Author: [email protected]

ISO 9001:2026 Is Here: What Changed and What to Do First

ISO 9001:2026, the sixth edition of the standard was published in September 2026. While there have been no major changes to operational clauses it has left many in the industry or new to the standard wondering what has changed and what these changes mean for them. Major changes to the standard include a more explicit requirement for leadership to promote a quality culture, enhanced guidance in the Annex on the meaning of the requirements, and structural changes throughout the standard.

In this article, I outline what has changed, a first 90-days action plan and where training may help with assuring your organization is aligned and conforming.

What Is ISO 9001:2026, and What Is the Timeline?

Publication and status

ISO management system standard gets reviewed every 5 years and a determination is made at the time by the technical committee on whether to revise the standard or not. The decision to revise the standard is made based on inputs from stakeholders and to keep the standard relevant to changes in industry and technology.

The previous revision of the standard was in 2015 when including among other changes the ISO 9001 standard was assigned to the harmonized structure per Annex SL. With the revision of ISO 9001 other standards in the family have already been revised or are in the process of being revised. Examples includes ISO 9000:2026, the glossary of terms used in ISO 9001 and also other guidance standards in the ISO 10000 series.

Transition period explained

The ISO consulting industry at large is pushing the need to implement the changes in your organization quickly. However, as with previous revisions of the standard, certified organizations have up to three years to transition to ISO 9001:2026. The date set for transition is September 2029. In order to make the change cost-effective companies will want to align this with their next surveillance or certification audit. Certification to ISO 9001:2015 will remain valid throughout this transition period. However, companies that are looking to get certified for the first time after September 2027 will need to certify to ISO 9001:2026.

ISO 9001:2026 Changes: What’s Actually Different

What did not change

Before I speak about the changes, I would like to address what remains the same. The standard is still aligned to the harmonized structure and the process approach based on the PDCA cycle. The standard still has clauses numbered 1 through 10 with the emphasis for certification on clauses under 4 through 10. With the changes being primarily in concept your system will likely not need a major rewrite and in some cases based on your current documentation perhaps no re-write at all.

Changes to the standard include the inclusion of relevant terms and definitions within the standard itself, the removal of Annex B and the increase in guidance in Annex A among others. I will cover the detailed changes in the next section

Key changes to explain

Planning and managing change: In the clauses under 6, to better align ISO 9001 with the structure of other standards (to make integration easier) clause 6.1.2 and 6.1.3 have been added for plans to address risks and opportunities. Clause 6.3 has been strengthened for planning, communicating, monitoring and reviewing QMS changes.
Climate change: The 2024 amendment to ISO 9001 for climate-related considerations are now added to the standard. A great resource for those struggling with understanding how to apply and audit is the guidance document published by the TC172 Auditing Practices Group.
Leadership, culture and ethics: As stated earlier there is a new requirement for leadership to promote a quality culture and ethical behavior. QMII’s ISO 9001 Lead Auditor course addresses how organizations can demonstrate conformity to this requirement as also how to audit this for effectiveness. This requirement is further supported by clause 7.3 for awareness.
Continual Improvement: Clause 10.3 has been removed, and improvement is now covered solely in clause 10.1.
Performance Evaluation: Additional clarity has been provided on measuring customer perception and the clause for internal audits has seen minor structural changes.

What to Do First: A Practical Starting Plan

Step 1. Get the standard and read the changes

Alright so the heading is stating the obvious. I am, however, often surprised by how many companies do not invest in a copy of the standard because of the high sticker price. The standard will probably not be revised for at least another 7-8 years based on previous revision history. So do not rely on summaries you read on the internet. Purchase a copy, read the standard, underline all the “shall” requirements for these you must implement and conform to.

Step 2. Run a gap analysis

Each time the standard updates is also a great time to review your system through a fresh perspective. With upgrade and certifications, an organization is likely to get enhanced cooperation from all departments. Use the opportunity to review existing documentation to ensure they reflect the “as-is” of how work is done before beginning a gap analysis.

With the as-is review complete, conduct a gap analysis. Having a matrix of which documents align to which clauses of the standard will make it easier to conduct the gap analysis. Keep in mind that because the standard clause structure has changed does not necessitate a change to the documents or numbering within them. A ‘manual’ written to the clauses is often indicative of a system documented for auditors.

Step 3. Brief leadership and secure resources

At any time in the process of transitioning, take time to brief the leadership on what are the new changes, what they mean for them and what they mean for the organization. Brief them on the timeline of the changes and what support you may require from them to implement the changes. Present them with your transition plan, identifying persons responsible for each phase and deadlines. Get their approval for the plan.

This may be a good time to secure a budget for training of personnel to upgrade their auditor knowledge. An ISO 9001 lead auditor or transition course may be the requirement for you. With the auditing standard ISO 19011 updated in 2026 it may be a good idea to take the entire lead auditor course instead of just the transition, especially if your last training was more than three years ago.

Step 4. Update documented information and processes

As I earlier said this is a great time to review the system and upgrade as needed. As a part of this I highly encourage a review of the risk register, if the organization has documented one. Also review your change management procedure and if you have a quality manual make the needed changes. With respect to documentation the ISO 9001:2016 standard has moved away from the use of maintain and retain within the standard. Where documentation si required it now just states shall be available as documented information.

Pro Tip: Keep it proportionate and avoid creating paperwork the standard doesn’t require.

Step 5. Train people

With the upgrades in place, it is now time to conduct refresher training for all personnel within the company. While it is easy to just cover the key changes and what it means for personnel it may be a great time to renew the entire awareness training. In addition to what you expect from all personnel in contributing to quality it’s always great to have a video by leadership conveying their commitment to the system and to providing the resources needed.

Step 6. Test through an internal audit cycle

With the upgrades completed and the system in place, let it run for a month to a month and a half before initiating an internal audit of the system. Do not forget to include the leadership in the audit plan. Here is a link to a recent webinar on Auditing Upstream that addresses this aspect of the internal audit.

Make sure that before your certification body comes in you have completed a management review, following the internal audit and that all findings from the internal audit have been addressed.

Why ISO 9001 Lead Auditor Training Matters During the Transition

What a lead auditor actually does

Having been in the ISO consulting line of work for nearly two decades I see several organizations prefer internal auditor training for internal auditors. This for a variety of reasons. QMII’s recommendation is that at least two auditors on your internal audit team be trained as lead auditors. Choosing a course that is certified by a personnel certification body such as Exemplar Global is an even better choice.

Here is my reasoning for the above. A Lead Auditor course takes a deeper dive on the standard, auditing principles and applying those principles to your management system and your audit program. The participant gets more workshop practice in the additional day of training and in the long run will serve your audit program better. A subjective auditor can slowly kill the audit program and the system. Additionally, providing the employee with certified lead auditor training demonstrates that the company is invested in their personal and professional success.

