IMS Internal Auditor Training: Audit ISO 9001, ISO 14001 and ISO 45001 in One Integrated Audit

Starts with a question: does your organisation run one management system, or three, audited three times with three checklists? After a self-rating, three recent cases follow: the door plug that blew out of a new Boeing 737-9 on 5 January 2024, the leaking nitric acid behind the X-Press Pearl fire off Colombo in May 2021, and the loose wire that left the Dali without power at Baltimore. Each shows one small failure crossing quality, environment and safety. Two auditors check the same test record, one with three lenses. You then meet the Dubai engineering company the course audits, plus a bakery in Toronto and a recycling plant in Frankfurt. The module outlines the twenty-six modules, practice and exam, and ends with a recap.

What you will be able to do

• Explain why one small failure can cross quality, environment and safety
• Describe how an integrated audit looks at each process once
• Identify what all three standards require of internal audits

Why it matters

Auditing the system the way it actually runs saves three separate visits and finds failures that cross the lenses.

Practice: Practice: Welcome, and why integrated audit matters · 3 questions

Opens with the QHSE manager of the Dubai engineering company and her proud table placing every clause of the three standards side by side, which an auditor quickly shows has no place for a clause without partners. You then learn the shared skeleton: ten clauses, the plan, do, check, act cycle, identical core text and common terms, and how clause 4.1 and clause 5.1 link to intended outcomes. The module explains what each standard adds, from customers and design, to aspects and compliance obligations, to workers and hazards. It shows how the same clause number can mean different things, such as clause 8.2 and the order of clause 10. It ends with the rule to always name the standard, clause number and clause name, and a recap.

What you will be able to do

• Explain the harmonized structure the three standards share
• Identify terms and requirements specific to each standard
• Cite every finding by standard, clause number and clause name

Why it matters

Knowing where the three standards share and where they differ stops integrated audits missing what one standard adds.

Practice: Practice: One structure, three systems · 3 questions

Starts at the workshop, where an internal auditor ticks every box on a checklist used since 2019 and finishes early with no findings, while the checklist never asks about climate change. You then learn the editions: ISO 9001:2026 and ISO 14001:2026 are new, and ISO 45001:2018 applies with its 2024 climate amendment, including the clause 4.2 note on climate requirements. The module covers changes such as management review in three parts and clause 10 opening with continual improvement. It explains clause 9.2.1, the shared core of internal audits at planned intervals for conformity and effectiveness, and how clause 9.2.2 differs, with ISO 45001 adding consultation and reporting results to workers. It ends with one programme taking the fullest wording of each, and a recap.

What you will be able to do

• Explain the main changes in the 2026 editions
• Compare the internal audit requirements in the three standards
• Build one audit programme that meets all three clause 9.2 texts

Why it matters

Auditing to the current editions catches new requirements that a checklist written for older editions will miss.

Practice: Practice: The editions, and the audit requirement · 3 questions

Opens at the hospital site, where a quality auditor on Monday and a safety auditor on Thursday ask the same manager for the same documents, and the quality auditor saw pipe spools in the open but never asked about paint fumes. You then learn the guidance and the language of auditing, which ISO 9001 and ISO 45001 point to in a note under clause 9.2.2, with harness inspection records and a roof check as evidence and remote methods such as waste records reviewed by video. The module explains combined and integrated audits, one report for the managing director with each standard traceable, and the seven principles, including fair presentation. A small bakery in Toronto shows independence when one auditor's evidence is checked by a second person. It ends with a recap.

What you will be able to do

• Explain the chain from criteria and evidence to findings
• Describe how combined and integrated audits are run
• Apply the seven principles, including independence, to internal audit

Why it matters

One piece of evidence can serve two standards, so a combined team finds more in less of the auditee's time.

Practice: Practice: ISO 19011:2026 and combined audits · 3 questions

Starts with the company's first integrated programme, where the QHSE manager merged three old schedules into thirty-six audits a year, each department audited three times by three auditors. You then learn what each standard asks the programme to consider, the importance of processes, changes and previous results, and the ISO 19011 steps to plan, establish and evaluate programme risks. The module shows rating each process through three lenses, with the highest rating setting frequency and all three lenses in each visit, so the hospital site is audited in March and September and the workshop in April and October. It covers records behind ratings, a new paint line in May, and the committee adding the paint store after headaches. It ends with checking coverage across the cycle, and a recap.

