Why organizations exist, why management systems matter, and how ISO standards help organizations conserve resources.
Why do organizations exist?
Organizations exist because organizing resources is often the most efficient way to conserve them and achieve shared objectives.
Individuals can accomplish many tasks independently. However, complex activities often require people, capital, technology, information, and other resources to work together. Organizations make this coordination possible by bringing resources under a common structure, allowing people to achieve outcomes that would otherwise require greater effort and cost.
Organizations also introduce a fundamental problem. The resources they bring together must be managed by individuals who have different interests, abilities, responsibilities, and access to information. The same structure that makes organizations efficient can therefore become a source of waste, conflict, and inefficiency.
Agency theory helps explain this problem. Principals, such as shareholders and citizens, delegate responsibilities to agents, such as executives, employees, and public servants. These agents may have interests that differ from those of the principals they serve. They may also possess information that principals cannot easily observe or verify.
Modern organizations are making this problem more complex by introducing non-human agents. Artificial intelligence systems can increasingly perform tasks, make recommendations, and execute decisions on behalf of organizations. Although AI agents do not have the same personal interests as humans, their behaviour may still differ from what the organization intended. Their speed and scale also make traditional supervision more difficult.
Organizations must therefore solve a fundamental problem: how to coordinate complex activities across diverse and imperfect human and non-human agents while ensuring that resources are used efficiently and for their intended purposes.
Management systems provide one way to address this problem.
Why management systems exist and their structural pyramid
Management systems establish how an organization directs its activities, assigns responsibilities, manages risks, monitors results, and improves performance.
Organizations have developed management practices for centuries. Policies communicate expectations, procedures establish how work should be performed, records provide evidence, and checklists help people complete activities consistently. Reviews and audits help management determine whether these arrangements are working.
Regardless of the specific domain—whether information security, environmental management, or quality—every formal management system follows the exact same structural hierarchy (or "pyramid"):
- LEVEL 1: POLICIES
(Driven by laws, organizational objectives, customer expectations, and contract requirements)
- LEVEL 2: PROCEDURES
(Define who does what, when, and how for each policy requirement)
- LEVEL 3: WORK INSTRUCTIONS & CHECKLISTS
(Step-by-step guidance and operational guidelines)
- LEVEL 4: FORMS & RECORDS
(Capture execution data, feeding process inputs, reporting, and governance audits to verify policy achievement)
The Anatomy of the Pyramid:
- Policies (Level 1): At the foundation of the system's direction are policies shaped by internal and external drivers—such as statutory laws, organizational objectives, customer expectations, and contractual requirements.
- Procedures (Level 2): Procedures translate policies into operational workflows, clearly defining who does what and when for each policy requirement.
- Work Instructions & Checklists (Level 3): When possible, step-by-step instructions or practical checklists provide frontline staff with granular guidelines on how to execute specific procedures.
- Forms & Records (Level 4): Execution is captured via forms that generate auditable records. These records serve as inputs into downstream processes, drive executive reporting, and provide the governance evidence required to audit whether policies were successfully achieved.
Organizations do not necessarily need a formal standard to establish this hierarchy. A small business may operate effectively through relatively simple arrangements, while a large organization requires more extensive documentation.
However, when each department develops these layers independently without a unified structure, it consumes resources without improving results. Established frameworks provide a common structure that organizations can adopt, adapt, and improve rather than building every process from scratch.
The economic case for management systems is therefore straightforward: the resources required to establish and maintain a management system should be justified by the resources it helps conserve and the risks it helps manage.
The development of management frameworks
Organizations have developed several widely recognized management frameworks to address different aspects of organizational performance.
The International Organization for Standardization (ISO) is one of the most influential institutions in this field. However, ISO is not the only source of management frameworks, and understanding the alternatives helps explain why its approach to management systems is particularly useful.
ISO: International standardization
The International Organization for Standardization was established in 1947 to support international cooperation through common standards. ISO is a non-governmental international organization headquartered in Geneva, Switzerland, with national standards bodies participating in its development and governance.
