ISO Management System Project Considerations

Motivation for a Management System

It’s not uncommon (and often an operational reality), that management systems are developed in order to meet customer requirements (such as for tendering).

This can be a motivation in order to remove barriers to market entry, or simply to win new work.

Other reasons can include:

• Need to standardise practices across siloed functional areas of the business.
• Improve regulatory compliance, and reduce the costs of non-compliance or poor performance.
• Support planned organisational growth, where it has been recognised that the status quo won’t work as the organisation grows and becomes more complex.

Which ISO Standards to include in the management system

There may be a desire to develop an integrated management system that meets the requirements of multiple standards (e.g. Quality – ISO 9001, and  Occupational Health and Safety – ISO 45001).

A management system built to meet the requirements of multiple standards will require more work to develop, involve higher internal and indirect costs, higher certification costs and more auditing (internal and external).

This may work for some organisations where resources are available, though other organisations may lack the internal resources and budgeting capabilities.

For these organisations, it may be better to start with a management system targeting a smaller number of ISO standards, and integrating further standards as the management system matures.

Scope of the Management System

When developing a management system, its scope and boundaries need to be clearly defined – ISO also requires the management system scope to be documented.

This should take into account:

• Organisational structure, operational complexity, and the degree to which operations and decision-making are centralised or decentralised.
• The geographical locations to be included, as this will impact processes, products, and services covered by the management system, and relevant regulatory obligations.
• Stakeholders and interested parties (internal and external).
• Issues, risks and opportunities that the management system is to address.

There’s more that could be added to this list, but this will get you started.

Responsibilities and Accountabilities

The clear definition and delineation of role-specific responsibilities and accountabilities ensures that the management system will be effective, meet compliance obligations, and mature over time.

Organisational leadership will need to understand their responsibilities towards:

• Leadership commitment and involvement.
• Legal and regulatory compliance.
• Ensuring that people across the organisation understand their contributions to the success of the management system.
• Assigning ‘process owners’, who will need to be held accountable their successful implementation, including how to address nonconformity.
• Identifying and capturing risks and opportunities within their areas of operations and controls.
• Ensuring that people are provided with sufficient training in order to carry out their expected duties.

Again, there’s more that could be included here, such as responsibilities relating to documentation and information management, internal audit, and management system performance evaluation.

Management System development and certification timeline

The timeline for the development, implementation and certification of an ISO-based management system will need to consider requirements for:

• Initial current-state / gap assessment.
• Development of an implementation plan, assignment of responsibilities, and resource allocation.
• Development of processes and supporting documentation.
• Training people on ISO requirements, and their responsibilities for the management system.
• Time for the management system to be implemented before initial audits.
• Internal audits, which are to be carried out before the certification audits.
• Management Review of the management system by top leadership.
• Certification Body audits (Stage 1 and Stage 2 audits), culminating in ISO certification.
• Post-certification activities, which may include addressing any issues raised by the Certification Body.

The time required for each of these will vary for each organisation, and will be impacted by other issues in this table.

Documentation and Information Management

Management systems rely on the issue, capture and control of documents, data and other records.

The organisation will need to ensure that information is accurate, accessible, and effectively controlled to support operational activities, consistency, governance and compliance.

This will include:

• Control of formally issued policies, manuals, processes and forms.
• Capture of information collected on forms (paper or electronic).
• Maintaining registers of useful information (e.g. incidents, asset maintenance, training matrix).
• Use of software applications to automate workflows, and capture operational data.
• External documents and information required by the organisation.

DBell Consulting works extensively with the Ideagen EHS team to bring together high-quality consulting and software solutions for ISO-based management systems. Read more about our tailored solutions.

Choice of Certification Assessment Body

For organisations seeking ISO certification, choosing the right Certification Assessment Body (CAB) for an ISO management system is critical to ensuring a smooth certification process.