What you will be able to do

• Rate each process through quality, environment and safety lenses
• Set audit frequency from the highest risk rating
• Check that every clause of all three standards is covered in the cycle

Why it matters

Letting effort follow risk cuts duplicated audits while making sure coverage across all three standards is complete.

Practice: Practice: An integrated, risk-based programme · 3 questions

Opens with last year's one-line plan for the hospital site audit, where the auditor read files all morning, spent the afternoon on waste records, and never reached the work. You then learn to define each audit's objectives, such as readiness of commissioning records for the first handover in March, its scope with shifts and locations, and its criteria with every clause named by standard, number and title, as ISO 45001 clause 9.2.2 b) requires. The module covers choosing a team that covers all three lenses, with nobody auditing their own area and an auditor in training. It explains preparing, mixing on-site and remote methods to fit the risk, and a plan with the riskiest part first, such as a lift. A pharmaceutical packaging plant in Mumbai repeats the pattern. It ends with a recap.

What you will be able to do

• Define an audit's objectives, scope and criteria
• Choose an audit team that covers all three lenses
• Write an audit plan that starts with the riskiest activity

Why it matters

An audit defined in advance finishes when its objectives are met, not when the clock says four.

Practice: Practice: One audit: objectives, scope, criteria, plan · 3 questions

Starts at the workshop, where an auditor carries three checklists with ninety questions and asks the supervisor about training twice in twenty minutes. You then learn checklist types and the course's recommended layout for an integrated checklist built around the process, with questions drawn from all three standards. The module explains asking each shared clause once while keeping each standard's extra words in the line, then adding specific requirements where they belong, such as ISO 45001 clause 5.4 on consulting workers about a new shift rota. It covers why a checklist built from a procedure can miss what the standard requires, writing every line as an open question with a sample, and using the checklist as a guide, not a script. A recycling plant in Frankfurt shows a second example. It ends with a recap.

What you will be able to do

• Build one checklist around a process for all three standards
• Write checklist lines as open questions with a sample
• Add standard-specific requirements where they belong

Why it matters

One process-based checklist saves the auditee's time and still tests every requirement of all three standards.

Practice: Practice: One process-based checklist · 3 questions

Opens in the boardroom of the Dubai engineering company, where a neat context table from 2023 lists competition, labour costs and cash flow but nothing about the summer heat that slows site work. You then learn clause 4.1: issues affecting all three sets of outcomes, a decision on climate change and, for ISO 14001, environmental conditions, with heat followed into risk registers and site controls. The module covers clause 4.2, with workers always interested parties in ISO 45001 and adopted promises becoming compliance obligations in ISO 14001, such as a hotel client's refrigerant log. It explains clause 4.3, a scope that follows control and influence, and clause 4.4.1 processes. A facilities management company in Hong Kong shows a working interested parties register. It ends with a recap.

What you will be able to do

• Check that context issues cover all three sets of outcomes
• Trace client requirements into compliance obligations
• Test whether the scope follows control and influence

Why it matters

Seeing one context through three lenses finds issues, like site heat, that affect quality, safety and environment at once.

Practice: Practice: Context, parties, scope and the system · 3 questions

Starts with the interview every integrated audit needs: the managing director of the Dubai engineering company, who answers that quality, safety and environment are the QHSE manager's job. You then learn clause 5.1: a shared core of leadership, plus quality culture and customer focus in ISO 9001, and culture, no reprisals and committees in ISO 45001, with accountability kept at the top as the clause 5.3 note says. The module shows testing answers against reports and minutes, and the evidence you usually find: minutes, budgets, walk records and what people say. It explains clause 5.2, one integrated policy that holds every commitment of all three standards, and clause 5.3, roles assigned and communicated, including reporting on environmental performance. It ends with a recap.

