Integrated Management Systems and Sector Standards

Introduction and Context

Organizations increasingly operate within several management-system expectations at once. A manufacturer may need to demonstrate product quality, environmental responsibility, worker safety, information security, regulatory compliance, and customer-specific performance. Treating each requirement as a completely separate system can produce duplicated procedures, conflicting objectives, excessive audits, and fragmented decision-making. An integrated management system (IMS) seeks to coordinate these requirements through a coherent governance and process architecture.

Integration, however, does not mean reducing every discipline to a generic checklist. Quality, environmental management, occupational health and safety, and information security address different risks, interested parties, controls, competencies, and legal duties. The central professional challenge is therefore to integrate common management-system elements while preserving discipline-specific rigor.

ISO’s harmonized structure—commonly called the harmonized structure (HS)—provides a common high-level architecture for many ISO management-system standards. ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001 use closely related clauses concerning context, leadership, planning, support, operation, performance evaluation, and improvement. Sector standards such as ISO 13485, IATF 16949 and AS9100 add requirements reflecting the risks and regulatory expectations of medical devices, automotive products, and aerospace operations.

This chapter explains how organizations can design, implement, and audit an IMS without weakening specialist requirements.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Explain the purpose and logic of ISO’s harmonized structure.
2. Distinguish integration from simple document consolidation.
3. Map common and discipline-specific requirements across ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 27001.
4. Describe the characteristics of ISO 13485, IATF 16949 and AS9100.
5. Design an integrated audit programme using risk, process, and compliance perspectives.
6. Evaluate the governance, competence, data, and ethical issues involved in IMS implementation.
7. Identify circumstances in which separate specialist audits remain necessary.

1. The Logic of Integrated Management Systems

1.1 What is an IMS?

An integrated management system is a coordinated set of policies, processes, responsibilities, resources, and performance controls used to manage two or more organizational disciplines through a unified governance framework. The system may include quality, environment, occupational health and safety, energy, business continuity, information security, or other domains.

Integration can occur at several levels:

Integration is not necessarily total. An organization may integrate leadership review and internal audit while retaining separate operational procedures for hazardous work, sterilization validation, or access-control administration.

1.2 Benefits and risks

Potential benefits include reduced duplication, clearer accountability, more consistent risk treatment, improved management visibility, and better use of audit resources. Integrated objectives can also reveal interactions—for example, a process change that improves productivity but increases environmental emissions or cybersecurity exposure.

Risks include superficial cross-referencing, over-generalized procedures, unclear ownership, inadequate specialist competence, and the mistaken belief that one audit team can assess every technical requirement. Integration becomes harmful when common documentation hides missing controls. A concise system is valuable; an incomplete system is not.

2. ISO’s Harmonized Structure

2.1 Common architecture

The harmonized structure organizes management-system requirements into a familiar sequence:

The structure supports alignment but does not make standards identical. Each standard adds its own definitions, scope, risk logic, controls, and mandatory requirements.

2.2 Process approach and risk-based thinking

The process approach views the organization as a system of interrelated activities that transform inputs into outputs. A process is normally described through its purpose, inputs, activities, outputs, resources, responsibilities, controls, measures, and interactions.

Risk-based thinking requires the organization to consider uncertainty that may prevent intended results or create undesirable effects. The method need not always be a numerical risk matrix. A documented qualitative assessment may be appropriate where consequences are difficult to quantify, provided the criteria and decisions are consistent.

A commonly used risk-priority calculation is:

where RPN is the risk priority number, S is a numerical severity rating, O is occurrence or likelihood rating, and D is detectability rating. This product is a management aid, not a universal ISO requirement. It is valid only when the rating scales are defined, applied consistently, and interpreted with care. A low product can conceal a catastrophic event if severity is insufficiently weighted; therefore, high-severity risks may require action regardless of RPN.

2.3 Commonality and difference

The HS creates common vocabulary and clause relationships, but integration requires a requirements matrix. Such a matrix should identify:

• the source standard and clause;
• the process or organizational owner;
• the applicable legal, regulatory, or contractual obligation;
• the required control and evidence;
• the audit method and competence needed;
• the consequences of failure.

