search account download cart
static-aside-menu-toggler

What Is a Management System and How Does It Work?

Management System Defined

A management system is the documented arrangement of policies, processes, records and responsibilities the organisation uses to deliver its objectives consistently. It is the structure of how the business runs, not a separate paperwork exercise on top.

What is a Management System?

A management system is how an organisation runs, written down in a way that can be followed, improved and checked. It covers the policies that set the direction, the procedures that describe how work is done, the records that show it actually was done, and the registers and reviews that keep it all in order. If the organisation stopped describing things in people's heads and put them on paper - that is a management system.

Most organisations have one already, even if they have never called it that. Someone decides how orders are processed. Someone writes a staff handbook. Someone keeps a list of suppliers. Someone decides what to do when a customer complains. A formal management system takes these scattered arrangements and turns them into one consistent, documented way of working that every worker can see, understand and follow.

The point is not paperwork for its own sake. A good management system makes the business easier to run - new staff can pick things up quickly, problems get caught earlier, and the organisation has evidence to show customers, regulators and auditors that it knows what it is doing.

What a Management System Contains

A management system is made up of documented information that describes and controls how the organisation operates. The main components are:

  • A management system manual - an overview document that describes the whole system, what it covers, how it is organised and who is responsible for what. IMS1 is an example of this kind of manual.
  • Policies - short statements of intent signed off by top management. Typical examples include a quality policy, an environmental policy, a health and safety policy, an information security policy and an anti-bribery policy.
  • Procedures - step-by-step descriptions of how particular activities are carried out, such as purchasing, staff induction, management of change or incident reporting.
  • Forms and templates - blank documents for capturing information consistently, like a staff induction form, a supplier appraisal form or a risk assessment template.
  • Registers - live lists that track things on an ongoing basis. A document register, an interested parties register, an opportunities and risks register, a legal register and a business continuity register are common ones.
  • Records - the completed forms and outputs that show the system has actually been used. Training records, audit reports, management review minutes, and completed checklists all fall into this category.

Together these form a controlled body of documentation that describes how the organisation runs, how it meets legal and contractual obligations, and how it manages risk.

Why Have a Management System?

Organisations set up formal management systems for a mix of practical and strategic reasons.

Consistency is the first benefit. When the way things are done is written down, it stops depending on the memory of one or two long-serving staff. New workers can be trained against the same procedures everyone else follows. Mistakes get caught earlier because there are checks built into the process rather than relying on someone noticing.

Legal compliance becomes easier to demonstrate. A management system holds a legal register, assigns responsibility for monitoring legislation, and links legal obligations to the procedures that meet them. If an inspector or auditor wants to know how the organisation complies with a particular law, the answer is in the system rather than in someone's head.

Customer and commercial confidence is another driver. Larger customers, public sector buyers and framework agreements increasingly ask suppliers to hold ISO certification. Having a certified management system opens doors that would otherwise stay shut.

Risk management improves as well. A management system forces the organisation to think about what could go wrong, what controls are in place, and what still needs doing. It gives a structure for reviewing risks regularly rather than only when something has already gone wrong.

And it supports improvement. The system has built-in mechanisms - internal audits, management review, improvement requests, corrective actions - that surface problems and track them to a fix.

Management Systems and ISO Standards

The connection between a management system and ISO standards is sometimes misunderstood. The management system is the organisation's actual way of working. The ISO standard is a framework that sets out what a good management system should include. Certification is the independent confirmation that the system meets that framework.

Each ISO management system standard covers a particular area:

All of these standards share a common structure (Annex SL), which makes them deliberately easy to combine. They all ask for the same core building blocks: understanding the organisation and its context, leadership commitment, planning, resources, operational controls, performance evaluation, and improvement.

An organisation does not need ISO certification to have a management system, and does not need to follow ISO at all. But the ISO standards are a well-tested template that covers most of what a sensible management system should include, so using them as the framework saves reinventing the wheel.

