Audit your quality, environmental and health & safety requirements in one coordinated visit: one plan, one team, one report and one set of corrective actions. We also combine AS9100, ISO 13485, ISO/IEC 27001 and R2v3.
- 25+ years of experience
- Over 200 clients
- 100% R2 track record
- SERI Approved Consultant
- Offices in Canada & Coral Springs, FL
What is an integrated internal audit?
An integrated internal audit (also called a combined audit) checks your management system against two or more standards at the same time. Instead of running separate quality, environmental and safety audits, one audit team follows each process once and assesses it against every standard that applies.
It is still an internal audit in every sense. It compares how things actually are with how your system says they should be, and with what each standard requires, so you can find and fix problems yourself before your certification body arrives.
Your systems don't have to be fully merged first. ISO 19011, the international guideline for auditing management systems, covers audits of separate systems carried out together as well as audits of a single integrated system.
One look at the whole system, with fresh eyes, instead of three narrower ones.
Want your own team to run internal audits? Paradygm also offers internal auditor training. Ask about internal auditor training
Why combine your internal audits?
Less disruption
Managers and supervisors are interviewed once about quality, environment and safety, not three separate times.
One plan, one schedule
A single audit plan covers every standard, site and shift in scope.
Shared clauses audited once
Common requirements such as documented information, competence, objectives, internal audit and management review are reviewed together.
Cross-functional findings
Seeing quality, environmental and safety controls side by side shows gaps that single-standard audits can miss, like a process change that affects both product quality and chemical handling.
One combined report
Findings are organized by process and tagged to every clause they affect, with a coverage summary for each standard.
One CAR set
A single corrective action log, so one root-cause fix can close a finding raised against several standards.
Fewer audit days? Combining audits usually cuts total time on site because shared elements are covered once. How much depends on your scope and how integrated your system already is. For context, accredited certification bodies follow IAF MD 11, which allows integrated-system audit time to be reduced by no more than 20% from the combined total. Internal audits aren't bound by that rule, but the efficiencies it lists are the same: one opening and closing meeting, one report, and auditing common elements together.
Why the standards fit together: the Harmonized Structure
ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 are all written on ISO's Harmonized Structure (formerly called Annex SL). They share the same high-level clauses, common terms and much of the same core requirements, so a large part of each audit is common ground.
- Clause 4: Context of the organization. Internal and external issues, interested parties and the scope of the system.
- Clause 5: Leadership. Top-management commitment, policy, and roles and responsibilities.
- Clause 6: Planning. Risks and opportunities, objectives and the plans to achieve them.
- Clause 7: Support. Resources, competence, awareness, communication and documented information.
- Clause 8: Operation. A common framework for operational planning and control. This is where each standard adds most of its own specific requirements.
- Clause 9: Performance evaluation. Monitoring and measurement, internal audit (9.2) and management review (9.3).
- Clause 10: Improvement. Nonconformity, corrective action and continual improvement.
The differences sit mostly in planning and operation: customer and product requirements for ISO 9001, environmental aspects and compliance obligations for ISO 14001, and hazard identification and worker participation for ISO 45001. Our integrated checklist audits the shared core once, then goes deep on each standard's specific requirements.
Clause numbers refer to the Harmonized Structure used by ISO 9001:2026, ISO 14001:2026, ISO 45001:2018 and ISO/IEC 27001:2022. AS9100 builds on the ISO 9001 structure. ISO 13485:2016 and R2v3 use their own structures and are mapped in.
Standards we combine
QUALITY
ISO 9001
The core quality management standard. It pairs naturally with every standard below.
ENVIRONMENT
ISO 14001
Environmental aspects, compliance obligations and environmental performance.
HEALTH & SAFETY
ISO 45001
Hazards, OH&S risks and worker participation. Most often paired with ISO 14001.
AEROSPACE
AS9100 family
Aviation, space and defence requirements built on ISO 9001. Often combined with ISO 14001.
MEDICAL DEVICES
ISO 13485
Uses a different structure from ISO 9001, so we audit it alongside other standards using a clause cross-reference.
