How Integrated ISO Audits Cut Your Audit Days and Cost
The short answer
Yes. Certifying ISO 9001, ISO 14001 and ISO 45001 through one integrated audit uses fewer total auditor-days than three separate audits, and it lowers the total audit cost.
Two rules set the frame. IAF MD 5 fixes the minimum base audit time from your full-time-equivalent headcount [1]. IAF MD 11 adds the principle that requirements common to the three standards are assessed once rather than repeated for each standard [2]. The time you save is the shared-clause work you would otherwise carry out twice more.
Combining ISO 9001, ISO 14001 and ISO 45001 into one audit lowers total audit time and certification-body fees because the shared clauses are assessed once rather than three times [2]. In UniCert's audit planning the reduction is typically around a quarter to a third of total auditor-days, and the exact figure varies by scope, number of sites and how genuinely integrated the system is [5]. IAF MD 11 sets the principle, not the number, so treat any single headline percentage as a starting point for discussion with your certification body.
The saving is not a discount for cutting corners. An accredited body still has to meet the minimum audit time in IAF MD 5 as applied to integrated systems under IAF MD 11 [1][2]. The reduction comes from assessing the shared requirements once, not from a lighter audit. If you are weighing integrated management system certification against three separate projects, and planning how to build a single integrated management system, the audit-day maths below is a large part of the business case.
An integrated audit assesses the shared management-system clauses once across all three standards. Source: UniCert
How audit duration is calculated for a single standard
For a single standard, an accredited certification body starts from your full-time-equivalent (FTE) headcount, reads across the IAF MD 5 duration tables, then adjusts for risk and complexity [1].
The MD 5 tables pair a headcount band with a starting number of auditor-days, and the number rises step by step as headcount grows [1]. As an indicative guide for an ISO 9001 initial audit that covers Stage 1 and Stage 2 together, the starting point is around 1.5 auditor-days for 1 to 5 staff, roughly 5 to 7 auditor-days for 50 to 100 staff, and 8 or more auditor-days above 150 staff. The auditor then moves the figure up or down for process complexity, the number of sites, the regulatory environment and system maturity, and rounds to the nearest half-day.
MD 5 also fixes the rest of the cycle as a proportion of that initial figure. Surveillance audits run at about one third of the initial audit time, and recertification at about two thirds [1]. That matters for the comparison here, because integration compounds: a shorter integrated initial audit produces shorter surveillance and recertification visits across the whole three-year cycle.
ISO/IEC 17021-1 sits underneath both MD 5 and MD 11. It is the standard accredited bodies are themselves certified against, and it requires audit time to be planned and justified by the certification body rather than negotiated down [3].
How integration changes the calculation
IAF MD 11 governs audits of integrated management systems [2]. Its core principle is that requirements common across the standards are assessed once, while requirements specific to a single standard are assessed for that standard.
The shared requirements follow the harmonised structure that ISO uses across its management system standards [4]. In clause terms they are context of the organisation (clause 4), leadership (clause 5), planning (clause 6), internal audit (clause 9.2), management review (clause 9.3) and improvement, including corrective action (clause 10). Under MD 11 an integrated audit examines these as one management system, not three [2]. Because the requirement text is effectively the same in ISO 9001, ISO 14001 and ISO 45001, one well-evidenced sample answers all three. You can compare the wording yourself across the three standards.
The standard-specific work sits mainly in support (clause 7) and operation (clause 8). It covers operational planning and control, environmental aspects and their controls, hazard identification and operational controls for health and safety, and the competence and communication needs that differ by discipline. MD 11 keeps all of this as separate, per-standard evidence, so the audit still tests each standard in full [2].
There is a findings benefit alongside the time benefit. Integrated audits tend to surface systemic issues once: a shared-clause weakness such as thin corrective-action analysis, gaps in competence records or inconsistent document control appears as a single cross-cutting nonconformity rather than three near-duplicates, which makes root-cause work more efficient. For the shared-clause issues that recur most often, see common ISO 9001 nonconformities.
A worked example: three audits versus one
The table below is an illustrative model, not a quote from any certification body. It sketches a single-site company of about 60 FTE with a moderate risk profile, and it compares three separate certification projects with one integrated project across the first year: Stage 1, Stage 2 and the year-one surveillance visit. The arithmetic is deliberately simple so you can follow it. Your own figures depend on scope and complexity, and only your certification body can confirm them.
