Category: Management System

Employees Ignore the QMS: How to Build Real Buy-In Beyond the Quality Team

ISO 9001:2026 just dropped and leadership promoting a quality culture is one of the new requirements. Since inception in 1986 QMII has stressed that an effective management system means more than just a folder of documents. True system effectiveness comes from personnel motivated, competent and knowledgeable of the requirements. Often with a poorly implemented system gaining QMS employee engagement can be a challenge. This leaves the quality manager doing all the heavy lifting and the system engagement only coming the week before an audit.

In this article I seek to highlight the steps organizations can take to gain engagement from the workforce. The steps outlined will help organizations reduce the resistance to change and move the mindset from one of just compliance. QMII’s clients’ have benefitted from this over the years and so should you.

Why Employees Treat the QMS as “Quality Team Paperwork”

As I visit clients for the first time, I hear people refer to me as “the ISO guy”. Herein is probably the first mistake that organizations make in their quality management system implementation journey. Treating the system as an ISO system or a quality system rather than how the company operates and gets work done. In doing so organizations tend to document their system to meet audit and customer requirements, prepare to pass audits and treat their QMS as an add-on that can be switched on and off as needed.

As with any change, implementing a QMS will come with this fair share of resistance. Each employee wants to know what’s in it for me. Why should they keep these additional records and document what they do when perhaps their pay will see no increase. Some have concerns about their job security if they document how they do what they do. Others feel they will be restricted in what they do and perhaps there will also be more documented accountability. All valid fears that must be alleviated by the leadership in explaining why the system is important and why personnel should treat their QMS as more than just paperwork.

If you walk onto the shop floor and do not see personnel using the QMS documentation because “I know better”, “I’ve been doing it this way for years” or “It ain’t broke so why fix it” then you know you have a QMS that exists only on paper.

What ISO 9001 Actually Expects from Employees

Before I speak about what ISO 9001 expects from the employees I want to focus on what it requires of Leadership. While a QMS requires engagement from all personnel the onus to promote that engagement, support other leadership roles in implementing the system and encouraging continual improvement lies with the leadership. Leadership is accountable for the success of the system. The leadership must convey their expectations via the policy and objectives and then provide the resources needed to achieve it. They must define clear roles and responsibilities and determine the competency requirements for each position in the organization.

With the framework above set, leaders must now focus on hiring and maintaining competent personnel. In addition, they must drive awareness of the system among the workforce. In ISO 9001:2026 clause 5.2 requires the policy to be communicated, understood and applied. This means that the workforce must understand how they contribute to the policy and then apply it in their daily job. When the entire workforce is working towards a common goal as outline in the policy and objectives then it can be said that the quality culture is good. The workforce must recognize why they should not take shortcuts, who to report to when they notice a risk and the ability to stop work if needed.

A common myth is that a QMS and the ISO 9001 standard requires employees to follow procedures, obey leadership and cross train others. None of these are requirements of the standard. Outlined below are five simple steps to encourage more active participation in the system.

Fix 1: Connect Quality Objectives to Each Role

As stated in the previous paragraph it is important to have measurable goals (also required by the standard). Once the processes have been defined then relevant process owners need to be assigned. Each process owner then defines the process to the extent needed only to have confidence that the process is being carried out as planned. Thus, documentation will vary based on the size of the organization, structure, number of personnel and their experience and the complexity of the process.

ISO 9001 does not limit the number of goals that can be set. Each process can have its own measurable goal, so long as it contributes to the overall objective and does not conflict with any other objective /KPI.

Outlined below is a simple example of an objective cascade through an organization.

Example QMS Objective Cascade
Level	Objective	Measure and Target	Owner
Organization	Improve customer satisfaction.	Increase the customer satisfaction score from 88% to 92% by year-end.	Top management
Operations process	Improve on-time delivery.	Increase on-time delivery from 90% to 96% by the end of Q4.	Operations manager
Production team	Reduce delays caused by rework.	Reduce rework from 5% to 2% of units produced by the end of Q3.	Production supervisor

Fix 2: Make Leadership Visible

I’ve been working with a number of organization and even through my own career nothing makes a system more effective that visible leadership. This is the reason when I audit, I ask leadership, “How do personnel evidence your commitment”? Top Management must walk the talk. A policy signed and posted on the notice board has no value when the leadership does not provide the resources to support it. When they bypass the requirements, they set for others and when quality goals are adjusted to pass audits.

Leadership must actively participate in contextual risk reviews, their decision making must be evident in the various operational aspects, and they must actively participate in management reviews. When non-conformities occur, they must ensure effective and timely action. Also, when the corrective action is ineffective, they must question why. Other ways that leadership commitment may be evidenced is in them refacing the QMS in meetings, effective communication on the state of the system to all and GEMBA walks.

For leadership a simple way to gain buy in is to not refer to the management system as the QMS. Take quality out of the name and put your company name in there so personnel “own” the system. Gain their inputs when documenting the system.

Fix 3: Replace Generic Training with Role-Based Awareness

The standard ISO 9001 does not ask for training. It requires competence. This minor difference is often lost in implementation where many companies I work with read competence as training. Competence is the ability to apply skills and knowledge effectively and training merely provides that knowledge. A leader that says they care about the system and in driving competence among personnel but then do not want to commit the time or resources to train those personnel does not show commitment.

Apart from competence the standard requires awareness training. Here is where employees need to be trained in how they can contribute to the system. This includes what to do when they evidence risks, how to recommend changes to documentation and whom to report opportunities for improvement to. They need to understand why the QMS supports them in all they do. QMS awareness training when implemented during employee onboarding should be followed by a refresher training at some periodic basis.

If you would like a template for training your employees on your QMS reach out to QMII at [email protected] .

Fix 4: Simplify Procedures and Forms

When consultants are brought in to design your system, they write the procedures based on their experience and with templates they have used in the past. QMII’s approach is to work with companies to capture the documentation the way work is actually done. No assumptions made and no fictional procedures are captured. This ensure that you say what you do and do what you say.

Consider how you can simplify QMS documentation so its easy for the user to locate and use. Think beyond procedures documented in MS word. Consider how to video files, posters, graphical representations, screen shots, flowcharts and more. Make the documentation user-friendly to locate and reference. Think computers at the point of use for ease of reference. Make suggesting changes to documentation easy while ensuring adequate control.

• Effective document control and compliance guide

Fix 5: Recognize and Involve People

People are more likely to support the QMS when their ideas and contributions are recognized. Recognition does not need to be expensive. Leaders can highlight useful suggestions in team meetings, thank employees who identify risks or improvement opportunities, and share examples where an employee’s input prevented a problem. These simple actions reinforce the message that quality is everyone’s responsibility and help build a culture of continual improvement.

Involvement is equally important. Organizations can introduce suggestion schemes, quality circles, and regular feedback loops that give personnel a simple way to recommend changes. In creating new documents gain reviews of the document from all relevant interested parties prior publishing the document .Employees from different departments can also be trained as internal auditors, allowing them to better understand how processes connect while bringing a fresh perspective to audits. When personnel see that their input leads to action, they are more likely to take ownership of the management system.

Measuring Whether Buy-In Is Improving

Employee buy-in should be visible in how the QMS performs. Look for fewer repeat audit findings, more near-miss and improvement reports, completed role-based awareness activities, and stronger employee feedback in surveys and management reviews. Positive trends in these simple indicators show that personnel are moving beyond compliance and taking ownership of the system.

A QMS becomes effective when objectives connect to each role, leaders remain visible, awareness is relevant, documentation is easy to use, and people are recognized for contributing. When employees see the system as the way the organization works engagement and the quality culture improve. Internal Auditor and Lead Auditor training can further build the skills needed to sustain that involvement and continual improvement.

About the Author

Julius DeSilva is CEO of QMII (Quality Management International, Inc.), with more than 25 years of experience in quality management systems, maritime safety and security, and information security. A former seagoing officer and Exemplar Global Certified Lead Auditor (ISO 9001, ISO 27001, ISO 50001, RC14001), he has trained over 1,500 professionals as lead auditors and led consulting and auditing engagements across manufacturing, government, maritime, and aerospace sectors. He holds an MBA from the Darden School of Business, University of Virginia, and is an Associate Fellow of the Nautical Institute.

ISO9001 Qualitymanagementsystems

Maximizing Infrastructure and Enterprise Value: The Strategic Imperative of ISO 55001 in Asset Management

In asset-intensive industries, physical assets, ranging from high-speed railway tracks and power distribution grids to massive petrochemical refining units and municipal water networks, represent the backbone of operational capability and capital expenditure. Historically, organizations viewed asset management through a narrow, siloed lens of treating maintenance as a cost center, capital planning was dictated by short-term budgeting cycles, and risk management was reactive.

The advent of ISO 55001, the international standard for Asset Management Systems (AMS), fundamentally transformed this paradigm. ISO 55001 provides a globally recognized framework that enables organizations to derive maximum value from their assets, balance financial costs against operational risks, and align day-to-day engineering and operational decisions with overarching corporate objectives. For global engineering and industrial leaders, ISO 55001 is not merely a mechanism for compliance; it is a vital competitive differentiator in delivering complex infrastructure and industrial projects across diverse markets.

Introduction: The Shift from Maintenance to Value Realization:

Therefore, the question as to why companies should adopt ISO 55001? Core drivers and business benefits of adopting an asset management system aligned with ISO 55001 delivers profound operational, financial, and strategic advantages. The standard steers companies away from firefighting and toward systematic value creation by:

Optimized Financial Performance and Capital Allocation: Physical assets require heavy capital investment. ISO 55001 helps organizations optimize total cost of ownership (TCO) by evaluating assets across their entire lifecycle, from creation and acquisition to utilization, maintenance, and ultimate disposal.
Data-Driven Decision Making: By establishing rigid criteria for data quality, traceability, and information management, the standard prevents costly decisions based on intuition or fragmented spreadsheets.
Proactive Risk and Vulnerability Management: Rather than responding to catastrophic equipment failures, ISO 55001 requires systematic risk identification, ensuring that operational hazards, environmental shifts, and obsolescence are addressed proactively.
Stakeholder and Regulatory Confidence: Implementation of the standard gives an organization the best systematic approach to procure, plan, design where needed, and provide assets. Certification provides independent validation that an organization exercises elite governance, reassuring investors, regulatory bodies, and public stakeholders that assets are managed safely and sustainably.

Salient Features and Clause-by-Clause Justifications:

ISO 55001 is built on the Annex SL high-level structure, aligning seamlessly with other management standards like ISO 9001 (Quality) and ISO 14001 (Environment). Below is an exploration of the key clauses and how they drive organizational excellence.

Clause 4: Context of the Organization

The Mandate: An organization must define the internal and external issues affecting its asset management system, understand stakeholder expectations, and account for emerging macro-factors such as climate change and regulatory shifts.
Justification: For example, for an aircraft fleet, a power generation plant, or a rail engineering consultancy, understanding context means recognizing that regional environmental factors (heavy coastal rainfall, seismic risks, corrosive atmospheres, and temperature swings) directly impact asset deterioration rates and dictate maintenance parameters.

