The ISO Show
Blackmores is a pioneering consultancy firm with a distinctive approach to working with our clients to achieve and sustain high standards in Quality, Risk and Environmental Management. We'll be posting podcasts discussing ISO standards here very soon!
info_outline
#260 What is ISO 9004? Guidance For Quality Management Systems
10/14/2026
#260 What is ISO 9004? Guidance For Quality Management Systems
Putting work into Quality Management doesn’t stop once you achieve ISO 9001. Continual Improvement is at the heart of every ISO Standard, but sometimes it’s hard to know what good looks like beyond certification. This is where Guidance Standards can lend a hand. ISO 9004 provides guidance for Quality Management Systems, and though its current iteration was published in 2018, its advice is more aligned with the 2026 version of ISO 9001 than the previous 2015 edition. In this episode, Ian Battersby dives into the purpose of ISO 9004, its applicability to the new 2026 version of ISO 9001 and explores the clauses and differences between ISO 9001 and ISO 9004. You’ll learn · What is ISO 9004? · What’s the main difference between ISO 9001 and ISO 9004? · Is ISO 9004 due an update? · Where do ISO 9001 and ISO 9004 connect? · What are the other differences between ISO 9001 and ISO 9004 · Breaking down ISO 9004 by clause Resources · · In this episode, we talk about: [02:30] Episode Summary – Ian Battersby dives into the guidance Standard for Quality Management, , looking at the key connections and differences between it and . [02:45] What is ISO 9004? ISO 9004 is a Guidance Standard designed to support ISO 9001. Its latest iteration was published in 2018, which was 3 years on from ISO 9001’s previous iteration, meaning much of its guidance aligns with the newer 2026 version of ISO 9001. [03:35] What’s the main difference between ISO 9001 and ISO 9004? There is a core distinction between the two: ISO 9001 is a management system standard — it specifies requirements. An organisation can be audited and certified against it. Its job is to give confidence that an organisation can consistently deliver products and services that meet customer and applicable statutory/regulatory requirements. ISO 9004 is guidance, not requirements — you can't be certified to it. It addresses the "quality of an organization" itself: the degree to which its inherent characteristics fulfil the needs and expectations of all relevant interested parties (not just customers), with the aim of sustained success over the long term, in a changing environment. ISO 9001 gives confidence in what you produce or deliver and ISO 9004 gives confidence in what you are as an organisation. In short, the two complement each other. Something worth noting: The 2018 edition of ISO 9004 deliberately repositioned itself as independent of ISO 9001 rather than an "add-on"; a change from earlier editions, which were more explicitly paired as a "consistent pair" with 9001. [06:00] Is ISO 9004 due an update? ISO 9001 has been updated as of 2026, so should we expect ISO 9004 to follow suit? The answer is no, there is no planned revision date currently, so the most current edition is still 2018. [08:45] Where do ISO 9001 and ISO 9004 connect? There are a number of features of each Standard that connect. Both sit under the same quality management principles from ISO 9000, so they share a common vocabulary and philosophical base, so there's no contradiction, just different altitude. ISO 9001:2026 has an Annex which is very helpful in explaining requirements, but ISO 9004 can be read as picking up where 9001 stops. ISO 9001's clauses (context, leadership, planning, support, operation, evaluation, improvement, all clarified in the new ISO 9001 Annex) reappear in 9004 but are expanded and extended into strategic territory, eg, 9001's "leadership" clause vs 9004's full treatment of policy, strategy, and organisational identity. An organisation that's already certified to 9001 has the infrastructure that 9004 assumes and builds on, so 9004 may be used as a maturity roadmap after certification, not before it. Remember: ISO 9001 is the ground, 9004 is the sky you're reaching toward. [10:50] What are the other differences between ISO 9001 and ISO 9004 – Other key differences include: · Certifiable vs non-certifiable (single biggest practical difference for clients: no third-party audit, no certificate, so no external pressure to adopt it). · Compliance / conformity mindset (ISO 9001) vs performance / excellence mindset (ISO 9004). · Narrower interested-party scope (customer focus, mainly) vs broader (all relevant interested parties). · Operational / tactical (ISO 9001) vs strategic / cultural (ISO 9004) — identity, values, culture literally appear as a clause heading in 9004 and have no equivalent requirement in 9001. [12:20] Why this matters for organisations right now, with 9001:2026 just out – ISO 9001:2026 has actually pulled a bit closer to ISO 9004's territory. The new 2026 version of ISO 9001 adds "quality culture and ethical behaviour" language and stronger strategic framing, which was already present in the 2018 version of ISO 9004. This narrows the conceptual gap slightly, even without ISO 9004 itself being revised. [13:05] Breaking down ISO 9004’s Clauses 1-4 – 1–3: Scope, normative references, terms and definitions: standard preliminaries. Clause 4 - Quality of an organization and sustained success: defines the core concept: quality of an organization is the degree to which its inherent characteristics fulfil the needs and expectations of customers and other relevant interested parties, and sets out what "managing for sustained success" means. It’s distinct from 9001, which focuses on quality of products / services. It introduces broader concepts than ISO 9001 in relation to IPs, relationship management, and the varied expressions of needs and expectations. [14:50] Breaking down ISO 9004’s Clauses 5 & 6 – Clause 5 - Context of an organization: identifying relevant interested parties and the external/internal issues affecting the organisation (it corresponds to but receives broader treatment than ISO 9001's equivalent clause). It builds upon ISO 9001 clause regarding internal and external issues and proposes external factors such as globalisation, innovation & natural environment. It expands on internal factors to bring in strategy, complexity and maturity. It invites top management to consider these issues and to determine which could result in risks to sustained success or opportunities to enhance sustained success Clause 6 - Identity of an organization: This is the clause with no real ISO 9001 equivalent: it's where 9004 moves into genuinely strategic / organisational territory. An organization is defined by its identity and context. The identity of an organization is determined by its characteristics, based on its mission, vision, values and culture. These are all too vague in many organisations, but here it lays out what they should really mean: · Mission: the organization’s purpose for existing; · Vision: aspiration of what an organization would like to become; · Values: principles and/or thinking patterns intended to play a role in shaping the organization’s culture and to determine what is important to the organization, in support of the mission and vision; · Culture: beliefs, history, ethics, observed behaviour and attitudes that are interrelated with the identity of the organization Note the word ‘ethics’, ISO 9004 is way ahead of ISO 9001 in addressing ethical behaviour. [18:15] Breaking down ISO 9004’s Clause 7 Leadership – Policy, strategy, objectives, and communication, all framed around driving sustained success rather than just QMS conformity. It refers back to leaders promoting the mission, vision etc. It talks about them creating the environment in which people are engaged and committed to objectives. It also describes unity of purpose and direction (established by top management). In 7.2 we have policy AND strategy. ISO 9001 does require alignment to strategic direction, but here it guides us to develop strategy, either by a recognised model or one bespoke to the organisation. It even proposes that top management should make strategic decisions regarding competitive factors and provides a model for doing that, it then goes on to discuss the alignment of objectives. It takes objectives way beyond ISO 9001 and considers framing them in terms of the organisation’s positive impact on society and the environment, and it’s people’s engagement in society beyond merely business-related activities. Again, we see the ethical slant in ISO 9004 well before its inclusion in ISO 9001. [18:15] Breaking down ISO 9004’s Clauses 8 & 9 – Clause 8 - Process management: Determining processes, assigning responsibility and authority, and managing processes. This clause contains fuller treatment than ISO 9001's process-approach requirements, but also one which discusses processes as means to fulfilling objectives. Clause 9 - Resource management: Beginning with people (engagement, empowerment, competence), organizational knowledge. Competent, engaged, empowered and motivated people are a key resource. Engagement of people enhances the organization’s ability to create and deliver value for interested parties. Empowerment enhances the motivation of people to take responsibility for their work and its results. 9.3 covers organisational knowledge, which receives very scant treatment in ISO 9001, but is expanded upon greatly here. Here it’s described as: ‘An intellectual asset which top management should manage as an essential element of the organization’s sustained success.’ The rest of clause 9 gives very broad guidance on technology, infrastructure and work environment, externally provided resources. All much more detailed than the ISO 9001 equivalents. In one part it discusses: ‘Creative work methods and opportunities for greater involvement, to realize the potential of people in the organization.’ And notably it mentions natural resources, which doesn't appear in ISO 9001 at all. [23:35] Breaking down ISO 9004’s Clauses 10 &11 – Clause 10 - Analysis and evaluation of an organization's performance: performance indicators, performance analysis and evaluation. ISO 9004 ties these back to policy commitments, needs and expectations of IPs, efficiency of processes, efficiency of resource use, finance, compliance, risks & opportunities. It frames internal audit, not just in terms of conformity, but also in terms of opportunities, promotion of good practice, increasing understanding. Clause 10.6 also introduces self-assessment Clause 11 - Improvement, learning and innovation: Improvement here is defined as an activity to enhance performance, small-scale or organisation-wide. It goes beyond ISO 9001 to encourage improvement and innovation through learning (learning doesn’t appear in ISO 9001). It also has a whole sub-clause on innovation (11.4). A note about Annex A of ISO 9004: It can be utilised as a self-assessment tool. It includes a maturity model plus detailed element-by-element assessment criteria, which organisations can use to score themselves against the concepts in the document. If you’d like help with ISO 9001 or assistance with making best use of ISO 9004, , we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/43288524
info_outline
#259 AmcoGiffen – The Road Towards ISO 27001 Certification
10/08/2026
#259 AmcoGiffen – The Road Towards ISO 27001 Certification
