Building and developing a management system

A management system should organise the work, not create extra work. In practice it is often put together under time pressure shortly before certification. The result passes the audit and is barely touched again afterwards.

A system that carries weight and brings benefit looks different. It describes how the work is actually done, and it can be maintained without taking someone off their job to do it. Whether ISO 9001, ISO 14001, ISO 45001, ISO 13485 or a sector standard: the build follows the same logic in every case.

Three ways in

Wherever you come in, three things stay the same in every project.

Lean rather than overloaded. Anyone building a system for the first time documents far too much, in our experience. That passes the audit and then costs you years of upkeep. Every additional document has to be controlled, trained and updated with every change. So we document first what you already do. We add only where the standard requires more.

Integrated rather than side by side. Context, leadership, competence, document control, internal audits and management review are near-identical in almost every management system standard. Separate systems mean maintaining and auditing the same processes twice. From the outset we build a shared base structure with the future in mind, so that further management system standards can be integrated later without changing that structure. The standard-specific parts are built in systematically instead of standing beside it.

The system comes from the people who work with it. Processes written at a desk are not lived. They describe a way of working that never existed on the shop floor. So we develop processes together with the people involved, at their workplace. Recording them takes a little longer, and it saves every later discussion about whether the requirement is workable.

Who this is for

• A customer demands a certificate and you have to deliver by a fixed date
• You have inherited a system from an earlier project, and nobody in the company knows any more why it is built the way it is
• Your documentation has grown over the years, and maintaining it now takes more time than the benefit justifies
• A second standard is being added, and you do not want to build a second system alongside the first
• Your certificate is in place, but the way the work is actually done has little to do with the written requirements

What you get

• A management system ready for certification to the standard or combination of standards you choose
• Documentation at the smallest possible scale: as much as the standard requires, and as little as is necessary to ensure conformity with the requirements while still fitting workably into the working day
• Process descriptions the people involved recognise, because they helped write them
• A base structure that takes further standards without a rebuild – shared clauses settled once, not again for each standard
• The evidence that gets asked for in the certification audit: context, risks and opportunities, objectives, competence, management review and so on
• A schedule up to the certification date with responsibilities and deadlines

How we work

1. 1

   Taking stock

   A gap analysis shows what you already meet and what is missing. There is often more in place than expected, just not recognisable as evidence. That saves effort at exactly the point where things otherwise get written from scratch.

2. 2

   Objective and schedule

   We fix the scope, the standards and the target date. From that comes a plan with work packages, responsibilities and deadlines. You can see from the start when and from whom time will be needed in your company.

3. 3

   Recording the processes

   Conversations in the departments, observation on site, comparison with the requirements. We record how the work is done and change only where the standard or common sense call for it.

4. 4

   Documentation and roll-out

   Requirements are drafted, agreed and approved. Plus training for those affected and a look at whether the rule works in day-to-day practice. Actions without a check on effectiveness are only statements of intent.

5. 5

   Ready for certification

   Internal audit, management review, preparation for stage 1 and stage 2 of the external certification audit. On request we accompany you through the certification audit and afterwards onwards through the surveillance cycle.

Who handles this at our end

Marion Rammé – IRCA certified and registered QMS / EMS / OHSMS Lead Auditor #01194927

Rüdiger Rammé – IRCA certified and registered QMS / OHSMS Lead Auditor #01192806

If we have built your system, a different person from our team carries out the internal audit. Nobody audits their own work. That is how we ensure the necessary independence and a clear view of your management system. Who can step in for which standard is set out in the competence matrix.

The team in detail

How this looked in practice

Starting point: A distributor of highly specialised laboratory products, around twenty employees at one site, part of a European group. The trigger came from outside: customers required a certified management system from their supplier. An organisation chart, a set of objectives and complaint statistics were in place. What was missing was a company policy, documented processes and any form of risk assessment.

Approach: Two gap analyses, the first remote covering context, interested parties and scope, the second on site covering the operational flow from goods receipt to dispatch. We assessed 18 requirement blocks along clauses 4 to 10 of the standard. From that came a scheduled implementation plan with traffic-light logic that sets out what the client handles and where we assist. At their express request, the outcome is process descriptions rather than a manual, in a lean format without the usual mandatory fields.

Result: Not one of the 18 requirement blocks was free of findings. But in 10 of the 18, the substance was already there and only the systematic approach was missing. That distinction is what determines the effort: where work is being done but not documented, the path is short. From the first meeting to the planned certification audit is around nine months.

The client's name and sector details remain confidential.

Related topics

• Internal audits & gap analyses – taking stock before the build, and the mandatory date afterwards
• External officers – when the role cannot be filled in-house on a lasting basis
• Software & databases – when evidence can only be kept properly with suitable tools
• ISO 9001 – the most common starting point, and the basis for almost every integrated management system
• ISO 14001 – usually the second standard, when a customer asks for environmental evidence
• Overview of standards – which standard fits your situation

Frequently asked questions

Let us talk about it

The first conversation is free and without obligation. It usually takes half an hour. Afterwards you know what to expect.

• Marion Rammé, Hamburg
• Rüdiger Rammé, Lüneburg – phone: +49 4131 2198634
• Email: all@bout-quality.de

Prefer to write? The contact form reaches us just as well.