Book a free consultation

Who Owns Your Business Management System? (Hint: Not Your HSEQ Manager)

Table of Contents

Business management system illustration showing a team sharing accountability for quality, safety and the environment

Who Owns Your Business Management System?

Ask people in most businesses who owns the business management system, and they’ll usually point to the HSEQ manager (or equivalent). It’s an easy answer. However, it’s rarely the right one, and it can quietly weaken the whole system.

Wilson Fernandez’s latest LinkedIn post inspired this post. It introduces Part 4 of his series ISO 9001:2026, Auditing Beyond the Checklist. It’s well worth a read, and three of his points stood out for us:

  • One decision, many systems: A resourcing or supplier decision rarely affects only one clause or process. Instead, it can flow through quality, WHS, environment, suppliers and customers.
  • Connect accountability, don’t concentrate it: Integration should link responsibilities across the business, not pile them onto the Quality or QHSE department.
  • Reflect how the business is really managed: A business management system (BMS) should build ISO requirements into the way the business actually runs, not just place several standards under one department or organisational function.

As an example, Wilson notes that AI-supported decisions increasingly shape processes and outcomes across several parts of a BMS. That’s a timely point, because many organisations are now putting AI to work.

So in this post, we give our take on how AI use in your organisation can affect your business management system, particularly when a certification body audits it for ISO certification. We use AI adoption as our running example. We also look at why the HSEQ manager shouldn’t own the system, what the role might involve, and how one AI decision touches quality, health and safety, and environmental management.

Why This Matters

A business management system owned by one person drifts away from how the business really works.

In many businesses, everyone sees the management system as belonging to the HSEQ manager. As a result, everyone else treats it as “their job”. Over time, the system drifts away from how the business really operates:

  • Procedures describe an ideal world: They read well, but they don’t match the reality of how the work is performed.
  • Managers work around them: Real decisions happen outside the system, so the system never learns from them.
  • One role carries the load: The HSEQ manager ends up holding accountability that belongs across the organisation.

In our view, a business management system needs to be tied to the context and operational reality of the business. For that reason, the HSEQ manager should never “own” it.

What the Standards Say

The requirement: The leadership requirements of ISO 9001:2015, ISO 14001:2015 and ISO 45001:2018 place accountability for the system’s effectiveness with top management. The new ISO 9001:2026 and ISO 14001:2026 editions keep this leadership focus. Leaders can assign roles, responsibilities and authorities, including reporting on how the system performs. However, they can’t hand off that accountability.

Our view: The standards already support shared ownership. The HSEQ role supports the system, while leaders and process owners are accountable for it.

AI Adoption: One Decision, Many Systems

The short version: Adopting an AI tool is a business decision, not just an IT or HSEQ decision.

Many businesses are now adopting AI. For example, they’re using generative AI to draft quotes, reports and procedures. Others use AI for scheduling, estimating or rostering, while some use AI-driven monitoring of equipment, sites or energy use.

Each of these looks like a single decision. In practice, though, it touches several parts of your business management system at once. It changes how work is planned, who checks outputs, what suppliers you rely on, what workers experience and what resources you use.

If the HSEQ manager is left to “fit AI into the system” after the decision is made, the system ends up chasing the business. On the other hand, if the people making and living with the decision share accountability, the system keeps pace.

We previously examined what auditors are likely to look for in AI in ISO Management System Audits. Below, we look at the same question from the business side.

AI Impact Review Across Your Business Management System

Here’s how a typical AI adoption decision can affect each of the three most common standards, and who should share the accountability.

Quality Management (ISO 9001:2026)

ISO 9001:2015 remains in force while certified organisations transition to ISO 9001:2026, published on 16 September 2026. The core ideas below apply to both revisions.

  • Risks and opportunities: AI can speed up quoting and planning. However, it also brings risks such as inaccurate outputs, outdated data and overreliance on automated answers.
  • Competence and awareness: People who use AI need to understand its limits and know when to check its outputs.
  • External providers: AI platforms are suppliers. Therefore, they belong in your process for selecting and monitoring external providers.
  • Documented information: Decide which AI outputs need to be kept, and how to show what data and version produced them.
  • Control of changes: Plan the change before rollout, and treat tool or model updates as changes too.
  • Monitoring and measurement: Check that AI-supported processes still deliver what customers need.
  • At your certification audit: An auditor may ask where you use AI within your scope, who is responsible for it and how you check its outputs. Expect them to look for evidence from the people using AI, not just your records.

Who shares accountability: Operations and project managers own the processes that use AI. Meanwhile, estimators and sales staff own the quotes and customer commitments, purchasing manages AI suppliers, and IT manages the platforms.

Health and Safety (ISO 45001:2018)

AI can improve safety, for example by spotting hazards in monitoring data. Equally, it can change how work feels and how it’s done. ISO 45001:2018 is the current edition, and a revision is under way.