The need for Information Security has only increased as we become more dependent on technology to keep things running smoothly. Even in industries such as construction, which many may have assumed were largely exempt. While not common, there are a few within the construction space that have taken the initiative to implement best practice information security Standards, such as todays’ guest, AmcoGiffen. In this episode, Ian Battersby is joined by James Butler, IT Director at AmcoGiffen, to dive into why they chose to implement ISO 27001, what they learned during the process and the benefits felt following certification. You’ll learn · Who is James Butler? · Who are AmcoGiffen? · What was the main driver for ISO 27001 Implementation? · What was the biggest gap identified during the Gap Anaylsis? · What did AmcoGiffen learn from the Implementation journey? · What are the main benefits of ISO 27001 Implementation? · James’ Top Tip Resources · · · In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by James Butler from AmcoGiffen to discuss their journey towards certification, including the challenges faced and resulting benefits following certification. [03:00] Who is James Butler? James Butler is the IT Director at AmcoGiffen. One thing many may not know about him is that he’s recently started taking swimming lessons aside his kids. Growing up, there weren’t many opportunities to learn, so he’s taking the time now to both set a good example for his children and to ensure he can keep them safe when in bodies of water in the future. [05:40] Who are AmcoGiffen?: AmcoGiffen are a national contractor for construction and engineering throughout the UK. They are owned by the group company . Their projects range from rail, infrastructure, highways, environmental sectors to aviation. [07:10] What was the main driver behind ISO 27001 Implementation? They had a couple of reasons: 1) They wanted to ensure that clients, stakeholders and shareholders had confidence in their ability to secure their data and information along with their employees data. 2) When you work in the public sector, ISO 27001 is becoming a necessary certification to have. James expects that within the next 5 years, it will be just as mandated as currently is. AmcoGiffen already proudly hold Cyber Essentials Plus, and saw ISO 27001 certification as the next natural step to provide that extra level of assurance. [08:35] How long did it take to achieve ISO 27001? It was discussed for a while before committing, but the whole process took around 12 months from start to certification. At first, they did want to challenge themselves with a shorter timeframe, but after starting the process they realised that a shorter time restraint was adding unnecessary pressure and wouldn’t have resulted in a good Management System that could be used. So, they took a step back and allowed more time for the system to be properly integrated into the business, which was that part that took the longest, as documentation is the easier part to deal with. [10:55] What was the biggest gap identified during the Gap Analysis? – For AmcoGiffen, the biggest gap was documentation. They already had a lot in place where controls were concerned thanks to their existing Cyber Essentials Plus certification, but the actual documentation of processes, objectives and risks were lacking. ISO 27001 allowed them to put the structure in place to manage this. Their key message throughout the implementation process was: ‘we need documentation for the right purpose’. [09:55] What did AmcoGiffen learn from the Implementation journey? ISO 27001 helped to create a priority list, while also allowing them reflect and realise they should be documenting a lot more, not just to meet Standard requirements but because it’s the right and responsible thing to do. One such example is making sure that there’s enough information to allow someone to pick up a task if it’s passed to them. They went to great pains to ensure the whole implementation wasn’t forced, and as a result they passed both their Stage 1 and Stage 2 Assessments with no non-conformities or observations! AmcoGiffen also had the benefit of strong leadership commitment and involvement throughout the Implementation. James stresses the need to have Leadership buy-in from day one, otherwise you have to fight an uphill battle of making cases for the changes that you need to make as a result of implementing a Management System. He also make a point of ensuring you understand your stakeholders requirements, as ISO 27001 is not just an IT Standard, it touches on aspects like HR and physical security, aspects they may actively be involved with. If possible, it’s best to bring them in and involve them in the initial planning so you’re all on the same page of why you want to achieve Certification. [15:20] When did AmcoGiffen achieve Certification? – They completed they Stage 2 Assessment in July of 2026 and received the certificate in September of 2026. [15:50] What are the benefits of ISO 27001 Certification? – James states that the benefits started from day 1 of the implementation process. The initial Gap Analysis allowed them to really look at how they currently operated, what were their strengths and weaknesses, where potential opportunities were. It gave them the chance to gather people from all corner of the business to come together and discuss their current processes, get feedback on how they could be improved, and ensure the updated processes would fit in with how they actually worked. James states that IT professionals can have a tendency to over complicate things, so he ensured that the system remained something that could be easily understood and integrated into the business. One other thing they implemented early was a mature Risk Register, this was so they could be driven by the actual risks facing the business and not just by who was shouting the loudest. Ultimately, ISO 27001 has provided a lot more organisational structure and more direction on priorities. [18:55] James’ Top Tips – Do it for the right reason, don’t do it as just a tick box exercise. If you’re simply doing it for a badge on the website, then it’s unlikely it will be providing any real benefit as it requires effort to keep the momentum of continual improvement going. Secondly, get Leadership buy-in before committing to certification. The process will be difficult without that endorsement from the top down. Lastly, challenge yourself to remove friction. The system has to work for the business, not just the auditors of the system. The key is to make the right information available to the right people at the right time. Don’t just bog them down with endless processes and manuals, keep it simple and easy to understand as that’s how a system gets integrated successfully. [21:50] James’ book recommendation – – Mark Manson [23:45] James’ favourite quote – ‘Keep it simple’ If you’d like to learn more about AmcoGiffen, If you’d like help with ISO 27001 Implementation or on-going support, , we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/43220748
info_outline
#258 What is BS 99001? Quality Management For The Built Environment
09/16/2026
#258 What is BS 99001? Quality Management For The Built Environment
Many of you will be familiar with ISO 9001, the leading Quality Management Standard, which provides a solid foundation for managing any business. However, for certain industries, ISO 9001 alone is not enough. The built environment is one such sector, as it requires more rigorous controls to keep projects on track, ensuring safety of all involved and processes that enable documented accountability for each and every step until project delivery. BS 99001 was introduced in 2022, not to replace ISO 9001 but rather to add to existing quality management systems for those in the built environment sector. In this episode, Ian Battersby is joined by Darren Morrow, Senior Consultant at Blackmores, to explain what BS 99001 is, how it addresses challenges unique to the built environment sector and explore the clauses and how they differ from ISO 9001. You’ll learn · What is the built environment sector? · Why was BS 99001 created? · What is BS 99001’s relationship with ISO 9001? · How does BS 99001 differ from ISO 9001? · Exploring the clauses of BS 99001 · Where is BS 99001 going in the industry? Resources · · In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by Darren Morrow to explore , Quality Management for the Built Environment. Join them as they discuss the reason for the Standards creation, it’s relation to and an overview of it’s main clauses. [03:30] What do we mean by the Built Environment Sector? The sector covers the whole human-made environment: · buildings (homes, workplaces, hospitals, schools, entertainment), · infrastructure (roads, rail, bridges, utilities), · public space (parks, squares, streets etc) On top of that, you could also add the urban environment on a large scale, the way cities and towns are planned, developed over time, connected Any profession involved could apply this standard: · Design and planning (town planners, architects, interior designers, landscape architects) · Engineering (civils, structural, M&E, transport, environmental (planning our waste, water etc) · Construction (delivery, PMs, QSs, SMs, trades, contractors) · Management (of estates/facilities, property developers, agents, surveyors, valuers) · Policy, regulation, compliance (local authorities, planning officials, building control, regulatory authorities, enforcement agencies) [05:00] Why was BS 99001 created?: Despite the widespread adoption of 9001 across the industry (and it being a prerequisite in many circumstances), there has continued to be a series of significant incidents, numerous reports and national enquiries. These all point to an issue with quality that a generic standard appears to have failed to address. When this is the case, it’s a sign that something more sector specific is necessary to avoid repeating the same mistakes. The is now being enforced, which has added more implications and requirements on contractors. BS 99001 can help to support compliance with this due to its focus on responsibilities, competency and accountabilities. [09:45] What is BS 99001’s relationship with ISO 9001?: BS 99001 doesn’t modify or replace ISO 9001, it builds on it for the built environment sector. ISO 9001 creates a solid foundation for any business, but because of this it is deliberately vague in it’s requirements. BS 99001 in comparison is very prescriptive with what it what’s businesses to do, record and evidence. [10:30] How does BS 99001 differ from ISO 9001? BS 99001 is very much aware of the project based nature of its targeted sector, so the requirements are written with this in mind. Its requirements are written to ensure all parties involved in construction projects are included, accountability is its foundation, and it looks to help facilitate a lessons learned environment for compliant businesses. [11:30] BS 99001 Clauses: 4 Context - We’re all used to this clause, but there’s a note to consider the nature of the interested parties, as it’s a lot more prescriptive and includes: · Members of the public are suggested first (users of stations, tenants in social housing) · Owners and operators of assets (ie, the built end product) · Project funders/investors · Project owners/sponsors · Project teams It also requires context documents specifically taking into account commitments