The below should be considered when making a decision, as the CAB will essentially become a significant partner of the organisation to support management system maturity:

• Ensure the CAB is accredited by a national or international accreditation body, such as JAS-ANZ (Joint Accreditation System of Australia and New Zealand) or UKAS (United Kingdom Accreditation Service).
• Verify that the CAB is accredited for the specific ISO standard (e.g., ISO 9001, ISO 14001, ISO 45001) and industry sector relevant to your organisation.
• Choose a CAB with offices or auditors available in your region to minimise travel costs and improve accessibility. This may involve the engagement of contract auditors who serve your region.
• Understand the CAB’s methodology for Stage 1 (document review) and Stage 2 (on-site audit) assessments.
• Assess whether the CAB tailors its audit approach and pricing to suit the size and complexity of your organisation.
• Request a detailed breakdown of costs, including initial certification, annual surveillance audits, and recertification fees.
• Ensure the CAB offers clear guidance on the certification process, especially for organisations new to ISO standards.
• If you are pursuing multiple certifications (e.g., ISO 9001, ISO 14001, and ISO 45001), confirm the CAB can audit all standards simultaneously to reduce costs and time.
• Confirm the CAB’s availability aligns with your timeline for certification.
• Some CAB’s offer training programs to help organisations better understand ISO requirements.

Reviewing Project Progress

Reviewing project progress during the design and development of an ISO management system is critical for ensuring the system meets its objectives, aligns with ISO requirements, and remains on schedule.

• Confirm that relevant stakeholders are identified (e.g. top management, process owners), with their responsibilities clear for the duration of the project.
• Confirm any critical project steps to get the project underway, including gap analysis, development of a project plan, allocation of key resources and schedule.
• Schedule regular progress reviews, where the progress towards completion of documentation and other deliverables are monitored within the project plan and schedule.
• Regularly review whether completed deliverables and activities align with the requirements of relevant ISO clauses – particularly where the ISO standard specifies a need for documented information.
• Gather feedback from employees, process owners, and management on the management system’s design and implementation progress.
• Engage top management in reviewing project progress to ensure alignment with strategic goals.
• Confirm that the management system sufficiently addresses current and emerging legal and regulatory requirements.

Develop Internally or Engage a Consultant

When deciding between internal development or engaging a consultant for the design and development of an ISO management system, there are pros and cons of each option, where the below considerations will guide a decision:

• Internal expertise: If there is a lack of expertise within the organisation, a consultant brings specialised knowledge, experience and insights from working with other organisations.
• Resource availability: Internal development will involve a more significant time and effort investment from internal staff, who are often fully utilised in their day-to-day roles. Engaging a consultant can reduce the workload on internal stakeholders by doing the heavy lifting of internal consultation, document development and project management.
• Cost: Internal development will reduce direct costs, though the opportunity cost of using internal resources will need to be considered. Consultants will result in higher direct costs, though may be a more efficient option. Further, consultants will remain focussed on the project’s objective, while internal personnel can often be pulled into work assignments with competing objectives.
• Timeframe: Internal development can involve a longer timeline if the organisation is new to ISO standards, and employees need time for training and learning. Consultants will generally work faster, and can bring previously-utilised process frameworks, and utilise proven methods.
• Knowledge Transfer: Internal development can enable the organisation to manage and improve the system independently post-certification, and promote a strong sense of system ownership by employees. Unless anticipated and built into the project plan, the use of a consultant may result in a reduced degree of knowledge transfer post-certification if the consultant’s support is not retained. A good consultant will build processes for continued learning within the organisation.
• Long-term sustainability: A system developed in-house is often more deeply embedded in the organisation’s operations. However, as a consultant doesn’t directly control the efforts of the organisation’s employees, the system may feel like an external imposition, impacting long-term buy-in.

To achieve a good balance between these options, an organisation may engage a consultant for initial guidance and system design, while simultaneously building internal capacity for long-term management system maintenance.

We’ve provided some information about what you should consider when selecting a management system consultant. If you’re not sure about whether this is suitable for you, book a free online consultation to discuss with us.