For example, competence is relevant to every standard, but the evidence differs. ISO 9001 may emphasize product and process competence; ISO 45001 requires competence for work affecting occupational health and safety; ISO/IEC 27001 requires competence for information-security responsibilities. One generic training record may be shared, but it must demonstrate the specific competence required by each discipline.

3. Integrating Major Management-System Standards

3.1 ISO 9001: Quality management

ISO 9001 focuses on the consistent provision of products and services that meet customer and applicable statutory or regulatory requirements, together with enhancement of customer satisfaction. Its central concepts include the process approach, customer focus, leadership, evidence-based decision-making, control of externally provided processes, operational planning, nonconformity control, and improvement.

Within an IMS, quality commonly provides the core process architecture because most other controls operate through organizational processes. This does not mean that quality dominates all other disciplines. Rather, the quality process map can become a platform into which environmental, safety, security, and sector controls are embedded.

3.2 ISO 14001: Environmental management

ISO 14001 addresses environmental aspects, impacts, compliance obligations, operational control, emergency preparedness, and improvement of environmental performance. A significant environmental aspect is determined by the organization’s criteria; it is not automatically identical to the greatest business risk.

Integration opportunities include:

• incorporating environmental aspects into process design and change management;
• adding lifecycle and supplier considerations to purchasing;
• combining environmental objectives with operational performance indicators;
• auditing waste, emissions, resource use, and emergency controls within relevant processes.

Environmental compliance must not be reduced to a general statement that the organization “cares about the environment.” Evidence may include permits, monitoring results, waste-transfer records, chemical inventories, emergency tests, and evaluation of compliance obligations.

3.3 ISO 45001: Occupational health and safety

ISO 45001 emphasizes the prevention of work-related injury and ill health, hazard identification, assessment of OH&S risks and opportunities, worker consultation and participation, legal requirements, operational controls, emergency preparedness, and incident investigation.

Its distinctive feature is the importance of worker participation. An integrated system that is designed only by managers and auditors may fail to identify practical hazards. Consultation must be meaningful, accessible, and free from retaliation. Safety controls must also follow the hierarchy of controls: elimination, substitution, engineering controls, administrative controls, and personal protective equipment, recognizing that PPE is generally the least reliable layer when used alone.

A shared corrective-action process can handle quality complaints, environmental incidents, safety incidents, and security events. Nevertheless, the investigation method must preserve the characteristics of each event. A near miss involving a machine guard cannot be managed as if it were merely a customer complaint.

3.4 ISO/IEC 27001: Information-security management

ISO/IEC 27001 establishes requirements for an information-security management system (ISMS). It is concerned with preserving confidentiality, integrity, and availability of information through a risk-management process and a defined applicability statement for selected controls.

Integration with quality and other systems may include:

• access control within competence and authorization processes;
• information classification within documented-information control;
• incident management linked to corrective action;
• supplier security integrated into purchasing and outsourced-process controls;
• business continuity and backup requirements included in operational planning.

Information security differs from ordinary document control. A document may be accurate and current yet still be exposed to unauthorized access. Auditors must therefore consider identity management, privileged access, logging, vulnerability management, encryption where justified, backup restoration, and secure change practices. The applicable controls depend on the organization’s risk assessment and stated scope.

4. Sector-Specific Standards

Generic management-system standards establish broad requirements, whereas sector standards translate those principles into high-risk technical and regulatory environments.

4.1 ISO 13485: Medical devices

ISO 13485 is designed for organizations involved in the life cycle of medical devices. It places strong emphasis on regulatory requirements, risk management, product realization, traceability, validation of processes, control of sterile or special processes where applicable, complaint handling, and post-market feedback.

A key lesson for auditors is that product safety and regulatory conformity cannot be treated as ordinary commercial quality characteristics. Design changes, supplier changes, software changes, and process deviations may require documented evaluation of regulatory and safety consequences. The organization must understand the jurisdictions and device classifications relevant to its activities.

4.2 IATF 16949: Automotive quality

IATF 16949 builds on ISO 9001 and addresses automotive supply-chain expectations. It is associated with customer-specific requirements, defect prevention, product safety, contingency planning, manufacturing process controls, problem-solving, warranty considerations, and the use of automotive core tools.

Important tools commonly associated with automotive quality include advanced product quality planning, production part approval processes, failure mode and effects analysis, statistical process control, and measurement-system analysis. These tools are not interchangeable. For example, a process capability study, a measurement-system study, and a design-risk analysis answer different questions.