Clause 5: Leadership and Commitment

The Mandate: Top management must demonstrate active leadership by establishing the asset management policy, ensuring integration with business processes, and ensuring resources are available.
Justification: Asset management fails when left exclusively to maintenance technicians and plant floor engineers. Clause 5 ensures executive alignment, tying asset health directly to financial viability and corporate reputation.

Clause 6: Planning (Featuring the Strategic Asset Management Plan (SAMP) and the Management Role):

The Mandate: Organizations must address risks and opportunities and establish a SAMP. The SAMP serves as the crucial “line of sight” linking high-level corporate goals to day-to-day asset tasks.
The Executive and Management Role in Creating the SAMP: Leadership cannot simply delegate the SAMP to lower-level planners (clause 5.1a). Top management and operational leadership must actively drive its creation by defining the organization’s long-term financial risk appetite, establishing organizational objectives, and allocating cross-functional resources. Management bridges the gap between boardroom financial targets (such as Return on Capital Employed) and front-line maintenance strategies, ensuring that the SAMP realistically reflects both commercial pressures and technical constraints.
Justification: This is often considered the heart of the standard. It prevents short-term budget cuts from gutting long-term preventative maintenance schedules, safeguarding infrastructure longevity.

Clause 7: Support (Information, Data, and Knowledge Management)

The Mandate: Requires robust processes for resource allocation, competence, communication, and notably, data, information, and knowledge management (Clauses 7.6 and 7.7).
Justification: For example, modern rail networks, smart electrical grids, and automated manufacturing plants generate massive telemetry streams. Clause 7 ensures that asset registries, financial data, and historical maintenance logs are accurate, traceable, and institutionalized rather than locked in individual employee silos.

Clause 8: Operation (Life Cycle Management and Outsourcing):

The Mandate: Operational planning and control must explicitly govern the asset life cycle, operational execution, management of change, and the control of outsourced activities.
Justification: Complex industrial projects routinely involve multi-tier supply chains and external contractors. Clause 8.3 ensures that third-party vendors adhere to the same rigorous asset safety and quality thresholds as the parent organization.

Clause 9 & 10: Performance Evaluation and Improvement (Predictive Action)

The Mandate: Organizations must monitor, measure, analyze, and evaluate asset performance through internal audits and management reviews, transitioning from reactive fixes to Predictive Action (Clause 10.3).
Justification: Rather than waiting, for example, for a rail track circuit to fail, a power transformer to blow, or a refinery pump to seize, predictive action leverages condition-monitoring and IoT (Internet of Things) data to intervene at the optimal economic and safety tipping point.

Practical Application: ISO 55001 Across Diverse Engineering and Industrial Sectors:

The true power of ISO 55001 is best illustrated across a spectrum of asset-intensive industries where safety, asset density, and capital intensity are exceptionally high.

A. Railway and Transit Systems

Track Maintenance Scheduling: Instead of relying purely on calendar-based inspections, an ISO 55001 framework integrates automated track-recording car data with dynamic load profiles. Under Clause 8 (Operation) and Clause 10.3 (Predictive Action), maintenance is triggered precisely when degradation trends approach risk thresholds, minimizing traffic disruptions.
Rolling Stock Lifecycle Economics: Rail cars have lifespans spanning decades. Using the SAMP (Clause 6.2.1), transit operators model mid-life overhauls against complete replacement costs, ensuring that capital expenditure (CapEx) and operational expenditure (OpEx) are balanced optimally across the 30-to-40-year asset horizon.

B. Electric Power Generation and Distribution

Grid Resiliency and Substation Management: Power utilities manage billions of dollars in transformers, switchgear, and transmission lines. By utilizing ISO 55001, utilities balance the risk of aging grid infrastructure against capital constraints.
Vegetation Management and Outage Prevention: Under Clause 6 (Planning) and Clause 8 (Operation), utilities utilize risk-based asset strategies to prioritize line-clearing and pole replacements in high-wildfire-risk zones, drastically reducing catastrophic failure probabilities and regulatory liabilities.

C. Oil, Gas, and Petrochemical Processing

Integrity Operating Windows (IOWs): In refineries and processing plants, pressure vessels, piping circuits, and rotating machinery operate under extreme temperatures and pressures. Planning per ISO 55001 ensures that corrosion monitoring data is tied directly to operational limits, preventing leaks and unscheduled shutdowns.
Decommissioning and Asset Retirement: The standard governs the entire lifecycle, ensuring that end-of-life abandonment, environmental remediation, and capital reinvestment provisions are budgeted decades before a facility shuts down.

D. Municipal Water and Wastewater Treatment

Pumping Station Reliability: Water authorities manage vast underground pipe networks and treatment facilities where failure results in public health crises. ISO 55001 helps municipalities prioritize pipe replacement schedules based on soil corrosivity, age, and consequence of failure, optimizing taxpayer funds.

Industry Spotlight: Engineering and Infrastructure Delivery:

As global engineering and industrial powerhouses deliver complex infrastructure, they maintain a vital operational footprint across continents, spearheading major transportation, energy, and urban development initiatives.

Why ISO 55001 Matters for Engineering and Asset Operations:

Bridging Design, Build, and Long-Term Operations: Major engineering firms frequently operate under progressive Design-Build-Finance-Operate-Maintain (DBFOM) delivery models. By embedding ISO 55001 principles into their engineering hubs, teams ensure that the assets they design and construct today are optimized for maintainability and total lifecycle cost decades into the future.
Navigating Environmental Realities: Operating across variable geographical regions exposes infrastructure to unique challenges—ranging from corrosive coastal marine environments to severe freeze-thaw cycles in mountain corridors. Utilizing Clause 4 (Context of the Organization) ensures that local climate risks are formally integrated into asset risk registers from day one.
Delivering Value to Asset Owners and Public Authorities: Municipal, provincial, and private asset owners increasingly mandate high standards of asset governance. By applying ISO 55001 frameworks, engineering teams provide clients with verifiable proof that their capital investments will achieve maximum availability, safety, and fiscal sustainability over generations.

Conclusion

ISO 55001 elevates asset management from a back-office maintenance function to a boardroom-level strategic advantage. By enforcing structural rigor across the entire asset lifecycle—from the contextual risk evaluations of Clause 4 and executive-driven SAMP creation under Clause 6 to the predictive actions of Clause 10—organizations protect their bottom line and secure public safety. Embracing this standard ensures that the complex infrastructure and industrial systems built today remain resilient, efficient, and valuable for decades to come.

About the Author

Inderjit (IJ) Arora, Ph.D., is the Chairman of QMII. He serves as a team leader for consulting, advising, auditing, and training regarding management systems. He has conducted many courses for the United States Coast Guard and is a popular speaker at several universities and forums on management systems. Arora is a Master Mariner who holds a Ph.D., a master’s degree, an MBA, and has a 35-year record of achievement in the military, mercantile marine, and civilian industry.

RCMS vs ISO 14001: Understanding the Responsible Care Management System for Chemical Companies

Chemical companies may think that by implementing ISO 14001 they meet the requirements for Responsible Care ®. ISO 14001 is an internationally accepted standard that provides the framework for an environmental management system. However, the Responsible Care ® program demands more. It adds a layer of requirements for Health & Safety and Security to be integrated along with environmental requirements.

Members of the American Chemistry Council (ACC) commit to implementing a system aligned to either the Responsible Care ® Management System (RCMS) Technical Specification or the RC 14001 which integrates the requirements of RCMS and ISO 14001 into one standard. Companies choosing the RC14001 standard can then claim conformity to both standards while putting in similar effort.

This article clarifies what each framework covers, where they overlap, and how to audit both efficiently

What RCMS Is and Who Requires It

Responsible Care ® is the American Chemistry Council’s (ACC) industry-wide performance initiative. It is not just an environmental standard. The need for a performance standard was identified following major incidents at chemical plants in the 1980s. RCMS is more than just a set of operational requirements. It outlines the requirements for a management system. Management systems include interaction from the highest level of the organization to the lowest level and enables effective interaction across processes.

ACC member companies are contractually required to certify to RC 14001 or RCMS; non-members may still be pulled in by customer or supply-chain requirements. Some organizations may voluntarily opt to confirm to the requirements of these standards. While RCMS is not a regulatory requirement, it is an obligation an ACC member opts to conform to.

RCMS follows the plan-do-check-act cycle and dovetails well with the requirements of ISO 14001. It expands upon the environmental requirements of ISO 14001 to include health & safety and security (HSS). It is also supported by the underlying ACC codes. Namely the Process Safety code, the Product Safety code and the Security code.

RCMS vs ISO 14001: Key Overlaps and Differences

Both standards, the RCMS and RC14001 are management system standards and thus based on the Plan-Do-Check-Act cycle. This means that both require the foundational aspects of a management system. These include leadership commitment, a documented policy, operational controls to manage identified risks, monitoring of the system, internal audits and management reviews.

Each of these standards also require the organization to determine their compliance obligations and to then take measures to meet them and evaluate them. The system as a whole is to be used to drive continual improvement. The key difference is that ISO 14001 has a focus solely on environmental requirements and does not address HSS requirements.

RCMS and RC14001 also integrate loosely via the Process Safety Code the OSHA PSM requirements. It is, however, not a replacement for these regulatory requirements. Further the two RC standards also address product stewardship which entails enhancing EHSS requirements throughout the supply chain from cradle to cradle.

Compared to ISO 14001, the RC standards also carry specific ACC-mandated elements (e.g., community outreach/CAER, security vulnerability assessments) with no ISO 14001 equivalent. There are also different certification requirements when it comes to RCMS and ISO 14001. The RCMS requiring just one audit by an approved provider every three years.

Why Chemical Companies Often Need Both

Depending on the customer base, especially when international, an organization can benefit from using the RC14001 standards. There is an increasing demand from stakeholders for sustainable production and procurement. As such many are seeking ISO 14001 certification. As a member of ACC companies that need to conform to RCMS may benefit from alignment with RC14001. Many downstream customers specify ISO 14001 certification contractually, independent of ACC membership

ACC membership requires member companies must certify to RC 14001 or RCMS on a fixed cycle to remain in good standing. There is however the added benefit to company reputation from an independent verification of practices to demonstrate to stakeholders and interested parties the organization’s commitment to EHSS goals.

Most chemical manufacturers end up needing both frameworks running concurrently rather than choosing one

Combining RCMS and ISO 14001 Audits

These standards aside, if your company has an integrated management system, there is no reason for you not to be doing integrated audits. So, what is an integrated audit? It is an audit where an auditor of team of auditors competent in the requirements of the various standards samples and assess the effectiveness of controls as determined and applied across the organizational processes. This to the various standards the company is certified to.