to social, economic and environmental sustainability. So is being embedded from the start. These interested parties encourage open forums between not only all those involved in the actual construction, but those that will be affected by the project and end product. This commitment to social, economic and environmental sustainability is a theme that continues throughout the whole Standard. Some businesses that already hold certification to Standards such as and think they may already have all of this covered, and in many ways they would be correct, however those typically apply to the business as a whole whereas BS 99001 incorporates everything in and around the project rather than treating projects as a separate entity – which is how other ISO Standards act in this sector. [15:40] BS 99001 Clauses: 5 Leadership – The specific requirement states: ‘Top management shall ensure that a competent person is appointed as the management representative with oversight of quality for projects the organization is involved in or plans to be involved in’ This may seem like an old-fashioned approach, however the need for competency in this sector is paramount. Organisational roles, responsibilities and authorities for Quality Management roles with clear competence and impartiality / independence criteria are explicitly stated. What was once a role that may have not held the power to stop a project like Health & Safety roles, now has that ability. If something is raised as a quality concern, then there is a strong argument for that becoming a safety risk down the line. It’s better to fix something early on than to have it become a bigger problem, therefore, significance to the roles that point out these issues have been given the power they deserve in the project management process. [20:00] BS 99001 Clauses: 6 Planning – Risk management is an essential part of BS 99001, Clause 6 is where the requirements for risks and opportunities is explicitly stated, however, these are references multiple times throughout the Standard. There are specific Risk requirements to take account of are: · Projects it is involved in or plans to be involved in; · The process of construction and the subsequent use of the asset; · The organization as a whole; and · Society the economy and the environment. Many construction companies will be tendering for multiple jobs, so it’s a good opportunity to build a robust risk register that gets added to with each project. Learning from one project should be used to help you to bid for the next one. Keeping track of these should also be done so you can inform your interested parties of the risks involved, and any subsequent lessons learnt should also be of value to your supply chain. One key group that often gets overlooked is the Funders, they’ll have a particular interest in the risks and to have all the knowledge available about what they’re funding. Having records to answer their questions will keep them happy or at least informed. Objective requirements include: · Quality objectives for each project, to reflect contractual and other requirements · Evidence of the following considerations in objectives: · Defined scope, time, cost and project lifecycle · Social, economic and environmental commitments · Collaboration with interested parties In ISO 9001, the objectives are set from the business level, but in BS 99001 these are aimed at the project level. [24:10] BS 99001 Clauses: 7 Support – As mentioned, people and competence is a big focus for BS 99001. Evidence for competence arrangements include: · Project / contract specific roles and responsibilities - formally assigned · Formal process(es) for determining competence · Competence arrangements relating to all people working on the organisation's behalf There are also verification processes for all external providers, including the need for: · Authorities for approval of operations, processes, design, production, inspection and tests · Competence arrangements for management representative(s) specifically regarding quality · Evidence that competence arrangements take into account requirements of interested parties It’s up to the business to make sure they can prove people are competent for the roles they are assigned, which is why there is a lot of detail in this area. Documented information is also key, as this provides a traceable and auditable path of accountability. Again, BS 99001 is a lot more prescriptive on this clause when compared to ISO 9001. BS 99001 requires documentation of: · Process(es) to ensure awareness of statutory / regulatory requirements specifically relating to documented information (eg, building information, product safety, structure, maintenance, retention timeframes) · Approval methods and authorities for the different types of documented information · Communication / availability / control of changes to documented information to interested parties Now this doesn’t mean you have to drown yourself in paperwork! These can all be stored as electronic records. This clause also sees a lot of repetition with areas such as risk, however this is simply the nature of Standards. They operate on the Plan Do Check Act cycle, you plan to do something, you do it, you check, you've done it, and you act on it. This repetition is there for a reason, documenting information especially as you need to prove that your final deliverable is safe, that it’s operational and that it can be maintained. While documentation may seem like a painful process in the early phases of a construction job, it will serve you well once the project is completed as when you get to the point of handover, everything is already done and all required information is readily available for those interested parties. [31:55] BS 99001 Clauses: 9 Monitoring, measurement, analysis and evaluation – In ISO 9001, it’s largely up to the organisation to determine what they monitor and measure, however in BS 99001 there are specific which must be measured, including: [28:30] BS 99001 Clauses: 8 Operation – This, like in most other Standards, is where the bulk of additional requirements sits. 8.3 Design includes: · Re-iterates the need to appropriate design processes at organisation and project level · Clear definitions of roles and responsibilities · Review, verification, validation, approvals and associated competences · Inclusion of interested partes · Compatibility between parties and their designs · Design maturity/novelty · Documentation needs · Life-cycle · Addressing of regulatory requirements, product safety 8.4 Control of externally provided products and services - Again, 9001 allows an organisation to determine its own controls over the supply chain (according to risk). But here, the standard specifically acknowledges the issues with supply chain which partly gave rise to it. It starts with defining the authority to approve suppliers The rest of clause 8 (Control of production and service provision) continues in similar detailed fashion, matching similar themes When we get to 8.7 (Control of nonconforming process outputs, products and services), we see the need to define specific roles, responsibilities and processes It also includes specific requirements for: · Evidence of reports to design team regarding design root causes · Close out of corrections · Agreements of interested parties to corrective action · Concession/design change notifications to design authority [35:45] BS 99001 Clauses: 9 Internal Audit – BS 99001’s internal audits must be risk-based and include projects. You also need to evidence audit results being reported to interested parties. It also goes without saying that you need evidence of auditor competence. Where Management review is concerned, you must include specific information on the performance of projects, and also evidence management review outputs being reported to interested parties. [37:45] Where is BS 99001 going in the industry? – Currently, this is a Standard that applies more to bigger multi-million pound projects. However, Darren is seeing more of the requirements being pushed down the supply chain. We do see that happen with the likes of ISO 9001, ISO 14001 and ISO 45001 certified organisations doing much the same with their supply chains. But BS 99001 differs as it explicitly promotes pushing its requirements down the supply chain, it’s not just a passive affect, it’s something to be actioned through leadership by promoting quality management. [39:55] Top Tip – If this Standard is applicable you, we highly recommend you complete a Gap Analysis, even if you’re already certified to ISO 9001. This Standard differs quite a bit and ISO 9001 misses the requirements that cover the project life-cycle, sustainability and social aspects that BS 99001 focuses on. At a basic level, ensure that your skilled people have their competences ready and available for if a client requires that information. [41:30] The advantage of BS 99001 – BS 99001 ensure that your business can plan well and protect itself with the required record keeping. If things go wrong, you have the documentation to protect yourself, and with the additional planning requirements, you can minimise the risk involved in projects before things have a chance to go wrong. If you are in the Construction Industry, this Standard is worth looking into. If you’d like any assistance with implementing or supporting BS 99001, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/42925787
info_outline
#257 How to meet legislative and ISO requirements in leasehold properties
08/19/2026
#257 How to meet legislative and ISO requirements in leasehold properties
Many businesses do not own the property they operate in, this can lead to complex questions over who has ownership over certain property and facility related legal obligations. Managing areas such as waste transfer, electrical, gas and aircon servicing etc could feasibly be managed by both landlords and those leasing the property, and it’s important to establish who manages what to ensure all legal requirements are met. In this episode, Ian Battersby discusses the complexities of leasehold compliance, including how to establish key responsibilities, examples of what legal and ISO related requirements need to be met and what evidence you need to be keeping a record of. You’ll learn · What is leasehold compliance? · What areas do you need to consider within leasehold compliance? · Establishing responsibility · What subject areas relate to ISO compliance? · How to plan for leasehold compliance and gathering evidence Resources · · · In this episode, we talk about: [02:35] Episode Summary – Ian Battersby discusses leasehold compliance, including establishing responsibilities and gathering evidence to ensure your legal and related ISO requirements are being met. [02:45] What is leasehold compliance? Many organisations don’t actually own the property where they operate, it’s very common for businesses to lease property. A landlord will lease the property to a client and often appoint a building manager, managing agent to run it on their behalf and act as the interface with all the leaseholders. Sometimes, the building manager will be part of a large organisation which also provide facilities management services. Often they’ll only offer the most basic of services and will contract another party to provide further facilities management. Whichever party provides general facility management services will almost certainly need to contract another