With the changes the auditor must focus on auditing the top management and not the QMS manager as the leadership for the system. Auditors must be able to interpret the standard correctly and a good auditor makes a good auditee who can challenge certification body auditors when they are being subjective. A good auditing course will get auditors to move beyond focusing on completing a checklist and merely seeking conformity to seeking effectives.

Choosing the right ISO 9001 lead auditor course

Do not choose a course based on the title alone. Ask whether it covers the edition of ISO 9001 you will be working with and the auditing guidance in ISO 19011. If you are taking the training to support your transition, ask the provider how the changes are addressed in the course. You want to understand what the requirements mean for your system, not merely be given a list of what has changed.

As I stated earlier, look for a course recognized by a personnel certification body such as Exemplar Global, and confirm what that recognition covers. Also ask about the trainer’s auditing experience and how much time is spent in practical workshops and role-plays. In my view, being able to explain a clause is only part of the training. Participants need the opportunity to ask questions, review evidence and practice reaching an objective audit conclusion.

Whether you choose virtual or in-person training, consider how you learn best and whether you can set aside the time to participate fully. Do not let the convenience of attending from your desk result in work taking priority over the training. The right ISO 9001 lead auditor training should help you return to your organization ready to apply what you have learned.

Conclusion

The transition is an opportunity to take a fresh look at your system, not a reason to rewrite every document. Keep these three points in mind:

Read the applicable edition of the standard rather than relying on summaries.
Confirm your existing certificate’s validity and transition arrangements with your certification body.
Begin preparing now, with changes proportionate to what your organization needs.

Start by getting the text and conducting a gap analysis against how work is actually done. Brief your leadership, agree on responsibilities and give your people the knowledge needed to make the changes work. If your auditors need a refresher or a deeper understanding of the requirements, explore QMII’s ISO 9001 lead auditor training. Choose training that supports your system and the effectiveness of your audit program. The goal is not simply to get through the next audit, but to have a system that works for your organization.

About the Author

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

ISO9001:2015

Employees Ignore the QMS: How to Build Real Buy-In Beyond the Quality Team

ISO 9001:2026 just dropped and leadership promoting a quality culture is one of the new requirements. Since inception in 1986 QMII has stressed that an effective management system means more than just a folder of documents. True system effectiveness comes from personnel motivated, competent and knowledgeable of the requirements. Often with a poorly implemented system gaining QMS employee engagement can be a challenge. This leaves the quality manager doing all the heavy lifting and the system engagement only coming the week before an audit.

In this article I seek to highlight the steps organizations can take to gain engagement from the workforce. The steps outlined will help organizations reduce the resistance to change and move the mindset from one of just compliance. QMII’s clients’ have benefitted from this over the years and so should you.

Why Employees Treat the QMS as “Quality Team Paperwork”

As I visit clients for the first time, I hear people refer to me as “the ISO guy”. Herein is probably the first mistake that organizations make in their quality management system implementation journey. Treating the system as an ISO system or a quality system rather than how the company operates and gets work done. In doing so organizations tend to document their system to meet audit and customer requirements, prepare to pass audits and treat their QMS as an add-on that can be switched on and off as needed.

As with any change, implementing a QMS will come with this fair share of resistance. Each employee wants to know what’s in it for me. Why should they keep these additional records and document what they do when perhaps their pay will see no increase. Some have concerns about their job security if they document how they do what they do. Others feel they will be restricted in what they do and perhaps there will also be more documented accountability. All valid fears that must be alleviated by the leadership in explaining why the system is important and why personnel should treat their QMS as more than just paperwork.

If you walk onto the shop floor and do not see personnel using the QMS documentation because “I know better”, “I’ve been doing it this way for years” or “It ain’t broke so why fix it” then you know you have a QMS that exists only on paper.

What ISO 9001 Actually Expects from Employees

Before I speak about what ISO 9001 expects from the employees I want to focus on what it requires of Leadership. While a QMS requires engagement from all personnel the onus to promote that engagement, support other leadership roles in implementing the system and encouraging continual improvement lies with the leadership. Leadership is accountable for the success of the system. The leadership must convey their expectations via the policy and objectives and then provide the resources needed to achieve it. They must define clear roles and responsibilities and determine the competency requirements for each position in the organization.

With the framework above set, leaders must now focus on hiring and maintaining competent personnel. In addition, they must drive awareness of the system among the workforce. In ISO 9001:2026 clause 5.2 requires the policy to be communicated, understood and applied. This means that the workforce must understand how they contribute to the policy and then apply it in their daily job. When the entire workforce is working towards a common goal as outline in the policy and objectives then it can be said that the quality culture is good. The workforce must recognize why they should not take shortcuts, who to report to when they notice a risk and the ability to stop work if needed.

A common myth is that a QMS and the ISO 9001 standard requires employees to follow procedures, obey leadership and cross train others. None of these are requirements of the standard. Outlined below are five simple steps to encourage more active participation in the system.

Fix 1: Connect Quality Objectives to Each Role

As stated in the previous paragraph it is important to have measurable goals (also required by the standard). Once the processes have been defined then relevant process owners need to be assigned. Each process owner then defines the process to the extent needed only to have confidence that the process is being carried out as planned. Thus, documentation will vary based on the size of the organization, structure, number of personnel and their experience and the complexity of the process.

ISO 9001 does not limit the number of goals that can be set. Each process can have its own measurable goal, so long as it contributes to the overall objective and does not conflict with any other objective /KPI.

Outlined below is a simple example of an objective cascade through an organization.

Example QMS Objective Cascade
Level	Objective	Measure and Target	Owner
Organization	Improve customer satisfaction.	Increase the customer satisfaction score from 88% to 92% by year-end.	Top management
Operations process	Improve on-time delivery.	Increase on-time delivery from 90% to 96% by the end of Q4.	Operations manager
Production team	Reduce delays caused by rework.	Reduce rework from 5% to 2% of units produced by the end of Q3.	Production supervisor

Fix 2: Make Leadership Visible

I’ve been working with a number of organization and even through my own career nothing makes a system more effective that visible leadership. This is the reason when I audit, I ask leadership, “How do personnel evidence your commitment”? Top Management must walk the talk. A policy signed and posted on the notice board has no value when the leadership does not provide the resources to support it. When they bypass the requirements, they set for others and when quality goals are adjusted to pass audits.

Leadership must actively participate in contextual risk reviews, their decision making must be evident in the various operational aspects, and they must actively participate in management reviews. When non-conformities occur, they must ensure effective and timely action. Also, when the corrective action is ineffective, they must question why. Other ways that leadership commitment may be evidenced is in them refacing the QMS in meetings, effective communication on the state of the system to all and GEMBA walks.

For leadership a simple way to gain buy in is to not refer to the management system as the QMS. Take quality out of the name and put your company name in there so personnel “own” the system. Gain their inputs when documenting the system.

Fix 3: Replace Generic Training with Role-Based Awareness

The standard ISO 9001 does not ask for training. It requires competence. This minor difference is often lost in implementation where many companies I work with read competence as training. Competence is the ability to apply skills and knowledge effectively and training merely provides that knowledge. A leader that says they care about the system and in driving competence among personnel but then do not want to commit the time or resources to train those personnel does not show commitment.