With ISO moving to the harmonized standard approach starting in 2013, most ISO management system standards including the RC14001 share the same 10 clause approach. This makes it easy to audit the system as there is shared audit evidence across standards. There is also cost savings to the company both from audit time of the auditor and the time of the auditee spent in the audit. There is less burden on the auditees overall from reduced audit fatigue.

An integrated audit essentially has a single audit schedule, combined checklists mapped to both standards’ (RCMS and ISO14001) clauses and one audit team covering both scopes. Companies choosing RC14001 have already integrated the requirements of RCMS and ISO 14001 into one standard and so perform a single audit. Integrated audits also result in fewer duplicate corrective actions for the same root cause

Building Auditor Competence for RCMS and RC14001

The above integrated audits require auditors preferably trained in both standards simultaneously, not two separately trained pools. This of course again to save on time and cost. QMII’s RC14001 Lead Auditor training approved by Exemplar Global covers the requirements of RCMS, RC14001 and the applicable ACC codes.

Auditors must understand the relevant additional RCMS elements in ISO 14001 and be able to be objectives if just performing and ISO 14001 audit versus an RCMS or RC14001 audit. An effective auditing course approaches audits as a positive activity that helps the organization identify improvement opportunities and audits as key in the preventive cycle. With this integrated competence auditors must remain objective and learn to look beyond documented processed to enable better inputs for leadership.

An auditing course apart from the requirements of the standard must also build competence in the principles of ISO 19011 and include hands on workshop that allow auditors to hit the ground running and to quickly contribute to their organization’s audit program.

Conclusion

In conclusion, RCMS and ISO 14001 aren’t competing standards, they’re complementary. RCMS adding in the HSS requirements to build on the foundation of an ISO 14001 if already in place. Those companies choosing between RCMS and RC14001 may want to opt from RC14001 given the later ease of integrating other ISO standards such as ISO 9001.

A well-trained auditor adds value to the system. They must provide good insight to the leadership on the state of the system, and this can only come from choosing a good sample, including whom to interview, questions to ask and documents to evidence.

ACC membership requires conformity to either RCMS or RC14001. Regardless of the option chosen by an organization, a trained audit team can only add value to the system. To learn more on the differences and build your auditing skills consider QMII’s RC14001 and RCMS Lead Auditor course.

Systematizing Government at all levels by using ISO 18091

The process-based management system approach gives any organization the best shot at systematically improving administration and addressing nonconformities, so the output of the administration is a confirming product as step one. The next step would be to continually improve the system and meet objectives. ISO 18091 (Quality management systems guidelines for the application of ISO 9001 in local government) is an international standard designed specifically to help local governments and municipal authorities implement effective quality management systems (QMS) based on ISO 9001. Using a standard which encompasses worldwide wisdom on the system approach as the basis of the system is better than reinventing the wheel every time.

The Technical committees for various standards (TC-176 for ISO 9001) bring to the table a lot of wisdom on which they frame these standards. ISO 18091:2019, the second edition, was reviewed and confirmed by ISO in 2024 and therefore remains current. It was prepared by ISO/TC 176, quality management and quality assurance. This is important because the guidance is connected directly to the accepted principles and requirements of ISO 9001 while recognizing that local government has responsibilities that are different from those of a commercial organization.

Government affects the citizen throughout life. Birth registration, education, public health, roads, water, sanitation, emergency services, licensing, land use and public safety are all delivered through processes. When these processes are left to personalities, informal practices or the priorities of the moment, results vary. A management system converts good intentions into defined responsibilities, controls, measures and opportunities for correction. It also helps preserve institutional knowledge when elected leaders or senior officials change.

The word systematizing should not be misunderstood as adding bureaucracy. The objective is to simplify and control the work so that it produces intended results. ISO 9001:2026, Clause 4.4, requires the organization to determine the processes needed for the QMS, their interactions, the criteria and methods for operation and control, the resources required, responsibilities, risks and opportunities, and the methods for evaluation and improvement. ISO 18091 explains how this process approach can be applied to public policy and municipal services.

Rather than creating a standalone set of requirements, ISO 18091 translates the core concepts, principles, and clauses of ISO 9001:2015 into terms, structures, and processes that directly address the public sector. The standard provides the core objectives for good administration particularly, citizen centric focus, reliability and transparency and alignment with UN (United Nations) SDGs (sustainable development goals) as follows:

Citizen-Centric Focus: Adapts the ISO 9001 concept of “customer satisfaction” into citizen satisfaction, focusing on key municipal responsibilities such as public safety, infrastructure, waste management, healthcare, and education.
Reliability & Transparency: Standardizes public administration processes to improve transparency, accountability, operational efficiency, and overall public trust (“Trusted Governance”).

Alignment with UN SDGs: Serves as a framework to implement, track, and measure progress toward the United Nations Sustainable Development Goals (SDGs) at the municipal level.

Citizen focus begins with understanding who the interested parties are and what they reasonably require. Clause 4.2 of ISO 9001 asks the organization to determine the relevant interested parties and their requirements. In a local government these parties extend beyond the person standing at a service counter. They include residents, visitors, businesses, employees, elected representatives, regulators, service contractors, vulnerable groups and future generations affected by present decisions. ISO 18091 helps the local government translate these different expectations into manageable processes and measurable public policy.

Leadership is central and Clause 5.1 requires top management to demonstrate leadership and commitment to the QMS. For local government this means that elected and appointed leaders cannot delegate the system to a quality coordinator and consider the work complete. Leaders must establish policy and objectives, provide resources, assign authority, review performance and act when results are not achieved. The system succeeds when it becomes the way the government manages, rather than a separate quality program maintained for an audit. Accountability remains with leaders and delegation of authority as per clause 5.3 would not mean leaders are not accountable.

Risk-based thinking also has direct public value. Clause 6.1 requires action on risks and opportunities. A municipality can therefore consider foreseeable interruptions and failures before they harm citizens: loss of drinking water, delayed permits, failure of waste collection, deterioration of roads, cyber incidents, extreme weather, contractor failure or loss of critical knowledge. Controls can then be proportionate to the consequence. The same analysis can identify opportunities such as digital services, shared resources, preventive maintenance and clearer communication with citizens.

A reliable system also distinguishes between correction and corrective action. If a citizen receives an incorrect permit, correcting the document solves the immediate problem. Clause 10.2 goes further by requiring the organization to react to the nonconformity, deal with its consequences, determine whether the cause could create the same or a similar failure elsewhere, implement needed action and review its effectiveness. This changes administration from repeated firefighting to prevention of recurrence.

The key Components and annexes of the standard include structured tools specifically tailored to municipal management. ISO 9001 remains the primary standard. ISO 18091 is not a sector specific standard in itself. It is a guideline enabling use of the ISO 9001 for governance. The standard provides:

Clause-by-Clause ISO 9001 Translation: Offers guidance on how each standard requirement (e.g., leadership, risk management, performance evaluation) applies to public policy and municipal administration.
Diagnostic Assessment Tool (Annex A): A self-assessment tool utilizing 39 key performance indicators across four broad policy categories:
- Institutional development for good governance
- Sustainable economic development
- Social development
- Sustainable environmental development

Integral Quality Management Processes (Annex B): Guidance on designing and maintaining processes that ensure reliable public service delivery.
Integral Citizen Observatories (Annex C): Guidelines for engaging citizens directly in monitoring public policy, fostering transparency and continuous improvement.
UN Agenda 2030 Alignment (Annex D): Maps local government management indicators directly to the 17 UN Sustainable Development Goals.

The clause-by-clause guidance covers the full management cycle: context in clause 4, leadership in clause 5, planning in clause 6, support in clause 7, operation in clause 8, performance evaluation in clause 9 and improvement in clause 10. This sequence is useful because it prevents a government from jumping directly to measurement without first defining its purpose, processes, responsibilities and controls. Measurement then becomes evidence for decisions rather than a collection of statistics with no clear use.

Annex A can provide the starting point. Its 39 indicators enable a local government to examine public policy as an integrated whole. The value lies less in declaring a score and more in identifying where conditions are unacceptable, where essential practices are only partly established and where results are being sustained. Priorities can then be based on evidence, citizen need and risk. Periodic reassessment provides a visible record of progress and exposes areas that remain dependent on temporary effort.

Annex B supports the process view. Services such as issuing a license or repairing a road are rarely the work of one department from beginning to end. They require inputs, decisions, resources, contractors, information and communication across organizational boundaries. Mapping these interactions helps identify delays, duplication, unclear handoffs and missing controls. It also allows objectives to be assigned to the complete service, not merely to the activity of an individual department.

Annex C recognizes that citizens should not be treated only as passive recipients of government output. An integral citizen observatory provides a structured way for citizens to observe public policy, examine evidence and contribute to accountability. Citizen participation becomes more useful when it is based on defined indicators and verified information. It can confirm where services are working and identify gaps that internal reporting may overlook.

Annex D connects the local indicators to the UN Sustainable Development Goals and to other assessment and management systems. This helps local government translate broad global commitments into local processes and measures. A goal such as clean water, sustainable communities or climate action becomes meaningful only when responsibility, resources, controls, measures and follow-up are established at the level where services are delivered.

The key difference in ISO 18091 from the primary standard ISO 9001 is the guidelines. ISO 9001 provides generic requirements for any organization, whereas ISO 18091 is a sector-specific guide. It does not add or alter ISO 9001’s fundamental requirements; rather, it bridges the gap between private-sector quality management language and the multi-stakeholder, public-policy realities of local government.

This distinction is important for certification. A local government may be assessed for conformity to ISO 9001, but ISO 18091 itself supplies guidance and does not create additional certifiable requirements. The guidance should therefore be used to make the ISO 9001 system relevant and effective, not as a checklist that produces another layer of documentation.

Clause 7 helps ensure that plans are supported by competent people, suitable infrastructure, organizational knowledge, communication and controlled documented information. In government, documented information provides continuity and transparency, but documentation should serve the process. A procedure that is not followed, a record that is not analyzed or a measure that does not support a decision adds little value. The necessary amount and form of documentation should depend on complexity, risk, competence and the need for accountability.

Clause 8 brings the discipline to service delivery. Requirements must be understood, changes controlled, external providers managed and nonconforming outputs identified. This is particularly relevant because many public services are delivered through contractors or partnerships. Outsourcing an activity does not outsource accountability. The local government must determine the controls needed to ensure that externally provided processes and services continue to meet requirements.

Clauses 9.1, 9.2 and 9.3 close the management loop through monitoring, internal audit and management review. Clause 9.1.2 addresses customer satisfaction; ISO 18091 places this in the context of citizens and other interested parties. Satisfaction surveys can contribute evidence, but they are not enough by themselves. Service times, complaints, recurrence of failures, infrastructure condition, regulatory compliance, access, cost and achievement of public objectives provide a fuller picture. Internal audit should test whether processes are implemented and effective, while management review should lead to decisions on improvement, resources and needed changes.

