Integrated audit scheduling: aligning cycles across standards

What is integrated audit scheduling?

Integrated audit scheduling is the planning work behind a combined or integrated audit: choosing one date, one duration and one team so that a client certified to ISO 9001, ISO 14001 and ISO 45001 (or any other mix) is audited against all of them in the same visit. The audit time itself is set separately, using the method in integrated audit time under IAF MD 11. This guide covers the dates.

The difficulty is that integration does not merge the rules. Each standard still has its own certification decision date, its own surveillance deadline and its own expiry date. A visit that suits one standard can be early or late for another. Planners who treat an integrated client as a single due date find out at the next assessment that one of the standards was audited outside its window.

An integrated client has one visit and several deadlines. The visit has to satisfy all of them.

Why do certification cycles drift apart?

Very few clients certify all their standards on the same day. A typical integrated client grows into it: quality first, environment a year later, health and safety after that. Each addition starts its own cycle. The illustrative history below shows how quickly three standards end up with three different sets of dates.

1. Mar 2024ISO 9001 certifiedCertification decision on 15 March starts the QMS cycle; expiry March 2027.
2. Nov 2024ISO 14001 addedSeparate stage 1 and stage 2; decision on 20 November starts a second cycle.
3. Feb 2025First QMS surveillanceBooked early to combine with the EMS stage 2 follow-up, then postponed by the client.
4. Jun 2025ISO 45001 addedThird cycle starts; the client now asks for one visit a year.
5. 2026Three windows, one visitQMS, EMS and OH&S surveillance deadlines fall in March, November and June.

Other causes are just as common: a certificate transferred in from another body under IAF MD 2 arrives with its own dates, a special audit shifts the next visit, or a client postpones one year and the combined visit is rebuilt around the late standard. Left alone, drift gets worse every year.

Which date rules apply to each standard in an integrated audit?

The rules below come from ISO/IEC 17021-1:2015 and IAF MD 11:2023, and they apply to each standard separately. Sector schemes and accreditation bodies can add stricter rules, so check the current issue of each document and your accreditation body's requirements.

For the detail of each rule, see surveillance audit frequency and timing and recertification audit timing.

How do you find the shared audit window?

Plot each standard's acceptable range for the coming visit, from the earliest date your procedures allow to the hard deadline. The combined visit must sit where every range overlaps. Most bodies set an internal earliest date for surveillance so that visits are not bunched too close together; use your own procedure, as 17021-1 sets the deadline but not the earliest date.

Here the EMS deadline is in November, but the combined visit is set by the QMS deadline in June. That is fine for compliance, yet it pulls every EMS surveillance forward by five months, which repeats each year. When the shared window is narrow or does not exist, you have two options: split the visit this year, or plan a realignment.

How can integrated audit scheduling realign drifting cycles?

Realignment is a programme decision, taken once and carried out over one or two visits. Choose an anchor standard, usually the one with the largest share of audit time or the earliest expiry, then move the others towards it without breaking any rule in the table above.

The usual moves are these. First, combine surveillance visits inside the shared window and leave the certificates as they are; this is the lightest change and often enough. Second, bring the later standard's recertification forward so it happens with the anchor's recertification, and agree the new expiry dates under your documented procedure. Third, when a client adds a standard, plan its first surveillance (no more than 12 months after its decision) to land in the anchor's next window. Whatever you choose, check it against your own procedures and your accreditation body's expectations before you commit, and keep the reasoning on the client file so an assessor can follow it.

What changes for the audit team?

IAF MD 11 requires the audit team as a whole to meet the competence requirements for each technical area in scope, and the audit to be led by a team leader competent in at least one of the audited standards. The audit plan must cover all areas and activities for each standard. In practice that means the team is decided alongside the date, not after it.

Auditors qualified in two or three standards and the right technical areas are the scarcest people in most bodies. If you book single-standard clients first, those auditors fill up and integrated clients are left with bigger, costlier teams. Book integrated clients early in the planning round, and check auditor rotation rules for each standard, because a multi-standard auditor can hit a rotation limit on one of them. For team building, see audit team selection for integrated audits.

How do optimisation and AI help with integrated audit scheduling?

By hand, a planner checks one integrated client at a time: find the overlap, find a team, check travel, move on. The difficulty is that every choice uses up multi-standard auditors that other clients also need. An optimisation engine checks every client's windows, every team combination and every travel route in the same run, so a booking in March is chosen knowing what it does to June.

For one global assurance provider, ScheduleAI scheduled 305 largely integrated audits in 11 min 24 s, formed 22 teams and found 46 historical competence gaps along the way (read the case). AI agents can then handle client date requests by offering only dates inside the shared window, while planners approve every change.

Integrated audit scheduling checklist

Use this list at each planning round for every client with more than one standard in scope.

• ✓Certification decision, surveillance deadline and expiry recorded separately for each standard
• ✓Shared window calculated from every standard's range, including scheme rules
• ✓Calendar-year surveillance checked for each standard after any date move
• ✓Anchor standard and realignment plan recorded in the audit programme
• ✓Team competent for every standard and technical area, lead competent in at least one
• ✓Rotation limits checked per standard for each auditor
• ✓Level of integration reconfirmed and audit time recalculated if it changed
• ✓Client told which standards each visit covers and what happens if it slips

ScheduleAI is the audit scheduling software certification bodies use to plan ISO programmes from stage 1 to recertification.