Reference case
From no management system
to four certifications in three months.
A company in the technical sector, around 100 employees, with no formal management system in place. A key customer required certification. A supervisory authority was asking questions at the same time. Both had to be answered, and the customer had set a deadline that could not move.
Below is the starting situation, the approach step by step, and the end state. Read it in that order.
This case is described without naming the client. Details that would identify the organisation have been left out deliberately.
The case in figures
4
certifications achieved: ISO 9001, ISO 14001, ISO 27001 and GRS, built as one integrated system rather than four separate projects.
3 months
from start to certification, including internal audit and management review, against a customer deadline that could not move.
~100 FTE
technical sector organisation with no quality, environmental or information security management system in place at the start.
The situation
An organisation that worked well, and could not prove it.
The organisation worked well in practice but had never written down how. There was no quality system, no environmental management, no information security framework and no structured way to demonstrate compliance to anyone outside the company.
When a major customer made certification a condition for continuing the relationship, and a supervisory authority started asking related questions, the gap became a commercial risk rather than an administrative one. Two parties were waiting for an answer at the same time, and only one of the two dates was negotiable.
The case at a glance
Sector
Technical sector.
Organisation size
Around 100 employees.
Standards in scope
ISO 9001, ISO 14001, ISO 27001 and GRS.
Starting point
No formal management system of any kind.
Trigger
A key customer required certification, a supervisory authority was asking questions at the same time.
Time available
Three months, set by the customer and not movable.
The approach
Four standards, one build, in five steps.
The four schemes were never treated as four projects. They were treated as one management system with four outputs, and the order of the work is what made the deadline possible.
Step 01
One system, four standards
Rather than running four implementation projects, I designed a single management system with four outputs. The shared clauses, context, leadership, risk, competence, internal audit and management review, were written once and used for all four schemes.
Step 02
Risk assessment before policy writing
Controls followed from assessed risk, not from a template. That kept the documentation set small and defensible instead of large and generic, which matters when an auditor asks why a control exists.
Step 03
Documented what already worked
The starting point was how the organisation actually operated, not a template. That is the main reason the system was accepted internally instead of resented, and why it survived after I left.
Step 04
A named owner for every process
Each process and each obligation was assigned to a person, not a department. This is what an auditor tests first, and what most stalled projects are missing.
Step 05
Internal audit and management review inside the three months
Both were completed before the certification audit, so the external auditor saw a system in operation rather than a system on paper. This is the step most schedules drop when time gets short, and the one that decides the outcome.
The result
Certified, and still maintainable afterwards.
The end state, as it can be checked against certificates and audit records:
All four certifications, ISO 9001, ISO 14001, ISO 27001 and GRS, were achieved within three months.
The customer requirement was met inside the deadline the customer had set.
The supervisory authority received a documented answer instead of an assurance.
The organisation kept one management system it could maintain itself, with a light annual cycle, rather than four systems needing four owners.
Speed here was not a matter of cutting corners. It came from refusing to build four parallel bureaucracies.
Next step
Facing a customer or regulator deadline?
Tell me the date you have to meet and what has been asked of you. I will tell you honestly whether it is achievable and what the shortest credible route looks like.