layer of providers responsible for specialist services such as waste transfer, electrical / gas / aircon servicing. Sometimes, the leaseholder will directly contract a third party for a service (air con, electrical, PAT, cleaning).So all in all, it can be quite a complex picture of responsibility! [05:10] The complexities of leasehold compliance: It can be tricky navigating through this and demonstrating that you’ve fulfilled all your own legal obligations as well as gaining assurance that other parties have done what they need to do to protect you and your employees. Often, those charged with liaising with the building manager are not experts in Health & Safety, Environment, Facilities Management and compliance. It might be the office manager who picks up this role. In some cases, you have an absolute duty, even where the landlord has complete control over the service which is provided to you (e.g. waste management). [06:45] Establishing Responsibility: Establish who owns what, who is responsible for things such as building fabric, installed services, the contracting of support services. But, regardless of actual ownership and the direct responsibility for a particular aspect of a building, there is always an interrelationship, a dependence between building, infrastructure elements. For instance, you may use a whole floor which has been fitted out for your own purposes, you own the electrical installation from the walls inwards, but that links into the electrics beyond your own shell. You may have certain responsibilities in your own area for firefighting equipment, fire doors etc, but fire safety also depends on things like: · The escape routes · The building’s fire alarm · Emergency lighting · Protection of the common areas such as the lobby If the building isn’t safe beyond your own demise, your own demise isn’t safe. While you may not have direct control over these aspects and your legal responsibilities, leases may leave the burden on you to seek evidence. Although there should be demonstration of various compliance obligations throughout the pre-let enquiries process. You may even be lucky enough to have a lease clause which requires landlord to complete or contribute towards compliance reporting. [08:30] What subject areas relate to ISO compliance?: Standards where leasehold compliance is particularly relevant include environmental management and Health & Safety management. For both of these, there may be a need for you to provide your own evidence or seek assurance from a third party. The examples we’re providing here apply to office locations and for more complex, more industrial, more heavily commercial premises. Considerations / requirements for either one of both of these Standards include: Energy performance certificates: Legally required documentation. They rate the energy efficiency of a property from A to G, and they have to be provided prior to leasing and on leasing. These can apply to a whole building or just a wing or floor of a building. These can be verified online via a .gov portal. As of the 1st of April 2023, any commercial property in England or Wales must have a minimum energy performance certificate rating of E. However, this is set to change after consultation, so from April 2031 you won't be able to let property unless it's in the A or B band. Recommendations Report: This supplements the previously discussed energy rating. This report, as the name suggests, provides recommendations for improving efficiency. If you’re already rated an A or A+, then there may not be too many recommendations. But C and below will have some that will improve your building over time. It’s important to note that there is no mandatory obligation to action these recommendations, and some provided can be quite generic and not at all applicable. However, you should seek through the landlord and ask if they're following through on any of the recommendations to improve energy performance, particularly if you will be looking to renew leases around the time that the law changes. Air Conditioning: If your building is relatively new, less than five years, you will really need to see the installation and commissioning information associated with air conditioning. There should be records of building control, electrical installation, commissioning certificates, and also a test which is called a TN 44. This test is legally required once on installation and then again after every 5 years. It needs to be carried out by an accredited energy assessor, who can be verified via the same Government portal as the Energy performance certificates. This applies to any system with an effective rated output of more than 12 kilowatts, which quite simply, is nearly all commercial offices. The TN 44 test will also provide a report which includes recommendations on how to use the equipment, the management regime for its setting points for temperatures and other such advice to keep it working as efficiently as possible. The person responsible for air conditioning is responsible for this certificate. If you own the aircon in your demise, it's yours, if the landlord owns the aircon, it's theirs. F Gases: Any system which contains fluorinated greenhouse gases, so what we call F gases, needs to be inspected regularly to ensure that none of the gas leaks and to ensure that they're operating at optimum efficiency. This can includes things such as air conditioning, heat pumps, Fire Protection (aerosols and foams) and is often used in various parts of Industrial Manufacturing. If there are any leaks, they need to be logged, replacements need to be made, recharge needs to be done, and all this needs recording in a logbook. When it comes to servicing of anything that uses F Gases, you need to check the competence of those individuals. Refcom has a register of accredited / approved companies that provide these services. Fire Risk Assessments: Fire Risk Assessments are legally required documentation which needs to be carried out by a competent person. There isn't a prescribed frequency on fire risk assessments, but you should really be reviewing them at least annually and doing a full reassessment on a three-year period – or when there has been a significant change to the layout / occupation of the building. There is a mandatory way of completing a fire risk assessment, PAS 79, which is a publicly available specification. So you need to check that yours are being done in alignment with this Standard as this provides proper risk evaluation and an action plan which is prioritized according to the level of risk. It may also be worth checking with your insurance organization or any local authorities whether they have a prescribed frequency for your fire risk assessments. Fire Alarms: You will no doubt have a fire alarm within your building, this may be the landlords own fire alarm system or it may be one you as the leasehold business own. As a starting point, you need to understand who has ownership of this. On installation and commissioning, you must comply with certain standards. For the UK this is , which requires building control, a commissioning certificate, handover certification, the correct drawings, a manual, a logbook, specific training to the owners and users of the system. Every six months you should have a competent person complete maintenance, servicing and inspection to ensure that the way the fire alarm was installed is the way it remains in compliance with BS 5839. As well as a six-monthly inspection, there is also a competent person test and inspection over elements over and above that, which requires certificate issuing annually. There's also a full test and inspection of the wiring underpinning the fire alarm system. This isn't prescribed, but it's commonly conducted at 10-year intervals. Fire Extinguishers: You may own the fire extinguishers in your own demise or they may be owned by the landlord. What you need to do is, if you own fire extinguishers within the organization, take responsibility for regular walk arounds to check that they're all in the right locations, the right numbers are present, that they are accessible, secure, fully charged in the green zone, undamaged, the seal is untampered, and the service date is correct. Every year, you need a competent person to come in and check the fire extinguishers fully, record this in the fire logbook and provide a certificate of service for each of the extinguishers in use. Depending on the type of extinguishers you've got, you may need a five yearly or possibly longer frequency extended service. Other Fire Suppression Systems: You might have a fire sprinkler system which will require installation and commissioning certificates. Regular inspection maintenance service will then depend on the type of system, this could be anywhere between a quarterly, annually, five yearly, 10 yearly inspection regime. There should be evidence that there is some form of local regular inspection to check that there is no visible damage to a fire suppression system. We would advise you to discuss with your landlord about what process exist for those inspections. There are also fire doors that need both competent person checks on a six month to annual basis to check for the physical robustness for the opening and closing mechanisms for external escapes to open correctly. But there should also be regular checks by local representatives within your organization of any fire doors within your own demise and from your own demise to check that they are physically sound and operate correctly. The escape routes from those should also be checked by the landlord for any obstructions beyond your demise to see that there's an adequate, safe path from the building in the event of a fire. Emergency Lighting: There is again a regular monthly checking to see that emergency lighting comes on should the power go down. Sometimes that's by flick testing, nowadays, some buildings have automated testing of their emergency lighting. This requires an annual inspection be a competent person, which will result in a test certificate as proof of inspection. Gas servicing and electrical wiring inspection: Gas servicing is required once a year by a gas safe, registered, competent person, and the resulting certificate will indicate whether there are any recommended actions. With electrical installation and condition reports (EICRs), Electrical and fixed wiring is checked every five years and on installation and commissioning as well. These have different levels of findings, including: · C1, danger is present · C2, potentially dangerous · C3, improvements recommended · And FI, further investigation Anything which is a C1 and C2 needs to be addressed, anything which is an FI requires seriously looking into to see what the implications are. If you have your own EICR for your own demise, you should be checking the content of that to see what the recommendations say, not just accepting the certificate as if it is the gospel says your equipment is safe. If the landlord is responsible for an EICR in other parts of the building, you should liaise with the landlord to see what implications there are for you. [29:15] How to plan for leasehold compliance and gathering evidence: What's your strategy for making sure you are safe and you know you're safe and you can provide assurance of that safety? If you've got direct control of the contracting of any services, then it can be quite straightforward because you control the contractor: · You should be verifying the contractor's competence. · You should be verifying that they're providing the right service, maintenance, inspection, test documentation. · You should have within that documentation recommendations, risks, actions that you can then take forward. But if you rely on the landlord's agent, for instance: · You have to rely on cooperation with them. · You also have to rely on their own understanding of their obligations and their record keeping. You'll need to approach them with a structured list to request all the things you need to meet your legal requirements. Work out a way to retrieve what you need, as they need it as well, so it should be straightforward once they've sourced it to provide you with it. If you have any regular tenant, landlord, managing agent meetings, use those to review compliance and any progress on recommendations. If those meetings don't exist, perhaps you could set up some form of regular meeting where you can assess your level of compliance and monitor any movement in that. Where you've received any record from a service, a maintenance, a test, a certification or an assessment, study that carefully. See where the risks are and follow through on relevant recommendations. If you’d like any assistance with navigating leasehold compliance or implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/42485325