Why Clause-Based Management Systems Are a Bad Idea

Most ready-made ISO toolkits on the market are built around the clause order of the standard. Section 4 for context, section 5 for leadership, section 6 for planning, and so on through to section 10. It looks tidy on the page and it satisfies an auditor who wants to tick each clause off in order. It is also a poor way to run an organisation.

Nobody does Clause 7.5 Documented Information on a Tuesday morning. They write a quote, process an order, handle a complaint, book a training session, investigate a near miss. A clause-based manual forces staff to translate back and forth between the way the standard is written and the way they actually do their jobs. The manual ends up describing how ISO committees structure a standard rather than how the business actually works, which makes it harder to read, harder to train against, and harder to keep current.

Clause-based systems also age badly. When a standard is revised the clauses move, and the manual needs restructuring to match. ISO 9001:2026 is due this year, ISO 45001 follows in 2027, and organisations running clause-based manuals face a rewrite every time a standard is updated. A management system built around how the organisation actually operates does not have that problem. Clauses change, operations do not.

The fix is to structure the management system around the business - leadership, resources, operations, monitoring, improvement - and keep the clause mapping as a separate reference document. When an auditor asks where Clause 8.5.1 is addressed, the correlation table points them straight to the relevant section of the manual. The operational system stays clean. The clause mapping sits alongside, ready when it is needed.

One Integrated System, Not Many

When a company adopts more than one ISO standard, a common mistake is to build a separate management system for each. A quality manual, an environmental manual, a health and safety manual - three different sets of documents, three different sets of audits, three times the paperwork.

The better approach is an Integrated Management System, usually called an IMS. One manual describes how the organisation runs across every standard it follows. Quality, environmental, health and safety, information security, business continuity and anti-bribery all live in the same structure, with one set of interested parties, one risk register, one management review and one internal audit programme.

This is the approach taken by IMS1, the integrated management system manual at the heart of the alphaZ toolkits. Rather than being organised clause by clause against a single ISO standard, IMS1 is organised around how a business actually works - leadership and planning, resources and support, operational processes, monitoring and improvement - with an ISO correlation table that maps each clause of each standard to the relevant section of the manual.

The practical benefit is that the system reflects the business rather than the standard. An auditor can still find every ISO requirement; the organisation's own staff use documents that describe what they actually do. One integrated manual covers ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and ISO 37001, with a Business Continuity Management System and an Anti-Bribery Management System built on top of it using the relevant policies.

Does My Organisation Need a Management System?

Every organisation has a management system of some kind. The real question is whether it is written down, consistent and fit for purpose, or whether it lives in a few people's heads and a scattering of emails.

A formal management system is worth having when any of the following apply: customers or contracts are starting to ask for ISO certification; the organisation is growing and it is getting harder to train new staff the way the business actually runs; there are legal or regulatory obligations that need evidence of compliance; senior management want a clearer picture of risks and performance; or the business is preparing to scale, sell, merge or diversify.

Having a management system does not automatically mean seeking certification. Plenty of organisations use the ISO standards as a framework, build a system that follows them, and never put it forward for a certification audit. Others do seek certification because their customers require it or because the external audit discipline is useful. Either way, the management system itself is the organisation's own - certification just confirms what is already in place.

People hear management system and picture a big pile of paperwork. It is not that. It is how your business actually works, written down in one place so it does not live in the head of Wendy in accounts. The confusion comes from folk trying to write a separate system for every standard. You do not need six systems. You need one system that covers the six things the standards ask about.

My advice, start with the one manual approach from day one. Easier to set up, an awful lot easier to maintain.

Clients often ask me what they legally have to document. The honest answer is that the standards require documented information, and what that looks like in practice depends on the size of the organisation and the complexity of what it does. A small consultancy will have a much thinner system than a manufacturing site with two hundred staff, and both can be fully compliant.

The ISO management system standards share a common structure by design. If you set up a quality management system now and add environmental or health and safety later, the core elements are already in place. You are extending the system, not starting again.

