For many organisations that already implement ISO 9001 and are now choosing to implement ISO 27001, the challenge for them is how do we make this all work in sync?
A common practice we see with organisations is they treat both management systems as separate projects but in fact, the best way to implement these standards is to integrate them as one system which will meet all the requirements.
By implementing an integrated approach your implementation team will save time and use less resources. It will also decrease the effort of maintaining the system and achieving continual compliance with both standards. The big plus will be it can save some money as integrated standards as audited as one which means Certification bodies will have to visit your site less often each year resulting in lower assessment costs.
You don't have to repeat yourself
Traditionally ISO 9001 (Quality) and ISO 14001 (Environmental) have been the more popular integrated standard; ISO 9001 and ISO 27001 actually have many similar traits thus is very suitable for integration. Both standards focus on the internal and external issues relevant to the company, but from different perspectives. Both standards follow the Annex SL structure which means there are similarities in what the documentation and procedures required to effectively implement the system.
When integrating the two standards, you will see a reduction of man-hours and resources.
Your implementation project should be based not only on the current state of your organization, in terms of compliance with the requirements of these two standards, but also on spotting shortcuts and low-hanging fruit. Some of the most important places where you can speed up the implementation are the following common requirements of both standards.
1. Understanding the needs and expectations of interested parties
The organization will have to determine interested parties and their requirements related to quality and information security. These requirements can be addressed with the same process, and an integrated list of interested parties can be created.
2. Roles, Responsibility and Authority
The roles and responsibilities within the QMS and the ISMS are different, but they can be defined in the same manner
3. Clause 7 - Support (Competence, Awareness, Communication, Control of Documented information)
All these requirements exist for both ISO 9001 and ISO 27001 and again they can be addressed in the same way and at the same time.
4. Internal Audit and Management Review
The requirements to be audited and the review inputs and outputs are different, but the way the process is conducted is the same. Depending on the size and complexity of the company and its processes, internal audit or management review can be done at the same time or separately.
5. Both require systems for nonconformity and corrective actions
The process of handling non-conformity and corrective actions can be the same for both standards and there again, another reason for integration.
With all these common elements, it would seem logical to maintain one system for each common element. Keep in mind that although some requirements seem the same and can be covered with the same process, that doesn’t mean they will have the same results for both standards. The focus of ISO 9001 is on quality products and services and customer satisfaction, while ISO 27001 is focused on information security; therefore, the results of the management review as well as the inputs will be different, and the same is with most of the above-mentioned common clauses.
Additional requirements of ISO 27001
The differences in these 2 standards can be used to supplement each other, which decisively contribute to increasing business success: information security secures the company’s potential, and quality management creates it. After addressing the common requirements of the standards, the company must deal with their differences that are mostly present in clauses 6 and 8. ISO 27001 adds the following into the IMS:
1. Information security risk assessment
The organisation needs to develop a methodology for identification and evaluation of information security risks. This process shouldn’t be mixed with addressing risks and opportunities in ISO 9001 since the second has far fewer requirements and applying the same methodology can be overwhelming and unproductive in ISO 9001.
2. Information security risk treatment
This process doesn’t have a peer in ISO 9001, so it can be done independently. It basically requires the organisation to apply one or more information security controls listed in Annex A of ISO 27001.
Do Integrating systems provide return of investment (ROI)?
Integrating the two management systems allow for combined resources to save time (up to 30%) and money on maintaining and improving the management system.
With a holistic management system approach that embodies international best practice, organisations can demonstrate compliance with both the ISO 27001 and ISO 9001 standards to customers, certification bodies, and regulatory authorities.
In addition, organisations can demonstrate both the quality and security of their processes, as well as achieve a significant competitive advantage through improved organisational performance, reduced risk, better customer satisfaction, and enhanced reputation and marketability.
Comments