Apart from competence the standard requires awareness training. Here is where employees need to be trained in how they can contribute to the system. This includes what to do when they evidence risks, how to recommend changes to documentation and whom to report opportunities for improvement to. They need to understand why the QMS supports them in all they do. QMS awareness training when implemented during employee onboarding should be followed by a refresher training at some periodic basis.

If you would like a template for training your employees on your QMS reach out to QMII at [email protected] .

Fix 4: Simplify Procedures and Forms

When consultants are brought in to design your system, they write the procedures based on their experience and with templates they have used in the past. QMII’s approach is to work with companies to capture the documentation the way work is actually done. No assumptions made and no fictional procedures are captured. This ensure that you say what you do and do what you say.

Consider how you can simplify QMS documentation so its easy for the user to locate and use. Think beyond procedures documented in MS word. Consider how to video files, posters, graphical representations, screen shots, flowcharts and more. Make the documentation user-friendly to locate and reference. Think computers at the point of use for ease of reference. Make suggesting changes to documentation easy while ensuring adequate control.

• Effective document control and compliance guide

Fix 5: Recognize and Involve People

People are more likely to support the QMS when their ideas and contributions are recognized. Recognition does not need to be expensive. Leaders can highlight useful suggestions in team meetings, thank employees who identify risks or improvement opportunities, and share examples where an employee’s input prevented a problem. These simple actions reinforce the message that quality is everyone’s responsibility and help build a culture of continual improvement.

Involvement is equally important. Organizations can introduce suggestion schemes, quality circles, and regular feedback loops that give personnel a simple way to recommend changes. In creating new documents gain reviews of the document from all relevant interested parties prior publishing the document .Employees from different departments can also be trained as internal auditors, allowing them to better understand how processes connect while bringing a fresh perspective to audits. When personnel see that their input leads to action, they are more likely to take ownership of the management system.

Measuring Whether Buy-In Is Improving

Employee buy-in should be visible in how the QMS performs. Look for fewer repeat audit findings, more near-miss and improvement reports, completed role-based awareness activities, and stronger employee feedback in surveys and management reviews. Positive trends in these simple indicators show that personnel are moving beyond compliance and taking ownership of the system.

A QMS becomes effective when objectives connect to each role, leaders remain visible, awareness is relevant, documentation is easy to use, and people are recognized for contributing. When employees see the system as the way the organization works engagement and the quality culture improve. Internal Auditor and Lead Auditor training can further build the skills needed to sustain that involvement and continual improvement.

About the Author

ISO9001 Qualitymanagementsystems

ISO/IEC 42001 Explained: The AI Management System Standard and Who Needs It

Artificial Intelligence (AI) is everywhere these days. It has within a short period of time become a daily part of how we interact with the internet and in some cases work. I won’t deny that AI does have its benefits, however, can cause issues of concern when not used responsibly. ISO 42001 seeks to outline a framework for companies to implement to enable responsible use of AI and better AI governance.

In this article I seek to explain what an AI management system is, who can benefit from it and how to implement an AI management system. The ISO/IEC 42001 standard is built on the harmonized structure in alignment with other ISO standards making it easy to implement. It is also built on the plan-do-check-act framework. Thus, companies that are already certified to other ISO standards should find it easier to integrate the requirements of ISO/IEC 42001 into their existing management system.

What Is ISO/IEC 42001?

ISO/IEC 42001 is the first management system standard released by the International Organization for Standardization (ISO) in 2023. AI management systems enable organizations to responsibly integrate AI into what they do. Per ISO the standard is applicable to “organizations of all sizes and sectors that develop, provide, integrate, or use artificial intelligence (AI) systems”.

What does this mean in plain English, and should you consider applying it to your organization? What if your employees use a Large Language Model (LLM) such as ChatGPT or Claude in their daily work? If you answered yes, then the standard applies to your organization, and you can benefit from the controls outlined in the standard. These controls are based on best practices for AI governance. It also applies if you develop AI software, AI agents, integrate AI agents into what you provide as a service and more.

Certification to ISO 42001 does not imply that your product or tool is certified. Rather it is a certification of your management system and how you implement and manage the risks from the use, integration or building of AI within your organization.

Why AI Governance Matters Now

As companies integrate AI into what they do, the products they deliver or build LLMs there are many concerns. The primary concerns include accountability, data privacy and bias in the dataset. The internet is full of AI and Terminator memes. There is also news of AI hacking of networks and companies without initiation by a human. The impact of such unwanted actions can spell huge legal issues for companies and potentially impact to brand reputation.

With new technology comes new risks, many of which may be unknown at this point. ISO 42001, as with other ISO management system standards, is meant to be used as a preventative tool. The framework and controls identified in the standard allow organizations to take a proactive approach to managing risks from AI. Customers are already concerned with how they data may be compromised from the irresponsible use of AI with propriety information available to all when used, for example in LLMs.

Taking a proactive approach allows organizations to provide continued confidence to customers that they are caring for their data and information.

Key Requirements of ISO 42001

ISO/IEC 42001 requirements are captured in clauses 4 through 10 of the standard. As the standard is based on the Annex SL structure, users and implementers of the standard will find similarity with other standard in the clauses under 4, 5, 7, 9 and 10. The primary differences in clauses 6 and 8. Additionally there are 38 controls across 9 control objectives. As with ISO/IEC 27001, the controls are not mandatory and serve as a reference catalog. Organizations need to consider the applicability and justify inclusion or exclusion of the controls.

The structure of the standard follows the PDCA cycle with leadership first determining the business risks to the AI management system and identifying the scope of the system (Clause 4). Leadership then commits to supporting the system and enabling its success (Clause 5). This is done by identifying the policy and roles and responsibilities for success of the AI management system.

In clause 6 risks and opportunities are determined based on the needs of the interested parties and contextual risks identified in clause 4. Clause 7 asks the organization to provide the needed support and resources to enable successful implementation of the plan and continual improvement of the system. Clause 8 provides the framework for operational controls. Clause 9 the controls to enable performance evaluation of the system including checks via internal audits and reviews by the leadership. Clause 10 identifies improvement requirements including identifying and recording non-conformities and working to improve on them.

Who Needs ISO 42001 Certification?

While many organizations can apply ISO 42001, certification may be most valuable when independent assurance is needed. This may be driven by customer requests, purchase order requirements or contractual commitments. Sometimes it may be based on a decision by leadership to provide external evidence that the organization has established a formal approach to managing AI. The question is therefore not only whether an organization uses AI, but whether it needs to demonstrate that its approach has been independently audited.

An organization should consider certification where AI is important to its operations, forms part of a major customer offering or is likely to be reviewed during supplier approval. The business case may also be stronger when several departments share responsibility for AI and a consistent approach is needed across the organization. Certification is generally voluntary, but it can become a commercial requirement when customers include it in procurement criteria or contracts. Smaller organizations may choose to implement the standard first and pursue certification later when there is a clear customer, regulatory or market need.