The model starts from the IAF MD 5 base audit time for a single standard at this headcount (about 7 auditor-days for Stage 1 plus Stage 2 for a ~60 FTE organisation) and then applies the shared-clause logic from IAF MD 11 [1][2].
| Audit stage | Three separate audits (auditor-days) | One integrated audit (auditor-days) |
|---|---|---|
| Stage 1 (readiness review) | 3.0 | 2.0 |
| Stage 2 (certification audit) | 14.0 | 9.5 |
| Year-1 surveillance | 5.5 | 3.5 |
| Total, year 1 | 22.5 | 15.0 |
In this model the integrated route removes 7.5 auditor-days in the first year, close to a third of the total. Most of the reduction falls in Stage 2, where the shared clauses would otherwise be walked three times. The 4.5-day Stage 2 gap represents the six shared-clause areas (4, 5, 6, 9.2, 9.3, 10) assessed once instead of three times, while the 9.5 retained days hold full standard-specific coverage of clauses 7 and 8.
A smaller desk-based service organisation follows the same pattern with lower absolute day counts, and the percentage saving can be slightly smaller because there is less standard-specific operational content to divide. See how headcount-based duration behaves for a service business when your operations are largely desk-based. To put your own headcount through an indicative calculation, use the price calculator.
Illustrative model comparing separate and integrated audit days for a single-site company of about 60 FTE. Source: UniCert
As an illustration from our own audit planning, and not a benchmark, a manufacturer with around 120 staff running all three standards was scoped at roughly 11 integrated auditor-days across Stage 1 and Stage 2, against about 15 to 16 auditor-days if the three standards had been audited separately. The reduction came from assessing clauses 4, 5, 6, 9.2, 9.3 and 10 once while keeping full standard-specific coverage of clauses 7 and 8. Your own figures will differ with scope, sites and integration maturity, and only your certification body can confirm them.
Where the savings really come from
The auditor-day reduction is the visible part. For most SMEs the larger saving is in the preparation and disruption around the audit.
An integrated system means one management review meeting instead of three, with a single agenda covering quality, environmental and health and safety performance together. It means one internal audit programme across all three standards, so your team plans, runs and reports once. Corrective actions sit in one log with one method, so a shared-clause finding is fixed once. For the certification body, an integrated project is a single visit rather than three, which cuts travel, scheduling, opening and closing meetings, and the number of days your managers spend hosting auditors instead of running the business.
The cycle stays aligned after year one. Surveillance dates for all three standards fall together, and recertification lands as one event in year three, so the planning overhead does not creep back. Running the integrated system on a single audit programme, with one management review and one internal audit programme feeding it, is consistent with how IAF MD 11 and ISO/IEC 17021-1 expect an integrated certification cycle to be planned [2][3].
Cost, not just days
Total audit cost is broadly the auditor day rate multiplied by the number of audit days, plus fixed certification fees such as application, certificate and registration charges. Fewer days cut the variable part of the bill directly, while the fixed fees stay the same and your internal preparation effort does not disappear.
Two practical consequences follow. First, the percentage saving on your total invoice is usually smaller than the percentage saving on days, because the fixed fees are unchanged. Second, the day rate varies between bodies and by auditor discipline, so a lower day count at one body will not always beat a higher count at another. Compare quotes on days, rate and fixed fees together. For what drives the total, see ISO certification cost in the UK and the pricing walk-through in how certification bodies price the work.
How to prepare so you actually get the benefit
The integrated-audit saving is available in the rules, but you earn it through the way you build the system. If your three standards are really three parallel systems in one binder, the auditor has to sample each separately and the day count barely moves.
Aim for a single integrated manual or process set, where each core process is described once and the quality, environmental and safety controls within it are called out where they apply. Run one internal audit programme across all three standards, with combined audit plans and checklists so a single visit to a process tests every relevant requirement; the ISO 9001 internal audit checklist is a useful base to extend with environmental and OH&S lines. Hold one management review with a combined data pack. Keep one risk and opportunity register, one legal and other requirements register structured by discipline, one competence matrix and one corrective-action log.
