IAF MD 11 – Audits of integrated management systems to ISO/IEC 17021-1

If organisations have implemented at least two management system standards that are to be audited and, where applicable, certified (e.g. ISO 9001 and ISO/IEC 27001), specific requirements arise for conformity assessment bodies (such as us) in preparing and conducting the audit. These are set out in IAF MD 11:2023.

Integrated management system

According to IAF MD 11:2023, an integrated management system is defined as follows:

"A single management system that manages multiple aspects of organisational operations in order to meet the requirements of more than one management standard with a given degree of integration. A management system can range from a combined system, to which separate management systems for each set of audit criteria/standards are added, to an integrated management system (IMS) that shares a single set of documentation, management system elements and responsibilities."

Degree of integration

The key term in this definition is the "degree of integration". This represents the extent to which at least two management system standards are integrated into a single central management system. Integration relates to that central management system and to whether – and to what extent – it is able to integrate the documentation, appropriate management system elements and responsibilities in respect of two or more sets of audit criteria/standards.

Assessing the degree of integration

According to IAF MD 11:2023, the degree of integration is measured by, among others, the following aspects, which must be assessed and evaluated by the client concerned:

An integrated set of documentation, including work instructions, where applicable at an appropriate stage of development,
Management reviews that take into account the organisation's overall business strategy and business plan,
An integrated approach to internal audits,
An integrated approach to the organisation's policy and objectives,
An integrated approach to system processes,
An integrated approach to improvement mechanisms (corrective and preventive actions; measurement and continual improvement), and
Integrated management support and responsibilities.

Why is the degree of integration so important?

The level of integration is directly linked to the audit time. To determine the audit time for an audit of an IMS covering two or more management system standards/specifications, the required audit time must be calculated separately for each management system standard. The sum of the respective audit times represents the time required for the IMS audit. This effort can then be reduced further depending on the degree of integration. However, if the IMS does not display a sufficient level of integration, the audit time may also increase. Alongside the complexity of auditing an IMS compared with individual management system audits, it is of central importance that the audit programme and audit plans cover all areas and activities relating to each management system standard affected by the scope of the audit.

Example

Let us take a hypothetical worked example. You are planning to certify your quality management system (hereinafter "QMS") to ISO 9001 and your information security management system (hereinafter "ISMS") to ISO/IEC 27001. The audit time required for the QMS is 5 days and for the ISMS 8 days. The total effort is therefore 13 days.

Now let us assume that the QMS and ISMS display a very high degree of integration and have already been through several cycles. This can lead to a reduction in audit time of up to 20%. Let us assume 15% – the audit effort would be reduced from 13 to 11 days.

This entry does not claim to cover all individual requirements of IAF MD 11:2023 in full. Rather, it is intended as a summary of the key requirements – particularly from a client perspective.

Go back

IAF MD 1 – Auditing and certification of management systems in multi-site organisations

How does certification work for organisations with multiple sites – and what needs to be considered in multi-site audits? The IAF MD 1:2023 guidance sets out clear requirements, which we examine more closely in this article. From the definition of key terms such as "head office" and "sites", through the requirements for matrix certifications, to the question of when a sampling procedure makes sense and when it does not: we provide a comprehensive overview of the factors that influence audit effort and audit duration. Discover the key prerequisites and find out how best to prepare the certification process for your multi-site organisation. An indispensable guide for organisations looking to structure their certification effort clearly.

IAF MD 2 – Certificate transfers

Would you like to transfer your certification to a new certification body? The IAF MD 2 document governs the prerequisites and requirements to be met when transferring certificates – for example for ISO 9001 or ISO/IEC 27001. In this article you will learn under which conditions a certificate transfer is possible, how the assessment process works, and what to do if certificates cannot be transferred due to particular circumstances. We also examine the role of the issuing and the accepting certification body in the transfer process and what to bear in mind after a successful transfer. An indispensable guide for organisations aiming for a smooth change of certificate.

IAF MD 4 – Use of information and communication technology (ICT) in audits

Digital technologies in audits – yes or no? IAF MD 4:2023 sets out clear rules on how information and communication technology (ICT) can be used for audit purposes and when remote delivery is possible. This article gives you an overview of the fundamental requirements a certification body must meet when audits are carried out using ICT. Find out how virtual sites are defined, which conditions apply to the use of ICT, and how factors such as security, confidentiality and procedural requirements are taken into account. A must for organisations considering ICT for more efficient audits.

IAF MD 26 – Transition from DIN EN ISO/IEC 27001:2017 to ISO/IEC 27001:2022

The transition to the new ISO/IEC 27001:2022 is unavoidable for certified organisations. The IAF MD 26:2023 document defines clear requirements and deadlines to ensure the transition from DIN EN ISO/IEC 27001:2017 to the new standard. Certified organisations have a transition period until 31 October 2025 to maintain their certification. This article summarises the key points of the transition – from the requirements for updating the ISMS and the Statement of Applicability through to the minimum effort involved in the audit. An essential guide for anyone looking to master the changeover successfully.

IAF MD 29 – Transition to ISO/IEC 27006:2024

With the publication of ISO/IEC 27006:2024, certification bodies face an important transition. IAF MD 29 governs the changeover to this new standard for information security management systems and primarily affects certification and accreditation bodies, with no direct impact on certified organisations. Certification bodies such as RSM Certification GmbH have two years to complete the transition, from the gap analysis through to the final audit by DAkkS. Find out here which steps are needed for a successful transition to ISO/IEC 27006:2024.