4.3 AS9100: Aerospace quality

AS9100 builds on ISO 9001 for aviation, space, and defense organizations. It emphasizes product safety, operational risk, configuration management, counterfeit-part prevention, special processes, supplier control, production planning, and management of nonconforming outputs. Traceability and objective evidence are particularly important where failures can have severe safety or mission consequences.

Aerospace auditors must understand the relationship between configuration status, design data, production records, inspection results, and authorized changes. A technically acceptable product manufactured against an obsolete configuration may still represent a serious nonconformity.

4.4 Comparison of sector emphasis

Sector standards should be treated as additional requirements, not as optional examples. Where a sector requirement is more specific than a generic requirement, the specific requirement governs the relevant activity.

5. Designing an Integrated Management System

5.1 Establish scope and governance

The organization should define sites, products, services, processes, boundaries, outsourced activities, and exclusions. Scope statements must not be written to conceal activities that create significant risk. Governance should identify an executive sponsor, system owners, process owners, specialist advisers, and escalation routes.

A useful governance model distinguishes three responsibilities:

1. Process ownership: accountability for process performance.
2. Subject-matter authority: technical interpretation of quality, environmental, safety, security, or sector requirements.
3. Independent assurance: audit and evaluation of conformity and effectiveness.

One person may hold more than one role in a small organization, but independence and competence risks must be addressed.

5.2 Build a requirements and risk architecture

Begin with a legal, regulatory, contractual, customer, and standards register. Map obligations to processes and controls. Then identify interactions among risks. For instance, introducing cloud-based production monitoring may create quality benefits while introducing data-protection and availability risks.

Risk evaluation should consider likelihood, consequence, existing controls, residual risk, and required treatment. For safety, medical-device, aerospace, and critical information risks, a purely numerical score should not replace expert judgment or mandatory controls.

5.3 Align objectives and indicators

Objectives should be measurable where practicable, monitored, communicated, and reviewed. A balanced IMS dashboard might include:

• customer complaints and first-pass yield;
• significant environmental aspects and waste intensity;
• injury rates, near misses, and corrective-action closure;
• security incidents, patching performance, and restoration-test results;
• sector indicators such as traceability performance or process capability.

Indicators require clear definitions. For example, a closure rate can be expressed as:

The formula is meaningful only when the numerator and denominator use the same reporting period and action definition. A high closure rate can still be misleading if actions are repeatedly extended or weakly verified.

5.4 Integrate documentation without creating ambiguity

Shared procedures are appropriate for document control, competence, internal audit, corrective action, management review, purchasing, and change management. Specialist instructions should remain separate where technical precision is required—for example, lockout/tagout, sterilization validation, cryptographic key management, or aerospace configuration control.

A document hierarchy may contain:

• integrated policy and objectives;
• process maps and process criteria;
• discipline-specific procedures;
• work instructions and technical specifications;
• records and objective evidence.

The test is not whether there are fewer documents. The test is whether users can identify the correct requirement at the point of work.

6. Integrated Audit Design

6.1 Audit principles

An integrated audit examines related requirements across one or more processes during a coordinated audit. It should be planned using risk, process importance, previous performance, changes, complaints, incidents, regulatory sensitivity, and certification scope.

The audit team must collectively possess competence in the standards and technical activities being assessed. A lead auditor may coordinate the audit without personally being competent to judge every specialist control. Technical experts can support the team, but their roles and independence should be defined.

6.2 Process-based audit method

A practical sequence is:

1. Define the audit objective, criteria, scope, sites, processes, and sampling plan.
2. Review risks, previous findings, changes, incidents, complaints, and performance data.
3. Build a requirements-to-process matrix.
4. Interview process owners and workers; observe activities; sample records and outputs.
5. Test controls against both generic and discipline-specific criteria.
6. Evaluate conformity, effectiveness, and risk significance.
7. Record evidence-based findings with precise criteria and affected processes.
8. Agree correction, root-cause analysis, action, ownership, and due dates.
9. Verify implementation and effectiveness independently of the original assumption.

Auditors should follow a transaction or product through the process. In a manufacturing example, this may include contract review, design or specification control, purchasing, incoming inspection, production, software or access control, environmental controls, worker safety, final release, and complaint feedback.

