What is a management system?
A management system is the coherent set of policy, objectives, roles, processes and documentation with which an organisation achieves its goals in a planned way, controls its risks and demonstrably improves over time. ISO puts it briefly as the interrelated or interacting elements of an organisation that establish policies and objectives, and the processes to achieve those objectives. A management system is therefore not a software package or a binder of procedures, but the way an organisation steers itself on a theme such as quality, safety, environment, energy or information security.
In an industrial environment, a management system supports, for example, the security policy, an ISMS for information security or a quality management system (QMS) based on ISO 9001.
🧠 How does a management system work?
Almost every management system runs on the Plan-Do-Check-Act (PDCA) cycle and consists of four building blocks:
- Policy and objectives - top management sets out what it wants to achieve, for example zero lost-time injuries, less than 1% scrap or an energy saving of 2% per year.
- Structure and responsibilities - clear roles such as process owner, prevention officer, quality manager or OT security lead, with authority and resources.
- Processes and work instructions - standardised working methods such as the work permit, Lock-out Tag-out, maintenance, inspection and change management.
- Monitoring and improvement - measuring with KPIs, internal audits, incident management, root cause analysis, training and lessons learned, concluded by a management review.
What separates a management system from a loose set of procedures is the feedback loop: deviations lead to corrective actions, and top management periodically adjusts course based on results.
🧱 What is the Harmonized Structure?
Since 2012 ISO has required new and revised management system standards to follow one common clause structure. It was first known as Annex SL or the High Level Structure and since 2021 as the Harmonized Structure. Clauses 1 to 3 are introductory (scope, normative references, terms); the requirements sit in clauses 4 to 10:
| Clause | Subject | PDCA phase | Example in an OT environment |
|---|---|---|---|
| 4 | Context of the organisation | Plan | Scope: which plants, control systems and suppliers are included |
| 5 | Leadership | Plan | Top management signs the policy and appoints an owner for OT risks |
| 6 | Planning | Plan | Determine risks and opportunities, set measurable objectives, plan changes |
| 7 | Support | Do | Competence, awareness, communication, control of documented information |
| 8 | Operation | Do | Operational control: work permits, change management, suppliers |
| 9 | Performance evaluation | Check | KPIs, internal audit, management review |
| 10 | Improvement | Act | Nonconformities, corrective action, continual improvement |
In February 2024 ISO and the IAF amended 31 standards to add a sentence to clause 4.1: the organisation must determine whether climate change is a relevant issue. Thanks to the shared structure, you can combine several standards in a single system.
🔍 What types of management system exist?
| System | Standard (current edition) | Theme |
|---|---|---|
| QMS | ISO 9001:2026 | Quality management |
| ISMS | ISO 27001:2022 | Information security |
| OH&S management system | ISO 45001:2018 | Occupational health and safety |
| Environmental management system | ISO 14001:2026 | Environment |
| Energy management system | ISO 50001:2018 | Energy performance |
| Food safety management system | ISO 22000:2018 | Food safety across the chain |
| Business continuity management system | ISO 22301:2019 | Business continuity |
| Asset management system | ISO 55001:2024 | Value from physical assets |
Alongside these certifiable standards there are guidelines without certification, such as ISO 31000 for risk management. An organisation that combines several standards speaks of an integrated management system: one policy, one audit programme, one management review and one set of procedures for document control and corrective action.
🏭 How is a management system applied in industry?
- Safety - ISO 45001, security policy, risk inventory and evaluation, work permits
- Quality - ISO 9001, QMS, batch control with electronic batch records, GMP in pharma, HACCP in the food industry
- Environment and energy - ISO 14001, energy management via ISO 50001 using data from energy meters and the process control system
- Information security - ISMS, NIST CSF, IEC 62443
- Compliance - audits, FAT and SAT at handover, change management
Typical sectors are manufacturing, chemicals, pharma, food, energy, water and infrastructure. In OT the management system meets the technology: the historian supplies KPI data, the MES records deviations, and a change to a PLC program goes through the same change procedure as a change to the process itself.
🔐 Where does OT security fit in the management system?
Two layers matter for cybersecurity in process automation. The ISMS based on ISO 27001 provides the management framework: policy, risk assessment, audit and management review. IEC 62443-2-1 adds specific requirements for the asset owner’s security programme. The 2024 edition dropped the old CSMS concept and was deliberately designed to work alongside an existing ISMS, without duplicating management system requirements.
