Older Blogs

One of the first questions any business asks when considering ISO certification is:

“How much is this going to cost us?”

And it’s a fair question. Because unlike buying software or equipment, ISO isn’t a single purchase — it’s a combination of time, effort, external audit fees, and ongoing commitment.

The problem is, most answers online are vague. They either throw out a generic number or avoid the question entirely.

One of the most common questions I hear before an audit is this:

“Can we actually fail?”

It’s a fair question. Audits can feel high-stakes. There’s pressure from clients, directors, and teams who’ve invested time building the system. Nobody wants to “fail.”

So let’s be clear about how it really works.

Yes, you can fail – but it’s not what most people think.

An ISO audit is not like an exam where you score 49% and get sent home.

Let’s be honest: no one gets excited about maintaining an asset register.

It’s one of those ISO requirements that often gets pushed to the bottom of the list. I’ve seen businesses treat it as a dusty spreadsheet in a forgotten folder – or, worse, assume IT “has a list somewhere.”

But here’s the thing: an up-to-date asset register isn’t just an admin task. It’s a tool that supports the effectiveness, security and sustainability of your entire management system – and it’s a requirement across ISO 9001, ISO 14001, ISO 45001 and ISO 27001.

In the world of ISO, few words cause more anxiety than nonconformity.

I’ve worked with plenty of organisations that go into panic mode the moment one is raised – whether during an internal audit, a surveillance visit, or day-to-day operations. People worry it will reflect badly on their work, damage their reputation, or trigger a flood of paperwork.

But here’s the thing: nonconformities aren’t bad. In fact, handled properly, they’re one of the most powerful tools your management system has for driving real improvement.

When businesses start thinking about ISO certification, supplier management rarely tops the list of priorities.

But as I’ve seen time and time again – both as a consultant and as an auditor – this is one of the most overlooked and underdeveloped areas of a management system. And it’s often the weakest link.

Whether it’s ISO 9001, 14001, or 45001, managing supplier relationships properly is vital, not just to comply with the standards, but to protect your customers, your reputation, and your operations.

In this blog, I’ll break down what ISO expects, what I’ve seen go wrong, and how smart businesses keep it simple, scalable, and effective.

“Can you just give us a training matrix?”

It’s one of the most common things I get asked when businesses are preparing for ISO certification – especially ISO 9001, 14001, 45001 or 27001. And while a training matrix is useful, it’s not what Clause 7.2 is really about.

After years of working with companies across sectors – and auditing their systems too – I’ve seen a lot of confusion around the word competence. Many organisations still assume that if someone’s been on a training course, or has a certificate on file, that’s job done.

Most people skip past Clause 4.3 of the ISO standards because it looks short and harmless:

“Determine the boundaries and applicability of the management system to establish its scope.”

Simple, right? Just write a sentence or two, job done.

But after years of working with organisations on ISO 9001, ISO 14001, ISO 45001 and ISO 27001 – and auditing countless more – I’ve learned this:

The scope sets the tone for everything else.

When it’s vague, overcomplicated, or too narrow, it creates confusion. When it’s clear, accurate and aligned with how your business actually operates, it makes the entire system easier to implement, manage, and audit.

If there’s one word that tends to make people nervous in the world of ISO audits, it’s nonconformity.

But over the years, I’ve found that the smartest businesses – the ones that don’t just get certified, but actually improve – treat nonconformities not as problems, but as opportunities.

Unfortunately, far too many organisations still view them as a nuisance. Something to explain away. Something to fix just enough to get the auditor off their back. And then they move on.

That’s a huge missed opportunity. Because nonconformities, handled correctly, are one of the most powerful tools for improvement any ISO system offers.

If there’s one ISO topic I get asked about time and again, it’s supplier management. Whether I’m working with a client on ISO 9001 for the first time, helping them transition to ISO 45001, or conducting a 14001 audit, the same issue crops up:

“We know our suppliers are important – but how do we manage them in a way that’s simple, scalable, and aligned with ISO requirements?”

It’s a great question. Because while supplier management might seem like a ‘supporting process’, in reality it has a huge impact on your compliance and your business performance.

I’ve worked with businesses where a poor-performing supplier caused major nonconformities – and with others where tight supplier control was their competitive advantage.

Sources of external knowledge often include other ISO/International standards; research papers; webinars from conferences; or knowledge gathered from, or about your customers, stakeholders or other external parties. Your organisation should assimilate and deploy...