What you will be able to do

• Test top management accountability across all three systems
• Check that an integrated policy holds every required commitment
• Audit roles, authorities and performance reporting to top management

Why it matters

Leadership shows in decisions and in what people are told, which is exactly what an integrated auditor can test.

Practice: Practice: Leadership, the policies and roles · 3 questions

Opens at the hospital site, where the site manager is proud of a monthly safety committee with six managers and one day shift foreman, and minutes issued only in English. You then learn the difference: consultation seeks views before a decision, participation involves workers in it, and informing is neither. The module explains clause 5.4: a process with mechanisms, information and barriers removed, such as no response, language, reprisals and practices that penalise taking part, and coordination with contractors in Annex A. It shows the thread through the whole system, such as objectives under clause 6.2.1, and why a welder reporting fumes may also know why paint runs. A cold-storage warehouse in Chicago is a second example. It ends with a typical finding citing ISO 45001 only, and a recap.

What you will be able to do

• Tell consultation from participation and from informing
• Identify barriers that stop workers taking part
• Write a clause 5.4 finding that cites ISO 45001 only

Why it matters

Finding one control that changed because workers spoke shows whether the safety system really hears the people doing the work.

Practice: Practice: Consultation and participation of workers · 3 questions

Starts in the QHSE office, where the auditor asks how risks and opportunities are managed and gets three separate files, including a quality register mostly about late deliveries and design errors. You then learn how each standard builds clause 6.1 differently, while sharing one aim: assurance, prevention and continual improvement. The module explains the two levels of risk in ISO 45001, to people and to the system, ISO 14001 clause 6.1.5 on significant aspects and obligations, and one integrated register as an option. It covers planning actions, integrating them into processes and evaluating effectiveness, shown with heat actions planned in April and done in June. A biotech laboratory in Boston with ultra-cold freezers is a second example. It ends with a recap.

What you will be able to do

• Check that every risk each standard asks about is identified
• Audit opportunities, where registers are often thinnest
• Follow each planned action into a process and its evaluation

Why it matters

Following every risk into an action that is checked turns three registers into one system that actually prevents problems.

Practice: Practice: Risks and opportunities, and planning action · 3 questions

Opens at the head office objectives board showing zero accidents, customers delighted and go green, with nobody able to say who owns each one, what the plan is or how progress is measured. You then learn the shared requirements: objectives consistent with the policy, measurable, monitored, communicated and planned with what, who, when and how, shown with a refrigerant objective and its leak checks and log. The module covers what each standard adds: customers and conformity, significant aspects and obligations, and risk assessments and worker consultation. It explains planning of changes in clause 6.3 of ISO 9001 and ISO 14001, and clauses 6.1.1 and 8.1.3 of ISO 45001, with one change form, three lenses and one owner, and a planned workshop change. It ends with a recap.

What you will be able to do

• Test whether objectives are owned, planned and measured
• Check each standard's extra inputs to objectives
• Follow one change through all three lenses

Why it matters

Objectives with owners and changes with plans turn slogans on a board into results the auditor can verify.

Practice: Practice: Objectives, and planning of changes · 3 questions

Starts with the workshop training matrix: every welder has a valid welding test, covering the quality lens, but nothing on recognising hazards, handling paint waste or recovering refrigerant. You then learn clause 7.1 resources, with ISO 9001 adding people, infrastructure, environment and knowledge, such as a plant room at fifty degrees in August. The module explains competence covering every lens of a job, with ISO 14001:2026 clause 7.2 as an example, and the step most often missing, evaluating whether training worked, sampled across three people. It covers awareness, from quality culture to significant aspects, hazards and the right to leave serious danger, and communication with responses and reportable incidents. A hospital laundry in Paris with agency staff is a second example. It ends with a recap.

What you will be able to do

• Check that competence covers every lens a job touches
• Audit whether training effectiveness was evaluated
• Test awareness and communication across all three standards

Why it matters

Sampling people across every lens of their job shows whether a training certificate really means competence.