ISO 42001 vs ISO 27001 vs ISO 9001

I did mention earlier in the article that ISO 42001 is built on the same harmonized structure other ISO management system standards such as ISO 9001 and ISO 27001. Often companies see additional management systems and additional certifications as a burden. This is myth however, as an integrated management system can help alleviate this. Companies choosing to implement the three standards above, could have an integrated policy, an integrates risk register, an integrated system for control of documented information and more.

The below table in brief outlines the similarities and differences:

Clause	ISO 9001	ISO 27001	ISO 42001
4. Context	QMS scope	ISMS scope	AIMS scope, incl. AI role
5. Leadership	Quality policy, customer focus	Security policy	AI policy
6. Planning	Quality risks, objectives	Security risk assessment and treatment	AI risk assessment, AI impact assessment
7. Support	Resources, competence, documents	Same	Same
8. Operation	Product/service delivery	Risk treatment in operation	AI risk treatment, impact assessment
9. Evaluation	Customer satisfaction, audit, review	Audit, review	Audit, review
10. Improvement	Corrective action, continual improvement	Same	Same
Annex A	No controls	93 controls	38 controls

Steps to Implement ISO 42001

As with any project, the first step should be the purpose. Begin by determining why your organization wants to implement ISO 42001 and what it expects the AI management system to achieve. From there, identify the scope by considering the departments, products, services and locations where AI is developed, provided or used. Everything withing scope will need to be controlled, and scope should not be sued to exclude that which you are responsible for. You should then create an AI inventory that identifies the AI systems in use, their purpose, the data involved, the responsible owners and the risks that may arise.

Next, conduct a gap analysis against clauses 4 through 10 and the applicable Annex A controls. The results will help you develop an implementation plan, assign responsibilities and prioritize actions. The organization should then complete its AI risk and impact assessments, decide how identified risks will be treated and implement the needed policies, procedures and controls. Employees must also be made aware of their responsibilities and provided with training appropriate to how they develop, manage or use AI.

Once the system has been implemented, allow time for records to be generated and for the controls to operate. Conduct an internal audit and management review to determine whether the AI management system is effective and ready for certification. Finally, select an accredited certification body. Any non-conformities identified must be corrected before certification can be granted.

In Conclusion

ISO/IEC 42001 provides organizations of all sizes with a practical framework for managing AI responsibly by addressing governance, risk, impact, accountability and continual improvement. Its harmonized structure makes it easier to integrate with standards such as ISO 9001 and ISO 27001, while certification can provide independent assurance where customers, contracts or market expectations require it.

Should AI management systems not be on your priority list for now, at a minimum set and implement an AI use policy for employees within your organization. The risks identified in this article are prevalent and action is needed now.

FAQs

How much does ISO 42001 certification cost?

The cost will depend on the size and complexity of your organization, the number of locations, the scope of the AI management system and how much work is needed before the certification audit.

How long does it take to implement ISO 42001?

There is no single timeline that applies to every organization. A smaller organization with an established ISO 9001 or ISO 27001 management system may be able to move more quickly, while an organization with several AI systems, locations or departments may need more time. QMII’s ISO 42001 training and consulting services can help your team understand the requirements, assign responsibilities and move from gap analysis to audit readiness.

Is ISO 42001 certification mandatory?

ISO 42001 certification is generally voluntary, but it may become a customer, procurement or contractual requirement. Even where certification is not yet a priority, implementing the standard can help an organization manage AI risks and demonstrate a responsible approach.

How does ISO 42001 relate to ISO 27001?

ISO 42001 focuses on the responsible management of AI, while ISO 27001 focuses on information security. The two standards share the harmonized management system structure and can be integrated. QMII can help organizations integrate ISO 42001 into an existing ISO 27001 or ISO 9001 management system rather than create a separate system.

About the Author

ISO 9001 iso27001 iso42001 Managementsystems

RCMS vs ISO 14001: Understanding the Responsible Care Management System for Chemical Companies

Chemical companies may think that by implementing ISO 14001 they meet the requirements for Responsible Care ®. ISO 14001 is an internationally accepted standard that provides the framework for an environmental management system. However, the Responsible Care ® program demands more. It adds a layer of requirements for Health & Safety and Security to be integrated along with environmental requirements.

Members of the American Chemistry Council (ACC) commit to implementing a system aligned to either the Responsible Care ® Management System (RCMS) Technical Specification or the RC 14001 which integrates the requirements of RCMS and ISO 14001 into one standard. Companies choosing the RC14001 standard can then claim conformity to both standards while putting in similar effort.

This article clarifies what each framework covers, where they overlap, and how to audit both efficiently

What RCMS Is and Who Requires It

Responsible Care ® is the American Chemistry Council’s (ACC) industry-wide performance initiative. It is not just an environmental standard. The need for a performance standard was identified following major incidents at chemical plants in the 1980s. RCMS is more than just a set of operational requirements. It outlines the requirements for a management system. Management systems include interaction from the highest level of the organization to the lowest level and enables effective interaction across processes.

ACC member companies are contractually required to certify to RC 14001 or RCMS; non-members may still be pulled in by customer or supply-chain requirements. Some organizations may voluntarily opt to confirm to the requirements of these standards. While RCMS is not a regulatory requirement, it is an obligation an ACC member opts to conform to.

RCMS follows the plan-do-check-act cycle and dovetails well with the requirements of ISO 14001. It expands upon the environmental requirements of ISO 14001 to include health & safety and security (HSS). It is also supported by the underlying ACC codes. Namely the Process Safety code, the Product Safety code and the Security code.

RCMS vs ISO 14001: Key Overlaps and Differences

Both standards, the RCMS and RC14001 are management system standards and thus based on the Plan-Do-Check-Act cycle. This means that both require the foundational aspects of a management system. These include leadership commitment, a documented policy, operational controls to manage identified risks, monitoring of the system, internal audits and management reviews.

Each of these standards also require the organization to determine their compliance obligations and to then take measures to meet them and evaluate them. The system as a whole is to be used to drive continual improvement. The key difference is that ISO 14001 has a focus solely on environmental requirements and does not address HSS requirements.

RCMS and RC14001 also integrate loosely via the Process Safety Code the OSHA PSM requirements. It is, however, not a replacement for these regulatory requirements. Further the two RC standards also address product stewardship which entails enhancing EHSS requirements throughout the supply chain from cradle to cradle.

Compared to ISO 14001, the RC standards also carry specific ACC-mandated elements (e.g., community outreach/CAER, security vulnerability assessments) with no ISO 14001 equivalent. There are also different certification requirements when it comes to RCMS and ISO 14001. The RCMS requiring just one audit by an approved provider every three years.