Implementation can begin on a manageable scale. The local government can define its context and interested parties, use Annex A for an initial diagnosis, select one or two high-impact services, map their processes, establish measures and responsibilities, and begin the cycle of audit, review and corrective action. Early projects should demonstrate that the system makes work clearer and services more reliable. Lessons can then be applied across other departments and levels of government.

The benefits are practical. Citizens receive more consistent services and clearer information. Employees understand responsibilities and handoffs. Leaders receive evidence on whether policies are producing intended results. Suppliers and contractors work within defined controls. Problems are recorded and their causes addressed. Objectives are linked to resources and reviewed. Transparency improves because processes, measures and decisions can be explained.

ISO 18091 can therefore help systematize government without attempting to standardize political choices or make every municipality identical. ISO 9001 itself does not require uniformity in the structure of quality management systems. Each government retains its mandate, priorities and local context. What becomes systematic is the method used to understand needs, plan services, manage risk, deliver outputs, evaluate results and improve.

The real test of good governance is not the number of procedures written or certificates displayed. It is whether the administration consistently fulfills requirements, corrects failures, learns from evidence and improves the results experienced by citizens. ISO 18091 provides a sound guideline for doing this. Used by leadership and team with purpose, it can make government more reliable, transparent and capable of sustaining improvement beyond changes in personalities and political terms.

About the Author:

IATF 16949 vs ISO 9001: What the Automotive Suppliers Need to Know Before Auditing

For suppliers operating in the automotive supply chain, quality management is not just an internal operational goal, it is a mandatory condition of doing business. While ISO 9001 serves as the world’s foundational standard for quality management systems (QMS) across industries, automotive original equipment manufacturers (OEMs) demand a far higher level of rigor. This is generally true of all sectors specific standards. Be it aviation or automotive or nuclear or any other ISO 9001 is not prescriptive or descriptive. It needs interpretation. As the interpretations for a sector of the industry become too many or prescriptive a sector specific standard is born. This is where IATF 16949 enters the frame as an automotive specific standard. Over 40 plus years QMII has built expertise in auditing, consulting and training of this standard.

Navigating the transition or managing a dual-standard audit requires a clear understanding of where ISO 9001 ends and IATF 16949 begins. Before entering an audit, suppliers must understand the structural hierarchy, specific core tools, standard clauses, and auditor requirements necessary to achieve and maintain certification. IATF 16949 Builds on ISO 9001. The system approach remains the underlying driver. A common misconception among suppliers is that IATF 16949 is a standalone quality standard that replaces ISO 9001. IATF 16949 is a sector-specific supplement layered on top of ISO 9001:2015, not a replacement. ISO 9001 provides the core quality management system baseline and IATF 16949 provides the automotive specific sector requirements.

Harmonized Structure (HS) Integration

IATF 16949 uses the exact same HS, as the ISO 9001:2015, comprising 10 core clauses. ISO 9001 provides the baseline framework, such as leadership, risk-based thinking, and continuous improvement. The IATF 16949 injects stringent automotive requirements into those identical clause structures. I am discussing the key structural clause references below:

Clause 4 (Context of the Organization): ISO 9001 requires identifying internal and external issues. IATF 16949 expands on this in Clause 4.3.2 by requiring customer-specific requirements, mandating that OEM customer specifications which are formally evaluated and included in the QMS scope.
Clause 7 (Support): ISO 9001 focuses on general competence and resources. IATF 16949 adds Clause 7.2.3 mandates internal auditor competency and clause 7.2.4 requires second-party auditor competency, enforcing qualification requirements for anyone conducting audits.
Clause 8 (Operation): ISO 9001 outlines general operational planning. IATF 16949 builds extensive automotive requirements directly into this section, covering product safety in clause 4.4.1.2 / 8.3.1.1 and embedded software, and supply chain management.

Key Differences Auditors Must Understand

To conduct a successful audit, internal and external auditors must look beyond general ISO 9001 processes and audit against automotive-specific methodologies. The general risk management of ISO 9001 per IATF makes it mandatory FMEA per clause 8.3.5.1 and contingency plans per clause 6.1.2.3. Basic process controls in ISO 9001 are strengthened by IATF 16949 to include requirement for core tools as APQP (advanced product quality planning), PPAP (production part approval process), MSA (measurement system analysis), SPC (statistical process control). The requirement of internal audits in ISO9001 clause 9.2 is made specific by including in clause 9.2.2.2-4, system, process and product audits. And the customer satisfaction is clarified with requirement for customer specific requirements (CSRs) and OEM scorecard in IATF.

Automotive Core Tools. IATF 16949 explicitly or implicitly mandates the use of five fundamental automotive core tools:

APQP (Advanced Product Quality Planning): Governs product development from concept through mass production (Clause 8.3.2.1 – Design and development planning).
PPAP (Production Part Approval Process): Formally verifies that manufacturing processes can consistently produce compliant parts at production rates (Clause 8.3.4.4 – Product approval process).
FMEA (Failure Mode and Effects Analysis): Risk identification tool for design (DFMEA) and process (PFMEA) (Clause 8.3.5.1 – Design and development outputs).
MSA (Measurement Systems Analysis): Evaluates variation in measurement equipment (Clause 7.1.5.1.1 – Measurement system analysis).
SPC (Statistical Process Control): Monitors process stability and capability (Clause 9.1.1.1 – Monitoring and measurement of manufacturing processes).

Customer-Specific Requirements (CSRs)

Unlike general ISO 9001 audits, an IATF 16949 audit evaluates compliance with Customer-Specific Requirements (CSRs) (Clause 4.3.2 & Clause 7.5.1.1). Auditors must verify that OEM-specific portals, packaging manuals, labeling rules, and scorecard metrics are integrated into the organization’s daily processes.

Common Nonconformities in Automotive Audits

During certification and surveillance audits, third-party auditors frequently issue major and minor nonconformities in specific, repeat areas. Understanding these failure points allows organizations to address gaps proactively.

Problem Solving (Clause 10.2.3): Organizations often submit superficial 8D corrective action plans that fail to address system-level root causes or update related PFMEAs and Control Plans (Clause 8.5.1.1).
Contingency Planning (Clause 6.1.2.3): Failing to regularly test or review contingency plans for key risk events (e.g., utility outages, cyberattacks, equipment failure, supply chain disruptions).
Internal Auditor Competency (Clause 7.2.3): Internal auditors lack documented evidence of competency in core tools, risk-based thinking, or customer-specific requirements.
Control Plan Alignment (Clause 8.5.1.1): Discrepancies between the PFMEA, the Control Plan, and actual shop-floor work instructions.

Preparing Your Team for a Combined Audit

Organizations seeking simultaneous certification or upgrading from ISO 9001 to IATF 16949 can streamline the audit process through a structured preparation by using a four-step path. In step 1 by conducting a gap analysis & CSR mapping (clauses 4.3.2 & 6.1) as also evaluating the existing ISO 9001 processes against IATF 16949 additions and by mapping all active OEM customer specific requirements (clause 4.3.2) into the process matrix. The second step includes core tool and process alignment (clauses 8.3 & 8.5) to include verification that every PFMEA directly informs the corresponding control plan (clause 8.5.1.1) and to conduct MSA studies (clause 7.1.5.1.1) for all key gauge types listed in control plans. The step 3 is the internal process and system audits (clause 9.2) shift away from clause-by-clause checklist audits. The requirement is to perform internal manufacturing process audits (clause 9.2.2.3) and product audits (Clause 9.2.2.4) using the Turtle Diagram methodology (inputs, outputs, resources, competence, key performance indicators, and risk). Step 4 is the management review and the assessment of final readiness (clause 9.3). Holding a formal management review meeting (clause 9.3) and addressing all IATF-specific inputs, including warranty performance (clause 9.3.2.1), OEM scorecards, and action plan reviews are requirements.

Building In-House Audit Capability

The success of an IATF 16949 QMS ultimately relies on effective implementation and therefore the competence of the people auditing it. Relying solely on external consultants for internal audits can be costly and creates dependency risks. Therefore, building a team of certified lead auditors is essential. IATF 16949 clause 7.2.3 sets strict qualification requirements for internal auditors. Auditors must demonstrate, understanding of the automotive process approach for auditing, including risk-based thinking and knowledge of applicable customer-specific requirements and of applicable ISO 9001 and IATF 16949 requirements. Auditors must have competency in Core Tools (APQP, PPAP, FMEA, MSA, SPC). Establishing qualified in-house expertise transforms internal auditing from a routine compliance exercise into a driver of process performance and cost reduction.

Path to Compliance

IATF 16949:2016 lead auditor training requires completing an accredited IATF 16949:2016 training program, providing quality managers, engineers, and internal auditors with the skills needed to lead full QMS audits, evaluate complex supply chains, and ensure seamless readiness for third-party registrar audits.

Conclusion

Understanding the dynamic between ISO 9001 and IATF 16949 is critical for any automotive supplier aiming for certification and operational excellence. By mastering automotive core tools, addressing common nonconformity areas, and investing in certified IATF 16949:2016 lead auditor capability, an organization can approach certification audits with confidence.

ISO 45003 in Military Operations: A Framework for Psychological Health and Operational Readiness at Sea

Bridging ISO Management Standards and Naval Operational Readiness

Integrating ISO 45003:2021 into military operations, particularly naval operations, specifically in the context of high tempo carrier strike group deployments like the USS Abraham Lincoln and other deployments of armed forces provides a compelling framework for evaluating psychological health, operational fatigue, and organizational resilience. For subject matter experts in management system standards like me and those planning the operations and those in command the standard gives a useful framework. I think ISO 9001 clause 7.1.4 requiring creation of an environment for the operation of the processes is worth considering. This is further amplified by ISO 45001 occupational health and safety standard in general terms. The addition of ISO 45003: 2021 centered on psychological health and safety at work provides very useful guidelines for managing psychological risks. In the present context linking ISO 45003, operational readiness, and naval safety would create a strong bridge between international ISO management system standards and naval oversight. This aligns directly with how Annex SL harmonized structure connects quality, physical safety, and psychosocial well-being into a unified management architecture. After all, as Napoleon said, “morale is to physical, as two is to one”. Not to forget “an army marches on its stomach,” implying understanding risks and planning the logistics.

Operationalizing Psychological Health During Extended Naval Deployments

Operationalizing psychological health at sea is a reality particularly when deployments are extended. Applying ISO 45003 to extended deployment of military units particularly to aircraft carriers and nuclear submarines the application of the standard would enable better and systematized risk appreciation and planning. Operations planning where deployments are away from the country/ home base and the period of deployment is extended and sometimes uncertain the context and the high tempo operational environment the risks must be considered (clause 4 context of the organization of ISO 45003 leading to clause 6.1 actions to address risk and opportunities).