Practice: Practice: Resources, competence, awareness, communication · 3 questions

Opens at the paint store in the workshop, where a laminated chemical handling procedure at the mixing bench says revision two while the master list shows revision four. You then learn clause 7.5 in all three standards and their different words: the 2026 editions say available, while ISO 45001 still says maintain for documents and retain for records. The module covers what each standard requires, such as ISO 14001 planning, operational control and emergency processes, and keeping shared records once, like one competence record covering welding, hot work and waste. It shows a quality test record signed and witnessed, searching an integrated register for duplicate procedures, and a company in New York managing office towers. It ends with auditing at the point of use: current version, external documents, protection and retention, and a recap.

What you will be able to do

• Compare documents at the point of use with the master list
• Map the records all three standards require, kept once
• Check retention and protection of records across the system

Why it matters

Checking the document where the work happens catches out-of-date procedures that every standard's control should have stopped.

Practice: Practice: Documented information · 3 questions

Starts with the QHSE dashboard on the meeting room screen: twenty-two bright indicators, none with a target or trend, so nobody can say whether a number is good. You then learn monitoring, measurement, analysis and evaluation in all three standards: determine what, how and when, with criteria and indicators, with ISO 45001 listing what to monitor and ISO 9001 listing what analysis evaluates. The module shows the company's revised dashboard cut to four lines, tracing near-miss figures, and calibrated or verified measuring equipment on one register. It explains management review: shared inputs, specific inputs from each standard, decisions with owners, and communication to workers under ISO 45001, using the agenda as your checklist on the minutes. A commercial bakery in Toronto is a second example. It ends with a recap.

What you will be able to do

• Check that each indicator has criteria and is evaluated
• Trace a dashboard figure back to its source records
• Audit management review inputs and decisions for all three standards

Why it matters

Asking what happens when a number turns red shows whether monitoring drives decisions or is only decoration.

Practice: Practice: Monitoring, measurement and management review · 3 questions

Opens with the incident log: a chiller slipped in its slings during a crane lift at the hospital site in March, the investigation said operator error, the rigger was retrained, and a similar event followed. You then learn the shared core of clause 10.2: react, find the causes, look for similar problems, act and check the action worked. The module explains what ISO 45001 adds, incidents, timely reaction, worker participation, root causes, the hierarchy of controls and sharing results, with Annex A examples, while ISO 14001 adds mitigating impacts and ISO 9001 updating risks. You see the new lifting plan template issued in July, with no further slips. A pharmaceutical packaging plant in Mumbai is a second example. It ends with a typical clause 10.2 finding, continual improvement and a recap.

What you will be able to do

• Check that investigations find causes, not someone to blame
• Apply each standard's additions to clause 10.2
• Verify that a corrective action removed the cause

Why it matters

Finding the cause instead of retraining the operator stops the same failure returning in all three lenses.

Practice: Practice: Nonconformity, incidents and improvement · 3 questions

Starts in the estimating office with the tender file for the hotel tower's chiller replacement, where the client's specification set requirements that the price may have left out. You then learn ISO 9001 clause 8.1 operational planning, communicating with customers, determining requirements, and clause 8.2.3 review before committing, including the ability to meet the requirements. The module explains the integrated link: environmental and safety terms in a contract belong in the compliance and legal registers and in the site's plans, so you ask the QHSE manager where they went next. It covers clause 8.3: planning design with stages, reviews, verification and validation, inputs, controls and changes, with the life cycle and the people who will build and maintain it in view. It ends with a recap.

What you will be able to do

• Audit contract review before committing to supply
• Trace environmental and safety contract terms into registers and plans
• Check design planning, verification, validation and changes

Why it matters

Reading the tender shows how a contract signed in the sales office can decide the safety of a roof a year later.

Practice: Practice: Customer requirements and design · 3 questions

Opens at the hospital site with the ductwork insulation subcontractor, chosen on price from three quotes, whose work has gaps, whose crew never had the site induction, and whose waste was mishandled. You then learn ISO 9001 clause 8.4.1 on controlling externally provided processes, products and services, ISO 45001 clause 8.1.4 on contractor hazards and criteria, and how one evaluation form could cover all three lenses. The module covers clause 8.5: controlled conditions, validated special processes such as brazing with a nitrogen purge, error prevention, traceability, property of customers such as old chillers and plant room keys, preservation and changes. It explains clause 7.1.5 measuring equipment calibrated and identified, and checking earlier results when equipment is found unfit. It ends with a recap.