info_outline
#256 BedX – Supporting Businesses Looking To Tender For Universal Bedfordshire and Beyond
08/05/2026
#256 BedX – Supporting Businesses Looking To Tender For Universal Bedfordshire and Beyond
There has been a lot of buzz around the upcoming Universal Project currently in development in Bedfordshire. It’s estimated to generate around £50 billion in economic benefit, along with the creation of 20,000 jobs during its construction, and a further 8,000 jobs once it’s operational. It’s undoubtedly brought a lot of eyes towards the smallest county in the UK, and with it a lot of opportunity for local businesses to get involved with not only the main theme park itself, but the surrounding projects that aim to make Bedford and beyond a thriving tourist destination. For those wondering how to get involved, there is a dedicated group looking to share knowledge and tools to get you tender ready. In this episode, we are joined by Lorna Leonard, Managing Director of LBS, and Kirsty Maynard, Commercial Director of THSP, who are instrumental in running BedX, a group dedicated to sharing knowledge and tools to help businesses get tender ready for Universal and beyond. Listen to our roundtable discussion as we dive into why BedX was created, its main drivers, how it can support local businesses and how you can get involved. You’ll learn · Who are Kirsty and Lorna? · What is BedX? · What were the main drivers behind the creation of BedX? · What are the group’s main aims? · What are Kirsty and Lorna’s roles within the group? · How can businesses get involved with and benefit from BedX? · What can businesses be doing now to get tender ready for Universal? Resources · · · · · In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman and Carly Mowbray are joined by Lorna Leonard (v) and Kirsty Maynard () to discuss the creation of BedX, and how it aims to support businesses with tender preparation ahead of the Universal and related projects currently underway in Bedfordshire. [01:25] Who are Kirsty and Lorna?: Kirsty is the commercial director at THSP. THSP work with businesses across health and safety, HR and compliance, helping organizations make sure they've got the right systems, processes and people in place to operate safely, professionally and compliantly. THSP have been in operation since 1992 and support any type of organisation, from construction to food brands, global luxury retailers, major transport organizations, and complex international businesses operating in highly controlled environments. Lorna is the managing director of LBS. LBS is a business solutions company supporting sophisticated start-ups and growing corporations with outsourced finance department services, direction and solutions. She set-up the business 14 years ago, and has worked with organisations of all sizes, from blue chip companies to micro businesses of only 1 or 2 people. Regular listeners may recall Lorna from a , she also shares many insightful posts on LinkedIn and is certainly worth a follow! [07:05] What is BedX? It's A business-led working group powered by the Bedfordshire Chamber of Commerce. It was created to help Bedfordshire businesses understand, prepare for and win work from the major investments coming into the region, in particular, the universal destinations and experiences, the Luton Airport expansion and other on-going linked projects. BedX’s role is to connect, inform and prepare, but they don't lobby, they don't represent the developers and they don't do politics. They are simply there to help local businesses get ready. [07:45] What were the main drivers behind the creation of BedX? The Universal park is certainly the banner piece for the group. It’s what all the big numbers are attached to, including 5 billion pounds worth of inward economic investment, 20,000 jobs created and the five years’ worth of construction. However, that is just one part of the upcoming development going on in Bedfordshire. The big project is seeing more funding going into the area to support transport networks and other venues as investors seek to make Bedfordshire a place worth staying for more than just the Universal Park. Other projects include the expansion of the Wixams Train Station, construction at the Luton Hoo, the new Luton Town Football Club and a new Data Centre at Quest Pit. BedX was created in response to all of these projects, not just Universal. It’s to help local businesses navigate these opportunities, as this small county has rarely seen such a seismic shift in the amount of investment going into the area. Even though the deadline for Universal Park is 5 years away, supply chains are looking for support now, which is why it’s better to start preparing sooner rather than later. [10:20] Making Bedfordshire a play to stay: It’s also not just about the venues, to prepare for the influx of tourists there will be more investment in housing and transport and related routes such as the work currently going on at the Black Cat roundabout. Kirsty states that the Bedford County Council have a scrutiny committee, which is currently labelled as the Universal Scrutiny Committee, and are in discussion about a viable tourist strategy for Bedfordshire. So, there is no doubt that there will be many more small projects going ahead within a very short timeframe to get the area ready. [12:00] How LBS’s expertise is instrumental within BedX: Businesses that want to get involved may not know how to get working capital or access potential available funding, which is where Lorna’s and LBS’s expertise comes in to support BedX’s aims. With tenders as highly valued as this, it can throw businesses through a loop if they’re not prepared. Lorna shares a story where she explains that she used to work for a company that made point of purchase display equipment, this company had a US subsidiary called Anshauser-Busch, who own Budweiser. That subsidiary put through an order directly through to their factory, requesting a huge order be manufactured and delivered within 180 days. The cost of which was upwards of $2.7 million, which was due to suppliers 150 days prior to Lorna’s company at the time being paid. It was their first time working with that subsidiary, so there was no guarantee on payment. The lessons they learned ended up shaping how the company operated going forward. All this to say, if you’re bidding for high value contracts, you need to think about the opportunity from every perspective. [14:40] Be realistic about what you bid for: Kirsty states she is really passionate about ensuring businesses are trying to grow responsibly, so that they understand those terms in the bid and that they're realistic about the size of contract that they should be bidding for. If you’re looking for more guidance in this area, Katie from Bids and Tender Support provided a webinar on this topic for BedX. It’s available to view on-demand on BedX’s website. [16:25] Lorna’s role within BedX: Lorna reminds us that a lot of the Tier 1 contractors started out as 1 or 2 person businesses. She states that, honestly, 90% of the companies that BedX help will not be in direct contact with one of those Tier 1 contractors. However, supply chains are just that, a chain, there are many opportunities to get involved further down the line. Lorna feels as if that’s a large part of her role, keeping businesses focused on the opportunities they can access within that supply chain. She is also keen to help all the local businesses understand how this is going to affect them, because whether they get involved in the various projects being built or not, the whole area is going to be affected regardless. She points out an example where they needed to source a large number of electricians, and it turns out that Bedfordshire simply doesn’t have enough! So BedX is helping to make the wider community aware of training opportunities like this that can open doors for local businesses. [18:45] Other considerations for businesses operating in Bedfordshire: Lorna points out a few other concerns that people had about the on-going development in the area, including the possibility of local contractors putting prices up due to all the other projects. Timeframes may also be affected by both on-going work and the fact that more businesses will be getting involved in the area’s development. [19:15] What are the group’s main aims?: BedX’s main aim is to be an opportunity exchange, they sit in the middle as a conduit between the opportunities and the Bedfordshire businesses and help to inform, educate and prepare to be a part of it. They are there to support preparation local businesses are able to access emerging supply chains as that waterfall flows down into tier 2 and 3 and even into 4 and 5 over the course of the project. If you’re not sure which of those tiers you’d likely sit in, BedX have a helpful household checklist to find out. [20:20] Getting ISO Ready for Universal: Kirsty mentions that she’s seen a lot of recent Pre-Qualification Questionnaires (PQQ’s) request that bidding companies are certified to Information Security. Many will be familiar with the requests for (Quality Management), (Environmental Management) and (Occupational Health & Safety), but ISO 27001 seems to be a more recent pre-requisite. This is particularly the case for any Government contracts, with them stating either Cyber Essentials or ISO 27001 must be in place for any bidding businesses. Carly points out that ISO 27001 in many cases is just the first step, as you can strengthen this with supporting Standards such as (Privacy Information Management) and & (Cloud Security), which can give you an advantage over your competitors. If you’ve not got any Standards in place, or are just starting out on your implementation journey, you can get in contact with Blackmores as we’d be happy to guide you towards successful certification. [25:00] Kirsty’s role within BedX: Kirsty’s role is focused on coordination, though all BedX organisers are volunteers, they still want to ensure that actions are followed up and completed. Kirsty has a project planning background and brings