‘Organisational Knowledge’ is closely linked with ‘documented information’. You should take steps to identify the internal and external knowledge necessary to ensure your continued product’s or service’s conformity. You should confirm how your organisation has...

Confirm that where measurement traceability is a requirement, instruments which are used for measurement are subjected to the following controls:   Devices are calibrated at intervals or prior to use, based on recognised standards; Devices are adjusted as...

Once your processes are determined, and their sequence is documented, you should identify the risks and opportunities associated with these processes. In order to realise the benefits associated with the identified risks and opportunities, subsequent changes to the...

Your organisation must undertake planning in order to determine how its management system objectives will be achieved. This planning includes determining the work required in order for the organisation to realise its objectives - you should look for evidence that...

An effectively implemented management system aligns the policy with strategic and management system objectives and provides the framework upon which to translate these objectives into functional targets. Establish and maintain documented quality objectives and targets...

Once your processes are determined, and their sequence is documented, you should identify the risks and opportunities associated with these processes. In order to realise the benefits associated with the identified risks and opportunities, subsequent changes to the...

Your organisation must undertake planning in order to determine how its management system objectives will be achieved. This planning includes determining the work required in order for the organisation to realise its objectives - you should look for evidence that...

An effectively implemented management system aligns the policy with strategic and management system objectives and provides the framework upon which to translate these objectives into functional targets. Establish and maintain documented quality objectives and targets...

The objective of Risk Treatment and Risk Mitigation is to identify how your identified risks will be treated. Risk treatment involves identifying the options for treating each risk, evaluating those options, assigning accountability (for Very High, High and Moderate...

Understanding the risks and managing them appropriately will enhance your organisation’s ability to make better decisions, safeguard assets, and enhance your ability to provide products and services and to achieve your mission and goals. By considering risk throughout...

Risk identification should be carried out with the full involvement of the relevant parties to ensure the relevant perspectives and expertise should be represented (e.g. appropriately qualified representatives from various functions, contractors, stakeholders,...

Throughout ISO management systems, there is a reliance addressing your organisation's risks and opportunities. These should be relevant to the context of your organisation as well as any interested parties. You should ensure that your organisation has applied a risk...

When implementing an ISO management system, you should check whether your quality, environmental, health & safety and/or information security policies have been communicated and understood throughout your organisation. The policies must also be available to any...

So far we've looked at setting up a management system for your organisation that conforms to ISO standards. But what evidence would you be able to show that it's working? Evidence may include Top Management reviewing management system KPI’s as part of regular business...

ISO 9001:2015 includes specific requirements necessary for the adoption of the processes approach when developing, implementing and improving a management system. This requires your organisation to systematically define and manage processes and their interactions so...

Defining the scope of your management system is a key step when developing any management system. The scope should concisely describe the activities, regulatory requirements, facilities, and remote locations that are to be covered under, and supported by, the...

Continuing from last time, although not specifically required, objective evidence could be a list or matrix of the interested parties, their corresponding needs and expectations, and indication of which of these have been accepted as compliance obligations. Compliance...

Last time we looked at using a PESTEL analysis to help you do the 'Context Analysis' requirement of the most popular ISO standards. This time we carry on in this vein to give you other ways to properly consider your organisation's context. Reviewing your...

Last time we looked at the ISO clause relating to the context of your organisation - how your company must determine external and internal issues that are relevant to your purpose and strategic direction, and that affect your ability to achieve the intended result(s)...

"Context of the organisation" is a clause of the main ISO management systems (for example, ISO 9001, ISO 14001, etc) and this requires organisations to consider both the internal and external issues that can impact on their strategic objectives and how they plan their...

Modern ISO Standards follow the Annex SL Structure (see the article last time), which ensures consistency across the Management System standards. The first real actionable clause of this structure - so no matter which standard you are looking - is number 4, 'Context...

This time we take a look at how internal audits actually work. As we saw last time, these are there to examine the operation of your management system and provide top level management with the information needed to ascertain whether the system is operating effectively...

Regardless of the industry, companies face increasing competition with each passing day. Whether you’re a massive enterprise, or a small startup, monitoring and maintaining operational efficiency has never been more important. Consequently, internal audits have grown...

A core but often misunderstood clause of the main ISO standards is the area of ‘Leadership’. This is a term which means different things to different people, but what does it mean in terms of management systems? Although there are a lot of different definitions of...

“Should I get ISO certification?” - this is a question only you can answer, and really only when you’ve answer the question “why do I need ISO certification”? It might be that you need it because a client has said it won’t deal with you until you do; or you want to...