ISO initially focused heavily on technical standardization. Common specifications for products, materials, and industrial processes helped manufacturers and trading partners reduce incompatibility, duplication, and unnecessary costs.
ISO expanded into organizational management with the ISO 9000 quality management family in 1987. ISO 9001 provided organizations with a common set of quality management requirements that could be independently assessed, allowing customers and suppliers to rely on a recognized international standard.
ISO subsequently developed management system standards covering environmental management, information security, occupational health and safety, energy management, and many other subjects.
Canada participates in ISO through the Standards Council of Canada (SCC), the country's national member of ISO. SCC also accredits eligible conformity assessment bodies, including management system certification bodies, under applicable accreditation requirements.
ISO's contribution extends beyond individual standards. Its most important development for organizations adopting multiple standards is the common structure that allows different management systems to operate together seamlessly.
Baldrige: Organizational performance
The United States established the Malcolm Baldrige National Quality Award through legislation in 1987, responding to concerns about industrial competitiveness and organizational performance. The Baldrige Performance Excellence Program, administered through the National Institute of Standards and Technology (NIST), developed criteria for assessing leadership, strategy, customers, workforce, operations, and organizational results.
COSO: Internal control and governance
Five professional associations established the Committee of Sponsoring Organizations of the Treadway Commission (COSO) in 1985 to address weaknesses in corporate financial reporting and internal control. COSO published its Internal Control Integrated Framework in 1992, establishing a structured approach to control environments, risk assessment, control activities, information and communication, and monitoring.
SOC 2: Assurance over service organizations
The American Institute of Certified Public Accountants (AICPA) developed the SOC reporting framework to support independent assurance over controls at service organizations using the Trust Services Criteria. A SOC 2 engagement produces an independent accountant's attestation report, differing from ISO management system certification, which provides a statement of conformity with specified standard requirements.
Why ISO management systems deserve particular attention
ISO has developed management system standards covering much of what modern organizations need to manage. Organizations can adopt ISO 9001 for quality, ISO 14001 for environmental management, ISO/IEC 27001 for information security, ISO 45001 for occupational health and safety, and ISO 50001 for energy management, alongside standards for artificial intelligence, privacy, business continuity, and compliance.
The range of standards reflects a simple observation: organizations must manage many different responsibilities, but they remain a single organization with shared resources.
ISO management system standards provide a particularly useful approach because many of them follow a common management structure. This common structure allows organizations to address different responsibilities without repeatedly establishing the same management processes.
The Harmonized Structure: A common foundation
ISO introduced a common high-level structure for management system standards through Annex SL in 2012. This approach subsequently evolved into what is known as the Harmonized Structure.
The Harmonized Structure provides common clause headings, core text, terms, and definitions for management system standards that adopt it. Technical committees can add subject-specific requirements while maintaining the common foundation.
The structure uses ten main clauses, with management system requirements generally concentrated in Clauses 4 through 10.
| Clause | Subject | Main purpose |
|---|---|---|
| 1 | Scope | Define what the standard covers |
| 2 | Normative references | Identify applicable referenced documents |
| 3 | Terms and definitions | Establish common terminology |
| 4 | Context | Understand the organization and its interested parties |
| 5 | Leadership | Establish accountability, policies, and responsibilities |
| 6 | Planning | Address risks, opportunities, and objectives |
| 7 | Support | Provide resources, competence, and information |
| 8 | Operation | Plan and control relevant activities |
| 9 | Performance evaluation | Monitor, audit, and review performance |
| 10 | Improvement | Correct problems and improve the system |
The structure follows a familiar management logic. Organizations determine what they intend to achieve, establish the necessary arrangements, perform activities, evaluate results, and make improvements.
The same logic applies whether an organization manages quality, information security, artificial intelligence, or energy consumption. The Harmonized Structure therefore creates an opportunity to integrate management activities that would otherwise be repeated across different departments and standards.