those skills to the group. She also plays a key part in tender and procurement readiness, as she has years of experience with PQQ’s from her work within the construction industry. She knows what good looks like when bidding for work, and ensures that knowledge is being passed on to those looking to bid for Universal and other Bedfordshire development projects. A trait that many of the BedX team hold, Kirsty and Lorna especially, is the motivation to help people, and this group allows them to do so at scale. [27:45] How can businesses get involved with BedX?: You don’t need to be a member of the to get involved. Currently BedX’s main focus is on knowledge sharing, so their main output in . They also have a , this is an online tool which takes just a few minutes to complete and will give you an idea of where you’re already compliant and where there’s work to be done. They have also had 1 in-person event, that being their official launch in April of 2026, which was attended by members from the Bedfordshire business community and representatives from Universal, Sizewell C and Luton Rising. They expect to run more in-person events in future, so keep an eye on their LinkedIn for news on these! Lorna hints at an upcoming event planned for September 2026 😉 You can also sign up to the Bedfordshire Chambers Newsletter for more updates. An ‘Easy Guide To Social Reporting’ is due out imminently. Those wanting to bid for Tier 1 contracts, social value is a legal responsibility, so if you’re not sure on how to report on that, this is one for you to keep an eye out for. For information you can access right now, they have: · Contractor Tier Checklist · Tender Diagnostic · Working with Tier 1 contractors webinar (hosted by Henry from Kia) · How to be tender or procurement ready webinar (Hosted by Kirsty) · How to write a good bid webinar (Hosted by Katie Beryl from Tender and Bid Writing Services) [31:10] What can businesses be doing now to get tender ready for Universal? One thing Lorna stresses is being visible. If you don’t have a social presence or good SEO, then you may be missed as an option for those looking for specific services within these developing supply chains. She also shares a story about the supply of the chocolate frogs that are sold at Universal Floria, which were all provided by a 2 person company. This highlights that it is possible for smaller local businesses to win big through these opportunities, but you need to be prepared. This is why Kirsty and Lorna both highly recommend making use of their Tender Diagnostic tool. Being tender ready may seem like a daunting process, and it can quite difficult, but they are worth putting time into. Also anything you can do to think about what you may need to change within the next few years. Think about how these developments are going to affect the traffic to the area, you might need to reconsider who your target market is depending on the whims of upcoming tourists. This can affect what services / products you offer and how you advertise going forward. The sooner you think about it, the better prepared you can be. Lorna also recommends networking with local businesses. Bedfordshire is going to become a thriving hub, and the more connections you can make now, the better. Some of these tenders may require the collaboration of multiple businesses, which would be an all round win for everyone involved. Networking also allows your name and brand to spread through word of mouth. If you’re not in the room, it helps to have people who can vouch for you if your specific services are being sought out. Lastly, Lorna and Kirsty just say to dream big. Just because you may be a small business does not mean you are automatically locked out of those big tenders, they are worth a try. An important note, being local to Bedfordshire won’t make up for gaps in the eyes of Universal and related projects, however, if you share equal capabilities as other companies outside of the county, then being local will tip you over. [40:10] Evidence is key: Ultimately being tender ready is in your best interest. Contractors will be looking for evidence that you do what you say you do, so ensure you have Case Studies and the required certifications to back-up your claims. Social Value is another big factor, which can account for up to 20% of a bid score, so this is another area where you need a clear trail of evidence. Having a clear library of evidence to back up your claims, that align with how you operate will make you stand apart from the competition. So, start gathering this now if you haven’t already. If you’d like to get involved with BedX, If you’d like any assistance with implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/42323830
info_outline
#255 AI Due Diligence - Information Security Checks Before You Integrate AI
07/22/2026
#255 AI Due Diligence - Information Security Checks Before You Integrate AI
AI can be fantastic for relieving a lot of administrative burdens, allowing individuals to focus on more complex tasks that need a human touch. However, many are all too quick to install and integrate, which can lead to crucial vetting processes being skipped. So many applications have also integrated various AI features, and while you may have vetted the software before these were available, those new AI features still need scrutiny before widespread use within the business. In this episode, we dive into why there is a need for a more cautious approach to implementing AI and share some tips on basic Information Security checks you can do to ensure an AI application or integration is safe to use. You’ll learn · The link between AI and increasing data breaches · Recent incidents as a result of AI misuse or error · Key considerations for the implementation of AI technology · 11 Information Security checks for AI tools Resources · · · In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman explains the need for caution when exploring the implementation of AI tools, and provides guidance on some information security checks you can perform to ensure your data stays safe. [02:45] The link between AI and increasing data breaches: Data breaches tripled since the wide adoption of AI in early 2024 and studies are saying there is a clear link between these two events. Here in the UK alone, 32% of businesses experienced a cyber-attack or data breach in 2023, compared to 43% of businesses in 2025, with us already steadily on track to surpass that in 2026. Does this mean people shouldn’t use AI at all? No, of course not, but we do need far more caution before you simply start using a tool. [03:35] Recent incidents as a result of AI misuse or error: ChatGPT copycat – There was a ChatGPT clone available as a web extension that was downloaded by some 1.5 million users. It functioned just like ChatGPT, answered queries and provided links to legit sources. But, in the background, it was scrapping passwords and gathering information that was to be sold off without users knowledge. Sage Copilot - The popular accounting software had to temporarily suspend Sage Copilot after a data-isolation flaw occurred. This incident caused an issue where users who prompted the AI to list recent invoices ended up with incorrectly surfaced financial records belonging to unrelated businesses. This was a major security issue, especially for an application thousands of businesses rely on to track their financial records. Google Gemini – Google Gemini was found to have been abused by bad actors for data reconnaissance. One particular group were building profiles on major cybersecurity and defense companies and were looking to gather specific technical job roles and salary information. Google’s threat intelligence team characterized this activity as a blurring of boundaries between professional research and malicious reconnaissance. Their soft touch approach allowed the bad actors to craft tailored phishing personas and to further identify potential soft targets to compromise. [06:30] Key considerations for the implementation of AI technology: Any software or technology you plan on introducing into the business that will interact with your and your customers data should be subject to clear vetting procedures, with clear rules for use to follow. Before integrating an AI tool, ask yourself, is the tool you want to use: a) Relevant b) Safe c) Ethical Ethical may sound strange, and will depend on what you’re using an AI for. Take CV sorting for example, many studies have shown that AI’s can have an inherited bias based on their training data. This has also now evolved into AI based recruitment tools preferring AI generated CV’s over human written ones. From a safety standpoint, think about the data you are feeding into those recruitment tools, that’s personally identifiable information, full names, phone numbers, emails and possibly even addresses. A full profile for an individual. Is that system your using closed, do you know if you consented to having any input data used for further training? Don’t just assume that inputted data won’t be used beyond your control. If that recruitment AI tool gets hacked, who do you think is liable for the breach? Is it the AI tool developer or the business that input the data? You think the answer would be clear, but the legality of all this is still being debated. [09:10] 11 Information Security checks for AI tools: #1: Have an AI Policy and AI Integration approval process in place - Many businesses will already have an AI policy in place, most are very generic, so we recommend looking at the guidance provided by to see what good looks like for an AI policy. You should also create a clear approval process that any AI tools must pass BEFORE people start using them. This should be clearly communicated to the wider team, and there should be a method to manage these checks such as a ticketing system to kick off the process. #2: Understand where your data actually goes - Find out whether inputs are used to train the vendor's models. These inputs can include prompts, uploaded files or even customer data depending on what the tool is. You also need to find out how long that data is retained, and whether it's stored in a specific jurisdiction. You can look for answers to these in a DPA (Data Processing Agreement), don’t rely on the basic marketing blurb they state on the website. If those answers aren’t provided, contact the tools support or basic enquiries to find out. #3: Check for a SOC 2, ISO 27001, or equivalent certification – This is an easy check for vendor's security posture. Absence of certification shouldn’t automatically disqualify a vendor or tool, but it should prompt more due diligence, not less. Even with a certification in place, you also need to double check that it’s valid. for example will need to be certified by a UKAS accredited certification body for those in the UK. For overseas, you will have your own ISO accreditation bodies, which can be verified on the #4: Map out third-party and subprocessor risk - Most AI tools sit on top of other infrastructure like cloud hosting, underlying foundation models and additional analytics tools. You should ask for a subprocessor list to fully understand who else touches the data. #5: Test for prompt injection and data leakage - If the tool interacts with external content such as emails, documents or web pages, it can potentially be manipulated by malicious instructions hidden in that content. Businesses should ask vendors how they