What you will be able to do

• Evaluate external providers through all three lenses at once
• Audit controlled conditions and special processes on site
• Check calibration and the action taken on unfit equipment

Why it matters

Remembering that work is outsourced but accountability is not keeps subcontractors inside your audit.

Practice: Practice: External providers and production · 3 questions

Starts at the hospital site with the handover of floor four, signed by the site engineer on Thursday although test sheets show two fan coil units over the noise limit. You then learn release: planned checks with evidence and the name of the person who released it, or a recorded approval. The module explains clause 8.7: identify, contain, decide, correct and verify, with records of the nonconformity, actions, concessions and the deciding authority, and looking for clause 10.2 when outputs keep failing, using a nonconforming output log. It covers clauses 9.1.2 and 9.1.3: using every source of satisfaction information, including the client's safety and environmental scores, and analysing quality performance. The hospital laundry in Paris is a second example. It ends with a recap.

What you will be able to do

• Check that release is on evidence by an authorised person
• Audit control of nonconforming outputs and concessions
• Use client safety and environmental scores as satisfaction data

Why it matters

Releasing only on evidence and controlling what fails keeps defective work from reaching the client.

Practice: Practice: Release, nonconforming outputs, customers · 3 questions

Opens with the company's two registers: aspects listing electricity, paper and general waste for head office only, and hazards covering routine site work, both written at a desk by one person each. You then learn ISO 14001:2026 clause 6.1.2: aspects with a life cycle perspective, abnormal conditions and potential emergencies, and significance by the organisation's own criteria, never downgraded for convenience. The module explains ISO 45001 clause 6.1.2: hazard identification that is ongoing and proactive, covering how work is organised, people, change and emergencies, with risk assessed against existing controls, such as a rotating fan in a locked plant room. It shows testing both together from one activity list, such as brazing on a roof, with the recycling plant in Frankfurt as a second example. It ends with a recap.

What you will be able to do

• Check that aspects cover abnormal conditions and the life cycle
• Audit hazard identification for non-routine work and change
• Test aspects and hazards together from one activity list

Why it matters

Walking the work before reading the registers finds aspects and hazards that desk-written registers leave out.

Practice: Practice: Environmental aspects and OH&S hazards · 3 questions

Starts with the QHSE manager's legal register: a spreadsheet of a hundred and forty environmental and safety laws with titles and dates, but nothing on how each applies or whether anyone checks. You then learn the terms: compliance obligations in ISO 14001, legal and other requirements in ISO 45001, and statutory and regulatory requirements in ISO 9001, and how clause 4.2 decides which expectations become obligations. The module explains evaluation of compliance under clause 9.1.2: a frequency, in ISO 45001 a method, action when something is found, knowledge of the status and a record, with clause 10.2 for gaps. It covers a safety regulation that changed in March and a utility's quarterly evaluation finding a late report. It ends with sampling requirements from register to evaluation to site, and a recap.

What you will be able to do

• Explain how each standard names legal and other requirements
• Audit evaluation of compliance and the action on gaps
• Trace a requirement from register to evaluation to site

Why it matters

Treating the list as the start and the evaluation as the test shows whether the organisation really knows it obeys the law.

Practice: Practice: Compliance obligations and evaluation of compliance · 3 questions

Opens on the roof of the hotel tower, where a brazer repairs copper pipe under a signed hot work permit naming a fire watch, but on the roof there is no fire watch. You then learn the shared core of clause 8.1: criteria for processes and control in line with them, checked by watching the work, with ISO 45001 Annex examples such as systems of work and maintenance. The module explains ISO 45001 clause 8.1.2, the hierarchy of controls, with a matching note in ISO 14001, eliminating first and PPE last. It covers control beyond the gate: the life cycle, management of change under clause 8.1.3, contractors, outsourcing under clause 8.1.4.3 and shared workplaces. The facilities management company in Hong Kong is a second example. It ends with sampling one aspect and one high risk, and a recap.

