The useful question is not “Which ISO certificate is popular?” It is “Which management outcome, obligation or material risk requires a controlled system?” ISO publishes thousands of standards, but this article focuses on management system standards that shape leadership, governance and organizational performance.
A management system standard does not replace management. It connects context, policy, objectives, responsibilities, processes, evidence, evaluation and improvement. Certification is optional unless a contract, regulator or market requirement makes it necessary.
Start with the management need
A management system organizes policies, responsibilities and processes to achieve objectives and review results. Link each proposed standard to a clear objective, an accountable person, processes needing improvement and evidence of progress.
Quality, environment and information security are different disciplines. Their systems can share governance, document control, competence, audits, corrective action and management review, but each retains specialist requirements. Selection should follow strategy, stakeholder obligations, material risks and operational dependence—not a desire to collect certificates.
Major standards leadership may consider
The table presents selected management system standards, not a complete list of ISO standards. The ISO 9001 entry and reference were updated on 1 October 2026 using the official ISO website. Before implementation, check the standard’s page, amendments and transition requirements applicable to your certification.
| Standard | System | Management purpose | Certifiable | Important notes |
|---|---|---|---|---|
| ISO 9001:2026 | Quality | Customer requirements, process performance and improvement. | Yes | Published on 16 September 2026, the 2026 edition replaced the 2015 edition. |
| ISO 14001:2026 | Environment | Environmental aspects, obligations, performance and lifecycle thinking. | Yes | The 2026 edition replaced ISO 14001:2015. |
| ISO 45001:2018 | OH&S | Work-related hazards, risks, worker consultation and performance. | Yes | A revised edition is under development. |
| ISO/IEC 27001:2022 | Information security | Confidentiality, integrity and availability through risk-based controls. | Yes | Use the full ISO/IEC designation. |
| ISO/IEC 20000-1:2018 | IT service management | Planning, delivery, assurance and improvement of services. | Yes | Relevant wherever services depend on digital operations. |
| ISO 55001:2024 | Asset management | Value from assets by balancing performance, risk and expenditure. | Yes | Applies across the asset lifecycle. |
| ISO 22301:2019 | Business continuity | Preparedness, response and recovery at acceptable capacity. | Yes | A revision is under development. |
| ISO 50001:2018 | Energy | Energy performance, use, consumption and systematic improvement. | Yes | Especially relevant to energy-intensive operations. |
| ISO 37301:2021 | Compliance | Compliance obligations, culture, controls and performance. | Yes | Broader than anti-bribery alone. |
| ISO 37001:2025 | Anti-bribery | Prevention, detection and response to bribery risk. | Yes | The 2025 edition replaced the 2016 edition. |
| ISO/IEC 42001:2023 | AI | Responsible development, provision and use of AI systems. | Yes | For organizations that develop, provide or use AI. |
Requirements standards and guidance are not the same
The standards in the table contain requirements against which conformity can be assessed. An independent certification body may certify an organization to them. ISO itself does not certify organizations.
Guidance standards—including ISO 31000 for risk management, ISO 26000 for social responsibility and ISO 19011 for auditing—can improve management, but they are not certification standards. A provider should not sell a certificate to a guidance document as accredited ISO management-system certification.
A leadership route to the right standard
Define the outcome
Name the performance problem, obligation, need for independent confirmation of conformity or material risk.
Confirm applicability
Check purpose, requirements, edition, legal context and sector alternatives.
Set a truthful scope
Define sites, activities, services, assets and technologies, and how they connect with departments and suppliers.
Assess the current system
Review existing responsibilities, processes, controls and implementation evidence before adding documents.
Decide on certification
Separate implementation value from the case for third-party certification.
Integrate systems and assign responsibilities
Share controls where sensible, retain specialist depth and hold leadership accountable.
A practical example: how do we choose?
Consider a hypothetical maintenance company receiving repeated complaints about late service and inconsistent quality. It may start by examining ISO 9001 to organize processes and monitor customer requirements. If employees face occupational risks, it should also assess the need for ISO 45001, while addressing urgent hazards and obligations without waiting for certification. If it manages sensitive customer data, it can consider ISO/IEC 27001 based on information risks. Priorities, obligations and resources determine the sequence; the company does not need to implement every standard at once.
One integrated system, not 11 document libraries
ISO management system standards use a harmonized structure that supports integration. This does not make their requirements identical. A sound integrated system creates a shared understanding of the organization, clear responsibilities, scheduled reviews, an approach to assessing risk, linked objectives, audit programme, corrective-action process and management review—while preserving discipline-specific controls and competence.
An organization can combine requirements from several standards in an Integrated Management System (IMS), for example quality under ISO 9001, environment under ISO 14001, and occupational health and safety under ISO 45001. Instead of maintaining separate, duplicate procedures for each standard, it can integrate document control, training, internal audits, corrective action and management review while preserving each standard’s specialist requirements and controls.
This can reduce the cost of preparing and updating documents and save staff time by avoiding repeated evidence collection, meetings and shared procedures. It may also reduce external audit time and cost when several standards are audited together. This depends on actual integration, the scope and complexity of activities, audit-team competence and applicable rules. The certification body determines audit duration and fees, so no fixed or automatic discount should be assumed.
Define the boundary between implementation and certification
An organization may use a requirements standard to improve its management system without seeking a certificate. If certification is required by customers, tenders or governance policy, define the legal entities, locations, products, services and processes included in scope before requesting proposals from certification bodies. A narrow or ambiguous scope can create a technically valid certificate that does not support the claim stakeholders believe it makes.
Implementation support, internal audit and independent certification are different roles. Protect impartiality by confirming who designs the system, who tests it internally and who makes the certification decision. Verify that the certification body is appropriately accredited for the relevant standard and sector, and ensure public statements reproduce the approved scope accurately.
Common executive mistakes
Avoid the following mistakes when choosing and implementing a standard:
Selecting a standard before defining the need and scope.
Treating certification as the outcome instead of system performance.
Copying generic procedures that do not describe real operations.
Assigning the system to one coordinator while leadership remains detached.
Running separate systems with duplicated controls.
Claiming certification to an edition that differs from the actual certificate, or overlooking transition requirements.
Using ISO’s name or logo as though ISO issued the certificate.
Choosing a certification body without checking accreditation and scope.
Frequently asked questions
Can an organization implement more than one standard?
Yes. Integration is efficient when scopes and governance align, but specialist requirements, risks and competence still need explicit treatment.
Does implementation require certification?
No. Certification is a separate third-party conformity assessment.
Which standard should a company start with?
There is no universal first standard. Start with the most material outcome, obligation or risk.
Are ISO 31000 and ISO 26000 certifiable?
No. They are guidance standards, not requirement standards for accredited management-system certification.
Who issues an ISO certificate?
An independent certification body—not ISO. Accreditation provides added assurance of competence for the relevant scope.
Conclusion
Choose a standard based on what the organization needs to organize or improve. Then define the scope, responsibilities and how results will be measured. Integrate shared requirements while preserving specialist controls, and decide separately whether certification is needed. Start by identifying the most important problem or obligation and comparing it with the scope of a suitable standard. Value comes from implementation, monitoring and improvement.