If you have ever looked into ISO certification and wondered why ISO 9001, ISO 14001, and ISO 45001 all seem to follow the same pattern, you have already noticed the effect of Annex SL without knowing its name. The standards look similar because they are built on the same foundation.
Understanding Annex SL will not just satisfy your curiosity. It will help you make smarter decisions about which standards to pursue, how to structure your management system, and how to avoid duplicating work across multiple certifications. For SMEs with limited time and resource, that matters enormously.
What Is Annex SL?
Annex SL is the name given to the framework that defines the structure, core text, and common terminology shared by all ISO management system standards. Published by the ISO Technical Management Board, it was introduced to solve a problem that had been growing for decades: each new ISO management system standard was being written independently, with its own clause structure, its own definitions, and its own way of expressing common concepts. Organisations holding multiple certifications were maintaining entirely separate management systems, duplicating documentation, running parallel audit programmes, and training staff on overlapping requirements that used different language to say essentially the same thing.
Annex SL changed that by creating a master template. Every management system standard developed or revised after its introduction must follow the same high-level structure, use the same core clause text, and adopt the same common definitions. The result is a family of standards that, beneath the surface, share the same skeleton.
You may also encounter the term "Harmonised Structure", which is the updated name ISO introduced in 2021 to replace Annex SL. The two terms refer to the same concept.
Which Standards Use the Harmonised Structure?
The list of standards using the Harmonised Structure is extensive and growing. The most commonly pursued standards built on the Harmonised Structure include:
| Standard | Description |
|---|---|
| ISO 9001 | Quality Management Systems. The most widely held ISO certification in the world, applicable to any organisation that wants to demonstrate consistent delivery of products or services that meet customer and regulatory requirements. |
| ISO 14001 | Environmental Management Systems. For organisations that want to manage and demonstrate their environmental responsibilities, reduce waste and energy use, and meet the growing sustainability expectations of customers and regulators. |
| ISO 45001 | Occupational Health and Safety Management Systems. For organisations seeking to reduce workplace risk, protect their workforce, and demonstrate compliance with health and safety obligations. |
| ISO 27001 | Information Security Management Systems. For organisations that handle sensitive data and need to demonstrate robust controls over information security risks. Note that ISO 27001 uses a slightly different clause numbering in its main body, but was revised in 2022 to align with the Harmonised Structure. |
| ISO 42001 | Artificial Intelligence Management Systems. The newest major addition to the family, for organisations that develop or deploy AI systems and want to demonstrate ethical, transparent, and well-governed AI practices. |
| ISO 50001 | Energy Management Systems. For organisations seeking to systematically improve energy performance, reduce costs, and demonstrate commitment to energy efficiency. |
This is not an exhaustive list. ISO continues to develop new standards using the Harmonised Structure, and existing standards are revised to align with it as they come up for periodic review.
The Ten Clauses of the Harmonised Structure
Every standard built on the Harmonised Structure is organised around the same ten clauses. The first three are introductory and do not contain auditable requirements. Clauses 4 to 10 are where the actual requirements live.
