Integrated audit time under IAF MD 11: combining management systems

What is IAF MD 11 and when does it apply?

The integrated audit time IAF MD 11 method applies when a certification body audits an organisation's integrated management system against two or more standards at the same time, such as ISO 9001, ISO 14001 and ISO 45001. The document is IAF MD 11, Application of ISO/IEC 17021-1 for Audits of Integrated Management Systems, currently Issue 3 (IAF MD 11:2023), issued 12 September 2023. Check the IAF website for the current issue.

MD 11 defines an integrated management system as a single management system managing multiple aspects of organisational performance to meet the requirements of more than one standard. ISO/IEC 17021-1:2015 already lists combined, joint or integrated audits among the factors that affect audit time (clause 9.1.4). MD 11 turns that into a method.

Integrated audit time IAF MD 11 method: three steps

MD 11 clause 2.1.1 sets a three-step method. The order matters, because each standard's own rules must be applied before any integration saving.

Step 3 can also increase time. MD 11 lists the complexity of auditing an integrated system compared with single audits among the factors to consider, so a poorly integrated system with a complex scope may need more than T. For how each standard's time is set, see IAF MD 5 audit time and ISO/IEC 27001 audit duration.

What decides the size of the reduction?

Annex 1 of MD 11 uses two measures. The first is the organisation's level of integration, from 0% to 100%. The second is the certification body's ability to perform a combined audit, which depends on how many standards each auditor on the team is competent to audit. A figure in Annex 1 maps the two to a maximum reduction. The 20% ceiling is only reachable where both are high; a system with little integration gives little or no reduction.

MD 11 lists seven areas for judging the level of integration:

• An integrated documentation set, including work instructions.
• Management reviews that consider the overall business strategy.
• An integrated approach to internal audits.
• An integrated approach to policy and objectives.
• An integrated approach to systems processes.
• An integrated approach to improvement mechanisms.
• Integrated management support and responsibilities.

MD 11 also expects the level of integration to consider how well the auditee can answer questions that cover several aspects at once. A client with one manual but separate teams for quality and environment is less integrated than its documents suggest.

How is audit team ability calculated?

MD 11 gives a formula for the horizontal axis of its figure: 100 × ((X1 − 1) + (X2 − 1) + … + (Xn − 1)) / (Z × (Y − 1)), where X is the number of standards each auditor can audit, Y is the number of standards in the audit and Z is the number of auditors. Its worked example uses three auditors and three standards.

Auditor 1 covers 3 standards, auditor 2 covers 2 and auditor 3 covers 1. The result is 100 × (2 + 1 + 0) / (3 × 2) = 50%. Replace auditor 3 with someone competent in all three and the result rises to 83%. Team selection changes the audit time the rules allow, which is why the choice of team and the calculation of days must happen together. MD 11 also requires the team as a whole to meet the competence requirements for each technical area, and the audit to be led by a team leader competent in at least one of the standards.

A worked example: ISO 9001, 14001 and 45001

A manufacturer with 200 effective personnel seeks certification to all three standards. Environmental complexity and OH&S risk are both medium. For simplicity, take each standard's table figure from IAF MD 5:2023 with no individual adjustments.

T is 29 auditor days. However integrated the client and however versatile the team, the integrated audit cannot fall below 23.2 days. The actual figure depends on where the client and team sit in the Annex 1 figure, and every step must be recorded on the client file.

How does integration affect scheduling across the cycle?

An integrated audit changes the booking as well as the day count. Fewer, more versatile auditors are needed on site, and every day they spend must be split across the standards in the audit plan. The auditors who can cover several standards are often in short supply, so integrated clients compete for them. See audit team selection for integrated audits.

MD 11 section 4 requires the certification body to confirm that the level of integration stays unchanged throughout the cycle, so that the durations still apply. If the client splits its systems, or a standard is suspended, the time must be recalculated. Reports can be integrated or separate, but every finding must be traceable to the standard it relates to, and a nonconformity against one standard must be assessed for its impact on the others.

• ✓Each standard's time calculated with its own rules first
• ✓Starting point T recorded
• ✓Level of integration assessed against the seven MD 11 areas
• ✓Team ability calculated from the actual team booked
• ✓Reduction checked against the 20% cap
• ✓Integration reconfirmed at each surveillance

Common mistakes with integrated audit time

For how the resulting days turn into bookings, see what an audit man-day is.

ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.