VIMS EHSVIMS EHS

Solution for audit and compliance

Integrated management system (IMS) — one finding register for ISO 9001, 14001 and 45001

Organisations running several management systems rarely lack knowledge. They lack synchronisation: the same actions appear in three plans, findings from quality, environmental and safety audits live in separate files, and management review starts with two weeks of data gathering. VIMS EHS keeps one audit programme, one finding register and one action flow for the whole integrated management system.

  • Internal audit programme
  • Findings and nonconformities
  • Corrective actions
  • Legal register and compliance evaluation
  • Management review
Book a demo Log in
VIMS EHS — audit and compliance dashboard with an annual audit plan by quarter, planned and completed audits, open findings and management review evidence
VIMS EHS — audit and compliance dashboard with an annual audit plan by quarter, planned and completed audits, open findings and management review evidence

The cost of running several systems side by side

An organisation with three or four implemented standards rarely duplicates processes on purpose. Duplication accumulates: each new area gets its own audit plan, report template and action register, because that was the fastest route at implementation time.

After a few years the effect is predictable. A production manager receives three different tasks that in practice concern the same work instruction. The system manager spends time reconciling which register is current instead of analysing findings.

The most expensive part is the missing common picture. When quality, environmental and safety findings sit in three files, nobody notices that all three point to the same weakness in controlling documentation changes.

One register of findings, many scopes

VIMS keeps an audit plan with scopes, dates and auditors, while findings go into a single register. Scope describes what a finding concerns; the action path is shared across the organisation.

For the system manager this means cross-cutting questions can be answered: how many findings are open past their date, which areas generate the most repeats, what share of actions passed effectiveness verification.

For line managers the change is simpler and more important: one task list instead of three, with a date and a clearly described expected evidence for each task.

Harmonized Structure — shared requirements of ISO 9001, ISO 14001 and ISO 45001

Management system standards share the High Level Structure (now the Harmonized Structure of Annex SL): context of the organisation and interested parties, leadership, actions to address risks and opportunities, objectives, control of documented information, internal audit, management review, nonconformity and corrective action, and continual improvement. These are the natural integration points.

Differences lie in scope: ISO 9001 — product quality and customer satisfaction, ISO 14001 — environmental aspects and impacts, ISO 45001 — hazards, OH&S risk and worker participation, ISO 50001 — energy performance, ISO/IEC 27001 — information security. In an IMS every finding carries its scope but follows the same path.

A frequent gap is the legal register with periodic evaluation of compliance, required by ISO 14001 and ISO 45001. VIMS EHS keeps it as a register with review dates and evidence, and findings flow into CAPA.

The scope of an IMS and compliance function

Annual audit plan

Scopes, dates, auditors and delivery status in one view. A slipped date is visible immediately, not at year end.

Internal and supplier audits

Report, findings, classification and actions linked to a specific audit, with full status history.

Shared finding register across scopes

Findings from different areas in one register, tagged with scope. Recurrence shows across the system, not inside a single standard.

Actions with evidence and verification

Every finding leads to an action with an owner, a date, completion evidence and a planned effectiveness check.

Registers of requirements, reviews and dates

Recurring obligations kept as dated records instead of reminders in one person's calendar.

Management review data

Audit plan status, finding structure, action timeliness and backlog available continuously, without assembling before the meeting.

The flow in an integrated management system

The same path handles an internal audit finding, an inspection remark and an internal report.

  1. 1Annual audit plan with scopes
  2. 2Audit delivery and report
  3. 3Findings with classification
  4. 4Root cause where needed
  5. 5Actions with owner and evidence
  6. 6Effectiveness verification
  7. 7Cross-cutting reports
  8. 8Management review

Modules in this solution

Each module works on its own, yet together they form the single data flow described above.

Registers and inspections

A plant runs a dozen parallel registers: cranes, pressure vessels, forklifts, extinguishers, hydrants, electrical installations, ladders, hoists, gates. Each has its own cycle and its own owner. This module brings them into one register with one calendar.

Explore the VIMS EHS module: Registers and inspections with reminders

Management of Change (MOC)

Most serious events do not come from routine work but from something new: a replaced unit, an altered parameter, a different raw material, a reshuffled crew. MOC brings order to the moment when risk appears that no assessment describes yet.

Explore the VIMS EHS module: Management of change (MOC)

Integration is not merging documents, it is merging the flow

A typical integration attempt starts with the manual: three documents become one and the system is declared integrated. Operationally nothing changes, because tasks are still created in three places and land on three lists.

Real integration starts with the flow of findings and actions. If every finding — quality, environmental, occupational safety or information security — enters the same path, most coordination work disappears.

The second step is a shared dictionary: finding classification, cause categories and action types. Only then can results from different areas be compared, and management review stops being three presentations stapled together.

Why evidence matters more than status

'Closed' is a declaration. Evidence is a fact. In audit practice the difference surfaces within minutes, when someone asks to see the effect of an action taken a year ago.

It is worth requiring concrete evidence with each action: an updated instruction, a training record, a photo of the changed workstation, a measurement result. This is not formality — it prevents reconstruction from memory a year later.

The third element is effectiveness verification spread over time. An action can be performed correctly and still fail to remove the cause. Without a planned check you learn that only when the problem returns.

Questions from IMS and compliance teams

What is an integrated management system (IMS)?

One system covering several standards, most often ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (OH&S), with a shared policy, internal audit programme, nonconformity register, corrective actions and management review. Integration is possible because the standards share the Harmonized Structure.

How do we plan an internal audit programme for several standards?

The programme considers process importance, changes and previous results. Integrated audits are common — one process audit checks several standards and findings are tagged by scope. See audits and inspections.

How is evaluation of compliance with legal requirements managed?

ISO 14001 and ISO 45001 require identifying legal and other requirements and periodically evaluating compliance. In the system this is a register with an owner, review date and evidence; an unmet requirement becomes a finding with an action. Legal interpretation remains with the organisation or its adviser.

Does the system guarantee conformity with standards?

No. Conformity results from how the organisation operates and from the certification body's assessment. The system organises the audit plan, findings, actions and evidence — usually the parts that are missing during assessment.

Can several scopes share one register?

Yes. Scope is an attribute of a finding, not a reason to create a separate register, which is what makes cross-cutting reporting possible without manual merging.

How do we migrate open actions from spreadsheets?

Migrate genuinely open cases and formally close what was long ago completed. Importing an unreviewed backlog undermines the new register from day one.

Can an external auditor see the data?

Access scope is the organisation's decision. In practice, exporting selected reports and evidence is used more often than granting outside access.

Can management review be prepared from the system?

Plan, finding and action data are available continuously. Interpretation and conclusions remain the team's work — the system supplies material, not decisions.

Can contractors be covered by the same oversight?

Yes. External company requirements and documents are kept as dated records, and findings about their work enter the shared action register.

Other solutions

Solution for safety teams

See

Solution for quality teams

See

Solution for food safety

See

Solution for fire protection

See

Let us tidy up your integrated system

We will show how an audit plan, findings and actions from several areas can work in one register.

Book a demo See all modules