  • Management of change: New AI tools and processes are changes to work. As a result, they call for hazard identification and risk assessment before they’re introduced.
  • Consultation and participation of workers: Workers should have a say in AI tools that change their work, such as AI rostering or monitoring. Our post on worker participation in health and safety explains why this matters.
  • Psychosocial hazards: AI-driven scheduling, workload targets or monitoring can affect workload, job control and privacy concerns. These need to be identified and managed like any other psychosocial hazard. Regulator guidance, such as WorkSafe WA’s psychosocial hazards code of practice, doesn’t address AI specifically, but it does explain how to manage psychosocial hazards generally.
  • Operational control: Where AI informs safety-critical decisions, decide where a competent person must review the output first.
  • At your certification audit: An auditor may look for evidence that you assessed AI changes before introducing them and consulted workers about them. They may also talk with workers and health and safety representatives about how AI affects their work.

Who shares accountability: Leaders own the decision. In addition, supervisors manage how it lands on the ground, workers and their representatives participate in consultation, and HR covers workload and wellbeing.

Environmental Management (ISO 14001:2026)

ISO 14001:2026 was published on 15 April 2026, and certified organisations are now transitioning to it.

  • Environmental aspects: AI and cloud services use energy and resources, and new hardware eventually becomes waste. These may belong in your review of environmental aspects.
  • Opportunities: On the positive side, AI-driven monitoring can help track energy use, emissions and waste more closely.
  • Monitoring and measurement: If AI produces environmental data, check that the data is accurate before you rely on it.
  • Compliance and claims: AI-drafted reports and marketing can overstate environmental performance. So, check environmental claims against real data before they’re published.
  • Purchasing: Environmental considerations can form part of choosing AI and IT suppliers.
  • At your certification audit: An auditor may check whether your environmental aspects and compliance obligations reflect your AI use. They may also check that environmental data and claims produced with AI are accurate.

Who shares accountability: Facilities and operations managers own energy and resource use. Likewise, purchasing and IT own supplier choices, and marketing owns any public environmental claims.

Sharing Accountability Across Your Business Management System

Area Who shares accountability
Deciding to adopt an AI tool Top management makes the decision, with input from the people whose work it will change.
Day-to-day use of AI outputs Process owners and the people doing the work check outputs before relying on them.
AI platforms and suppliers Purchasing and IT evaluate and monitor AI providers, as they would any other supplier.
Workers’ health, safety and wellbeing Supervisors, HR and health and safety representatives consult workers and manage workload and psychosocial risks.
Environmental effects and claims Facilities, operations and marketing manage resource use and check claims against real data.
Reviewing how well it all works Leaders review AI performance in management review, supported by the HSEQ role.

For more on the last row, see our post on management review documented information. Our own AI Governance Policy shows how we apply these ideas to our business. Where AI use is significant, ISO/IEC 42001:2023 offers a dedicated AI management system standard that can integrate with your existing system.

What the HSEQ Role Should Look Like

So if the HSEQ manager doesn’t own the system, what do they do?

The HSEQ manager has a role with a specific focus and set of responsibilities. Those responsibilities tie into the responsibilities of people in interrelated roles.

In our view, it’s an internal servant leadership role:

  • Interfacing: Working with key stakeholder representatives across operations, projects, purchasing and admin.
  • Collaborating: Helping process owners shape how the system supports the way they work.
  • Supporting improvement: Developing and improving the system so it keeps serving the organisation, rather than the other way around.

With AI, this might mean the HSEQ manager helps operations, IT, purchasing and HR work through the impact review above. However, each of those areas still owns its part of the outcome.

No HSEQ Manager? Then It’s a Leadership Job

Many smaller businesses don’t have a dedicated HSEQ role. In that case, planning and facilitating the system falls to top leadership.

That isn’t a burden to fear. In fact, leaders in smaller businesses are usually closest to the decisions that shape the system, including whether and how to adopt AI. External support can help, but accountability stays with leadership.

Our ISO Governance and Assurance services support leaders in exactly this position.

Final Thoughts

A business management system works best when it reflects how the business really runs, and when accountability is connected across the people who make and live with each decision. AI adoption simply makes that clearer, because one decision can reach quality, safety and the environment at once.

As Wilson puts it, “One organisation. Many risks. Connected consequences.”

So, here’s the test: does your system reflect how your business really operates, and does each role understand its part in it?

Speak with Us About Your Business Management System Needs

DBell Consulting helps organisations build business management systems that reflect how they really work, and support leaders and HSEQ teams to share accountability across the business. Speak with us to discuss your business management system needs, or visit our Contact Us page.

Sources

Our commentary reflects our professional experience. It isn’t a formal interpretation of any standard or a statement about any particular organisation.

Accessing Official Copies of ISO Standards

ISO management system standards are protected by copyright, with reproduction subject to certain restrictions. This includes the standards being subject to licensed purchasing via the ISO website and approved distributors. If you require a copy of these standards, visit the ISO website, or follow the below links for specific standards:

Share the Post:
Related Posts