Why Chemical Companies Often Need Both

Depending on the customer base, especially when international, an organization can benefit from using the RC14001 standards. There is an increasing demand from stakeholders for sustainable production and procurement. As such many are seeking ISO 14001 certification. As a member of ACC companies that need to conform to RCMS may benefit from alignment with RC14001. Many downstream customers specify ISO 14001 certification contractually, independent of ACC membership

ACC membership requires member companies must certify to RC 14001 or RCMS on a fixed cycle to remain in good standing. There is however the added benefit to company reputation from an independent verification of practices to demonstrate to stakeholders and interested parties the organization’s commitment to EHSS goals.

Most chemical manufacturers end up needing both frameworks running concurrently rather than choosing one

Combining RCMS and ISO 14001 Audits

These standards aside, if your company has an integrated management system, there is no reason for you not to be doing integrated audits. So, what is an integrated audit? It is an audit where an auditor of team of auditors competent in the requirements of the various standards samples and assess the effectiveness of controls as determined and applied across the organizational processes. This to the various standards the company is certified to.

With ISO moving to the harmonized standard approach starting in 2013, most ISO management system standards including the RC14001 share the same 10 clause approach. This makes it easy to audit the system as there is shared audit evidence across standards. There is also cost savings to the company both from audit time of the auditor and the time of the auditee spent in the audit. There is less burden on the auditees overall from reduced audit fatigue.

An integrated audit essentially has a single audit schedule, combined checklists mapped to both standards’ (RCMS and ISO14001) clauses and one audit team covering both scopes. Companies choosing RC14001 have already integrated the requirements of RCMS and ISO 14001 into one standard and so perform a single audit. Integrated audits also result in fewer duplicate corrective actions for the same root cause

Building Auditor Competence for RCMS and RC14001

The above integrated audits require auditors preferably trained in both standards simultaneously, not two separately trained pools. This of course again to save on time and cost. QMII’s RC14001 Lead Auditor training approved by Exemplar Global covers the requirements of RCMS, RC14001 and the applicable ACC codes.

Auditors must understand the relevant additional RCMS elements in ISO 14001 and be able to be objectives if just performing and ISO 14001 audit versus an RCMS or RC14001 audit. An effective auditing course approaches audits as a positive activity that helps the organization identify improvement opportunities and audits as key in the preventive cycle. With this integrated competence auditors must remain objective and learn to look beyond documented processed to enable better inputs for leadership.

An auditing course apart from the requirements of the standard must also build competence in the principles of ISO 19011 and include hands on workshop that allow auditors to hit the ground running and to quickly contribute to their organization’s audit program.

Conclusion

In conclusion, RCMS and ISO 14001 aren’t competing standards, they’re complementary. RCMS adding in the HSS requirements to build on the foundation of an ISO 14001 if already in place. Those companies choosing between RCMS and RC14001 may want to opt from RC14001 given the later ease of integrating other ISO standards such as ISO 9001.

A well-trained auditor adds value to the system. They must provide good insight to the leadership on the state of the system, and this can only come from choosing a good sample, including whom to interview, questions to ask and documents to evidence.

ACC membership requires conformity to either RCMS or RC14001. Regardless of the option chosen by an organization, a trained audit team can only add value to the system. To learn more on the differences and build your auditing skills consider QMII’s RC14001 and RCMS Lead Auditor course.

Keeping Your Management System ‘Ordinary’ in the Age of AI

We’re living in an era where every week seems to bring a new AI tool or software promising to “transform” your business. Predictive analytics, digital twins, algorithm-driven risk models; the buzzwords are endless. And while some of these advances do have their place, I argue that companies must not forget their basics. In a previous career as a mariner, as technology evolved and found their way on ships there was still some value to a simple visual bearing and the information it could give you.

Call me old-school, but I still believe in systems that are owned by people, not platforms. In fact, I’d argue that now more than ever, we need to protect the ordinariness of our management systems, because that’s where the real strength lies.

Don’t Mistake “Ordinary” for “Outdated”

I’ve worked on ships and in boardrooms, with multinationals and mom-and-pop shops. Across the board, the systems that work best are not the flashiest, they’re the ones that are understood, used, and respected. I’ve used fancy preventive/planned maintenance systems and then a simple excel spreadsheet with macros built in. Perhaps surprisingly, the company using the ordinary excel spreadsheet had better maintained equipment.

An “ordinary” system means:

Everyone knows their roles and responsibilities.
Processes are documented clearly, not buried in folders.
Documentation is clear and concise.
Records are maintained and can be trusted.

You don’t need artificial intelligence to tell you your maintenance wasn’t done. You need a culture where someone owns the task, completes it, and checks the box honestly.

When the Tool Becomes the Boss

I’ve seen organizations spend small fortunes on digital platforms that promise complete “management system automation.” These platforms often come with dashboards no one reads, workflows no one updates (because they don’t know how to), and training modules people click through just to make them go away. (Let’s be honest, you know how effective your CBT program are!)

Compare that to a simple 8D form built in Excel, yes, plain old Excel. When it’s used properly by a team that understands the process, it becomes a great tool for problem-solving. No licenses, no AI, no data scientists required.

If you’re curious, QMII’s Root Cause Analysis workshop teaches this practical approach. And it works because it’s rooted in thinking, not tech.

PDCA: Still the Smartest Loop in the Room

You don’t need AI to plan, do, check, and act. You need discipline. In a world full of reactive fixes and AI-generated insights, PDCA still calls on people to pause, observe, think, and improve. And frankly, we could all use more of that.

A well-run PDCA cycle doesn’t care whether your data comes from a sensor or a clipboard. What matters is how your team reflects, learns, and adjusts. If you want to sharpen that loop, QMII’s ISO 9001 Lead Auditor Training doesn’t just teach clauses. It teaches systems thinking, real auditing skills, and how to see the story behind the numbers.

Use AI? Sure. But Stay in the Driver’s Seat

I’m not against AI. Let me be clear on that. It’s a tool that, when used wisely, can absolutely support your management system. It can help you analyze patterns in data and generate reports that are helpful. But that’s exactly the point. AI is a tool, not the system itself, and certainly not the leader of it.

I’ve seen organizations fall into the trap of trusting algorithms more than their own people. They install AI to identify when personnel are not using PPE, to generate solutions based on data analysis and when errors occur. But no one stops to ask the most important questions: Does this make sense? Is this what’s really happening? Who validated this? Why did the person not use PPE?

The danger is that we start to mistake output for understanding. AI doesn’t know your organizational culture. It doesn’t know that one department always closes their nonconformities just to get them off the list. Only your team, using their judgment and grounded in your process reality, can make those distinctions.

If you’re going to use AI, integrate it into the PDCA cycle. Feed its outputs into your management review. Use it to inform, but not to dictate. And perhaps most importantly, teach your team to question it. Train them to ask, Where did this data come from? What assumptions are built into this model? What’s missing from the picture?

Own Your System. Keep It Ordinary.

There’s something refreshing about an audit checklist that an auditor actually helped write. Not an AI generate one. That’s real ownership. That’s engagement.

Management systems aren’t meant to be high-tech puzzles. They’re meant to be frameworks that help people do their jobs better. They are not a compliance burden, they’re a strategic asset, but only when they belong to the people who use them.

