Integrated management systems
Kellwick designs, audits and maintains integrated management systems combining ISO 9001, ISO 27001 and ISO 42001. Governance, document control, internal audit and management review run once. Each standard's own requirements stay intact.
There is no required starting point. Manufacturers usually start from quality, technology firms from information security, AI companies from ISO 42001. We build from what operates today.
The shared structure
ISO management system standards share the Harmonized Structure: the same clause numbers and core text for clauses 4 to 10. That shared layer is what an integrated system builds once.
Interested parties, scope and the issues that shape the system - determined once, with each standard's own context added.
One policy framework, one set of roles and one top-management commitment, instead of several competing ones.
One planning cycle for objectives and actions - with each discipline's risk method run inside it, not replaced by it.
Competence, awareness, communication and document control run once for every standard in scope.
Shared change and supplier processes where they genuinely overlap; discipline-specific operational controls stay separate.
One internal audit programme and one management review that cover every standard, with each standard's inputs visible.
One nonconformity and corrective-action log, so a finding from any audit is handled the same way.
Common combinations
IT services, outsourcing, software and professional services firms answering tenders that ask for both.
Quality processes and the ISMS share document control, internal audit and management review. Service delivery and information security controls stay distinct.
SaaS and AI companies whose buyers ask what governs the model as well as the data.
The AI management system reuses the ISMS machinery, then adds AI system inventory, AI risk and AI system impact assessment.
Organisations using AI inside a quality-controlled process - inspection, forecasting, customer service.
AI lifecycle controls sit alongside process control. Useful where there is no ISMS yet and quality is the established discipline.
Technology and service providers that need quality, security and AI governance assurance in one system.
One audit programme across three standards. The audit plan still names which requirements of each standard are sampled.
Organisations adding ISO/IEC 27701 privacy, or other Harmonized Structure standards, to what they run.
We scope these case by case and say plainly where we bring in a specialist for a discipline outside our core.
Who it is for
Separate policies, document registers and owners for each standard, maintained by different people and drifting apart.
The same process owner interviewed three times a year by three internal audits that never compare findings.
One merged risk register that satisfies no standard properly, because a single method was forced onto all of them.
Integration done on paper only - a shared manual over systems that still operate separately.
How it works
Each system's scope, documented information, owners, audit programme and certification cycle - and where they already overlap.
Context, policy framework, roles, document control, competence, internal audit and management review designed once for every standard in scope.
Each standard's risk method, controls and operational requirements kept as they are, with clear links into the shared layer.
Internal audit programme and management review rebuilt to cover every standard, and the certification cycles mapped so combined audits become possible.
An integrated internal audit by an auditor independent of the design work, and corrective actions closed before the certification body visits.
Optional ongoing support through Managed IMS, with one monthly rhythm and each standard's requirements still visible.
What stays separate
A single generic risk assessment cannot satisfy every standard. The governance can be shared; the methods each standard requires cannot be replaced.
| Standard | What its risk work requires |
|---|---|
| ISO 9001 | Risks and opportunities to the QMS and to conformity of products and services, addressed through process planning. |
| ISO 27001 | Information security risk assessment and treatment, with the Statement of Applicability justifying every Annex A control decision. |
| ISO 42001 | AI risk assessment plus an AI system impact assessment covering effects on individuals, groups and society. |
What you receive
What we need from you
Integrated internal audits
An integrated audit interviews each process owner once and follows shared processes once. It does not shorten the list of requirements. The audit plan states, per standard, which requirements are sampled in this audit and which later in the programme, so coverage over the cycle can be shown to a certification body.
Each part is audited by someone competent in that standard, and physical processes are audited on site.
ISO internal audit services →Scope and pricing
An IMS engagement is quoted per scope, not per standard count alone.
Multi-standard work is quoted after a scoping conversation. Certification body fees, travel and taxes are separate from Kellwick's fees.
Delivery
Boundaries
A combined audit programme still has to sample the applicable requirements of every standard in scope. Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
Related services
Questions
No. Any Harmonized Structure standard can be the starting point. We start from whichever system already operates best in your organisation and integrate the others into it.
The management system machinery integrates: context, leadership, planning, support, internal audit, management review and improvement follow the same structure. The discipline-specific requirements do not merge - information security controls, AI impact assessment and quality processes each stay what they are.
You can use one risk governance process - one register format, one review cadence, one escalation route. The methods inside it stay standard-specific: ISO 27001 needs information security risk treatment and a Statement of Applicability, and ISO 42001 an AI system impact assessment.
Often, where it is accredited for each standard in scope. Whether combined audits reduce audit time depends on the certification body and your scope, so ask yours. We prepare the system so a combined audit is possible.
Our auditors hold ISO/IEC 27001 Lead Auditor, ISO 9001 Lead Auditor and ISO/IEC 42001 Lead Auditor certification. Integrated internal audits are planned so each standard's requirements are sampled by an auditor competent in that standard, and nobody audits work they designed or operate.
We map where your systems already overlap and what a single system would remove - and say if integration is not worth it for your scope.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.