IMS Risk Management Procedure Template & Guide (ISO 9001 + ISO 14001 + ISO 45001)

A complete, editable risk, aspect and hazard identification procedure for one integrated management system to ISO 9001:2015, ISO 14001:2026 and ISO 45001:2018 — written as a finished working document, not an outline.

The three scopes are not one scope

The ISO 14001 scope is declared by the organization and may legitimately exclude sites, activities or entities. The ISO 9001 scope may exclude requirements that do not apply, and whole product lines. ISO 45001 has no equivalent latitude: it applies to workers under the organization's control, and you cannot exclude a location because it is small, leased or awkward.

So there is a predictable class of location inside OH&S and outside the EMS — the sales office, the service depot, the customer site. And there is the product line excluded from the quality scope whose manufacture still generates aspects and hazards. Nothing is wrong with any of that. Not knowing is. Section 2.0 reconciles all three, location by location, and it takes about two hours.

Two identification routes, one shared spine

Hazards and aspects are found by watching the work as it is performed. Quality risk is not visible on a walkway — it lives in process performance data, a supplier's change-notification clause, a customer requirement, a repeat nonconformity. This procedure runs both routes into one shared assessment and treatment spine, which is what makes an integrated procedure honest rather than three procedures stapled together.

Strictness runs in different directions

ISO 45001 is strictest on method: the assessment methodology and criteria held as documented information, maintained and retained; the hierarchy of controls mandatory; the participation of non-managerial workers required. ISO 14001:2026 is strictest on criteria and life cycle. ISO 9001 requires the least at Clause 6.1 — and contributes the obligation that makes the document necessary, at Clause 4.4.1 c).

Appendix D records nineteen divergences, six of them genuinely three-way, each with the position adopted as house standard and the alternative rejected with its reasoning — followed by a sign-off table. Where the standards disagree, which did you follow and why? That is the answer, written down, before three certification bodies ask it separately.

What is in it

• Section 2.0 — three-way scope reconciliation, location by location, with every gap named and what covers it.
• Section 5.0 — Developing this process in your organization, which with Appendix E is the documented methodology ISO 45001 Clause 6.1.2.2 requires, maintained and retained, applied as the house standard to all three systems.
• Three distinct rating scales — injury and ill health, the environmental receptor, and the intended result at risk — deliberately different in length so a rating cannot be transcribed between them.
• The full scope of ISO 45001 Clause 6.1.2.1, including how work is organized, workload, work hours, harassment and bullying — the elements a walkway inspection cannot see.
• The hierarchy of controls, applied to environmental controls too at four levels, with any rejection of a higher level recorded and approved.
• Worker participation designed rather than asserted — how a concern is raised without going through a manager, and protection from detriment.
• Established environmental significance criteria judged against the receptor, with life cycle perspective and the communication requirement.
• A quality risk register, the ISO 9001 proportionality test, and integration into QMS processes.
• Combinations across all three systems, including the single conditions that trigger entries in two or three registers at once.
• Figure 1 — process interaction map, required once ISO 9001 is in scope.
• Appendix A — the registers, kept apart. Appendix B — action and effectiveness record carrying the hierarchy level. Appendix C — desk-level work instruction with worked examples.
• Appendix D — the integration decision record: nineteen divergences, nineteen decisions, one sign-off table.
• Appendix E — determination worksheet. Appendix F — legal obligations outside the standards, including a ready-to-sign written certification of hazard assessment.

Specification

Who it is for

Organizations holding all three certificates, and consultants supporting integrated management systems. Particularly useful for multi-site operations where the three scopes were never compared, and for any organization that walks the site once and records the results in one merged table.

The full documentation package

This procedure is one document in a wider system. If you are building or rebuilding the whole integrated documentation set rather than filling a single gap, the packages below collect the procedures and guides, and work out considerably cheaper than buying them individually.

• ISO 9001, ISO 14001 and ISO 45001 package — the complete integrated management system documentation set — the direct match for this procedure
• ISO 14001:2026 and ISO 45001 package — the environmental and safety set, without the quality system
• ISO 45001 procedure templates and guides — the occupational health and safety set on its own
• ISO 9001 and ISO 14001 package — the quality and environmental set without safety content — for a site or division certified to ISO 9001 and ISO 14001 only, which Section 2.0 of this procedure is designed to surface. In preparation. Email info@msi-international.com or call 760-434-9141 to be told when it is released, or to be invoiced for it now.