Annex SL and the Harmonised Structure of ISO Standards Explained

If you have ever looked at ISO 9001 and ISO 45001 side by side and noticed they seem strangely similar in layout, that is not a coincidence. It is the result of a deliberate design decision that quietly shapes the entire world of ISO management standards. It is called Annex SL, and the common structure it creates, now known as the harmonised structure, is one of the most useful things to understand if you hold or plan to hold more than one ISO certification. This guide explains what it is, why it exists, and why it saves businesses a great deal of effort.

In short: Annex SL is the framework that gives all modern ISO management system standards the same high level structure, the same core clauses, and much of the same wording and terminology. It means ISO 9001, ISO 14001, ISO 45001, ISO 27001 and the others share a common skeleton, which is exactly why they can be combined into a single integrated system so efficiently.

What Annex SL is

Annex SL is a part of the directives that ISO's own committees follow when they write management system standards. It specifies a common high level structure, identical core text and common terms and definitions that every new or revised management system standard must adopt. The structure it defines is now commonly called the harmonised structure, having previously been known as the high level structure. The practical effect is that the standards are built from a shared template rather than each being designed from scratch.

Before this harmonisation, different ISO standards had different layouts, different terminology and different ways of expressing similar requirements, which made holding several of them genuinely painful. A business with quality, environmental and safety certifications effectively ran three differently shaped systems. Annex SL was introduced to end that, and it has reshaped the standards as they have been revised.

The shared clauses 4 to 10

Every modern ISO management system standard follows the same numbered structure. Clauses 1 to 3 cover scope, references and terms. The substance lives in clauses 4 to 10, which are the same across the standards:

• Clause 4, Context of the organisation, understanding your organisation, its interested parties and the scope of the system.
• Clause 5, Leadership, top management commitment, policy and responsibilities.
• Clause 6, Planning, addressing risks and opportunities and setting objectives.
• Clause 7, Support, resources, competence, awareness, communication and documented information.
• Clause 8, Operation, the actual doing of the work the standard governs.
• Clause 9, Performance evaluation, monitoring, internal audit and management review.
• Clause 10, Improvement, handling nonconformities and improving over time.

Whether the subject is quality, environment, safety, information security or business continuity, this skeleton is the same. Each standard then adds its own discipline specific requirements within that structure, ISO 45001 adds hazard and risk control, ISO 27001 adds information security risk and controls, and so on, but the frame is shared.

Why the harmonised structure runs on Plan, Do, Check, Act

The clause structure maps neatly onto the Plan, Do, Check, Act cycle that underpins continual improvement. Leadership and planning are the Plan, support and operation are the Do, performance evaluation is the Check, and improvement is the Act. This shared logic is part of why the standards feel coherent once you understand one of them: learn the rhythm once, and every other management system standard becomes far more readable.

Why this matters for your business

The harmonised structure is not just an academic tidiness. It delivers real, practical benefits to any organisation that holds or wants more than one certification:

• Integration becomes easy. Because the standards share context, leadership, support, evaluation and improvement, you can write those parts once and use them across all your systems.
• One system instead of several. Your people work from a single coherent management system rather than separate, differently shaped manuals for quality, safety and environment.
• Combined audits. Certification bodies can audit your integrated system across multiple standards together, reducing cost and disruption.
• Easier to learn. Staff who understand the structure of one standard can navigate the others quickly.
• Smoother revisions. When standards are revised, the shared structure keeps changes predictable and manageable.

Where it shows up in practice

The clearest example is the common trio of ISO 9001, ISO 14001 and ISO 45001 held by construction, manufacturing and many service businesses. Thanks to Annex SL, these three are routinely run as a single integrated management system rather than three separate ones. The same applies when adding information security, business continuity or other standards: the shared structure is what makes building on what you already have efficient rather than starting again each time.

It is worth noting one deliberate exception. ISO 13485, the medical device quality standard, intentionally does not follow the harmonised structure, retaining its own layout tailored to the heavily regulated medical device sector. That is the exception that proves the rule, and a reminder to check the structure of any standard before assuming it slots straight into an existing system.

How ISO Accreditation can help

We help Australian businesses take full advantage of the harmonised structure, building integrated management systems that combine the standards you need into one coherent system rather than several. That means less documentation, less duplication, combined audits and a system your people can actually navigate. Book a free consultation to discuss which standards you need and how best to integrate them.

Book a free consultation → isoaccreditation.com.au/contact-us

Call 1800 577 060 · info@isoaccreditation.com.au