ISO 9001:2015 + ISO 14001:2026 + ISO 45001:2018 · Clause 9.2 in all three standards
Three standards, three versions of the same clause, and no two of them agree.
A combined audit is the normal case in an integrated system, and this procedure is built for it: one program, one plan, one report, with scope markers throughout showing which obligation applies where.
The clause cross-reference in this template runs to twenty-two obligations across the three standards. Twelve of them carry at least one dash — a requirement one standard imposes and another does not.
ISO 14001:2026 requires per-audit objectives; the other two do not. ISO 14001:2026 requires the audit program itself to be available; the other two require retained evidence of its implementation. ISO 45001 requires consultation, worker reporting, and continual improvement of OH&S performance; neither other standard does. ISO 9001 and ISO 14001 ask the program to consider changes affecting the organization; ISO 45001 does not. ISO 9001 requires correction and corrective action; ISO 45001 requires action citing Clause 10; ISO 14001 Clause 9.2 requires neither.
That is the practical argument for a combined procedure rather than three separate ones.
The action clause is a genuine three-way split: ISO 9001 is the only one that names correction. ISO 45001 is the only one that names continual improvement and cites Clause 10. ISO 14001 Clause 9.2 carries no action requirement at all. Start from any one of the three and you lose something the other two require.
| Requirement | Where it comes from | How the template handles it |
|---|---|---|
| Three-way scope determination | Section 2.1 | All three, two of three, one only, or uncertain — with guidance on which variant to use instead where fewer than three apply. |
| [Q] [E] [S] scope markers | MSI house standard | Every obligation carries the standard or standards it comes from, so single-standard requirements survive integration. |
| Three importance lenses, never averaged | Appendix D row 8 | Process importance, environmental significance, and OH&S risk profile recorded separately. Averaging gives a middling audit to a process critical in one discipline. |
| Combined-audit competence stated | MSI house standard | An auditor competent in all three disciplines is uncommon. Where no single auditor covers the scopes, the procedure requires a team with the scopes divided and one lead accountable for the conclusions. |
| Appendix D across three directions | MSI house standard | Ten divergences, each naming which standard the house decision came from, because no one standard is strictest throughout. |
| Process interaction map | ISO 9001 Clause 4.4.1 | The quality scope brings the requirement in. Editable SVG plus embedded image, with the scope of each interface marked. |
43 pages, editable Microsoft Word format. The process interaction map ships alongside as an editable SVG.
All three clauses require the program to take account of process importance, each through its own lens. The template turns it into a mechanism, with the three rankings recorded separately and the audit set against the highest of them.
| What varies | Higher risk | Lower risk |
|---|---|---|
| Frequency | Every cycle, re-audited early where findings recur | Longer interval, with the basis recorded |
| Depth | Walked end to end, including handoffs | Key controls sampled |
| Sample size | Large enough to support a conclusion about the system | Sufficient to confirm the control operates |
| Method | On-site, including the shift where supervision is thinnest | Records reviewed remotely |
| Auditor | Most experienced available; second auditor where contested | Any qualified auditor on the register |
Why this matters: Most programs answer the importance-of-processes requirement by adjusting frequency alone. A low-risk and a high-risk process both audited annually, same checklist, same two-hour slot, have not been differentiated in any way that changes what the audit finds.
Management representatives and integrated-system managers at organizations holding ISO 9001, ISO 14001, and ISO 45001, and consultants supporting integrated systems. Particularly useful during the ISO 14001:2026 transition, when one of the three clauses moves and the other two do not.
$349
Combined variant. All three clauses in full, with the divergences resolved and recorded.
One-time payment. Immediate download. Editable Microsoft Word format.
For an integrated system, usually yes — one visit, one report, one set of records, and the interfaces between the three systems get examined rather than falling between three audits. The caveat is competence: auditing three disciplines in one pass requires either an auditor qualified across all three or a team with the scopes divided. The procedure states that requirement rather than assuming it away.
Effectively yes, and it is one of the few things in this procedure that applies uniformly. The February 2024 climate action amendment added climate wording to Clauses 4.1 and 4.2 of ISO 9001:2015 and ISO 45001:2018, and ISO 14001:2026 carries climate considerations in its own text. The template notes the uniformity explicitly, because it is the exception in a document full of divergences.
Both, and that is deliberate. It is written as a filled-in worked example so you can see what each element looks like when done properly, with bracketed placeholders wherever a value is genuinely yours to set — thresholds, roles, systems, retention periods, audit frequency. You are editing a working document rather than filling in a hollow outline.
Editable Microsoft Word (.docx). Adapt it, rebrand it, adopt it into your document control system.
It is structured to the ISO 19011:2026 clause architecture, and it implements the change ISO names in its own foreword — expanded guidance on remote auditing methods, drawing on ISO/IEC TS 17012. Everything beyond that, including the platform-specific competence prerequisite and the evidence-reliability check, is MSI's house standard drawn from 200+ audits attended, and is labeled as such in the document. ISO 19011 is guidance rather than a requirements standard, so no organization is certified against it and no clause of it can be raised as a nonconformity.
A procedure does not pass an audit; an organization does. What this gives you is a procedure that addresses every requirement of the clause with a named owner and a named record, and that describes a process people can actually follow. Conformity is demonstrated by implementation and evidence — a perfect document over a program that ignores it is still a finding. Unfilled placeholders are unmet requirements, so fill them.
Outside this procedure, deliberately. This one owns the audit program, the audit, the report, finding classification, and the follow-up verification. Root cause analysis, the corrective action record, and effectiveness evaluation belong in your corrective action procedure. The handoff is defined at one named point so nothing falls between them.
Every cross-reference is held in a table at the back rather than baked into the body text, precisely so you can renumber to your own system without unpicking the procedure.
Yes. Call MSI at 760-434-9141 to schedule a planning session.
The free Internal Audit Maturity Check scores eight elements of your audit program in under five minutes and returns an element-by-element breakdown with a priority order. It is the same maturity ladder built into this template, so it will tell you which sections matter most to you before you spend anything.
Take the free Internal Audit Maturity Check
MSI's QMS process interview course covers how to run the interviews an internal audit depends on: QMS Process Interviews
Management Systems International, LLC is a veteran-owned, female-owned ISO consulting firm co-founded in 1998. MSI has 28 years of experience, has supported 80+ certifications, attended 200+ audits, and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries.
This template encodes the patterns that recur across that work — not one organization’s approach generalized, but the structural weaknesses that show up again and again.
To discuss your audit program directly, call MSI at 760-434-9141 or 888-914-9141.
© 2026 Management Systems International, LLC · All rights reserved.