What you will be able to do

• Check permit controls against what is in place at the job
• Apply the hierarchy of controls to aspects and hazards
• Audit change, contractor and outsourcing controls

Why it matters

Watching the work, not reading the permit, shows whether controls on paper are the ones actually in place.

Practice: Practice: Operational control · 3 questions

Starts with the company's drill records: four fire evacuation drills timed to the second, but no drill for a diesel or paint spill, even though a diesel spill at the workshop generator reached a drain in March. You then learn that every potential emergency in the aspects and hazard registers needs a planned response for people, the environment and, where relevant, customers, with contingency such as hire chillers on call. The module explains testing where practicable, reviewing and revising after tests and real events, and how an emergency is also an incident linked to clause 10. The cold-storage warehouse in Chicago runs a night shift exercise with the city's fire department, as Annex A suggests. It covers measuring environmental and OH&S performance with trends, and ends with a recap.

What you will be able to do

• Check that every potential emergency has a planned response
• Audit drills and reviews after tests and real events
• Evaluate environmental and OH&S performance trends

Why it matters

Testing more than fire drills makes sure the organisation is ready for the spill or gas release that actually happens.

Practice: Practice: Emergencies, incidents and performance · 3 questions

Opens at the workshop, where last year three auditors came on three days, each taking an hour of the supervisor's time and walking past the same paint store, while this year one team of two does it in one day. You then learn the opening meeting: agreeing one plan for three standards, introducing the team, and confirming people and records are ready, plus following the safety rules yourself under ISO 19011 Annex A guidance. The module explains the three-lens walk, testing a dozen requirements from one spot, such as a store keeper's competence and current records, and interviews with the people who do the work. It covers on-site and remote methods, sampling to the risk, verifying with four checks, the path from information to conclusions in clause 6.4.7, and notes that name the standard. It ends with a recap.

What you will be able to do

• Run one opening meeting for an audit against three standards
• Walk a site with three lenses and test many requirements at once
• Write audit notes that name the standard behind each point

Why it matters

Following the work with three lenses tests more requirements in one visit while taking less of people's time.

Practice: Practice: Conducting the integrated audit · 3 questions

Starts with a draft report from a new auditor citing a missing fire watch at roof hot work against ISO 9001 clause 8.5.1, when the requirement for that control is in ISO 45001. You then learn to trace each finding to the standard whose requirement was not met, often one, sometimes two, rarely all three, and to generate findings as ISO 19011 clause 6.4.8 describes. The module shows a statement in four parts with criteria such as ISO 45001:2018 clause 8.1.1 b), graded on one defined scale. It covers the closing meeting with no new nonconformities, an agreed time frame for action plans, one report with a conclusion for each standard and safety results shared with workers, and follow-up until actions work. The biotech laboratory in Boston is a second example. It ends with a recap.

What you will be able to do

• Trace each finding to the standard whose requirement was missed
• Write and grade a nonconformity in four parts
• Report once with a conclusion for each standard and follow up

Why it matters

Findings that cite the right standard hold up when the auditee checks, and counting causes, not standards, keeps reports honest.

Practice: Practice: Findings, reporting and follow-up · 3 questions

Starts with a question: with one day to audit one place against three standards, where would you start? With the risk, then the plan, the checklist and the work. You then follow a practice integrated audit of the workshop, with its objective of conformity and effectiveness, a scope of duct fabrication, the paint store and booth, the welding bay and the yard, and the last six months of records. At moments you decide, such as a welder whose qualification expired in August making hospital spools in September, extract filter changes, and the generator bund and drain valve checklist. The module shows the mistakes integrated audits make at each stage and clause 10.2 on reviewing corrective action. It ends with the key takeaways, the course recap and the final exam.

What you will be able to do

• Plan and conduct a one-day audit against three standards
• Decide findings from evidence gathered during a practice audit
• Avoid the common mistake at each stage of an integrated audit

Why it matters

Working through a full practice audit prepares you to run your first real integrated audit and follow it to results.

Practice: Practice: A practice integrated audit, and the exam · 3 questions