| Clause | Description |
|---|---|
| Clause 1: Scope | Defines the purpose and intended outcomes of the specific standard. |
| Clause 2: Normative References | Lists any other standards referenced within the document. |
| Clause 3: Terms and Definitions | Provides the shared vocabulary used throughout the standard. |
| Clause 4: Context of the Organisation | Requires the organisation to understand its internal and external environment, identify its interested parties, define the scope of its management system, and establish the system itself. This is where your SWOT and PESTLE analyses live, as covered in our earlier articles in this series. |
| Clause 5: Leadership | Sets out the responsibilities of top management, including demonstrating commitment to the management system, establishing policy, and assigning roles and responsibilities. For ISO 9001:2026, this clause has been updated to include the promotion of quality culture and ethical behaviour. |
| Clause 6: Planning | Covers the identification and management of risks and opportunities, the setting of objectives, and the planning of changes. For ISO 9001:2026, this clause has been restructured to provide a clearer separation between risk management and opportunity management. |
| Clause 7: Support | Addresses the resources needed to operate the management system, including people, infrastructure, and documented information. It also covers competence, awareness, and communication requirements. |
| Clause 8: Operation | This is the most standard-specific clause, covering the day-to-day operational requirements that vary depending on the discipline of the standard. |
| Clause 9: Performance Evaluation | Requires the organisation to monitor, measure, analyse, and evaluate its performance. This includes internal audits and management reviews. |
| Clause 10: Improvement | Covers the treatment of non-conformities, corrective actions, and the pursuit of continual improvement. |
This structure follows the Plan-Do-Check-Act (PDCA) cycle, a concept familiar to anyone with a background in quality or operations management. Clause 6 is the Plan phase. Clause 8 is Do. Clause 9 is Check. Clause 10 is Act. Clauses 4, 5, and 7 provide the overarching context and support that enables the cycle to function.
Why the Harmonised Structure Matters for SMEs
For large organisations with dedicated compliance teams, managing multiple separate management systems is inconvenient but manageable. For SMEs, it can be genuinely prohibitive. Maintaining separate documentation, separate audit schedules, separate training programmes, and separate management reviews for each standard creates an administrative burden that quickly outweighs the benefits of certification.
The Harmonised Structure removes most of that duplication. Because the clauses, core text, and common requirements are shared across standards, an SME holding both ISO 9001 and ISO 14001 can operate a single Integrated Management System (IMS) that satisfies both standards simultaneously. One set of procedures. One internal audit programme. One management review. One set of documented policies covering the shared requirements.
The standard-specific requirements - the quality-focused content of ISO 9001 Clause 8, or the environmental aspects and impacts assessment required by ISO 14001 - remain distinct and must be addressed separately. But the shared scaffolding around them does not need to be built twice.
For an SME considering ISO certification for the first time, understanding the Harmonised Structure helps with sequencing decisions too. If you anticipate needing both ISO 9001 and ISO 14001 in the next three to five years, it makes sense to design your management system for integration from day one, even if you only certify against ISO 9001 initially.
The Shared Core Requirements: What They Mean in Practice
To make this concrete, here are the requirements that are common to all Harmonised Structure standards and what they look like in a typical SME setting.
Context analysis (Clause 4.1 and 4.2)
Every standard requires you to understand the internal and external factors that affect your organisation, and to identify the stakeholders who have a relevant interest in your management system. In practice, this means maintaining a documented context analysis (using tools like SWOT and PESTLE) and an interested parties register. These documents serve all your standards simultaneously. You do not need a separate context analysis for each one, though you may need to ensure that standard-specific factors are adequately covered within it.
Scope (Clause 4.3)
Every management system requires a documented scope statement. In an integrated system, a single scope statement can cover multiple standards, provided it is clear about what each certificate covers and any exclusions are justified.
Policy (Clause 5.2)
Each standard requires a policy commitment from top management. In an integrated system, many organisations combine these into a single integrated policy document that addresses quality, environmental, and safety commitments together. This is entirely acceptable provided all the required elements are present.
Risk and opportunity management (Clause 6.1)
Identifying and addressing risks and opportunities is a shared requirement across all Harmonised Structure standards. A single risk register can cover multiple standards, with columns or categories distinguishing quality risks from environmental risks from safety risks as needed.
Competence, awareness, and communication (Clause 7)
Training records, competence assessments, and communication plans can all be managed centrally across multiple standards, with discipline-specific additions where required.
Internal audit (Clause 9.2)
An integrated internal audit programme can audit against multiple standards simultaneously, using a combined audit checklist. This is one of the most significant practical time savings available to SMEs operating an integrated system.
Management review (Clause 9.3)
A single management review agenda can address the performance of all in-scope standards. The inputs and outputs required are largely the same across standards, with some standard-specific additions.