Before Stage 2, map your documentation against the shared clauses (4, 5, 6, 9.2, 9.3, 10) and confirm each is evidenced once, then check that the standard-specific clauses (7 and 8) show clear, separate evidence for each standard. The audit team uses that mapping to plan an integrated Stage 2, and giving it to them early tends to tighten the plan.
Practical summary of the key steps covered in this guide. Source: UniCert
Frequently asked questions
Does an integrated audit always cost less than separate audits?
Almost always on auditor-days, and usually on total cost. The day reduction follows from the IAF MD 11 principle that shared requirements are assessed once [2]. The total invoice saving is a little smaller because fixed certification fees do not change, and the gap between bodies also depends on the day rate. Compare full quotes, not just the day count.
How much shorter is an integrated ISO audit?
In UniCert's audit planning, combining two or three standards typically removes roughly a quarter to a third of total auditor-days [5]. It is a range, not a fixed figure, and IAF MD 11 sets the principle behind it rather than the number [2]. A system with one manual, one internal audit programme and one management review sits at the better end; a loosely combined system sits lower.
Can we add ISO 45001 later to an existing ISO 9001 certificate?
Yes. The new standard is brought in at a surveillance or recertification visit, with extra time for its standard-specific clauses and a lighter revisit of the shared clauses. Aligning all three onto one cycle keeps future visits integrated and avoids repeated mobilisation costs.
Does combining standards into one audit weaken the assurance?
No. Shared clauses are assessed once because the requirement text is effectively the same across standards. The standard-specific clauses, including operational planning and control, environmental aspects and OH&S hazard controls, are still audited for each standard. Accredited bodies must still meet the minimum audit time in IAF MD 5 as applied under IAF MD 11 [1][2].
Do surveillance visits also get shorter?
Yes. IAF MD 5 sets surveillance at about one third of initial audit time [1], so a shorter integrated initial audit produces shorter surveillance visits, and all three standards are covered in one visit rather than three.
Turning the audit-day maths into a decision
An integrated ISO 9001, 14001 and 45001 audit is shorter and cheaper than three separate audits because the shared management-system clauses are assessed once, not because the audit is lighter [2]. Plan for roughly a quarter to a third fewer total auditor-days, the reduction UniCert sees in its own integrated-audit planning [5], a smaller but real cut in total cost, and a clear drop in preparation and disruption once one management review and one internal audit programme cover everything. How much you capture depends on how genuinely integrated your system is. Start with the overview of integrated management system certification, then ask your certification body for an integrated audit plan and compare it line by line against three separate quotes.
Editorial note: UniCert is UAF-accredited for ISO 9001, ISO 14001 and ISO 45001, and is an IAF MLA signatory through that accreditation. See /accreditation.
References
- IAF MD 5:2019, Determination of Audit Time of Quality, Environmental and Occupational Health and Safety Management Systems. International Accreditation Forum. https://iaf.nu. Used for headcount-based base audit time, half-day rounding, and surveillance at about one third and recertification at about two thirds of initial audit time.
- IAF MD 11:2013, Application of ISO/IEC 17021 for Audits of Integrated Management Systems. International Accreditation Forum. https://iaf.nu. Used for the principle that requirements common to the standards are assessed once while standard-specific requirements are assessed for each standard.
- ISO/IEC 17021-1:2015, Conformity assessment. Requirements for bodies providing audit and certification of management systems. Part 1: Requirements. International Organization for Standardization. https://www.iso.org. Used for the requirement that audit time is planned and justified by the certification body.
- ISO, Harmonized structure for management system standards (Annex SL / Annex L). International Organization for Standardization. https://www.iso.org. Used for the list of clauses shared across ISO 9001, ISO 14001 and ISO 45001.
- UniCert audit-planning records and integrated-audit scheduling experience (UAF-accredited certification body, London; first-party). Basis for the indicative reduction of roughly a quarter to a third in total auditor-days when ISO 9001, ISO 14001 and ISO 45001 are combined into one audit; the exact figure varies by scope and integration maturity, and IAF MD 11 [2] sets the underlying principle rather than a number.
- UniCert audit-planning records, UAF-accredited certification body, London (first-party). Basis for the illustrative example table and the anonymised day-count figures, both labelled as indicative and not a quote.