Ongoing compliance - integrated systems
Ongoing management of an integrated management system - any combination of ISO 9001, ISO 27001 and ISO 42001 - with shared document control, corrective action and management review, and each standard's own requirements kept visible.
Integration removes duplicated work. It does not remove requirements. A combined audit programme still has to sample every standard, and one generic risk assessment cannot replace the different risk methods the standards ask for.
Shared and specific
The test of a well-run IMS: shared work is done once, and every standard can still find its own requirements.
| Area | Shared | Stays standard-specific |
|---|---|---|
| Governance | Policy framework, roles, top management commitment, management review | Each standard's required policy content and review inputs |
| Documented information | One document control process and register | SoA (ISO 27001), AI impact assessments (ISO 42001) |
| Risk | A common risk governance cadence and reporting | Information security risk, quality risks and opportunities, AI risk and impact - different methods |
| Improvement | One nonconformity and corrective action process | Standard-specific triggers, such as product nonconformities or AI incidents |
| Internal audit | One audit programme and reporting format | Every included standard's applicable requirements still audited |
Who it is for
Three management reviews, three document registers, three action logs for one organisation.
Standard-specific requirements disappear in the merge and surface as audit findings.
A single register tries to cover security risk, quality opportunity and AI impact, and fits none.
Each standard has a champion; nobody owns the system as a whole.
How it works
We map what is genuinely shared and what is standard-specific across your certifications, and agree the target structure.
A single operating calendar with each standard's specific activities marked, sized to the contracted capacity.
Shared document control and corrective action each month, standard-specific evidence and risk reviews on their own schedules.
Integrated internal audit programme with independent auditors, one management review, readiness for combined or separate certification audits.
Operating calendar
Shared activities run once; each standard's specific activities run on their own schedule inside the same calendar.
| When | Activity | What it involves |
|---|---|---|
| Monthly | Shared corrective action log | One log for nonconformities across the system, each tagged with the standards and requirements it affects, followed to verified closure. |
| Monthly | Document control | Shared procedures maintained once; standard-specific documents (SoA, AI impact assessments) kept under the same control. |
| Monthly | Standard-specific evidence | The evidence each standard needs that month - security control evidence, quality KPIs, AI monitoring - checked against its own schedule. |
| Quarterly | Risk reviews, by method | Each risk method reviewed in its own terms: information security risk assessment, quality risks and opportunities, AI risk and impact. Shared where genuinely the same, separate where the standard requires. |
| Quarterly | Supplier reviews | One supplier register with criteria per standard - security assurance, quality performance, AI provider terms. |
| Quarterly | Objectives and metrics | Integrated objectives reported together, with each standard's required objectives still traceable. |
| Annually | Integrated internal audit programme | One programme across the system, planned so every included standard's applicable requirements are sampled; audits performed independently. |
| Annually | Integrated management review | One review meeting with inputs for every standard, so top management sees the whole system and every standard's required inputs are covered. |
| Annually | Combined audit readiness | Readiness checked for combined or separate certification audits, including any edition transitions such as ISO 9001:2026. |
The calendar is agreed at the start of the retainer and sized to the contracted monthly capacity. Activities that do not fit the capacity are scheduled across months or quoted separately - never squeezed in.
What you receive
What we need from you
Responsibilities
A managed system is still your management system. The retainer covers the coordination, upkeep and expert work; decisions, approvals and the controls themselves stay with your people.
Audit independence
Auditors must remain independent of the activities they audit. Where Kellwick has supported implementation or ongoing management, any subsequent internal audit is subject to an independence and conflict-of-interest review. The assigned auditor must not have participated in the work being audited. Where sufficient objectivity and impartiality cannot be assured, Kellwick will decline the affected scope or recommend independent external assurance.
The retainer coordinates the internal audit programme - scheduling, scope, follow-up of findings. The audit itself is either a separate independent audit by another Kellwick auditor, or performed by your own trained auditors or another provider.
Capacity and pricing
Managed IMS retainers are scoped to the system: which standards, how many sites, whether operations need onsite visits, and the certification audit pattern. The monthly days are stated in the proposal.
Retainer fees are Kellwick consulting fees only. Certification body fees, travel, taxes and third-party tools are separate.
Typical investment
Monthly retainerScoped on a call
Up to three advisory days per month (24 hours)
What changes it: Standards in scope · Sites · Onsite visits
Delivery
Boundaries
Each certification body audit tests the requirements of its own standard. A Managed IMS keeps shared processes shared and keeps every standard-specific requirement visible, so integration never becomes the reason a requirement was missed.
Related services
Questions
No. An integrated system can start from whichever standard you hold first - quality, information security or AI governance. The standards share a common high-level structure, which is what makes integration practical.
One audit programme can, and combined audits save time. But every included standard's applicable requirements still have to be audited; integration changes how the audit is organised, not what it must cover.
You can use one governance cadence and one reporting format. The standards ask for different risk methods - information security risk assessment, quality risks and opportunities, AI impact assessment - so those stay distinct where the standard requires.
An auditor with no involvement in maintaining it, under a separate engagement, or your own trained auditors or another provider.
Tell us which standards you hold, how they are run today and your certification dates. We will propose a calendar and the capacity it needs.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.