mitigate this and ideally test it themselves. #6: Clarify access controls and permission scoping - This is especially the case for AI agents or tools with system integrations. You need to establish if the tool operates with the same permissions as the user, or whether it has broader access. Overprivileged AI agents may operate independently with no human oversight. ‘Human in the loop’ has become a common phrase within cyber security for a reason, you always need a point of human oversight to ensure the AI is doing what it’s supposed be doing and is doing so safely. #7: Ask about model update and versioning transparency - You need to ensure that the vendor won’t just silently swap out the underlying model for its AI tools, as this can introduce sudden behaviour changes in the tool itself. Transparency is a key component of emerging AI security frameworks and regulations such as ISO 42001 and the . If a vendor isn’t willing to tell you when they’re making major changes to their tools, then it’s not a vendor you want to entertain. #8: Evaluate the output reliability and hallucination risk in context - For security-adjacent or compliance-adjacent AI tools, factually wrong outputs are a risk. AI can have a tendency to ‘hallucinate’ data or outcomes and then present them as fact. So, ask the vendor what guardrails exist and whether their tools’ outputs are auditable / traceable. They should know what data was used to train their models, or where their models are pulling data from. If they don’t or can’t control what data is being used, then it’s not a tool you can 100% trust. #9: Review incident response and breach notification commitments - If the vendor is breached, do you how quickly you would be notified, and what their recovery process looks like? If you hold ISO 27001 and , or simply have a business continuity plan in place then you will already have similar procedures in place for peace of mind for your own customers, so why should you settle for any less? And just like your clients would expect, breach notifications and expected recovery times should be contractually defined, not just assumed. #10: Consider the supply-chain risk of the vendor itself - This tech is still relatively new, and so newer AI vendors may have smaller security teams and less mature processes than what you may be used to with more established providers. However, startup pace doesn't mean you have to tolerate the start-up risk. Consider all of the previously mentioned steps, if they don’t have a lot of that in place, then they may not be mature enough yet for you to go ahead with. This doesn’t mean you have to automatically disqualify them, if they have a clear plan of action for growth, which shows a clear focus on increased security and transparency within a reasonable timeframe, then it’s still worth considering. #11: AI tool monitoring and Kill switch – In addition to this initial vetting procedure, you should also have a process in place to continuously monitor these AI tools too. Many AI tools aren’t static, they’ll update and become better or possibly introduce issues as they will inevitably face the risk of bugs and other technical problems as they roll out updates. If a tool is consistently encountering issues, continuous monitoring allows this to be flagged up as a security issue. Which is where you’ll also need a kill switch in place if an AI tool is behaving unsafely. It’s important that you know how to isolate it and remove it from your systems. AI tools are more ingrained that your typical software, often designed to work in tandem with existing apps rather than as a standalone system. This will mean that some tools will have access to possibly sensitive data, something that needs to be protected if the AI tool experiences issues that could lead to that data being compromised. The relevant staff, likely your IT team, need to have a clear process for what to do in those scenarios. If you’d like any assistance with implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/42179290
info_outline
#254 Driving ISO Implementation – Meet the Consultant: Emma Coxhill
07/01/2026
#254 Driving ISO Implementation – Meet the Consultant: Emma Coxhill
The path towards becoming an ISO consultant is often a meandering one. It’s not often a career that many aspire to, yet despite that, there are still thousands of ISO professionals worldwide. We’re continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification. In this episode we introduce Emma Coxhill, an isologist® at Blackmores, to share their recent journey into the world of ISO consultancy and how they’ve found their first year working with other organisations to help them achieve ISO certification. You’ll learn · What is Emma’s role at Blackmores? · What does Emma enjoy outside of consultancy? · What did Emma do before becoming an ISO consultant? · How has Emma found her first year as an ISO consultant? · What Standards has Emma worked with so far? · Has there been any unexpected elements to her role? · What is the biggest challenge Emma has had during a project so far and how did she overcome it? · What is Emma’s biggest achievement? Resources · · In this episode, we talk about: [00:30] Episode Summary – We introduce Emma Coxhill, an Isologist® here at Blackmores, to discuss her recent entry into the world of ISO consultancy, including how she’s found working on the other side to help other organisations achieve ISO certification. [03:30] What is Emma’s role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards. Emma specialises in information security management systems (ISMS), but is branching out to other Standards as she takes on more clients. [04:30] What does Emma do in her free time? Emma is a big fan of the outdoors, enjoying long walks and exploring in general. It makes sense then that she also enjoys gardening. While it is a lot of work, she finds the result rewarding. Emma is also a big fan of movies, excluding horror films! She enjoys making the trip to see films on the big screen when she has the chance. Lastly, Emma is also a qualified life coach. This involves guiding people to get where they want to be in life, with the crucial distinction that it’s not about telling people what to do, but rather providing the right questions and tools to help them achieve their goals quicker. These skills have evidently translated well into her role as an ISO consultant, as auditing is very similar in the fact that it’s about giving people a different perspective. [06:55] What was Emma’s previous role? Emma previously worked in admi and retail roles, with her last job being a sales admin at a company for 13 years. She first started at that company as a sales admin, moved onto business systems and around 2019 the request for them to earn certification came in. Back then ISO 27001 was a ‘nice to have’ and not a ‘need to have’ like it is today. Emma jumped at the chance to join the team working on the ISO 27001 Implementation, taking part in the research, training and implementation tasks. The company managed to navigate their certification, even through the turbulence of COVID, and Emma was the one maintaining that ISMS for the following years. During that time she also implemented TISAX, an Information Security Standard specific to the automotive industry, which you can learn more about on one of our hosted by Emma. Sadly, Emma was made redundant in 2025, but was fortunate to join the Blackmores team shortly after. [10:10] How has Emma found her first year as an ISO consultant? It’s been challenging for Emma to adjust to being on the other side of the fence, helping others to achieve certification rather than being the one to implement a system firsthand. Thankfully there was plenty of opportunity to learn during her first year with Blackmores, including expanding her repertoire of Standards and being able to learn from other experienced consultants in the team. She’s really enjoying working with a variety of clients, getting to learn about different industries and how different each company is in their operations. Emma is aware that she’s just scratching the surface within her first year, and is eager to learn more. [12:20] What Standards has Emma worked with so far? ISO 27001 is the main one as it’s the one that Emma learned to implement from scratch at her pervious job. Since joining the Blackmores Team she’s also gained experience working with (Quality Management), (PII Management), (Translation), (AI Management) and ISO 27001 remains her favourite out of all of them, and she’s keen to learn more from Blackmores own Information Security guru, Steve Mason. [14:15] Has there been any unexpected elements to her role? One of the more unexpected aspects has been helping clients navigate various acquisitions. When she joined, Blackmores had an unusual amount of clients currently in the middle of this process. Dealing with ISO management in these situations can get tricky as you’re having to marry up different styles of management as two companies merge. Emma’s role was in helping them to navigate that transition. She was surprised as she expected to be dealing with companies that were business as usual for years, but ISO Management is at the heart of managing these types of changes. So, it was interesting to learn how involved an ISO consultant can get into the inner workings of a business to help ease the burden for all parties involved. [17:20] What is the biggest challenge Emma has had during a project so far and how did she overcome it? Emma is still relatively fresh to implementation projects, but has found the process to be quite straight forward with the both the Blackmores 7 step methodology and support from other team members. What has been a challenge was the promotion she was tasked with for TISAX. It was a new service offering for Blackmores due to her expertise, and she was involved in recording a podcast and hosting a webinar. Both activities she’d not had any prior experience with. She doesn’t think of herself as a big presenter, so it seemed like a dauting task. Emma did a lot of practice and went our of her comfort zone to do the webinar, which was positively received by the audience. The experience certainly boosted her confidence in that area, and though it was a bit stressful at the time due to nerves, she felt like it was a good learning opportunity. [19:45] What is Emma’s biggest achievement? Emma has various moments throughout her life, with an early one being the fact that she passed her driving test first time at the age of 17. Later in 2005, she went solo travelling for 5 months around Australia, New Zealand and Fiji. She did end up having to work for a bit of that trip to make up some additional funds, but that was a necessary evil. Other than that, she was amazed at all the different people she met during her travels and was so pleased that she was able to complete the trip. Lastly, she’s proud to have joined the Blackmores team in 2025. She’s recently helped her first client achieve certification from scratch, which felt like a reward in of itself to know they’d passed their ISO assessment. If you’d like any assistance with implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41917375
info_outline
#253 Building The Case For Health & Safety Regulations & Standards
06/24/2026
#253 Building The Case For Health & Safety Regulations & Standards