A Practical Example: Hartley Precision Engineering Ltd
Hartley Precision Engineering, our fictional Sheffield manufacturer, currently holds ISO 9001 and is considering adding ISO 14001 to reflect growing customer pressure around sustainability.
Without the Harmonised Structure, this would mean building an entirely separate environmental management system from the ground up: new documentation, a new audit programme, a separate management review, and entirely separate training.
With the Harmonised Structure, Hartley's transition looks quite different. Their existing context analysis simply needs to be extended to capture environmental factors alongside quality factors, much of which is already present in the Environmental dimension of their PESTLE analysis. Their interested parties register needs a review to ensure environmental stakeholders (the local authority, their waste contractor, and key customers with sustainability criteria) are captured. Their risk register gains an environmental column. Their internal audit programme is extended to cover ISO 14001 clauses, using the same audit cycle and the same internal auditor. Their management review agenda gains a section covering environmental performance.
The standard-specific work - identifying Hartley's environmental aspects and impacts, assessing legal compliance, setting environmental objectives - is new and requires proper attention. But the shared infrastructure is already in place.
Common Misconceptions About Annex SL
"If the structure is the same, the standards must cover the same things." The shared structure is a framework, not the content. The operational requirements in Clause 8 are highly specific to each standard's discipline. ISO 9001 Clause 8 covers product and service delivery. ISO 14001 Clause 8 covers environmental operational controls. ISO 45001 Clause 8 covers hazard elimination and risk reduction. The shared clauses ensure these standards can work together. They do not make them interchangeable.
"An integrated management system means one certificate." Operating an integrated management system means managing shared requirements together under one system. It does not necessarily mean one certificate. Each standard is certified separately, by an accredited certification body, and each can result in its own certificate. The integration is in the management system, not necessarily in the certification. Speak to your certification body or consultant for guidance.
"Annex SL means all ISO standards are the same." The Harmonised Structure applies to management system standards specifically. It does not apply to product standards, testing standards, or technical specifications. ISO 9001 is a management system standard. ISO 9660 (a data storage standard) is not, and the two have nothing structurally in common.
"Smaller businesses do not need to understand this." The opposite is true. For large organisations, the overhead of separate systems is significant but manageable. For SMEs, understanding the Harmonised Structure is what makes multiple certifications financially and operationally viable at all.
Annex SL and ISO 9001:2026
The ISO 9001:2026 revision, covered in our transition checklist, is itself an example of the Harmonised Structure in action. The three confirmed changes to the standard, including the new climate change requirement in Clause 4.1 and the quality culture requirement in Clause 5.1, are consistent with the direction of travel across the whole standard family. The climate change addition mirrors a similar requirement already present in ISO 14001, reflecting the ISO Technical Management Board's intention to align the standards family around common themes over time.
This is worth noting for SMEs currently planning their transition to ISO 9001:2026. If you are also considering ISO 14001 in the coming years, the groundwork you lay now in addressing the climate change and context requirements for ISO 9001:2026 will transfer directly to your ISO 14001 implementation. The investment compounds.
Where to Start with ISO Certification
If you are new to ISO certification and the Harmonised Structure, the most useful first step is to identify which standards are relevant to your business and in what order it makes sense to pursue them. For most SMEs, ISO 9001 is the natural starting point because it is the most widely recognised, the most commonly required by customers and procurement frameworks, and because its quality management foundations underpin the other standards in the family.
From there, the question of whether and when to add further standards depends on your sector, your customer base, and your regulatory environment. An experienced ISO consultant can help you map that journey and design a management system that is built for integration from day one, rather than retrofitted later at greater cost.
The ISOCentral directory lists consultants across the UK and US who specialise in management system design, implementation, and certification support. Whether you are pursuing your first ISO certificate or building an integrated system across multiple standards, finding the right expertise early will save you significant time and resource.