not.
4. Auditors competent in one standard. An integrated audit programme staffed by quality auditors produces environmental and safety findings that are shallow, and the certification body notices.
5. Booking certification before the first review. The management review is a stage 1 prerequisite in practice; a system that has not been reviewed has not completed a cycle.

Frequently asked questions

How long does IMS implementation take?
Typically 6–9 months to stage 1 for an ISO 9001-certified organization adding ISO 14001 and ISO 45001, 9–15 months from nothing, and 3–6 months to integrate three existing certificates. The common core is built once; clause 8 is the critical path.

Can we get one certificate for an IMS?
Certification is per standard; a certification body issues separate certificates, often on one document, from one integrated audit conducted under IAF MD 11.

What level of integration should we aim for?
The highest you can evidence: shared documentation including work instructions, one policy and objective set, one risk process, one audit programme, one management review and shared responsibilities. Those are the markers MD 11 uses, and each you meet reduces audit time toward the 20% cap.

Do we need one policy or three?
Either is acceptable. One integrated policy with quality, environmental and OH&S commitments is the stronger integration marker; three policies in one document is common and acceptable if each standard’s required commitments are present.

Which standard editions apply?
ISO 9001:2026 and ISO 14001:2026 are the current editions, with the 2015 editions withdrawn and transition periods running; ISO 45001:2018 is current, with a revision expected in 2027. Build the IMS to the current editions and track the 45001 revision.

Where this leaves you

Run IMS implementation as seven steps: decide and record the integration level, map the clauses against what exists, build the common core once, add the quality, environmental and OH&S processes that cannot be shared, run the system until it has records, audit it as one and review it as one. The system that results is the one MD 11 recognizes as integrated — and the one that costs a third less to build and up to a fifth less to audit than three.

References

• IAF MD 11:2023 — Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems — The definition of an IMS, the integration markers and the audit-duration rules.
• ISO 9001:2026 — The sixth edition of ISO 9001.
• ISO 45001:2018 — Occupational health and safety management systems.

More on integrated management systems

• IMS implementation — you are here
• Integrated management systems: combining ISO standards
• The integrated management system manual
• Annex SL and the ten harmonized clauses
• The integrated management review
• IMS certification cost

The EHQMS system manual and policy, the 26 integrated procedures from organizational context to continual improvement, and the 52 registers and forms behind them are in the IMS Toolkit, or start with the free templates.