Psychosocial Hazards in High-Tempo Carrier and Submarine Operations

Appreciating the operational context for each deployment must consider the unique psychological hazards of high-stress naval deployments (e.g., high-speed flight operations, extended periods at sea, geopolitical tension, unpredictable schedule shifts, availability of logistics, rest and recreation, changed work hours and isolation etc.). ISO 45003 clause 4.1 explicitly mandates assessing both external aspects (geopolitical instability, extended sea lines of communication) and internal aspects (vessel design limitations, habitability, sleep architecture). For an aircraft carrier and other surface units the bridge physical safety with psychosocial risk management are relevant inputs. Physical safety controls (ISO 45001) are incomplete without addressing operational stress, decision fatigue, sleep deprivation, and psychological safety (ISO 45003). These are further extenuated in nuclear submarines where prolonged submergence, lack of natural light, and extreme isolation amplify cognitive strain.

The Three Domains of Psychosocial Risk Under ISO 45003 Clause 6.1.2.1

Understanding the ISO 45003 framework in a naval unit and incorporating it in operational planning would provide the systematized resource planning and preparations. ISO 45003 as a guidance document that extends ISO 45001 by identifying psychosocial hazards across three key domains outlined in sub-clause 6.1.2.1. It can look at how work is organized (clause 6.1.2.1.1: shift patterns, watch standing rotations, high workload, administrative overload). Then there are the social factors (clause 6.1.2.1.2: command climate, communication, leadership dynamics, isolation) and a discussion on work environment and hazardous tasks (clause 6.1.2.1.3: confined spaces, high noise, operational danger, vibration, high heat on flight decks). All these and more that commanders at sea could provide would enable better defining of the context of the organization.

Mapping ISO 45003 Clauses to Carrier Strike Group Operations

Looking at the clauses in ISO 45003 the key clauses mapping and deployment application would strengthen the planning effort. For example, the operational planners could map key ISO 45003 clauses directly to operational conditions aboard a deployed aircraft carrier.

Clause 4 — Context of the Organization

ISO 45003, clause 4, context of the organization covering context and needs of personnel in clause 4.1 / 4.2 requires assessing external drivers (geopolitical conflict, extended deployments) and internal stressors (watch schedules, habitability, separation from families). Clause 4.3 further reinforces defining the boundary of the management system thereby ensuring psychological safety applies equally to organic ship’s company, embarked air wing personnel, and staff elements.

Clause 5 — Leadership and Worker Participation

Clause 5 related to leadership and worker participation in clause 5.1 / 5.4 provides the inputs for leadership commitment to psychological safety. Clause 5.1 requires top management to demonstrate accountability by ensuring resources are allocated for mental health support, while Clause 5.4 mandates consultation with personnel without fear of reprisal. Demonstrating that leadership balances mission accomplishment with crew fatigue and mental well-being, fostering open communication without stigma or fear of career reprisal.

Clause 6 — Planning and Psychosocial Risk Assessment

Clause 6 related to planning and psychosocial risk assessment in clause 6.1.2 requires proactive identifying of psychosocial hazards. Evaluating the compounded impact of fatigue, high job demands, low autonomy, and environmental stress on deck and in combat direction spaces. Under clause 6.2, commands must establish measurable objectives regarding fatigue metrics, rest-hour compliance, and psychological safety indicators.

Clause 8 — Operational Control and Risk Elimination

Further clause 8, operational control and risk elimination in clause 8.1.2 looks at implementing operational controls managing watch and station bill rotations, enforced rest cycles, access to mental health professionals (e.g., Chaplain, OSCAR t[i]eams), and clear command communication. In line with ISO clause 8.1.1, controls must follow a hierarchy—where hazard elimination isn’t feasible during combat operations, robust administrative controls (enforced circadian watch schedules, rotational relief) become the primary line of defense.

Clause 7 — Support, Competence, and Communication

Clause 7 (support) also plays a key role here through clause 7.2 (competence) and clause 7.4 (communication). Division Officers and Chief Petty Officers must be competent in recognizing early signs of psychological distress, while transparent communication down the chain of command during schedule changes directly mitigates rumor driven anxiety.

Auditing Psychological Safety: The PDCA Cycle and Clause 9

The PDCA (plan, do, check and act) cycle which is the fundamental of the process-based management system approach in implementing all the harmonized standards which includes ISO 45001 and in this case ISO 45003, the check stage is important. Therefore, effective auditing of psychological safety by the armed forces auditors would drive continual improvement. Clause 9.1 (monitoring, measurement, analysis and performance evaluation) combined with clause 9.2 (internal audit) provides the mechanism for this verification. The discussion would bring up how they conduct independent, third-party evaluations across the Naval Enterprise to verify risk controls and safety management systems (SMS). Auditing beyond physical compliance of ISO 45003 lens requires analysis of how service auditors can evaluate whether a command is “safe to operate and operating safely” by assessing psychosocial health metrics including by self-assessment and self-correction. They would ask questions including if the command leadership evaluate fatigue and burnout indicators prior to high-risk flight deck operations? Audit traps and behavioral indicators would include auditing beyond surface-level checklists and looking at medical department stress reports, watch stander qualification pacing, incident reports linked to human error, and command climate surveys.

Worker Involvement and Psychological Safety Within Military Command Structures

One of the underlying principles in OH&S is involvement of the workers. In all other standards the leadership decisions are sufficient. However, in occupational health the worker involvement and perception on feeling safe, secure and healthy is important. This can sometimes cause conflict with military requirements when command and control may require going in harm’s way. This does not imply, not considering the risk. Therefore, incorporation of risk evaluation and communication is a factor. Testing if junior sailors and division officers feel empowered to stop unsafe evolutions caused by acute fatigue or psychological strain (psychological safety in practice) keeping within the military directions is a factor in interpretation of the standard. This directly operationalizes clause 5.4, proving that worker participation can coexist with traditional military command structures by establishing clear boundaries where operational safety interventions are welcomed rather than penalized.

Strategic Benefits of Integrating ISO 45003 and ISO 45001

Strategic benefits and recommendations in incorporating ISO 45003 with ISO 45001 in working systematically would include strengthening operational readiness and resilience. Use of ISO 45003 would address hazards directly reduces human-factor mishaps, improving retention, and enhances tactical focus during critical operations. Clause 10 (improvement) ensures that lessons learned from near-misses, fatigue-related mishaps, or extended surge operations feed back into operational planning for future deployment cycles.

Practical Recommendations for Naval Quality and Safety Systems

Practical recommendations for naval quality and safety systems would include formalizing psychosocial audit criteria by incorporating ISO 45003 guidelines into naval safety audit protocols alongside physical safety metrics. Predictive fatigue management by using data-driven scheduling tools aligned with clause 8 operational controls would be a strong recommendation. Of course, leadership training would educate senior leadership and department heads on identifying early indicators of psychosocial distress within division teams.

Conclusion: Mental Well-Being as a Core Operational Readiness Metric

In conclusion, I would say treating mental well-being and psychosocial risk management as core operational readiness metrics validated through rigorous auditing and oversight helps ensure that capital assets like the USS Abraham Lincoln remain fully combat-capable and resilient.

[i] OSCAR Team Uses Technology to Identify Mental Health Risk Factors — Navy Medicine (link at the “Chaplain, OSCAR teams” reference) — https://www.med.navy.mil/Media/News/Article/2609002/oscar-team-uses-technology-to-identify-mental-health-risk-factors/

About the Author:

How Will an Internal Audit Help Any Business?

An internal audit is often viewed as a compliance exercise, a scheduled activity designed to check whether an organization is following its procedures and meeting the requirements of a standard. However, a well-planned internal audit can provide much more value. It can help a business identify risks, improve processes, reduce costs, strengthen customer satisfaction, and support better management decisions.

Whether a company operates under ISO 9001, ISO 14001, ISO 45001, ISO 27001, or another management system, internal auditing can become an important business-improvement tool.

Identifying Problems Before They Become Serious

One of the greatest benefits of an internal audit is early problem detection, like they, if you have a headache for more than a day then it’s best to get it checked before it becomes something big and uncurable.

Every organization has weaknesses. Procedures may not be followed consistently, records may be incomplete, employees may misunderstand responsibilities, or processes may have gradually changed without the relevant documentation being updated.

An internal audit provides an opportunity to identify these issues before they develop into major problems.

For example, an audit may discover that equipment inspections are not being completed according to schedule. If this issue is identified early, management can take corrective action before equipment failure causes production delays, customer complaints, or safety incidents.

In this way, internal audits are preventive as well as corrective.

Improving Business Processes

Internal auditing should not simply ask, “Are we following the procedure?”

A stronger audit asks, “Is this process actually working?”

A procedure may technically meet requirements but still be inefficient. Employees may spend unnecessary time completing forms, approvals may take too long, information may be duplicated, or communication between departments may be poor.

An internal audit can identify these inefficiencies and provide evidence for process improvement.

For example, an organization may discover that a purchasing process requires three separate approvals for relatively low-risk purchases. The audit could identify unnecessary delays and encourage management to simplify the process while maintaining appropriate controls.

The result is a system that is not only compliant but also more efficient.

Reducing Costs and Waste

Businesses constantly look for ways to reduce unnecessary costs. Internal audits can contribute directly to this objective.

Auditors may identify:

Repeated errors and rework
Excessive material waste
Inefficient use of resources
Unnecessary administrative activities
Poor inventory controls
Equipment maintenance problems
Duplicate processes
Supplier-related problems

Consider a manufacturing organization experiencing a high level of product rework. An internal audit may trace the problem back to unclear work instructions or inconsistent inspection practices.

Addressing the underlying cause can reduce scrap, labor costs, production delays, and customer complaints.

Therefore, the financial value of an internal audit can be much greater than the cost of conducting the audit.

Strengthening Risk Management

Modern businesses operate in environments filled with risks. These may include operational, financial, environmental, cybersecurity, supply-chain, regulatory, and reputational risks.

Internal audits provide management with an independent examination of how effectively these risks are being controlled.

For example, an audit may determine that an organization has identified cybersecurity risks but has not adequately controlled access to sensitive information. Similarly, an environmental audit may identify inadequate controls over waste management.

The auditor does not necessarily solve the problem. Instead, the audit provides management with objective information so appropriate action can be taken.

This makes internal auditing an important component of risk-based management.

Supporting Compliance

Organizations are often required to meet laws, regulations, contractual requirements, industry standards, and internal policies.

Failure to comply can result in fines, legal problems, loss of customers, operational disruption, or damage to reputation.

Internal audits can provide an early warning system.

For organizations certified to an ISO standard, internal audits also help determine whether the management system continues to conform to applicable requirements and whether processes are effectively implemented.

Importantly, an internal audit should not be treated as preparation for “passing” an external audit. Its purpose is to determine whether the organization’s management system is genuinely effective.

Preparing for External Audits

A strong internal audit program can significantly improve an organization’s readiness for certification, surveillance, recertification, regulatory, or customer audits.