6.3 Audit evidence and sampling

Audit conclusions are based on sampled evidence, not complete inspection of every transaction. Sampling should be sufficient to support a reasonable conclusion and should reflect risk, variation, shifts, locations, suppliers, and unusual events. Convenience sampling alone is weak because it may select only well-controlled examples.

The auditor should distinguish:

• conformity: a requirement is fulfilled;
• nonconformity: a requirement is not fulfilled;
• observation or opportunity: an issue that may merit attention but does not establish failure of a criterion;
• effectiveness: the control achieves its intended result.

A procedure existing on paper is not evidence of effective implementation. Conversely, an isolated human error is not automatically evidence of system failure; the auditor must evaluate recurrence, control design, supervision, competence, and consequences.

6.4 Maintaining discipline-specific rigor

Integrated audits must include “stop points” for specialist review. Examples include:

• environmental compliance obligations and significant aspects;
• worker consultation, hazard controls, and legal safety requirements;
• information-security access rights, logs, vulnerabilities, and incident response;
• medical-device validation, traceability, and post-market controls;
• automotive customer-specific requirements and product-safety controls;
• aerospace configuration, counterfeit-part, and special-process controls.

These areas should not disappear into a generic question such as “Are operational controls effective?” The audit checklist may be integrated, but the evidence criteria must remain explicit.

7. Applied Case: Illustrative Integrated Audit in a Medical-Device Manufacturer

Background

The following is an illustrative case. MedTech Components Ltd. manufactures electronic modules used in diagnostic equipment. It operates a quality system based on ISO 13485, maintains environmental controls aligned with ISO 14001, uses occupational safety controls aligned with ISO 45001, and operates an information-security system aligned with ISO/IEC 27001. It has recently introduced a cloud-based manufacturing execution system.

Problem

Management planned one combined audit to reduce disruption. Previous audits had been document-heavy and had not examined whether access rights, supplier changes, chemical controls, and device traceability interacted effectively. A production engineer had also transferred to another department without timely removal of privileged system access.

Analysis

The audit team mapped the product-realization process from supplier approval to final release. Four risk connections were identified:

1. A supplier change could affect device conformity and require regulatory evaluation.
2. Cloud-system access could affect electronic production records and traceability.
3. Chemical handling could affect worker safety and environmental compliance.
4. A production deviation could require both product-risk assessment and information-system record preservation.

The team included a lead auditor, a medical-device regulatory specialist, an information-security specialist, and an OH&S/environmental specialist.

Approach and findings

The team sampled supplier-change records, reviewed authorization logs, observed chemical handling, traced one production batch, interviewed operators, and examined complaint and deviation records. It found that:

• the batch traceability process was effective;
• supplier changes were reviewed for quality impact but not consistently for regulatory impact;
• privileged access was removed after an average delay of several days;
• chemical labels and storage were generally compliant, but one emergency drill did not include the night shift;
• corrective actions were tracked centrally, but effectiveness verification was inconsistent.

The findings were not merged into one vague “integration issue.” They were classified against their appropriate criteria. The supplier-change weakness was treated as a medical-device change-control issue; the access weakness as an information-security control issue; and the emergency-drill weakness as an OH&S/environmental preparedness issue.

Solution and outcome

Management introduced a single change-request workflow with mandatory impact prompts for product conformity, regulatory status, environmental aspects, safety hazards, information security, and business continuity. It also established role-based access removal triggered by the human-resources termination or transfer event, and scheduled emergency drills across all shifts.

After implementation, an effectiveness audit confirmed that sampled changes contained cross-disciplinary assessments, access removal occurred within the defined service level, and all shifts participated in drills. The integrated system reduced duplicated meetings while preserving specialist evidence.

Learning points

The case demonstrates that integration is strongest at interfaces. The greatest risks often arise when a change, supplier, record, or incident crosses disciplinary boundaries. It also demonstrates why findings should retain their original technical identity, even when managed through a common corrective-action process.

8. Governance, Ethics, and Contemporary Developments

IMS governance involves more than certification. Senior managers remain responsible for ensuring that quality, safety, environmental, security, and regulatory risks are not concealed by performance targets. Ethical concerns arise when organizations manipulate indicators, suppress near misses, delay reporting, or treat certification as proof that all products and operations are safe.

