Understanding ISO Management System Standards
How the ISO management system standards family fits together: the harmonised structure, the ten standards QA Assessor certifies against with their current editions, and how an integrated system reduces duplicated effort.
ISO management system standards share one design. Since the harmonised structure (formerly called Annex SL, now Annex L of the ISO directives) was adopted, every management system standard uses the same ten clause layout, the same core definitions and a large block of identical text. Once you understand one, you understand the skeleton of all of them.
The harmonised structure
Clauses 1 to 3 cover scope, normative references and terms. The requirements start at clause 4.
- Context of the organisation. Understanding internal and external issues, interested parties and their requirements, and defining the scope of the system.
- Leadership. Top management commitment, policy, and organisational roles, responsibilities and authorities.
- Planning. Actions to address risks and opportunities, objectives and planning to achieve them, and planning of changes.
- Support. Resources, competence, awareness, communication and documented information.
- Operation. Operational planning and control, plus the discipline specific requirements that make each standard different.
- Performance evaluation. Monitoring, measurement, analysis and evaluation, internal audit and management review.
- Improvement. Nonconformity and corrective action, and continual improvement.
The structure follows Plan, Do, Check, Act. Clauses 4 to 7 are Plan, clause 8 is Do, clause 9 is Check and clause 10 is Act.
The ten standards QA Assessor certifies against
| Standard | Discipline | What it adds to the common structure |
|---|---|---|
| ISO 9001:2026 | Quality management | Customer focus, product and service realisation, control of externally provided processes, design and development, release and control of nonconforming outputs. |
| ISO 14001:2026 | Environmental management | Environmental aspects and impacts, compliance obligations, life cycle perspective, emergency preparedness. |
| ISO 45001:2018 | Occupational health and safety | Hazard identification, worker consultation and participation, hierarchy of controls, incident investigation. |
| ISO 50001:2018 | Energy management | Energy review, energy baseline and performance indicators, design and procurement for energy performance. |
| ISO/IEC 27001:2022 | Information security | Risk assessment and treatment, the Statement of Applicability, and the 93 controls in Annex A. |
| ISO/IEC 42001:2023 | Artificial intelligence management | AI system impact assessment, AI policy, responsible development and use, and the Annex A controls for AI. |
| ISO 22301:2019 | Business continuity | Business impact analysis, risk assessment, continuity strategies and plans, exercising and testing. |
| ISO 13485:2016 | Medical devices quality | Regulatory requirements, design and development files, traceability, sterile device controls. Based on the earlier ISO 9001 structure rather than the harmonised one. |
| ISO 22000:2018 | Food safety | Prerequisite programmes, hazard analysis, HACCP plan, traceability and withdrawal. |
| ISO 37001:2025 | Anti-bribery | Bribery risk assessment, due diligence, financial and non financial controls, the anti-bribery compliance function. |
Editions matter. ISO 9001 and ISO 14001 were both revised in 2026 and ISO 37001 in 2025. Organisations certified to the previous edition have a transition period, and auditors need to know both editions during that time.
Integrated management systems
Because the standards share a structure, an organisation can run a single integrated system covering, for example, quality, environment and occupational health and safety. One policy framework, one set of objectives, one internal audit programme, one management review. The discipline specific requirements in clause 8 stay separate; everything else is shared. Integration reduces duplicated documentation and gives management one view of performance instead of three.
Requirements versus guidance
Standards with “requirements” in the title, such as ISO 9001, ISO 14001 and ISO/IEC 27001, can be certified against. Guidance standards, such as ISO 19011 for auditing, ISO 31000 for risk management and ISO 9004 for sustained success, cannot. An organisation is certified to a requirements standard; it uses the guidance standards to get there.
Personnel certification and the standards
QA Assessor certifies individuals, not organisations. Each of the ten standards above is a QA Assessor certification scheme with five auditor grades, from Associate Auditor to Principal Auditor, and each grade defines the training and verified audit experience an applicant must show for that standard. Choose the standard that matches your work and the grade that matches your experience.
Put it into practice
QA Assessor certifies management system auditors at five grades, Associate Auditor to Principal Auditor, across ten ISO management system standards.
View certification schemes More articles