External auditors are likely to examine evidence showing how processes are controlled and whether the organization is meeting applicable requirements.

If internal audits are performed regularly, problems can be identified and corrected before an external auditor discovers them.

For example, an internal audit may identify an incomplete training record, an overdue calibration, or an ineffective corrective action. Management can address the issue before it becomes an external-audit finding.

The objective should not be to hide problems from external auditors. Instead, internal audits should help the organization discover and resolve its own problems first.

Improving Employee Awareness

Internal audits also create opportunities for employee engagement and learning.

During an audit, employees may be asked questions about their responsibilities, procedures, objectives, risks, and controls. This can reveal whether employees truly understand the management system or are simply completing tasks because they have been instructed to do so.

An auditor might discover that employees understand what they do but do not understand why they do it.

That distinction is important.

Employees who understand the purpose behind a process are generally better positioned to recognize problems, make appropriate decisions, and suggest improvements.

Internal auditing can therefore contribute to a stronger culture of quality, accountability, and continuous improvement.

Providing Management With Objective Information

Managers often make decisions based on reports, meetings, performance indicators, and employee feedback. While these sources are valuable, they may not always reveal what is happening within a process.

Internal auditors provide another perspective.

A good auditor collects objective evidence through interviews, observation, document review, and sampling. The resulting findings can help management understand the actual condition of a process.

For example, management may believe that customer complaints are being addressed effectively. An internal audit might reveal that complaints are being closed quickly but that root causes are not being properly investigated.

That information can lead to better management decisions.

Encouraging Continual Improvement

Continual improvement is a fundamental principle of many management systems, but improvement cannot occur effectively without knowing where improvement is needed.

Internal audits provide that information.

An audit can identify trends and recurring weaknesses. If the same type of finding appears repeatedly, management should consider whether the organization is addressing symptoms rather than underlying causes.

For example, repeated findings involving incomplete records may indicate a deeper problem with training, process design, workload, responsibilities, or management oversight.

Instead of repeatedly correcting individual records, the organization can investigate the systemic cause.

This is where internal auditing moves from simple compliance checking to genuine business improvement.

Increasing Customer Confidence

Customers want to know that a business can consistently deliver products or services that meet requirements.

A reliable internal audit program helps strengthen the systems supporting that consistency.

By identifying process weaknesses, controlling risks, improving corrective actions, and monitoring performance, internal auditing can contribute to improved product and service quality.

This can ultimately lead to fewer complaints, fewer returns, better delivery performance, and stronger customer relationships.

Conclusion

An internal audit should not be viewed as an exercise designed to find fault with employees. Its real purpose is to provide an objective assessment of how well the organization is operating and where it can improve.

A valuable internal audit identifies weaknesses before they become major problems, improves processes, reduces waste, supports compliance, strengthens risk management, prepares the organization for external audits, and provides management with reliable information for decision-making.

The most effective organizations do not ask, “How can we pass the audit?”

They ask, “What can this audit teach us about our business?”

When internal audits are approached in this way, they become much more than a requirement of an ISO management system. They become a practical management tool that helps businesses operate more efficiently, control risk, improve performance, and achieve sustainable growth.

Ultimately, the value of an internal audit is not measured by how many findings an auditor raises. It is measured by how effectively the organization uses those findings to become better.

About the Author:

Anjalika Singh is the President of QMII (Quality Management International, Inc.), a global management systems consulting firm headquartered in Ashburn, Virginia. Over the course of her career, she has developed a sharp intuitive sense combined with strong operational and training management skills, making her a key asset in QMII’s consulting and training initiatives. Her work focuses on practical lead-auditor training and helping organizations adopt ISO and industry-specific management systems in a way that delivers real business value. Anjalika also serves as President and CEO of iCertifications, LLC, where she leads efforts to make accredited ISO certification services accessible to small and medium-sized businesses.

ISO 22301 Business Continuity: Preparing for Disruptions Before They Happen

The 2015 revision of ISO 9001 introduced risk-based thinking into Clause 6.1, and sector-specific standards such as AS9100 went further by addressing operational risk in Clause 8.1.1. Once identified, a risk may be treated, accepted, or used as an opportunity for improvement. What these standards do not fully address, however, is how an organization will continue operating when a risk becomes a disruptive event.

That is the territory of business continuity. A cyberattack locks employees out of critical systems. A supplier failure halts production. A storm closes a facility. A key utility is lost, or a public-health emergency depletes the available workforce, as COVID-19 demonstrated on a global scale. The trigger may vary, but the leadership question remains the same, can the organization continue delivering its most important products and services at an acceptable, predefined capacity?

Resilience is not the ability to predict every disruption. It is the discipline of deciding—before pressure arrives—what must continue, how quickly it must recover, what resources it will require, and who has the authority to act.

ISO 22301 provides a structured approach. The international standard specifies requirements for a business continuity management system (BCMS): a management framework for understanding the organization and its disruption-related risks, establishing continuity priorities, preparing response and recovery arrangements, exercising those arrangements, evaluating performance, and continually improving capability.

Its value is not found in a binder on a shelf or a certificate on a wall. Its value lies in a practiced capability that helps people make sound decisions when normal assumptions no longer hold.

Continuity Begins Before the Incident. Many organizations begin with a plan template containing contact lists, emergency numbers, alternate locations, and recovery checklists. Those items may be useful, but beginning with the document reverses the logic.

A sound continuity program first establishes the organization’s context, the needs and expectations of relevant interested parties, the BCMS scope, leadership intent, responsibilities, and measurable continuity objectives. It then analyzes what the organization does, what its activities depend on, and what the consequences would be if those activities stopped. These foundations align with ISO 22301 Clauses 4.1–4.3, 5.1–5.3, and 6.2.

Organizations should also account for ISO 22301:2019/Amd 1:2024. The amendment adds an explicit requirement in Clause 4.1 to determine whether climate change is a relevant issue and adds a note to Clause 4.2 recognizing that interested parties may have climate-related requirements.

Business continuity is related to, but distinct from, other response disciplines:

Emergency response protects life, property, and the environment during the immediate event.
Crisis management coordinates strategic decisions, leadership, and communications.
IT disaster recovery restores technology and data.
Business continuity connects these disciplines to the continued delivery of prioritized products and services.

ISO 22301 helps align these elements within one managed system and, because it follows ISO’s harmonized management-system structure, it can be integrated with other management systems.

A Practical Path from Risk Assessment to Recovery. The following sequence turns business continuity from a broad aspiration into an operating capability.

Establish scope, governance, and decision rights

Define which sites, services, legal entities, technologies, and third parties fall within the BCMS scope. Appoint an accountable executive, assign process owners, and clarify who may declare an incident, activate a plan, authorize emergency expenditure, communicate with stakeholders, or accept temporary operating risk.

Ambiguity in these decisions consumes precious time during a disruption, and, in a severe event, may threaten the organization’s survival. Relevant requirements appear in Clauses 4.3, 5.1, 5.3, and 8.4.2.

Assess disruption risks

Identify plausible sources of interruption and evaluate their likelihood and consequences. These may include cyber events, utility loss, fire, severe weather, equipment failure, transportation interruption, labor shortages, civil disturbance, and the loss of critical suppliers or data.

The purpose is not to develop a separate plan for every imagined scenario. It is to understand vulnerabilities and select measures that reduce the likelihood or impact of disruption. ISO 22301 addresses the assessment of risks of disruption to prioritized activities in Clause 8.2.3. This should not be confused with Clause 6.1, which concerns risks and opportunities affecting whether the BCMS itself achieves its intended outcomes.

Conduct the business impact analysis

The risk assessment asks, “What could happen?” The business impact analysis (BIA) asks, “What happens to the organization as time passes after an activity stops?”

The BIA establishes recovery priorities and provides the evidence needed to define continuity strategies, resource requirements, and recovery objectives. ISO 22301 addresses the BIA in Clause 8.2.2.

Select continuity strategies and solutions

Choose proportionate ways to protect, continue, or restore prioritized activities. Options may include cross-trained personnel, remote-working capability, alternate facilities, redundant utilities, backup communications, diversified suppliers, emergency inventory, manual workarounds, resilient cloud architecture, and tested data recovery.

A strategy is credible only when its people, capacity, cost, and activation time are consistent with the BIA. ISO 22301 addresses business continuity strategies and solutions, associated resource requirements, and implementation in Clauses 8.3.1–8.3.5.

Develop response and recovery plans

Translate strategy into action. Plans should define activation criteria, initial actions, roles, escalation paths, communications, dependencies, workarounds, resource requirements, recovery steps, and stand-down arrangements.

Make plans usable under stress: concise, role-based, accessible when primary systems are unavailable, and clear about what must occur during the first hour, the first day, and the subsequent recovery period. These matters are addressed principally in Clauses 8.4.1–8.4.5.

The BIA: Identifying What Cannot Be Allowed to Fail. Not every process is equally urgent. Labeling everything “critical” leaves leaders with no meaningful priority. The BIA creates a time-based view of impact. It examines how disruption may affect life and safety, customers, revenue, contractual obligations, regulatory compliance, reputation, cash flow, and other operations. It also reveals the chain of dependencies supporting each activity: people, information, applications, facilities, equipment, utilities, logistics, and external providers.

A useful BIA produces decisions, not merely scores. For each prioritized activity, the organization should determine the time within which impacts would become unacceptable, the prioritized time frame for resuming the activity, the minimum acceptable capacity during recovery, and the resources and dependencies required over time. Where information and communications technology are involved, data-loss and restoration targets should also be aligned with business needs.

The following table summarizes the decisions a BIA should support:

Decision area	Question for the organization	What it drives
Priority	Which activities must resume first?	Recovery sequence
Time objective	When would the impacts of interruption become unacceptable, and by when must the activity resume?	Recovery design and investment
Minimum capacity	What level of service is acceptable initially?	Staffing, sites, systems, and workarounds
Dependencies	What must be available for the activity to operate?	Supplier, technology, facility, utility, and data controls

These targets must be reconciled across departments. One function’s recovery may depend on another function that has assigned itself a lower priority. The BIA should be challenged, approved, and reviewed when products, technologies, suppliers, locations, or operating models change. It is not a one-time questionnaire owned by the continuity coordinator; it is a management decision about what the organization is prepared to sustain. Clause 8.6 requires the organization to evaluate the suitability, adequacy, and effectiveness of its business impact analysis, risk assessment, strategies, solutions, plans, and procedures.

Designing a Response People Can Actually Use. A continuity plan must work amid incomplete information, unavailable colleagues, and competing priorities. Effective plans therefore emphasize decisions and interfaces. They identify the incident leadership structure, primary and alternate role holders, communication channels, escalation criteria, and the point at which a local response becomes an enterprise-level crisis.