One organization, multiple standards, one integrated management system
An organization may need to satisfy several management system standards because its activities involve different responsibilities. A technology company, for example, may adopt ISO 9001 for quality, ISO/IEC 27001 for information security, ISO/IEC 27701 for privacy, ISO/IEC 42001 for artificial intelligence, and ISO/IEC 20000-1 for IT services.
Each standard addresses a different subject, but the organization remains one legal and operational entity with shared financial resources, leadership, and workforce. Creating five entirely separate management systems introduces unnecessary duplication.
An integrated management system allows the organization to maintain common arrangements for leadership, document control, competence, internal audits, management reviews, and corrective actions.
Each standard still requires specialized activities—such as security risk assessments, privacy impact evaluations, or AI lifecycle controls—but integration allows the organization to manage them through a shared foundation.
The economic benefit is substantial: the organization can expand the range of risks and responsibilities it manages without expanding its management overhead at the same rate.
How similar are the requirements?
The similarities become clearer when comparing six ISO management system standards.
| Management activity | ISO 9001 | ISO 27001 | ISO 27701 | ISO 42001 | ISO 20000-1 | ISO 22301 |
|---|---|---|---|---|---|---|
| Organizational context | Quality | Security | Privacy | AI | IT services | Continuity |
| Leadership & policy | Shared approach | Shared approach | Shared approach | Shared approach | Shared approach | Shared approach |
| Roles & responsibilities | Shared approach | Shared approach | Shared approach | Shared approach | Shared approach | Shared approach |
| Risk management | Quality risks | Security risks | Privacy risks | AI risks | Service risks | Disruption risks |
| Objectives & planning | Quality objectives | Security objectives | Privacy objectives | AI objectives | Service objectives | Continuity objectives |
| Competence & awareness | Common process | Common process | Common process | Common process | Common process | Common process |
| Document control | Common process | Common process | Common process | Common process | Common process | Common process |
| Operational controls | Product/service quality | Security controls | Privacy controls | AI lifecycle & controls | Service delivery | Continuity arrangements |
| Internal audits | Common process | Common process | Common process | Common process | Common process | Common process |
| Management review | Common process | Common process | Common process | Common process | Common process | Common process |
| Corrective action | Common process | Common process | Common process | Common process | Common process | Common process |
| Improvement | Common approach | Common approach | Common approach | Common approach | Common approach | Common approach |
Note: The table illustrates opportunities for integration and does not replace the specific requirements of each standard.
This comparison reveals a crucial insight: managing an organization shares a common core, while managing a particular subject requires specialized controls. Because the core management processes are identical, an organization can maintain a single internal audit process or management review while deploying auditors or reviewers with domain-specific competence.
Practical takeaway: Start with what you already have
Organizations considering ISO management systems should begin by examining how they currently manage their resources, responsibilities, and risks.
Most organizations already have policies, procedures, records, and management practices that can form the foundation of a formal management system. The first opportunity is to identify what already works and where duplication or gaps exist.
A practical starting point is to ask five questions:
- What are we trying to achieve? Identify the organization's objectives, the resources required, and the risks that could prevent success.
- How are we managing these activities today? Review existing policies, procedures, responsibilities, controls, and performance measures.
- Where are we duplicating effort? Identify management activities that different departments perform separately, such as risk assessments, document control, internal audits, and corrective actions.
- Which standards address our actual needs? Select management system standards based on operational risks, legal obligations, customer expectations, and business objectives.
- What can we manage through one system? Establish common management processes wherever practical while maintaining the specialized requirements of each standard.
Organizations that already operate an ISO management system have an additional advantage. They can evaluate new standards against their existing arrangements and determine which requirements are already satisfied, which need adjustment, and which require new capabilities.
Organizations seeking their first certification should also distinguish between implementing a management system and obtaining independent certification. The management system should create value through better coordination, risk management, and resource efficiency. Certification provides independent assurance that specified requirements have been met.
Conclusion
The most important question for leadership is not how many ISO certifications an organization should obtain, but how effectively the organization can use a common management system to lead, manage, coordinate, and mobilize human resources—conserving resources, managing risks, and achieving its objectives to create net-new value and ultimately capture a portion of that value for its principals.