So here’s my message in conclusion: Keep your system ordinary. And make it extraordinary in how well it’s embraced and used.

—
About the Author
This article was written by Dr. Julius, Senior Consultant at QMII. With over 25 years of experience in ISO and aerospace quality systems, Dr. Julius has trained and advised hundreds of U.S. defense contractors in aligning with AS9100 and DoD requirements. He specializes in turning certification into a competitive advantage for suppliers.

Types of Challenging Auditees – and How to Engage Them Effectively

– by Julius DeSilva

In every audit, auditors will encounter a diverse range of personalities—some cooperative, others a bit more complex. Understanding and managing these interactions is a core skill, particularly when auditees inadvertently—or intentionally—create barriers to transparency. Here are the most common types of challenging auditees, and expanded strategies on how to engage them effectively.

1. The One Word Wonder

Characteristics:

Offers short, clipped answers.
Rarely expands on details unless specifically asked.
May be uncomfortable, anxious, or disengaged.

Enhanced Strategies:

Build rapport early: Start with informal, low-stakes conversation before diving into audit questions. A simple “How long have you been with the company?” can ease tension.
Use layered questioning: Follow up “Yes/No” questions with: “Can you walk me through how that works?” or “What happens next?”
Prompt with context: “When I reviewed the procedure, it mentioned X—how is that handled in your area?”
Be patient and unhurried: Silence is a tool. After a question, wait calmly. Many reserved auditees will fill the silence with additional information if not interrupted.

2. The Egoist

Characteristics:

Seeks to dominate the conversation.
May condescend or subtly undermine the auditor’s authority.
Talks more about theory than actual practice.

Enhanced Strategies:

Acknowledge their expertise: Use phrases like “You clearly have deep experience in this process” to soften defensiveness.
Redirect focus to conformity: “That’s a great point. Let’s tie it back to what the standard requires and how your team demonstrates that.”
Anchor with facts: Use documentation and objective evidence as neutral ground—“Let’s take a look at the latest calibration log to verify that.”
Avoid debates: Don’t match ego with ego. Instead, maintain a calm, confident presence grounded in your role and purpose.

3. The Perfectionist

Characteristics:

Presents carefully curated documents.
May try to steer you away from real-time observations.
Views any finding as a personal failure.

Enhanced Strategies:

Normalize findings: “It’s common for systems to evolve, and audits are a way to support that continuous improvement.”
Use the PDCA approach: Frame observations as part of the cycle—”This finding shows an opportunity to adjust and refine the process.”
Request real-time demonstrations: Ask to observe actual practices in the workplace—not just documentation—to validate implementation.
Showcase positive practices: Where applicable, cite strengths during the audit to balance critique and support their desire for excellence.

4. The Over-Talker

Characteristics:

Provides excessive detail, often going off-topic.
Turns simple answers into storytelling sessions.
May genuinely enjoy the audit—or be trying to obscure weak spots.

Enhanced Strategies:

Set time expectations upfront: “We’ve got 30 minutes scheduled to cover this section, so let’s focus on the core areas first.”
Use summary statements: “So, to confirm, your process begins with A, goes through B, and ends at C—is that correct?”
Politely interrupt: “Sorry to cut in—I just want to make sure we stay on track. Can you show me the documentation for that step?”
Assign structure: Give the auditee a format to follow. “Can you explain this in three steps—input, action, output?”

5. The Ghost

Characteristics:

Avoids being present.
Pushes responsibility to others.
Responds only under pressure.

Enhanced Strategies:

Secure buy-in from leadership: During opening meetings, confirm auditee availability and responsibilities with senior management.
Use formal scheduling tools: Calendar invites, email confirmations, and audit plans in writing create accountability.
Document delays diplomatically: If access is denied or delayed, note this in the audit record professionally.
Adapt and improvise: Shift to records review or interview other personnel if the primary auditee is unavailable. Highlight systemic access issues in findings if applicable.

6. The Nervous Novice

Characteristics:

Easily flustered.
May fear saying the “wrong thing.”
Often new to audits or in a junior role.

Enhanced Strategies:

Create a low-pressure environment: Explain that the audit is not a test of their personal performance.
Break questions down: Instead of asking “How does your process ensure compliance with Clause 8.5.1?”, ask “What’s the first step you take when starting this task?”
Avoid audit jargon: Use plain language, e.g., “How do you make sure things are done the right way every time?”
Reassure through transparency: Let them know what you’ll be asking and why. “Next, I’d like to look at how you manage incoming materials—is that okay?”

Final Thoughts: Mastering the Human Element of Auditing

At its core, auditing is not just about finding nonconformities—it’s about understanding how people interact with systems. Every auditee, no matter how challenging, offers insight into how the organization truly functions. As auditors, our role is not to judge personalities but to uncover evidence that reflects the effectiveness of processes. This requires patience, emotional intelligence, and a steady commitment to impartiality.

By adapting our approach to the individual while remaining anchored in the audit objectives, we build credibility and foster cooperation—even in the most resistant environments. Ultimately, the success of an audit is measured not only in findings, but in the quality of the dialogue, the clarity of the evidence, and the positive influence it has on continual improvement. A skilled auditor doesn’t just complete a checklist—they leave behind a stronger, more self-aware organization.

The article was recently published in “The Auditor” An Exemplar Global publication.

Clause 4.1 of ISO 9001: Understanding Context of the Organization

When ISO 9001 was revised in 2015, Clause 4.1 – Context of the Organization became a game-changer. It requires U.S. companies to analyze internal and external factors that affect their management system.

This means ISO is no longer just about procedures—it’s about aligning quality with business strategy.

What “Context of the Organization” Really Means

Clause 4.1 asks companies to evaluate:

Internal factors (culture, resources, performance).
External factors (markets, regulations, technology, competition).
Stakeholder needs (customers, regulators, suppliers).

For example, a U.S. medical device company may identify FDA regulations as a critical external factor, while workforce skills are an internal factor.

How Clause 4.1 Drives Risk-Based Thinking

For U.S. businesses, Clause 4.1 of ISO 9001 ensures quality systems are not isolated. They:

Link directly to strategic goals.
Align with customer and regulatory expectations.
Adapt faster to market changes.

How QMII Helps Identify and Analyze Context

At QMII, we guide companies through context analysis using tools like SWOT and PESTLE. We help organizations connect ISO systems with their business environment—turning Clause 4.1 into a strategic advantage.

Conclusion: Clause 4.1 as a Foundation for Success

Understanding the context of the organization is not just compliance—it’s strategy. By applying Clause 4.1 effectively, U.S. companies align ISO with growth and resilience.

With QMII’s expertise, businesses turn a requirement into a roadmap for competitive strength.

Read: What is quality manual system?

Need help turning Clause 4.1 into strategic insight?

Visit www.qmii.com and explore our ISO 9001 consulting services to get started.

What Is Risk-Based Thinking in ISO Standards?