Plans must also address stakeholder communication. Employees need instructions. Customers need honest service expectations. Regulators may require notification. Suppliers need revised priorities, and leadership needs a consistent operating picture. Preapproved message frameworks can save time, but facts must be verified before release. Speed matters; credibility matters more. ISO 22301 addresses warning and communication in Clause 8.4.3, supported by the broader communication requirements in Clause 7.4.

Continuity arrangements must account for their weakest dependencies. An alternate site is ineffective if access credentials, specialized equipment, or key records remain at the affected location. Remote work is not a recovery strategy if the identity platform is the failed system. A backup is not a recovery capability until data have been restored within the required time and shown to be usable. Plans also require appropriate control as documented information under Clause 7.5. Accessibility, protection, version control, distribution, retention, and availability during a disruption all matter.

Exercising the Plan and Proving the Capability. Documentation creates potential capability; exercises provide evidence. ISO 22301 Clause 8.5 requires an exercise program to validate business continuity strategies and solutions over time. Clause 8.6 requires evaluation of the continuing suitability, adequacy, and effectiveness of the organization’s continuity arrangements.

A mature exercise program progresses from simple checks to realistic, cross-functional tests:

Walkthroughs and checklist reviews confirm that roles, contact information, resources, and procedures remain accurate.
Tabletop exercises present an evolving scenario and require leaders to make decisions, communicate, and resolve competing priorities.
Functional exercises activate selected capabilities, such as emergency notification, remote operations, supplier substitution, or restoration from backup.
Full or integrated exercises test multiple teams and dependencies together under realistic time pressure while controlling safety and operational risk.

An exercise is not successful merely because participants completed the script. It succeeds when the organization learns. Observers should record decisions, elapsed times, assumptions, bottlenecks, communication failures, and gaps between stated and actual capability. Corrective actions need owners, due dates, and verification of effectiveness. Repeating the same unresolved finding in the next exercise signals a weakness in the management system, not merely in the plan. Corrective action and continual improvement are addressed in Clauses 10.1 and 10.2.

The exercise schedule should be risk-based. High-impact activities and fragile dependencies deserve greater frequency and realism. Exercises should also follow material changes, significant incidents, major technology migrations, acquisitions, facility moves, or supplier changes. Where a live test would create unacceptable risk, controlled simulations and component tests can provide evidence without exposing the organization unnecessarily.

Keeping the BCMS Alive. People change roles. Suppliers consolidate. Applications migrate. Inventories shrink. Workarounds become obsolete. Sustained readiness therefore depends on monitoring and measurement, internal audit, management review, corrective action, and continual improvement—the disciplines covered by Clauses 9.1–9.3 and 10.1–10.2.

Useful performance measures may include:

completion of scheduled exercises;
achievement of recovery objectives;
overdue corrective actions;
supplier continuity assurance;
currency of plans and contact information;
training and awareness coverage; and
trends identified through incidents, exercises, and near misses.

Leadership review should go beyond asking whether documents are current. It should examine whether continuity objectives remain aligned with organizational strategy, whether resources match exposure, whether risk acceptance is explicit, and whether exercises demonstrate the promised capability. Internal audits should likewise evaluate effectiveness—not simply whether a procedure exists, but whether it is understood, implemented, exercised, and improved.

The Role of Lead Auditor Training. Sustained conformity with ISO 22301 requires long-term ownership by people who can see the BCMS as a connected system. A capable lead auditor follows the evidence from leadership commitments to the BIA, from recovery objectives to continuity solutions, from exercise results to corrective action, and from management review back to investment decisions. This line of sight helps distinguish polished documentation from genuine resilience.

QMII’s ISO 22301 Lead Auditor Training is designed to develop the competence to assess a BCMS against ISO 22301, identify vulnerabilities and improvement opportunities, evaluate the effectiveness of plans and controls, and support continual improvement.

For organizations building internal capability, lead auditor training can strengthen three essential forms of ownership:

Independent assurance: Auditors can test whether practice matches policy and whether recovery claims are supported by evidence.
Cross-functional understanding: Trained personnel can examine the links among operations, technology, facilities, suppliers, communications, and leadership decisions.
Improvement discipline: Audit findings can be framed around systemic causes and followed through to effective corrective action, rather than treated as a documentation clean-up exercise.

Training alone does not own the BCMS. Leadership and process owners do. Trained auditors, however, provide the challenge, structure, and feedback that help keep continuity integrated with everyday management. They enable the organization to ask uncomfortable questions before a real incident asks them under pressure.

Preparedness Is a Management Habit. No continuity program can eliminate uncertainty. What ISO 22301 can do is replace improvisation with informed priorities, rehearsed responsibilities, viable recovery options, and a repeatable cycle of learning.

The objective is not uninterrupted perfection. It is the ability to absorb disruption, protect essential commitments, recover within acceptable limits, and emerge better prepared for the next test. The best time to discover that a recovery objective is unrealistic, a supplier has no viable alternative, or a contact list is obsolete is before operations are at risk. Begin with the BIA. Build strategies from evidence. Turn them into usable plans. Exercise those plans honestly. Audit the system for effectiveness. Then improve it-again and again.

—

About the Author:

ISO 9001 Certification: A Business Leader’s Roadmap

ISO 9001 certification is more than a certificate displayed on a wall. For business leaders, it represents an opportunity to build a disciplined management system that consistently delivers quality, satisfies customers, manages risks, and supports continuous improvement. Yet organizations sometimes approach ISO 9001 as a compliance exercise rather than as a continual improvement tool. The difference in approach can determine whether certification becomes a valuable strategic asset or simply another administrative burden.

For leaders considering ISO 9001 lead auditor certification, the journey should begin with understanding what the standard is designed to accomplish and how it can support organizational objectives.

Understanding ISO 9001

ISO 9001 is an internationally recognized standard for quality management systems (QMS). It provides a framework for organizations to establish processes that consistently meet customer requirements, applicable regulatory requirements, and the organization’s own objectives.

Importantly, ISO 9001 does not prescribe exactly how a business must operate. A manufacturing company, consulting firm, software provider, construction company, or service organization can all implement the standard. The organization determines the processes, controls, resources, and methods appropriate to its size, complexity, products, services, and risks.

For business leaders, this flexibility is important. Certification should not mean copying another organization’s procedures. The management system should reflect how the organization operates.

Step 1: Establish Leadership Commitment

Successful ISO 9001 implementation starts with the Top Management/ Leadership.

Senior leadership must understand why the organization wants certification and what business outcomes it expects. Possible objectives include improving customer satisfaction, reducing defects, standardizing processes, strengthening supplier management, improving operational efficiency, entering new markets, or satisfying customer requirements.

Leadership should communicate that quality is an organizational responsibility rather than the sole responsibility of a quality manager.

A strong leadership commitment includes providing appropriate resources, establishing quality objectives, assigning responsibilities, participating in management reviews, and ensuring that employees understand the importance of effective processes.

If employees believe ISO 9001 is simply “the quality department’s project,” implementation is likely to struggle.

Step 2: Define the Business Context and Scope

The organization should next determine the context in which it operates. Leaders need to consider internal and external issues that can affect the organization’s ability to achieve its intended quality outcomes. These may include market conditions, technology, competition, customer expectations, regulatory requirements, organizational capabilities, supply-chain issues, and changes in the business environment.

The organization must also determine the scope of its quality management system. The scope should clearly identify the products, services, locations, and organizational activities covered by the QMS. It should be realistic and accurately represent the organization’s operations. A clearly defined scope prevents confusion later in the certification process.

Step 3: Identify and Manage Risks and Opportunities

Modern quality management is not simply about detecting problems after they occur. ISO 9001 encourages organizations to think about risks and opportunities before problems affect customers or business performance.

Leaders should ask questions such as:

What could prevent us from meeting customer requirements?
Which processes are most critical to our success?
Where are errors most likely to occur?
Which suppliers create significant operational risk?
What opportunities could improve efficiency or customer satisfaction?
What changes could affect our ability to deliver consistent products or services?

Risk-based thinking should become part of everyday decision-making rather than a standalone exercise performed only for an audit.

Step 4: Map and Standardize Key Processes

A quality management system is fundamentally a system of processes. Organizations should identify their major processes and understand how they interact. Depending on the business, these may include sales, contract review, purchasing, design and development, production, service delivery, inspection, testing, customer support, human resources, maintenance, and supplier management.

Process mapping can reveal duplication, unclear responsibilities, bottlenecks, missing controls, and opportunities for improvement.

The goal is not to create excessive paperwork. The goal is to make important processes predictable and effective.

Step 5: Build Competence and Employee Awareness

Even the best designed QMS will fail if employees do not understand their responsibilities.

ISO 9001 places significant importance on competence and awareness. Organizations should determine the competencies required for people performing work that affects quality, provide appropriate training or other actions, and evaluate whether competence has been achieved.

Training should be practical.

Employees should understand not only what procedure they are expected to follow but also why it matters. For example, a purchasing employee should understand how supplier selection affects product quality, delivery performance, customer satisfaction, and organizational risk.

This creates ownership rather than simple procedural compliance.

Step 6: Establish Performance Measures

Business leaders cannot effectively manage what they do not measure.

Organizations should establish meaningful quality objectives and appropriate performance indicators. Depending on the organization, these might include customer complaints, on-time delivery, defect rates, rework, process efficiency, supplier performance, warranty claims, service response times, or customer satisfaction.

The key is to avoid measuring everything simply because data is available.

Good metrics help leaders answer important questions:

Are our processes working? Are customers satisfied? Are objectives being achieved? Where should management focus its attention?

Performance information should be reviewed regularly and used to make decisions.

Step 7: Implement Internal Audits

Internal audits are one of the most valuable tools in the ISO 9001 system.

An internal audit should not be treated as a rehearsal for the certification audit. Its purpose is to determine whether the QMS conforms to requirements and whether it is effectively implemented and maintained.

Effective auditors look beyond documentation. They follow processes, interview employees, examine records, observe activities, and evaluate objective evidence.

A strong internal audit program can identify weaknesses before they become customer complaints or external audit findings.

Leaders should encourage employees to view internal audits as improvement opportunities rather than investigations designed to assign blame.

Step 8: Use Corrective Action for Real Improvement

Problems will occur in every organization. ISO 9001 does not require perfection; it requires organizations to respond appropriately when nonconformities occur.

The critical question is whether the organization addresses the underlying cause.

For example, if an employee repeatedly completes a form incorrectly, simply retraining that employee may not solve the problem. The organization should investigate why the error occurred. Was the form confusing? Was the procedure unclear? Was the employee adequately trained? Was the process poorly designed? Was there insufficient supervision?

Effective corrective action addresses causes rather than symptoms.

Step 9: Conduct Management Review

Management review gives senior leaders an opportunity to evaluate whether the QMS remains suitable, adequate, effective, and aligned with organizational direction.

Management should review relevant performance information, audit results, customer feedback, process performance, nonconformities, corrective actions, risks and opportunities, supplier performance, and changes that could affect the QMS.

The output should be decisions and actions, not merely meeting minutes.

