Management System Standards - Part 5 - Implementation

Go to -

Management System Standards - Part 1 - Overview

Management System Standards - Part 2 - Common Structure

Management System Standards - Part 3 - One Free Standard

Management System Standards - Part 4 - Interaction

Management System Standards - Part 6 - Certification

STRATEGY

If you decide that you are going to implement a management system you must determine and decide the following.

(1) What training should you attend, to prepare you to establish and then operate, the management system?

(2) Will you use a consultant, to support you to establish the management system? If so:

What will you want the consultant to be responsible for, to establish the management system;

What will you be responsible for, to establish the management system?

(3) Will you (continue to) use a consultant, to support you to operate the management system? If so:

What will you want the consultant to be responsible for, to operate the management system;

What will you be responsible for, to operate the management system?

TRAINING and CONSULTANCY

It is important to understand the relative value that both training and consultancy can provide, to support you to establish and operate a management system. The relative value differs, for different management system standards.

Training Courses

An organisation should provide appropriate training to its staff, to enable them to establish and operate the management system, dependent upon the extent to which the organisation may choose to use a consultant to provide support. Most certification bodies offer a selection of training courses. The courses offered will differ among providers, but the following are typical examples.

ISO XXXXX Introduction - 1 Day

ISO XXXXX Implementer - 2 Days

ISO XXXXX Lead Implementer - 3 Days

ISO XXXXX Internal Auditor - 2 days

ISO XXXXX Lead Auditor - 5 Days

Where the use of consultancy may be appropriate

For standards that apply to aspects of operations, which are relevant to many organisations, including the following, there are a choice of reliable, established consultants, which can provide support that is of value.

ISO 9001:2015 - Quality management systems - Requirements

ISO 14001:2015 - Environmental management systems - Requirements with guidance for use

ISO 45001:2018 - Occupational health and safety management systems - Requirements with guidance for use

ISO 50001:2018 - Energy management systems - Requirements with guidance for use

ISO/IEC 27001:2022 - Information security, cybersecurity and privacy protection - Information security management systems - Requirements

ISO 22301:2019 - Security and resilience - Business continuity management systems - Requirements

An organisation may choose to do one of the following:

Establish and operate the management system without the support of a consultant;

Establish and operate the management system with the support of a consultant;

Use a consultant to establish and operate the management system for the organisation. The support can assist an organisation, particularly a small enterprise, to conform to one or more management system standards, but allow its staff to concentrate on its core operations.

Where the use of consultancy may be less appropriate

For some management system standards, such as the following, it may be preferable to invest more in training, and either not use a consultant or only use a consultant to provide advice.

ISO 37001:2016 - Anti-bribery management systems - Requirements with guidance for use

ISO 44001:2017 - Collaborative business relationship management systems - Requirements and framework.

ISO 55001:2014 - Asset management systems - Requirements

These standards apply to aspects of operations that require significant involvement of, and leadership from, senior management, and may also require substantive changes to the organisation. For these management system standards, a substantial component of training is appropriate, to enable the organisation itself to establish and operate its management system, and achieve, and crucially maintain, certification.

INTERNAL AUDITS

An essential and important component of any management system is internal audits. An organisation can choose to do one of the following.

(1) Train its own staff to do audits, who then do all the internal audits.

(2) Train its own staff to do audits, who then do some of the internal audits. A consultancy does the remainder of the internal audits.

(3) A consultancy does all of the internal audits.