In practice this means:
- Include OT in the scope of the ISMS, or define a separate OT domain with its own risk assessment
- Documented procedures for safe working, incident management and change management, including remote access by suppliers
- Awareness and training for operators and technicians, not only for office staff
- Measure maturity with a cybersecurity maturity model so that top management can see progress
A good management system increases the organisation’s resilience to internal and external risks, because security then becomes a cycle rather than a one-off project.
⚖️ Which management systems are legally required?
ISO certification is voluntary, but legislation often does demand a systematic approach:
| Obligation | What is required | Who |
|---|---|---|
| Dutch Working Conditions Act | An up-to-date RI&E with an action plan | Every employer |
| Seveso III (in the Netherlands via the Environment and Planning Act since 2024, previously the Brzo 2015) | Major-accident prevention policy and a safety management system with seven elements | Sites with large quantities of dangerous substances, see Seveso and Cybersecurity |
| EU Energy Efficiency Directive (2023/1791) | Energy management system above an average of 85 TJ per year, energy audit above 10 TJ | Large energy consumers |
| Cybersecurity Act (Dutch Cbw) | Duty of care with risk management and board accountability, in force since 15 August 2026 | Essential and important entities under NIS2 |
| GMP | Pharmaceutical quality system | Medicine manufacturers |
The Dutch Cybersecurity Act does not require an ISO 27001 certificate, but a working ISMS is the simplest way to demonstrate that you meet the duty of care.
🔧 How do you set up a management system?
- Define context and scope - which sites, processes, systems and interested parties are covered.
- Secure leadership - top management adopts the policy, appoints owners and allocates budget.
- Map the risks - reuse existing analyses such as the RI&E, a HAZOP or an OT risk assessment, and set measurable objectives.
- Describe processes - document only what is needed; a separate quality manual has not been mandatory since ISO 9001:2015.
- Implement and train - let the system run for a few months so that evidence builds up.
- Evaluate - carry out an internal audit and a management review, and close out nonconformities.
- Certify (optional) - an accredited certification body audits in two stages (documents first, then practice). A certificate is valid for three years with annual surveillance audits.
A medium-sized manufacturer typically needs six to twelve months to reach its first certification. If you later add a second standard, you can usually reuse much of clauses 4, 5, 7, 9 and 10.
❓ Frequently asked questions
What is the difference between a management system and a standard?
A management system is the way an organisation actually steers itself, with policy, processes and improvement cycles. A standard such as ISO 9001 or ISO 27001 only describes the requirements that such a management system must meet. An organisation can therefore have a management system without being certified.
Is a management system mandatory?
An ISO-certified management system is not a legal requirement in the Netherlands, although customers and public tenders often ask for one. Laws such as the Dutch Working Conditions Act, the Seveso rules and the Dutch Cybersecurity Act do require a systematic approach to risk. A management system is the usual way to demonstrate that you comply.
What is an integrated management system?
An integrated management system combines several standards, such as ISO 9001, ISO 14001 and ISO 45001, into one coherent system. Because these standards follow the same Harmonized Structure, you share the policy, document control, internal audits and management review. This saves effort and prevents conflicting procedures.
Should OT security sit in the ISMS or in a separate management system?
OT security preferably sits within the scope of the existing ISMS, supplemented by the specific requirements of IEC 62443-2-1. A separate management system for OT often leads to duplicated work and conflicting arrangements between IT and OT. OT does deserve its own risk assessment, because availability and safety weigh more heavily there.
What do ISO 9001:2026 and ISO 14001:2026 mean for an existing management system?
ISO 14001:2026 was published in April 2026 and ISO 9001:2026 in September 2026; both revisions are evolutionary and keep the Harmonized Structure. Certified organisations get around three years to transition, for ISO 9001 until 30 September 2029. A gap analysis against the new text is usually the first step.
How long is a management system certificate valid?
A management system certificate is valid for three years. In the intervening years the certification body carries out an annual surveillance audit, followed by recertification after three years. Major nonconformities must be resolved within an agreed period, otherwise the certificate can be suspended.
📌 In summary
A management system brings policy, roles, processes and measurable objectives together in a PDCA cycle. Thanks to the Harmonized Structure, ISO 9001, ISO 14001, ISO 45001, ISO 50001 and ISO 27001 share the same layout and can be combined into one integrated system. In industry the management system increasingly reaches into OT: change management, incident handling and the security requirements of IEC 62443-2-1 and the Dutch Cybersecurity Act all run through the same cycle.
A management system makes safety, quality, environment and information security demonstrable and continuously controlled, and thereby forms the backbone of compliance, continual improvement and risk management in industrial environments.