This column will cover the background and importance of Auditing Multiple and Integrated Management Systems, the advantages and disadvantages organizations accrue when integrating and when auditing their systems. And adjusting their auditing programs to fit the new reality of multiple and integrated management systems (intMS) increasingly prevalent today.

The adoption of formal Management Systems has risen dramatically the past few decades, and an increasing number of organizations have implemented multiple management systems. Organizations are increasingly recognizing the advantages and efficiencies that accrue by their integration, whether it be full, or partial integration.

Integration was more difficult prior to the harmonization of the ISO Standards – now guided by ISO’s Annex SL – the high-level structure that provides identical structure, text, and common terms and definitions for management system standards of the future. This will ensure consistency among future and revised management system standards and make their integration, and integrated use simpler. This is highlighted in the recent adoption of ISO 9001 and ISO 14001: 2015, and ISO 45001, ISO’s Occupational Health and Safety Management System Standard, and ISO’s newest.

With the addition of each management system, auditing resources necessary to ensure their effectiveness could, without integration and streamlining efforts, roughly double. Those organizations with a QMS, EMS, and HSMS could triple the auditing resources – including time, utilized over that of a single system.

For the commonly used 2-3 auditors per system, 6-9 auditors may be necessary for those with a QMS, EMS, and HSMS. For those using 3 or more audit team members, imagine the audit army this creates, let alone the time necessary to audit separate systems, and the disruption to the organization.

Considering all the other financial, customer, supply chain, and other audits organizations are subjected, and you can understand why many organizations are ‘audit weary’!

Integrated Audits

Professionals who have conducted integrated audits recognize how much more efficient they can be. The process under review, along with all its controls; environmental, health, safety, and quality; has to be evaluated only once.

There is less duplication of effort during the planning, execution, and even follow-up phases of the audit. Other efficiencies, often unforeseen, are uncovered or revealed once an organization begins an integrated management system pathway, and is yet another advantage to integrated auditing.

Typically, management systems integration allows the organization to minimize duplication and redundancy of effort, streamline or leverage the use of its limited resources, and reduce or eliminate overlapping responsibilities. This is true of integrated systems in general and is especially true regarding the audit function. minimizing duplication and redundancy of efforts translates to significant cost savings, productivity increases, risk reductions, and enhanced effectiveness and efficiency that the intMS are designed to achieve.

When it comes to intMS registration, Registrars should confer savings when auditing and certifying intMS through the same efficiencies and streamlining efforts organizations achieve internally.

Disadvantages of Integrated Audits

While there are many advantages to implementing and auditing intMS, it is important to recognize that there are disadvantages as well.

If an organization is seeking third-party registration to one or more standards, a non-conformance against a requirement of one standard may carry over to another standard. In the worst case scenario, if the non-conformance is major, all registrations could be at risk unless effective corrective action is taken.

Another disadvantage is the learning curve and attendant training that will likely be an adjustment for staff members, many of whom will not be familiar with the requirements of all the management systems involved in the IntMS.

For example, Quality staff may be intimately familiar with ISO 9001 requirements, while needing extensive and perhaps costly training on ISO 14001. The same will be true of OHSMS staff, and vice-versa for each staff function.

—

In the next installment of this column, we will dive into the mechanics and logistics of intMS auditing, as well as provide tips and techniques to help improve intMS audit team effectiveness and efficiency.

About John Grosskopf: Since a Dr. Deming led quality and environmental paradigm shift at General Dynamics in the late 80’s, John has been a strong management systems (MS) advocate. He has pioneered advances in auditing, integrating MS, a chief contributor to two national MS Standards, and has led the development, implementation, and improvement of hundreds of MS in the public and private sectors. He is an accredited EMS, HSMS, and QMS auditor (accreditations pending), a published author, instructor/trainer, and has presented widely on MSs. Through his firm, DeepGreen Consulting, he is currently assisting clients to improve their triple bottom line through a combination of MS, best practices, collaboration, and leadership

Reference: Auditing Integrated Management Systems: Considerations and Practice Tips, November 2008, Journal of Environmental Quality Management, John Grosskopf, with co-author Jennifer Kraus.

Determining the Context of the organization is a new requirements in ISO 45001 and, has already been incorporated in ISO 9001:2015 and ISO 14001:2015.

Context of the Organisation is about understanding the entire environment in which the organisation operates. The Context can be external or internal. Utilizing SWOT Analysis and PESTLE Analysis (Political, Economic, Social, Technological, Legal and Environmental factors) are two methodologies which can be useful determining context.