Digital systems and artificial intelligence can support integrated auditing by identifying duplicate findings, detecting overdue actions, analyzing incident trends, and suggesting process relationships. However, AI outputs require human validation. Risks include biased training data, incorrect classification, leakage of confidential information, automation bias, and inadequate explanation of recommendations. Sensitive audit records should be protected through access controls, data minimization, retention rules, and approved tools.

Contemporary IMS practice is also shaped by supply-chain complexity, climate-related risks, remote work, cloud services, product cybersecurity, and increasing expectations for demonstrable due diligence. Organizations should monitor revisions to standards, certification-body rules, legal obligations, and customer-specific requirements. A management system is not static; changes in technology, regulation, climate exposure, and organizational structure may require a renewed context and risk evaluation.

9. Challenges and Limitations

Common implementation challenges include:

• treating integration as document reduction rather than control integration;
• assigning system ownership without process accountability;
• using one generic risk matrix for fundamentally different risks;
• auditing clauses without observing work;
• relying on auditors who lack sector competence;
• failing to include contractors, suppliers, and outsourced processes;
• allowing conflicting objectives, such as output pressure overriding safety;
• measuring activity rather than effectiveness;
• overlooking local legal and customer-specific requirements.

Certification provides external assurance against specified criteria and scope; it does not guarantee perfect performance, legal compliance in every circumstance, or the absence of incidents. Internal audit, management review, regulatory oversight, worker participation, customer feedback, and operational learning remain necessary.

Best-Practice Checklist

An advanced practitioner should ensure that the organization:

1. Defines an honest, operationally meaningful scope.
2. Maps standards and obligations to processes and owners.
3. Maintains specialist competence and independent assurance.
4. Integrates objectives without hiding conflicting risks.
5. Uses shared procedures only where they remain clear and effective.
6. Retains explicit controls for safety, regulatory, security, and sector requirements.
7. Plans audits according to risk, change, performance, and process interaction.
8. Samples actual work and objective evidence, not documents alone.
9. Verifies corrective-action effectiveness.
10. Reviews the IMS when technology, suppliers, regulations, or organizational conditions change.

Chapter Summary

An integrated management system coordinates multiple management disciplines through shared governance, processes, information, and assurance. ISO’s harmonized structure provides a common architecture, but it does not make ISO 9001, ISO 14001, ISO 45001, ISO/IEC 27001, or sector standards interchangeable. Integration should combine common requirements such as leadership, competence, documented information, risk, audit, and improvement while preserving specialist controls.

ISO 13485 emphasizes medical-device regulatory conformity and product safety; IATF 16949 emphasizes automotive customer requirements, defect prevention, and product safety; AS9100 emphasizes aerospace configuration, operational risk, traceability, and counterfeit-part prevention. Integrated audits should be process-based and risk-informed, use competent teams, and retain clear discipline-specific criteria. The most valuable audit evidence often appears at interfaces such as change management, supplier control, access management, traceability, incident response, and emergency preparedness.

Effective IMS governance requires ethical reporting, meaningful worker participation, reliable data, and continual adaptation. Integration is successful only when it improves control and decision-making without diluting technical or regulatory discipline.

Key Terms

Integrated management system: A coordinated system used to manage two or more organizational disciplines.

Harmonized structure: ISO’s common high-level framework for many management-system standards.

Process approach: Managing activities as interrelated processes that transform inputs into outputs.

Risk-based thinking: Considering uncertainty and its possible effects on intended results.

Interested party: A person or organization that can affect, be affected by, or perceive itself affected by a decision or activity.

Documented information: Information required to be controlled and maintained by a management system.

Management-system scope: The organizational and operational boundaries to which a system applies.

Compliance obligation: A legal, regulatory, contractual, or other requirement the organization must or chooses to meet.

Environmental aspect: An element of an organization’s activities, products, or services that interacts or can interact with the environment.

OH&S hazard: A source or situation with potential to cause work-related injury or ill health.

Information-security risk: The effect of uncertainty on confidentiality, integrity, or availability of information.

Sector standard: A standard that adds industry-specific requirements to general management-system principles.

Customer-specific requirement: A requirement specified by a customer or adopted by an organization to meet customer expectations.

Configuration management: Control of product identity, requirements, characteristics, and authorized changes.

