Write the Clause Once. Certify Everywhere.
Running ISO 9001, ISO 27001 and ISO 42001 as three separate programmes is one of the most expensive avoidable mistakes in corporate compliance. They share a skeleton — most organisations pay three times to build it.
Every modern ISO management system standard is built on Annex SL — a common high-level structure mandated for all ISO management system standards. Clauses 4 through 10 are the same clauses, in the same order, in every one of them. What differs is the subject. ISO 9001 asks about quality risk; ISO 27001 about information security risk; ISO 42001 about AI risk. The management architecture around them is identical.
What organisations do instead
They run three programmes, on three timelines, with three consultants, producing three sets of documentation — three context analyses describing the same organisation, three interested-parties registers listing the same stakeholders, three internal audit programmes. Then three surveillance audit cycles a year, each asking overlapping questions of the same people, who by the third cycle have stopped taking any of it seriously.
The integrated alternative
An Integrated Management System writes the shared architecture once and layers standard-specific requirements onto it: one context analysis, one interested parties register, one risk methodology applied to distinct domains, one internal audit programme that assesses a process once against every applicable standard. Standard-specific content — the Annex A controls for 27001, the Annex A controls for 42001 — sits on top, where the genuine differences actually live.