Leadership should use management review to determine where resources, priorities, or processes need to change.

Step 10: Prepare for the Certification Audit

Once the QMS has been implemented and has generated sufficient evidence of operation, the organization can engage an accredited certification body for the certification process. Certification generally involves an initial assessment conducted in stages. The certification auditors evaluate whether the management system meets ISO 9001 requirements and whether it is effectively implemented.

Organizations should not attempt to hide weaknesses from auditors. A mature QMS recognizes that problems are opportunities to improve. Preparation should include reviewing internal audit results, closing appropriate corrective actions, confirming employee awareness, ensuring required documented information is controlled, and verifying that processes are actually being followed.

The Business Leader’s Role After Certification

Certification is not the destination. One of the most common mistakes organizations make is treating certification as the end of the project. Once the certificate is issued, attention may decline and the QMS can gradually become disconnected from daily operations.

Business leaders should instead treat ISO 9001 as an ongoing management framework. The organization should continue monitoring performance, conducting internal audits, addressing customer feedback, managing risks, improving processes, reviewing objectives, and preparing for surveillance audits.

The real value of ISO 9001 becomes apparent when the QMS becomes part of how the organization is managed, not something maintained only because an auditor is coming.

Conclusion

ISO 9001 certification provides business leaders with a structured approach to improving quality, consistency, customer satisfaction, and organizational performance. However, the certificate itself is not the objective. The objective is to create a management system that helps the organization understand its processes, manage risks, make informed decisions, and continually improve.

The roadmap is straightforward: establish leadership commitment, understand the business context, identify risks and opportunities, manage processes, develop competent employees, measure performance, conduct effective internal audits, implement meaningful corrective actions, perform management reviews, and undergo certification with confidence.

When leadership treats ISO 9001 as a business management tool rather than a compliance exercise, certification can become much more than an external recognition of conformity. It can provide the foundation for a more disciplined, customer-focused, resilient, and continuously improving organization.

—

About the Author:

ISO 14001 vs ISO 9001: Can Your Organization Implement Both at the Same Time?

Organizations today face increasing pressure to deliver consistent quality while also managing their environmental responsibilities. Customers, regulators, investors, and other stakeholders increasingly expect organizations to demonstrate not only that their products and services meet requirements, but also that their operations minimize environmental impacts.

ISO 9001 focuses on quality management, customer satisfaction, and consistent processes, while ISO 14001 focuses on environmental management and the organization’s interaction with the environment. Although they have different purposes, the two standards share a significant amount of common management-system structure. As an add on, adding ISO 45001 will greatly add value to the organization with respect to Health and Safety along with Quality and Environmental Management Systems. As an option, an organization can also integrate ISO 9001 with ISO 27001 for integrated Cybersecurity management system. Perhaps, ISO 22301, for Business Continuity Management System. There are various ways why Integrated Management Systems works wonders for an organization. For a Maritime Company, organization can integrate ISO 9001 with ISM Code, or maybe add ISO 27001 to integrate and meet the objective of Maritime Cybersecurity. For the Aviation Industry, AS9100 or AS9110 can be integrated with ISO 9001.

Here’s a link to another article on the emphasis and benefits of having an integrated management system: https://www.qmii.com/integrated-management-systems-aka-a-balanced-lifestyle/

In this article, we will discuss the value behind implementing ISO 9001 with ISO 14001.

Understanding ISO 9001 and ISO 14001

ISO 9001 is the internationally recognized standard for Quality Management Systems (QMS). Its primary objective is to help organizations consistently provide products and services that meet customer and applicable statutory and regulatory requirements.

Key areas include:

Customer focus
Leadership
Planning
Risk and opportunity management
Competence and awareness
Operational control
Performance evaluation
Continual improvement
Corrective action

ISO 14001, on the other hand, specifies requirements for an Environmental Management System (EMS). It helps organizations manage their environmental responsibilities systematically and improve environmental performance.

Important areas include:

Environmental aspects and impacts
Compliance obligations
Environmental objectives
Operational controls
Emergency preparedness and response
Environmental monitoring
Risk and opportunity management
Continual improvement

The standards therefore address different organizational objectives, but they use many similar management principles.

Why Implement Both Standards?

One of the biggest advantages of implementing ISO 9001 and ISO 14001 together is that organizations do not necessarily need two separate management systems.

Many of the underlying processes can be shared. For example, an organization can establish one system for:

Document and record control
Internal audits
Management reviews
Corrective action
Employee competence
Training and awareness
Risk management
Supplier evaluation
Organizational context
Leadership responsibilities
Performance monitoring

The organization can then incorporate quality-specific and environmental-specific requirements into these common processes.

Instead of creating two independent systems, the organization can develop an Integrated Management System (IMS). A major reason ISO 9001 and ISO 14001 can work well together is their use of a common high-level structure.

Both standards address areas such as:

Context of the organization
Leadership
Planning
Support
Operation
Performance evaluation
Improvement

This common structure allows organizations to integrate requirements without unnecessarily duplicating procedures.

For example, an organization may conduct one internal audit covering both quality and environmental requirements. Similarly, one management review meeting can evaluate quality performance and environmental performance.

This approach can reduce duplication and make the management system easier for employees to understand.

What Should Remain Separate?

Although integration is beneficial, organizations should not assume that ISO 9001 and ISO 14001 are identical. Some requirements are specific to each discipline.

ISO 9001 places considerable emphasis on issues such as customer requirements, product and service conformity, customer satisfaction, design and development, and process performance; whereas, ISO 14001 places greater emphasis on environmental aspects and impacts, environmental compliance obligations, environmental objectives, life-cycle considerations, and environmental performance.

For example, a manufacturing organization may need to consider:

Quality perspective:

Are products manufactured according to specifications?
Are customer requirements being met?
Are defects being controlled?
Are processes producing consistent results?

Environmental perspective:

What emissions are generated?
How are wastes managed?
What resources and energy are consumed?
What environmental impacts are associated with operations?
What legal environmental requirements apply?

These requirements should remain clearly identifiable even when they are managed through common processes.

An Integrated Risk-Based Approach

Another advantage of combining the standards is the ability to consider quality and environmental risks together. Suppose an organization changes a production process to reduce manufacturing costs. From a quality perspective, the organization should consider whether the change could affect product conformity.

From an environmental perspective, it should consider whether the change could increase waste, energy consumption, emissions, or other environmental impacts. Considering both perspectives during planning can lead to better business decisions.

An integrated risk-management process can therefore help management understand the broader consequences of operational decisions.

Internal Auditing Can Also Be Integrated

Internal auditing is another area where organizations can achieve significant efficiencies.

Rather than conducting two separate audits for ISO 9001 and ISO 14001, an organization can develop an integrated audit program.

For example, an auditor reviewing a production process could examine:

Process controls
Product conformity
Customer requirements
Competence of personnel
Equipment and infrastructure
Waste management
Chemical handling
Energy consumption
Environmental controls
Emergency preparedness
Applicable compliance obligations

This provides a more complete picture of process performance. However, auditors must still understand the specific requirements of each standard. An integrated audit should not become a superficial checklist exercise.

Management Review Can Cover Both Systems

Management review is another area where integration provides significant value. Instead of holding separate meetings, top management can review quality and environmental performance during the same management review process.

The agenda might include:

Customer feedback
Quality objectives
Environmental objectives
Nonconformities
Corrective actions
Audit results
Process performance
Environmental performance
Compliance status
Risks and opportunities
Resource requirements
Improvement opportunities

This gives leadership a broader understanding of organizational performance.

What Are the Challenges?

Implementing both standards simultaneously is not without challenges.

The first challenge is Scope. The organization must clearly define which activities, locations, products, services, and processes are included.

The second challenge is Competence. Personnel responsible for quality management may not automatically understand environmental requirements, and environmental personnel may not have sufficient knowledge of quality-management principles. Training is therefore important. Click here to view some of the training services that QMII provides including ISO 9001, ISO 14001, ISO 45001, ISO 27001, ISO 22301 and many others: https://www.qmii.com/training-services-qmii/

Another challenge is avoiding unnecessary documentation. Organizations sometimes respond to two standards by creating excessive procedures, forms, and records. Integration should achieve the opposite: a streamlined system that provides effective control without unnecessary bureaucracy.

Leadership commitment is also essential. ISO 9001 and ISO 14001 should not be treated as separate certification projects owned by different departments. They should support the organization’s overall strategic direction to meet its measurable objectives and scope.

Should You Implement Them Simultaneously?

For organizations that are starting from scratch, implementing both standards simultaneously can make considerable sense when quality and environmental management are both strategically important. However, the organization should consider its resources, size, complexity, regulatory environment, and existing management-system maturity. A practical implementation approach could be:

Step 1: Define the organizational context and scope

Identify internal and external issues, interested parties, organizational processes, and the boundaries of the management system.

Step 2: Identify common processes

Determine which processes can support both ISO 9001 and ISO 14001 requirements.

Step 3: Identify standard-specific requirements

Clearly identify quality-specific and environmental-specific requirements that need dedicated controls.

Step 4: Establish integrated objectives

Develop measurable quality and environmental objectives that support business strategy.

Step 5: Train employees

Ensure employees understand both the quality and environmental responsibilities relevant to their work.

Step 6: Implement operational controls

Integrate quality and environmental considerations into everyday processes rather than treating them as separate administrative activities.

Step 7: Conduct integrated internal audits

Evaluate both standards systematically while ensuring that each requirement is adequately addressed.

Step 8: Conduct management review

Use management review to evaluate the effectiveness and performance of the integrated system.

Step 9: Prepare for certification

If certification is required, the organization can work with a certification body to determine the appropriate audit and certification arrangements.

The Bigger Picture

The real value of implementing ISO 9001 and ISO 14001 together is not simply obtaining two certificates. The objective should be to create a management system that helps the organization produce consistent results while controlling environmental impacts and improving overall performance.

Quality and environmental performance are often interconnected. Poor process control can generate defects, rework, waste, and additional resource consumption. Better process control can therefore improve both quality and environmental performance.

An integrated management system can help organizations recognize these connections.

Conclusion

The two standards have different purposes, but their common management-system structure makes integration practical. Organizations can combine processes such as internal auditing, management review, corrective action, competence, document control, risk management, and continual improvement while maintaining separate controls for quality-specific and environmental-specific requirements.

The key is to avoid treating the standards as two independent compliance exercises.

Instead, organizations should build one coherent management system that supports quality, environmental performance, regulatory compliance, customer satisfaction, risk management, and continual improvement.

When implemented effectively, ISO 9001 and ISO 14001 can complement rather than compete—helping an organization become not only more consistent and customer-focused, but also more environmentally responsible and sustainable.

If you have any questions, contact QMII and our panel of expertise and solution providers can help you and guide you with your requirement of an integrated management system.

Email – [email protected]
Phone no – 888-357-9001
Website – www.qmii.com

—

About the Author