Special process: A process whose output cannot be fully verified by subsequent inspection or measurement alone.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Effectiveness: The extent to which planned activities are realized and intended results achieved.

Technical expert: A person providing specialized knowledge to an audit team.

Objective evidence: Verifiable information supporting an audit conclusion.

Review Questions

Short Answer Questions

1. What is an integrated management system?
2. Why does the harmonized structure support, but not guarantee, integration?
3. State two distinctive emphases of ISO 45001.
4. What is the purpose of an information-security applicability statement?
5. Why should sector-specific audit findings retain their technical identity?

Long Answer Questions

1. Explain how ISO 9001, ISO 14001, ISO 45001, and ISO/IEC 27001 can be integrated through a process-based management architecture.
2. Compare ISO 13485, IATF 16949, and AS9100 in terms of risk, regulatory, and customer expectations.
3. Describe a complete method for planning and conducting an integrated internal audit.
4. Discuss the benefits and risks of using shared procedures and records in an IMS.
5. Explain how leadership, worker participation, competence, and independent assurance influence IMS effectiveness.

Analytical / Application Questions

1. An organization has a single corrective-action database but separate quality, safety, environmental, and security teams. Design a governance and audit arrangement that improves integration without removing specialist accountability.
2. A cloud-based production system is introduced in an aerospace supplier. Identify the quality, configuration, information-security, safety, supplier, and business-continuity issues that should be assessed before implementation.
3. A medical-device manufacturer experiences a supplier change, delayed access removal, and an emergency-drill failure. Classify the issues, identify the relevant standards, and propose an integrated corrective-action and effectiveness-verification plan.

Multiple Choice Questions with Answers

Question 1

What is the principal purpose of ISO’s harmonized structure?

A. To make all ISO standards technically identical

B. To provide a common high-level architecture for management-system standards

C. To eliminate the need for specialist auditors

D. To replace sector-specific requirements

Correct Answer: B. To provide a common high-level architecture for management-system standards

Question 2

Which standard places particular emphasis on worker consultation and participation?

A. ISO 45001

B. ISO 13485

C. AS9100

D. IATF 16949

Correct Answer: A. ISO 45001

Question 3

Which characteristic is most closely associated with ISO/IEC 27001?

A. Sterilization validation

B. Automotive core tools

C. Confidentiality, integrity, and availability of information

D. Aerospace counterfeit-part prevention

Correct Answer: C. Confidentiality, integrity, and availability of information

Question 4

Which standard is specifically focused on medical-device organizations and regulatory conformity?

A. ISO 14001

B. ISO 13485

C. IATF 16949

D. ISO 45001

Correct Answer: B. ISO 13485

Question 5

Why should a generic risk-priority number not be used as the sole basis for safety decisions?

A. It cannot be calculated numerically

B. It may conceal high-severity risks through an inappropriate scoring product

C. It is required only for environmental risks

D. It eliminates the need for legal compliance

Correct Answer: B. It may conceal high-severity risks through an inappropriate scoring product

Question 6

An integrated audit should primarily be organized around what structure?

A. The alphabetical order of standards

B. The organization’s processes and their risks

C. The personal preferences of the lead auditor

D. Only the clauses with previous nonconformities

Correct Answer: B. The organization’s processes and their risks

Question 7

Which is a distinctive concern of AS9100?

A. Configuration management and product safety

B. Worker consultation as its only control

C. Environmental-aspect identification only

D. Medical-device post-market surveillance only

Correct Answer: A. Configuration management and product safety

Question 8

Using the formula Closure rate (%) = (actions closed by due date ÷ actions due) × 100, what is the closure rate when 45 of 50 actions due were closed on time?

A. 45%

B. 50%

C. 90%

D. 95%

Correct Answer: C. 90%

Question 9

What is the best reason for retaining separate specialist procedures within an IMS?

A. To increase document volume regardless of need

B. To preserve technical precision where generic procedures could obscure critical controls

C. To prevent management review

D. To avoid process mapping

Correct Answer: B. To preserve technical precision where generic procedures could obscure critical controls

Question 10

Which audit evidence most directly demonstrates effective access-control management?

A. A general information-security policy

B. An unsigned training presentation

C. Verified authorization and timely removal of privileged access

D. A list of department names

Correct Answer: C. Verified authorization and timely removal of privileged access