Over the past two decades of working closely with clients in both the manufacturing and service sectors, I’ve witnessed firsthand the transformation that occurs when organizations stop treating compliance as a checklist exercise and start thinking in terms of risk and opportunity. With the 2015 revisions to many ISO standards, particularly ISO 9001, we saw a deliberate shift away from siloed “preventive actions” toward an integrated, strategic approach known as Risk-Based Thinking (RBT).

This wasn’t just a semantic change. It marked a cultural evolution, an acknowledgment that uncertainty is inherent in every business process, and that success belongs to those who plan for it, not those who simply react to it. RBT has empowered organizations to navigate complexity with greater confidence, embedding foresight into their planning and decision-making at all levels.

In this article, I’ll draw from real-world consulting experiences across diverse industries to demystify Risk-Based Thinking. We’ll explore what it really means, why it matters, how it supports proactive leadership, and what tools you can use to bring it to life within your own management system. Whether you’re guiding a mature enterprise or a fast-scaling startup, the principles of RBT are not only practical, but they’re also essential.

What Is Risk-Based Thinking (RBT)?

Risk-Based Thinking (RBT) is the proactive approach embedded in ISO standards like ISO 9001:2015, ISO 14001:2015, and ISO 45001:2018. Rather than treating risk as a separate component, RBT integrates it into every facet of an organization’s management system. This shift moves organizations from a reactive stance to a proactive culture, where potential issues are anticipated and addressed before they escalate.

In my consulting journey, I’ve observed that organizations embracing RBT don’t just prevent problems, they identify opportunities for improvement and innovation. For instance, a manufacturing client leveraged RBT to streamline their supply chain, resulting in reduced lead times and increased customer satisfaction.

How Risk-Based Thinking Supports Proactive Decision-Making:

Identifying Potential Risks and Opportunities: By assessing both internal and external factors, organizations can foresee strategic and operational challenges and capitalize on opportunities.
Integrating Risk Assessment into Planning: This ensures that objectives are achievable, and resources are allocated effectively.
Enhancing Stakeholder Confidence: Demonstrating a proactive approach to risk management builds trust among customers, suppliers, and regulators.

A service industry client I worked with implemented RBT in their project management processes. This led to improved project delivery times and a significant reduction in unforeseen issues.

Key Objectives of Risk-Based Thinking:

The primary goals of RBT include:

Enhancing Organizational Resilience: By anticipating potential disruptions, organizations can develop contingency plans.
Promoting Continuous Improvement: Regular risk assessments lead to ongoing enhancements in processes and systems.
Aligning Risk Management with Strategic Objectives: Ensuring that risk considerations are integral to achieving business goals. Read clause 6.1 connected to clause 4.1 and 4.1 per ISO harmonized structure.
Fostering a Culture of Risk Awareness: Encouraging employees at all levels to consider risk in their daily activities. Clause 7.3 drives awareness to employees on how they can contribute to the system.

Practical Application of Risk-Based Thinking:

Implementing RBT involves:

Contextual Analysis: Understanding the organization’s internal and external environment.
Risk Identification: Recognizing potential events that could impact objectives.
Risk Assessment: Evaluating the likelihood and impact of identified risks.
Risk Treatment: Determining appropriate actions to mitigate or capitalize on risks.
Monitoring and Review: Continuously tracking risk factors and adjusting strategies accordingly.

Comparison: Preventive Action (Old) vs. RBT (New):

Previously, ISO standards emphasized preventive actions as separate clauses. However, this often led to a checkbox mentality, where organizations implemented measures without truly integrating them into their processes.

With RBT:

Integration: Risk considerations are embedded throughout the management system.
Proactivity: Organizations anticipate and address potential issues before they occur.
Flexibility: RBT allows for tailored approaches based on the organization’s specific context.

This evolution encourages a more dynamic and effective approach to risk management.

Tools & Techniques to Support Risk-Based Thinking:

1. SWOT Analysis (Strengths, Weaknesses, Opportunities, Threats)

Use: SWOT analysis helps organizations evaluate their internal strengths and weaknesses, alongside external opportunities and threats. It’s particularly useful during strategic planning sessions or when entering new markets or launching new products.

When to Use: Early in the business planning process or during the review of the organization’s context.

Clause Alignment: ISO 9001:2015 – Clause 4.1 (Understanding the organization and its context) and Clause 6.1 (Actions to address risks and opportunities). This tool ensures that strategy and quality objectives are grounded in a realistic assessment of the internal and external environment.

2. Failure Mode and Effects Analysis (FMEA)

Use: FMEA systematically evaluates potential failure points in a product, process, or system and ranks them by severity, occurrence, and detection. It’s widely used in manufacturing, healthcare, and aerospace sectors.

When to Use: During product design, process development, or when implementing changes that could introduce new risks.

Clause Alignment: ISO 9001:2015 – Clause 8.3 (Design and development of products and services) and Clause 6.1 and 8.1. It supports risk-based planning and preventive strategies by analyzing “what could go wrong” and mitigating those risks before implementation.

3. Risk Registers

Use: A risk register is a living document that captures identified risks, assesses their likelihood and impact, and outlines mitigation actions and responsible parties. It provides transparency and traceability for risk management activities.

When to Use: Continuously throughout project lifecycles or operational management, especially in industries like construction, logistics, or IT.

Clause Alignment: ISO 9001:2015 – Clause 6.1 and Clause 9.1 (Monitoring, measurement, analysis and evaluation). It helps document ongoing risk review processes and links actions to strategic and operational plans. While not a requirement it is beneficial.

4. Root Cause Analysis (RCA)

Use: RCA investigates underlying causes of nonconformities, defects, or failures to prevent recurrence rather than just treating symptoms. It’s a staple in corrective action processes.

When to Use: After incidents, near misses, or nonconformities—often triggered by audit findings or customer complaints.

Clause Alignment: ISO 9001:2015 – Clause 10.2 (Nonconformity and corrective action). It supports continual improvement by ensuring lessons are learned and corrective actions address the source of problems.

5. ISO/IEC 31010 – Risk Assessment Techniques

Use: This standard outlines a variety of risk assessment tools including brainstorming, checklists, fault tree analysis, and bowtie analysis. It offers structured approaches tailored to industry-specific needs.

When to Use: Depending on organizational maturity, criticality of operations, or regulatory environment.

Clause Alignment: Supports ISO 9001:2015 – Clause 6.1, as well as clauses in ISO 14001 and ISO 45001 related to risk and opportunity planning. This framework provides flexibility for choosing appropriate methods suited to specific organizational risks.

These tools, when chosen and applied correctly, don’t just satisfy audit checklists, they cultivate a culture of resilience and foresight. Over the years, I’ve seen organizations evolve by not just using these techniques mechanically, but integrating them into daily decision-making, making risk-based thinking a true operational philosophy rather than a compliance exercise.

—

About the Author

Dr. Julius is a Senior Consultant at QMII with over 25 years of experience in ISO and aerospace quality systems. He has trained and guided hundreds of U.S. defense contractors on AS9100 and compliance, turning certification into a competitive advantage.

