ISO 9001 and 27001 readiness
Certification prepared by somebody who has sat on the auditor's side of the table.
Ready before somebody asks
Usually this starts with a client, a tender or an insurer asking whether you hold 9001 or 27001, often with a deadline attached. I can work to that deadline, but the better position is to be ready before anybody asks, so certification is a decision you make rather than a scramble somebody else forces on you.
It is worth understanding what is really being bought. ISO 9001 is a quality management standard and 27001 covers information security, and in both cases what an auditor is looking for is evidence that the business does what it says it does. Most of the pain comes from businesses inventing a system to be audited against rather than describing the one they already have.
How I run it
I am a qualified auditor, so I know what will actually be asked for on the day, and a great deal of ISO preparation goes on things no auditor will ever look at. I run a gap assessment against the standard, write the documentation around the way you already work instead of inventing a parallel system nobody follows, and then run the internal audit myself before the real one.
Where it helps, I also build the tooling that keeps it current, so evidence is captured by the people doing the work in the tools they already use rather than gathered in a scramble beforehand. That is the difference between a system that survives its second audit and one that quietly rots after the first.
What you end up with
A management system your team recognises as a description of their own jobs, evidence in place, and no surprises on audit day. The certificate matters commercially, but the thing worth having is a business that can answer questions about itself.
If the preparation turns up operational problems that have nothing to do with the standard, which it usually does, those are better dealt with as a process build than bolted onto the compliance work.
Common questions
Can you certify us yourself?
No, and nobody who prepares you should. Certification has to come from an independent certification body. What I do is make sure you pass when they arrive.
How long does ISO 9001 or 27001 readiness take?
It depends on how much already exists in writing and how the business operates. A business with documented processes is a shorter job than one where everything lives in people's heads.
Will we end up with a folder nobody reads?
That is the thing I am trying to avoid. The documentation is built around how you already work, so it describes the business rather than an imaginary version of it.
Do we need 9001 or 27001?
9001 is quality management and tends to be asked for in tenders and supply chains. 27001 covers information security and comes up where clients are handing over data. Some businesses need both.
What if we already hold certification?
Then the useful work is usually keeping it current between audits, which is where the tooling and internal audit side comes in.
Start with a conversation
Half an hour on the phone is usually enough for us both to work out whether there is something worth doing here.