Where I see organisations waste effort is building separate silos. One company, one system.

When I audit a new organisation I look first at whether the management system reflects the way the business actually runs. A manual copied from a template and never adjusted is easy to spot, because the procedures do not match what staff describe when I talk to them. That gap is where non-conformances come from. The other thing I check is whether the integration is real. Some organisations hold separate quality and environmental manuals that duplicate each other and contradict each other in places. One integrated manual with a clear correlation to each standard is simpler to audit and a lot less work for the organisation to maintain.

Practical Compliance Guidance

The IMS1 Manual provides the foundation of an integrated management system, with sections structured around how a business actually operates rather than clause by clause against any one ISO standard. It includes a correlation table that maps each clause of each standard to the relevant section of the manual, so external auditors can find what they need without the organisation reshaping its documentation to suit them.

The alphaZ toolkits bundle the IMS1 Manual together with the policies, procedures, registers and forms needed to build and run a management system. Choosing the right toolkit depends on which standards apply to the organisation.

alphaZ document How to use it
ISO 9001 Management System Toolkit Starting point for a quality management system based on ISO 9001. Includes the IMS1 manual, core policies, procedures and registers needed to build a QMS.
ISO 9001, 14001, 45001 IMS Toolkit For organisations integrating quality, environmental and health and safety in a single system. The most common combination and a good choice for manufacturing and services.
ISO 9001, 14001, 45001, 27001 IMS Toolkit Extends the three-standard IMS to include information security. Suited to organisations handling sensitive client data alongside their main operations.
Full Six-Standard IMS Toolkit Complete integrated toolkit covering quality, environmental, health and safety, information security, anti-bribery and business continuity in one system. Built around the IMS1 manual.
F-IMS20 Document Register Central register of all controlled documents in the management system. Every management system needs one.
F-IMS22 Interested Parties Register Logs the parties that influence or are influenced by the management system - customers, regulators, suppliers, neighbours - and the requirements of each.
F-IMS23 Opportunities and Risks Register Captures the strategic risks and opportunities facing the organisation, with controls and residual risk ratings. Reviewed at least annually during management review.

Note - all the above files can be downloaded with an alphaZ subscription.

Frequently Asked Questions

A formal, documented management system is useful regardless of whether the organisation seeks certification. It gives consistency, helps new staff learn how things work, supports legal compliance, and makes problems easier to spot and fix. Certification is an additional step that provides independent confirmation the system meets an ISO standard, and is mainly driven by customer and commercial requirements rather than being a reason to have the system in the first place.
The ISO standard is a published document that sets out the requirements a good management system should meet. The management system itself is the organisation's own way of working - the policies, procedures, registers and records it uses day to day. The standard is the template; the management system is the real thing.
A clause-based manual is structured around the numbered clauses of the ISO standard - Clause 4 context, Clause 5 leadership, Clause 6 planning, and so on. It looks tidy to an auditor but it does not reflect how the business actually works, which makes it hard for staff to use and hard to train against. It also has to be rewritten every time a standard is updated, because the clauses move. A better approach is to structure the manual around how the organisation operates, then use a correlation table to show auditors where each clause is addressed.
No. The ISO management system standards share a common structure precisely so they can be integrated. Running separate systems for quality, environmental and health and safety duplicates effort, creates inconsistencies between documents, and multiplies the audit workload. An integrated management system uses one manual, one set of registers, one management review and one internal audit programme to cover every standard the organisation follows. IMS1 is built around this approach.
For a small to medium organisation using a toolkit as a starting point, three to six months is a realistic timeframe to go from nothing to a working documented system, including reviewing templates, adapting them to how the business actually operates, training staff and running an initial internal audit. Organisations building from scratch without a template, or aiming for certification across several standards at once, typically take longer.

UK Legislation

No single UK law requires an organisation to have a formal management system, but several pieces of legislation require documented arrangements that a management system is the natural way to provide.

Further Resources

payment logos