An integrated management system audit in Kenya should be one of the most useful exercises your organisation runs each year. When it works, it surfaces the real gaps before an external auditor does. When it does not work, it produces a report that looks complete, confirms what leadership wants to hear, and leaves the actual integration problems sitting underneath the surface until a certification audit finds them.
The challenge is that most HSEQ managers do not know which category their internal audit falls into. The audit was planned. The checklist was completed. The report was submitted. But the audit that tells you whether your ISO 9001, ISO 14001, and ISO 45001 are genuinely functioning as one system is a different audit from the one that checks whether each standard’s boxes are ticked.
This article describes the five most common signs that your integrated management system audit is not doing what it is supposed to do, drawn from discussions with experienced auditors and practitioners working across East Africa.
The difference between a documented IMS and an operational one
Before looking at the signs, it is worth being precise about what an integrated management system is supposed to be. Not three standards that reference each other. Not a shared document numbering system. One management system, built on a single policy framework, a unified risk management process, integrated audit planning, and a combined management review, that covers the requirements of all three standards simultaneously.
The distinction matters because most organisations in Kenya that describe themselves as running an IMS are running something closer to three standards that have been harmonised at the documentation level. The operational and audit reality remains largely separate.
That gap is what an effective integrated management system audit in Kenya is designed to find. If your internal audit is not finding it, here are five reasons why.
Sign 1: You have separate policy documents for each standard
When an experienced auditor walks into an organisation claiming to run an integrated management system and finds a quality policy, an environmental management policy, and a safety policy each standing as independent documents, they know immediately that the integration is mostly administrative.
The policy is one of the clearest signals of how deeply integration has been designed. If the organisation has one integrated policy that addresses quality, environmental, and occupational health and safety commitments in a single framework, tied to one organisational strategy, that is a signal that the integration was intentional from the start. If the policies are separate, the management system underneath them is very likely to be separate as well.
An integrated management system audit in Kenya should begin with the policy framework. If your internal audit is not examining this as a starting signal, it is not auditing integration.
Sign 2: Your risk register separates standards rather than consolidating them
ISO 9001, ISO 14001, and ISO 45001 all require risk assessment. Each has a different focus: quality risks follow process inputs and outputs; environmental risks follow activities and legal obligations; safety risks follow tasks and workplace hazards.
The common implementation error is maintaining three separate risk registers, one for each standard, each owned by a different team. The result is that quality risks, environmental risks, and safety risks are assessed in isolation, and the organisation misses the interactions between them.
An effective integrated management system requires one risk management process that addresses all three standards through a single methodology. The methodology identifies quality, environmental, and health and safety risks through the same process, using the same approach, with findings consolidated into a single risk register.
When an integrated management system audit in Kenya does not examine whether the risk registers are genuinely consolidated, or accepts three separate registers as evidence of integration, it is not auditing the IMS. It is auditing three separate management systems.
Sign 3: Your audit plan treats each standard as a separate audit
This is the most visible sign that integration has not been achieved. If your internal audit programme has a quality audit scheduled in February, an environmental audit in May, and a safety audit in September, with different audit teams, different schedules, and different reporting lines, you do not have an integrated management system audit. You have three sequential audits.
A genuinely integrated management system audit plans, conducts, and reports all three standards simultaneously, under one audit plan, with one combined audit team that covers requirements across ISO 9001, ISO 14001, and ISO 45001 in the same engagement.
[See our article on building an integrated audit programme]
The planning phase is where this decision must be made. If the decision is not made at planning, the audit will default to the path of least resistance, which is the three-sequential-audit model that most organisations know from before they integrated.
Sign 4: Management review cycles run separately for each standard
The management review is one of the clearest indicators of whether the leadership team is engaged with the integrated management system as a whole. If quality management review, environmental management review, and safety management review are held as separate meetings, with separate agendas and separate outputs, the integration does not reach leadership level.
An integrated management system requires a combined management review that considers the performance, risks, objectives, and improvement actions of all three standards together. When leadership is reviewing quality performance without simultaneously reviewing environmental and safety performance, they are making strategic decisions with an incomplete picture.
This is the point where an integrated management system audit in Kenya most commonly finds that the integration, even where it exists in documentation, has not been embedded in how the organisation is actually managed.
Sign 5: The physical environment does not reflect the documented system
The fifth sign is one that auditors check before the first interview is conducted. Walking through the facility, before opening a single document, a trained auditor observes whether the requirements of the management system are visible in how the organisation operates.
PPE registers may show full compliance. Workers may not be wearing PPE. Environmental monitoring logs may show regular sampling. Waste segregation practices may tell a different story. Quality control records may indicate 100% inspection. Production lines may be running procedures that the records do not reflect.
The gap between documentation and operational reality is the most consequential gap an integrated management system audit can find, and it is the one that most internal audits, conducted by people who know the organisation and its pressures, are most likely to overlook.
[ISO 19011 Guidelines for auditing management systems, ISO.org]
An external auditor does not know the pressures. They observe what they find. Your internal integrated management system audit should be designed to observe the same way.
What to do with these findings
If your last integrated management system audit in Kenya produced a report that did not surface any of the signs described above, it is worth asking whether the audit looked for them.
The cost of finding these gaps internally, before an external certification audit, is time and corrective action. The cost of finding them in a certification audit is a major nonconformity, a follow-up audit, and, in some cases, a suspended certificate.
The internal audit is the organisation’s best opportunity to find the real state of integration. It is only useful if it is designed to look.
[IMS Workshop, September 1–4, Naivasha — for teams building their internal audit competence] [Kenya Bureau of Standards, kebs.org — guidance on management system certification in Kenya]
Saladin Consulting Limited is a specialist HSEQ and environmental advisory firm supporting organisations across Kenya and East Africa with IMS implementation, gap assessment, internal audit, and PECB-aligned training. Contact us at info@saladinglobal.com or visit saladinglobal.com.