Understanding ISM Code Compliance for Maritime Operators

Having spent over 15 years in the maritime and compliance world, and a further decade working with various international Flag Administrations, I’ve seen firsthand the shift from traditional shipping operations to a more safety- and systems-driven industry. One of the major forces behind that transformation? The International Safety Management (ISM) Code. For maritime operators today, ISM Code compliance isn’t just about ticking boxes, it’s about embedding a culture of safety, responsibility, and continual improvement into every layer of their operation.

What is the ISM Code?

There is a saying that regulations are written in blood. The ISM Code was born out of hard lessons learned from major marine accidents. The major event that acted as a catalyst in its development was the MV Hearld of Free Enterprise. Introduced by the International Maritime Organization (IMO) under the SOLAS convention, the code mandates that every shipping company operating SOLAS compliant vessels implement a Safety Management System (SMS), a system that governs practices for the safe operation of ships and prevention of marine pollution.

I remember when the ISM Code first rolled out in the ’90s. Many shipowners were skeptical, and some even resistant. Back then, I was sailing with a company who was navigating the early implementation. The real challenge was shifting the mindset, from reactive firefighting to proactive risk management. From a documentation exercise to a shift in the way operations were done. That’s where I learned: policies are easy to write, but real compliance starts with people.

Why ISM Code Compliance Matters More Than Ever

Today, ISM Code compliance is not optional—it’s foundational. For operators navigating increasingly complex global regulations, it offers several key benefits:

Safety First: The SMS serves as a blueprint for safe operations at sea. I’ve seen it reduce incidents dramatically when implemented properly.
Environmental Responsibility: With public scrutiny and environmental regulations tightening, having structured pollution control measures is non-negotiable.
Credibility & Trust: In one of my past sailing tenures with a major operator, ISM compliance helped secure long-term contracts with charterers. Clients want to work with companies that can prove they’re managing risks responsibly.
Operational Clarity: When roles, responsibilities, and procedures are clearly outlined, decision-making becomes faster and more consistent.

The Core Objectives of the ISM Code

The ISM Code objectives listed in clause 1.2 remain as relevant now as when the code was first introduced. Clause 1.2 is about outcomes, not just documents. It’s about creating a system that actually prevents harm, not just reacts to it.

For me, ISM Code compliance under Clause 1.2 isn’t just about passing an audit, it’s about building a culture where every person onboard understands their role in safeguarding lives, the vessel, and the environment. It requires integrating risk assessments into planning, ensuring safe working practices, maintaining the ship properly, and always being prepared for emergencies.

I always emphasize these objectives when training ship and shore staff. It’s not about overwhelming them with paperwork, it’s about aligning them with a purpose. The code provides the structure; we provide the commitment.

Key Elements of ISM Code Compliance

A fully compliant SMS includes:

Safety and Environmental Protection Policy
Defined Roles and Responsibilities
Safe Operating Procedures
Emergency Preparedness
Reporting and Analysis of Incidents
Internal Audits and Continuous Improvement

One of the best implementations I facilitated was for a regional bulk carrier. We not only developed the vessel SMS but aligned office procedures, and built an SMS that didn’t just sit in a manual, it lived on the bridge, in the boardroom and in the daily practices of personnel.

The Compliance Process for Maritime Operators

Getting compliant involves more than a checklist. Here’s a simplified roadmap:

Gap Analysis – Review what you already do and what the code expects. Does it reflect the operational reality or is it a fictional system?
SMS Development/Update – Build or refine your safety management system. Comprehensive reviews when done after many years can lead to a reduction in documentation by over 20 percent.
Training & Awareness – Everyone onboard and ashore must know their part. How do they contribute to the effectiveness of the system.
Certification – Obtain the Document of Compliance (DOC) and Safety Management Certificate (SMC) through audits.
Ongoing Monitoring – Regular internal audits and management reviews keep the system alive and evolving.

Common Challenges in ISM Code Compliance

Let’s be real, compliance has its hurdles:

Top-down Disconnect: Without leadership buy-in, the SMS becomes a box-ticking exercise.
Crew Resistance: “We’ve always done it this way” is a common attitude.
Training Gaps: If your crew doesn’t understand the ‘why’ behind procedures, they won’t follow them.
Audit Fatigue: Poor recordkeeping and rushed preparation can derail audits.

My advice? Keep it simple. Make procedures practical, not bureaucratic. Involve the crew in developing routines. That’s how you make compliance sustainable.

The Future of ISM Code Compliance and Technology’s Role

The maritime industry is changing fast. Digital tools are making compliance easier and smarter:

Cloud-based SMS systems offer real-time updates and reduce paperwork.
Remote audits became mainstream during the pandemic—and they’re here to stay. Where a full remote audit is not feasible consider hybrid audits.
Data analytics can identify patterns in incidents and help prevent them.
Mobile apps for onboard reporting are empowering seafarers to be active players in the compliance process.

Look at mistake proofing of the system. So even if a human wanted to make an error the system would prevent it.

In Conclusion, ISM Code compliance isn’t just about certificates. It’s about creating a safety culture that protects your people, your assets, and the environment. For maritime operators willing to invest the effort, the returns in safety, efficiency, and reputation are well worth it.

If you’re a maritime operator looking to simplify or strengthen your ISM safety management system, I’m happy to share more from my experiences. As someone who’s walked ship decks, sat in boardrooms, worked with Flag Administrations and led audits, I believe that compliance done right isn’t a burden-it’s a competitive advantage.

—

About the Author

#managementsystems ISM Code ism code compliance

Internal vs External Audits: What Every Business Owner Should Know

The Strategic Importance of Audits for Business Owners

Audits are more than compliance checks; they are strategic tools that provide insights into performance, risk, and improvement opportunities. Engaged business leaders use audit results to drive better decision-making and long-term success. When conducting well, they provide leadership insights into where they may have to re-prioritize or allocate resources, where policies may be in conflict, what may be working well and where the system needs their leadership intervention.

What Are Internal and External Audits?

Internal Audits: Performed by or for the organization to check its own processes. These may be process audits or full system audits.

External Audits: These could be supplier audits (second party) or certification regulatory audits (third party). Third party audits are conducted by a third-party or certification body to verify compliance with standards.

Internal and external audits differ in breadth and depth of the audit based on scope and objective.

Why External Audits Should Be Taken Seriously?

External audits affect certification, reputation, and client confidence. A successful external audit demonstrates credibility and reliability.

Tip: Be prepared, be honest, and see auditors as partners in your improvement journey.

How to Prepare for Both Audits?

Keep documentation current
Review and close previous findings
Train staff on audit processes
Conduct mock audits
Engage leadership in the audit process

Conclusion:

ISO audit and their findings are not to be feared. They are valuable tools for identifying weaknesses and driving continuous improvement. With the right mindset and preparation, audits can move beyond mere compliance and become a core part of your strategic growth. Organizations that stay audit-ready show that they are not only compliant but also committed to excellence.

—

About the Author