Home › Blog › Harmonized structure

ISO harmonized structure: why ISO 9001, 14001, 45001 and 27001 look so alike

Management system standards share their structure, core text and definitions. Understanding that common base saves work and lets you run several standards as one system.

ISO management system standards connected by a common structure

October 16, 2026 4 min readBy the ICS technical team

Anyone who has read ISO 9001 and then opens ISO 14001 gets a feeling of having seen it before: the same clauses, in the same order, with almost identical paragraphs. That is no accident. ISO management system standards are written on a common base, the harmonized structure, so that an organization can apply several of them without duplicating effort.

At a glance

The harmonized structure gives every management system standard the same clause numbers and titles, a common core text and common definitions.
It was born in 2012 as the "high level structure" in Annex SL; today it is part of the ISO/IEC Directives, Part 1.
ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 follow the same ten clauses. Each standard adds only the requirements of its own discipline.
Thanks to that base, several standards can share context, policy, objectives, internal audit, management review and improvement in an integrated system.

What the harmonized structure is

It is the set of elements every ISO management system standard must use: the same clause numbers in the same order, the same titles, a common core text of requirements and notes, and terms with common definitions. The committee that writes each standard adds the requirements of its discipline on top of that base: quality, the environment, occupational health and safety or information security.

The idea appeared in 2012 as the "high level structure", published in Annex SL of the ISO Supplement to the ISO/IEC Directives. In 2021 it was updated and renamed the harmonized structure. Today it is part of the harmonized approach described in the ISO/IEC Directives, Part 1, and its stated purpose is to make it easier for organizations to implement and, if they wish, certify several management system standards.

The ten shared clauses

This is the common base, with a few examples of what each standard adds on top:

Clause	What they all require	What each standard adds (examples)
1 to 3. Scope, references and terms	The scope of the standard, reference documents and the shared vocabulary	Each standard adds the terms of its own discipline
4. Context of the organization	Understanding its situation, interested parties, the scope of the system and its processes	Since 2024, determining whether climate change is a relevant issue
5. Leadership	Top management commitment, policy, roles and responsibilities	ISO 45001: consultation and participation of workers
6. Planning	Risks and opportunities, objectives and planning of changes	ISO 14001: environmental aspects. ISO/IEC 27001: information security risk assessment and treatment
7. Support	Resources, competence, awareness, communication and documented information	ISO 9001: monitoring and measuring resources, and organizational knowledge
8. Operation	Planning and controlling processes	ISO 9001: requirements for products and services. ISO 45001: hierarchy of controls. ISO 14001 and ISO 45001: emergency preparedness
9. Performance evaluation	Monitoring and measurement, internal audit and management review	ISO 9001: customer satisfaction. ISO 14001: evaluation of compliance
10. Improvement	Nonconformities, corrective action and continual improvement	ISO 45001: incident investigation

The overlap has practical effects. In February 2024, ISO added the same climate change text to clauses 4.1 and 4.2 of several management system standards. Because they all share the structure, one change reached all of them at once. It is not a new requirement but a clarification: the organization must determine whether climate change is a relevant issue for its system.

Which edition each standard is on

ISO 9001:2026. Published in September 2026. It keeps the structure, and certified organizations have three years to transition. See what changes in ISO 9001:2026.
ISO 14001:2026. Published in April 2026, also on the harmonized structure. See what changes in ISO 14001:2026.
ISO 45001:2018. Still current. Its revision is under way: the international draft was open for comment from June to September 2026, the new edition is expected no earlier than April 2027, and it will keep the harmonized structure. More in ISO 45001 in Panama.
ISO/IEC 27001:2022. Already uses the harmonized structure and received the climate change amendment in 2024. See ISO 27001 and Law 81.

How to use it: the integrated system

An integrated system is a single management system that meets several standards at once. The harmonized structure makes it possible because many of the requirements are the same. This is what can be shared:

Context and interested parties. One analysis covering quality, the environment, health and safety and information.
Policy and objectives. One integrated policy, with objectives for each discipline.
Documented information. One control of documents and records.
Internal audit and management review. One audit program and one review covering all the standards.
Nonconformities and corrective action. One method for dealing with problems, wherever they appear.

What is not shared are the requirements specific to each discipline: the evaluation of environmental aspects, hazard identification with worker participation, or the statement of applicability of information security controls. Those are added on top of the common base.

How to start

Build on what you have.If your company is already certified to one standard, that system is the base: the second standard is added on top.
Compare clause by clause.A gap analysis against the new standard shows which requirements you already meet thanks to the common base and which are missing.
Use one process map.The process approach is the natural way to integrate: each process takes on the quality, environmental or safety controls that apply to it.
Coordinate the audits.Ask about combined or integrated audits. When the certification body offers them, they avoid checking the common parts twice.

If you are not sure which standard to start with, read which ISO standard your company needs.

Sources: ISO joint coordination group for management system standards; ISO/TC 176: revision of the high level structure; UKAS: climate change within management systems; SGS: ISO 9001:2026; SQS: ISO 45001 revision.