INFORMATION SECURITY
ISO/IEC 27001
Shares the Harmonized Structure. Its Annex A controls are audited as a dedicated module.
RESPONSIBLE RECYCLING
R2v3
Requires a certified EHSMS (ISO 14001 + ISO 45001, or RIOS) with R2 built in and internally audited at least annually.
YOUR MIX
Any combination
Tell us what you're certified to, or working toward, and we'll build one integrated audit around it.
Common combinations: ISO 9001 + ISO 14001 ISO 14001 + ISO 45001 ISO 9001 + 14001 + 45001 AS9100 + ISO 14001 AS9100 + ISO 14001 + ISO 45001 ISO 13485 + ISO 14001 ISO 9001 + ISO/IEC 27001 R2v3 + ISO 14001 + ISO 45001
Need to audit your suppliers rather than your own system? See supplier audits.
How our integrated internal audit works
- Scope & plan. We agree which standards, sites, shifts and processes are in scope, review your previous audit results and risks, and issue one combined audit plan.
- Build the integrated checklist. One process-based checklist. Each question is cross-referenced to every applicable clause, so shared requirements are audited once and nothing standard-specific is missed.
- Process walk & interviews. One opening meeting, then we follow your processes on the floor and in the office. Each interview covers quality, environmental and safety questions together.
- Findings & closing meeting. Findings are discussed as we go and summarized at one closing meeting. Every finding is tagged to each standard and clause it affects.
- One combined report. A single report organized by process, covering nonconformities, observations and opportunities for improvement, plus a coverage summary per standard for your registrar.
- CAR follow-up. One corrective action request (CAR) set. Follow-up support is available: we can help with root-cause analysis, verify that actions are effective and feed the results into your management review. Follow-up may be quoted separately depending on scope.
Separate audits vs one integrated audit Separate single-standard audits Integrated internal audit Planning A plan and schedule for each standard One audit plan for every standard in scope Meetings An opening and closing meeting per audit One opening and one closing meeting Interviews The same people interviewed again and again Each person interviewed once, covering all standards Shared clauses Documented information, competence, objectives and management review audited repeatedly Audited once and cross-referenced to each standard Findings Seen one discipline at a time Interactions between quality, environment and safety are visible Reporting Separate reports One report, with every finding traceable to each standard Corrective action Separate CAR logs; the same root cause may be fixed more than once One CAR set; one fix can close findings across standards Best for A single standard, or systems run completely separately Two or more standards at the same site
Integrated internal audit FAQ
Will my certification body accept an integrated internal audit?
The standards require planned internal audits that cover their requirements. They don't require each standard to be audited separately. Your registrar will look for evidence that every applicable requirement of each standard was audited at planned intervals and that findings were acted on. Our cross-referenced checklist and per-standard coverage summary are designed to show exactly that.
Do our management systems have to be fully integrated first?
No. We can audit separate systems together (a combined audit) or a single integrated system. If your systems are still separate, the audit often points to practical ways to merge procedures and records.
How much time will we save?
It depends on your scope, number of sites and how integrated your system already is, so we estimate it when we scope your audit. The savings come from shared meetings, shared clauses and one report. We'd rather give you a real estimate than a headline percentage.
Can you include R2v3 with ISO 14001 and ISO 45001?
Yes. R2v3 requires certification to an environmental, health and safety management system (ISO 14001 together with ISO 45001, or RIOS), with the R2 requirements built into that system and reviewed at least annually through internal audits. Paradygm is a SERI Approved Consultant with a 100% R2 track record, and auditing R2v3, ISO 14001 and ISO 45001 in one visit is a natural fit.
ISO 13485 uses a different structure. Can it still be combined?
Yes. ISO 13485:2016 keeps an older clause structure for regulatory reasons, so we map its requirements to the other standards in scope (the standard itself includes an annex correlating it with ISO 9001). That way it's audited in the same visit without losing any medical-device-specific requirements.
Is each standard covered as thoroughly as in a separate audit?
It should be, and ours are planned that way. Shared requirements are audited once, and each standard's specific requirements, such as environmental aspects, OH&S hazards, aerospace configuration management or information security controls, get their own checklist sections and an auditor competent in that standard.