Firstly, the organization needs to determine in internal and external issues which have the ability to affect the outcomes of its Occupational Health & Safety (OH&S) Management System. The internal or external issues can be positive or negative. They can include conditions, characteristics or changing circumstances which can affect the OH&S management system.

External issues can be:

• PESTLE (Political, Economic, Social, Technological, Legal and Environmental) etc. factors.
• New competitors, contractors, suppliers, partners etc.
• Latest knowledge about products and their ability to affect OH&S.
• Key drivers and trends relevant to industry.
• Relationships with external interested parties.
• Changes in any of the above factors.

Internal issues can be

• Organizational structure, and roles.
• Policies and objectives.
• Capabilities in terms of Resources such as capital, human and technological.
• Information systems.
• Relationship as well as perception of workers.
• Contractual relationships such as outsourced activities.
• Working conditions and organizational culture.
• Working time arrangements.
• Changes in products, processes, equipment.
• Changes in any of the above factors.

Secondly, the organization has to determine the Interested Parties in addition to workers, and their needs and expectations which are relevant to its OH&S Management System.

Interested Parties can be legal and regulatory authorities, parent organizations, suppliers, contractors and subcontractors, workers representatives, workers organizations such as trade unions and employers’ organizations, customers, medical or other community services, media, business associations and NGO’s, occupational health & safety organizations and practitioners.

Some needs and expectations are incorporated in to the laws and regulations and are therefore mandatory. Then there are some voluntary requirements which the organization may have subscribed to. The organization addresses the needs and expectations through the planning and implementation of its OH&S Management system.

Thirdly, the organization has to define the Scope of its OH&S Management System by defining its boundaries and applicability.

To determine the scope, the organization has to consider the Issues relevant to it. Then it has to consider the interested parties and their needs and expectations. After that it has to take in to account the planned or performed work related activities. The boundaries can include the whole organization or a specific part of the organization. The scope shall not be used to evade its legal and other requirements. Those activities have to be considered that can affect the OH& S performance of the organization. The scope has to be maintained as documented information.

Fourthly, the organization must establish, implement, maintain and continually improve an OH&S management system according to requirements of ISO 45001 and establish one or more processes that fulfil the requirements of this standard and implement those processes, control them and achieve the intended outcomes. The organization shall also integrate and incorporate the requirements of this standard into its business processes such as design and development, procurement, training and education, human resources, sales and marketing.

Organizations go through a great deal of work, time and effort to implement management systems such as ISO 9001, ISO 14001, and many others. These management systems are implemented and certified for many reasons, and one of these reasons is recognition. Organizations want their clients, customers, consumers and other interested parties to recognize that their management systems follow specific standards and comply with certain requirements.

When a certification body is accredited, it means that an accreditation body has verified that it follows a series of standards and requirements that guarantee that their service is impartial, consistent, reliable and recognized internationally. These strict and regular checks that certification bodies undergo provide trust and credibility to the certification. Thus, accredited certification can provide confidence to clients, customers, regulators and other interested parties that the organization is complying with the specific standard, code of conduct or requirement.

Additional to having a certification recognized by all the interested parties of an organization, there are other benefits of accredited certification. These are:

Ensures competency
Accreditation can guarantee that the certification body is competent in assessing specific standards. Organizations want to make sure that auditors are knowledgeable, experienced and that can provide an impartial assessment in the management system being certified.

Provides legitimacy

This legitimacy is based on the participation and recognition of public authorities in the structure of the accreditation body, which follow strict international regulations.

Ensures equality of criteria

The regular checks of the certification body can guarantee that over the years the organization’s management system will be assessed by the same criteria. This equality of criteria will assist in the maturity of the management system, by supporting its continuous improvement, innovation and internal prestige. It can also support organizations in focusing on the achievement of proposed goals.

Reduces risks

Organizations rely on the outcome of their certification body’s assessment to make important decisions regarding their management system. Thus, it reduces the probability of making bad decisions regarding the management system and misallocating resources.
In general, with accredited certification it is possible to ensure legal compliance, guarantee objective and impartial assessments, ensure confidence and credibility with interested parties, focus on activities that add value, focus on what is important to the interests of the organization, and improve the assessment of the management system that will consequently support decision making.

These are the main reasons for choosing accredited certification, however, there could be others. There could be the case that a client or a regulatory body requires an organization to have an accredited certification. Thus, before choosing, organizations need to consider the above benefits and any other that could apply to their particular situation and their specific goals.

There are many accredited Registrars’ listed on the ISO Update Registrar Directory. Fine one here: http://isoupdate.com/registrar-listing/