Everyone who goes to work should have the right to go home after work. This is a sentiment that wasn’t necessarily formally recognised until the 1970’s here in the UK. Health & Safety often gets mocked for overly cautious or seemingly onerous tasks to meet certain regulations and Standards today, however these are in place for a reason. They save lives, plain and simple. In this episode, Ian Battersby makes the case for Health & Safety regulations, including why they were introduced, events that sparked the conversation for workplace safety and the impact regulations have had since their introduction. You’ll learn · The decline in ISO 45001 adoption · The Health and Safety at Work Act · How much difference has this Act made since its introduction? · How do the US and UK differ in their approach to safety regulations? · What events led to the creation of safety regulations in the UK? · Addressing broader health and safety risks – illness and long-term damage as a result of work · How to make health & safety manageable Resources · · · In this episode, we talk about: [02:05] Episode Summary – Ian Battersby makes the case for modern Health & Safety regulations, sharing why they were introduced, how they’ve impacted workplace safety statistics and how you can make health & safety more manageable. [03:30] The decline in ISO 45001 adoption – From our standpoint as consultants, there has been less adoption of when compared to other Standard such as or . In years previous, it was a common Standard to implement either with or straight after ISO 9001. There are a number of reasons for this, including: · The appetite for ISO 45001 has reduced in favour of newer Standards · Supply chains not proposing it as a requirement · Our particular client base feel they are low risk in their respective industries To be fair, health and safety does get a bad reputation for being overbearing. It’s been subject to many attacks from various media and lobbying groups, however, it’s necessary to ensure we all stay safe at work. Let’s look at some history… [05:00] The : This act received Royal Assent in the UK on 31 July 1974, and came into force on 1 April 1975. To an extent it replaced and improved upon previous laws covering separate industries and activities: Factories, Mines & Quarries, Agriculture, etc It was enacted in response to a recognition that, although conditions for workers had improved over the century, there was still completely unnecessary harm being caused to many in the country’s workforce. This is also the point when the Health and Safety Executive was formally established to enforce the law. It also provides a wealth of guidance to businesses, so we highly recommend checking out their website. They also have the legal duty to collect consolidated data on workplace injuries for the UK, and have provided an annual report since it’s inception in 1975. [07:45] How much difference has this Act made since its introduction? In the year to 31/03/1975 when consolidated data was first recorded there were 651 deaths at work. The equates to more than 2.5 deaths in a single year per 100,000 workers. Comparatively, in 2024/25 124 people died in work, and while that’s 124 too many, it’s a big improvement. The rate per 100,000 workers is now 0.37, and you have to bear in mind that the workforce has grown, but overall that’s a reduction of over 85%. [09:10] How do the US and UK differ in their approach to safety regulations? The (OSHA) serves similar purpose in USA as HSE, but they have important differences in approach and independence. The HSE is independent of government to an extent and has no ministerial control, whereas OSHA sits within the Dept of Labor. It can also be argued that the OSHA approach is prescriptive in setting rules whereas HSE follows the more outcome-based principles of HASAWA: to reduce risk "so far as is reasonably practicable", which some argue is more sophisticated and produces better results. OSHA has also seen its powers to intervene, investigate and enforce curtailed at times due to certain political interests. Looking at the numbers, the US Bureau of Labor Statistics published fatality rates for 2024: Census of Fatal Occupational Injuries: There were 5,070 fatal work injuries recorded in the United States in 2024, down 4.0% from 5,283 in 2023. The fatal work injury rate was 3.3 fatalities per 100,000 full-time equivalent workers in 2024, a decrease from 3.5 in 2023. That rate is notably higher than Great Britain's — 3.3 per 100,000 versus 0.37 — though the two figures aren't directly comparable. The BLS uses full-time equivalent workers as the denominator and covers a broader range of incident types, while the HSE's RIDDOR series uses a headcount of all workers and has specific exclusions (road traffic accidents, air and sea travel, etc.). The methodological differences mean a like-for-like comparison requires some care. [13:35] What events led to the creation of safety regulations in the UK? In the days of Victorian Britain, it’s difficult to view the common working man, woman AND child as anything other than a commodity. Thousands died every year in industrial accidents during this era, and large-scale accidents in many industries weren’t uncommon. Mining was particularly tragic, a few events include: · The Oaks Colliery explosion of 1866 killed around 360 men and boys. · Hartley Colliery in 1862 trapped and killed 204 miners when the single shaft collapsed (but individual deaths from falls, gas explosions, and equipment failures happened constantly and attracted no particular attention) · The Abercarn Colliery explosion in Monmouthshire (1878) killed 268 men. · The Albion Colliery explosion at Cilfynydd in Wales (1894) killed 290. These were not exceptional events, they were part of a continuous toll. In the 1860s alone, over 1,000 miners died annually in Britain. Textile mills, ironworks, shipyards, and construction sites all had very high casualty rates. Factory machinery had no guards. Children routinely worked in spaces too small for adults, climbing inside machinery to clean it while it was still running, or crawling under looms. Mill workers lost fingers, hands, and arms with regularity. The end of the Victorian era saw attempts at regulation, but without true enforcement. The Factories Act didn’t appear until 1933 and it was bitterly opposed by many owners of mines and mills. Modern regulations exist today to prevent the tragedies of the past from happening again, they were hard fought for by workers and lobbyists, and in some ways we’re still fighting to include the broader impacts work can have on an individual. [16:45] Addressing broader health and safety risks – This is in relation to harm accumulated over a lifetime of work with long-term and often fatal consequences. The suffering caused to workers exposed to hazardous conditions is immeasurable. For example, let’s look at asbestos. The dangers of working with asbestos were recognised remarkably early, as far back as 1890s in France, and Asbestosis was formally recognised in 1930. This led to regulation in 1931, but only applying to the asbestos textile industry, excluding all the industries where its use was widespread such as construction, shipbuilding, anyone working in insulation etc Worse still, it wasn’t even enforced! Then take mesothelioma, the distinctive and almost invariably fatal cancer of the lining of the lungs and abdomen. The connection between asbestos and mesothelioma was established in SA in 1960 when mining blue asbestos. Further research in the UK firmly established the link in the 60s. From the mid-60s, headlines were being made nationally when shipyard workers from the war era stared dying in large numbers. Unions began lobbying for protections and media coverage continued for years as cases multiplied across several areas and industries. Nevertheless, its manufacture and use continued. introduced licensing for the most hazardous asbestos removal work. Blue asbestos (crocidolite) was banned in 1985, followed by brown asbestos (amosite) in 1986, though white asbestos (chrysotile) remained legal until 1999. In the interim and since then thousands of people died and multiple legal cases have ensued. 2218 people died of mesothelioma alone in 2023. Altogether it’s estimated that workplace-related lung disease and cancers kill as many 13000 per year in the UK. Several thousand more are known to die of non-lung-related occupational diseases each year, but these aren’t recorded as workplace deaths on certificates, so these people aren’t included in HSE annual reporting. It doesn’t stop at deaths either, there is an argument for the detriment that certain work can have on quality of life. Incidents and conditions such as: · accidents causing amputation and fracture · eye conditions from welding and other light sources · Deafness and hearing difficulties · HAVS, vibration white finger · Skin conditions from exposure · Musculoskeletal in low risk environments None of these are terminal and so often go unreported. [23:25] How to make Health & Safety manageable – Some consider modern health and safety regulations to be over the top, but overarching law in the UK has the principle ‘As Far As Is Reasonably Practicable’. One common area is in risk assessment, The Management of Health and Safety at Work Regulations states: “Every employer shall make a suitable and sufficient assessment of— (a) the risks to the health and safety Where the employer employs five or more employees, they shall record— (a) the significant findings of the assessment” The keyword being ‘significant’ there. If you work in lower risk industries, you aren’t being forced to make unnecessary risk assessments, only when significant risks are present do you need to complete a risk assessment. For more guidance, check out the on office-based risk assessments. [25:55] Ian poses a question: Can you seriously say that the drop in deaths and injuries suffered by the common worker would have dropped at the rate it has without regulatory intervention? Can all employers (or other vested interests) be trusted to do the right thing through good will and voluntary mechanisms alone? If you’d like any assistance with your ISO 45001 Implementation or need any additional ISO Support, contact us, we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41790630
info_outline
#252 Wavenet’s On-going Commitment to Best Practice – Successfully Maintaining Seven ISO Standards
06/17/2026
#252 Wavenet’s On-going Commitment to Best Practice – Successfully Maintaining Seven ISO Standards
Anyone that has undergone the ambitious task of Implementing an ISO Standard will know how much work goes into creating and maintaining a single ISO certification. Now imagine juggling seven ISO certifications! There’s a key difference between those that simply collect badges and those that see the value each ISO certification can bring, as every Standard has their own requirements and guidance to tackle specific areas of quality, risk and sustainability. When implemented well, they create a solid well-rounded framework that can drive unparalleled continual improvement. In this episode Ian is joined by Damian Edwards, Head of Standards at Wavenet, to dive into how they manage the mammoth task of maintaining seven ISO Standards, the challenges with managing multiple ISO certifications and what benefits they’ve brought to the business since implementation. You’ll learn · Who is Damian Edwards? · Who are Wavenet? · How did Damian manage integrating management systems during Wavenet’s acquisition of Daisy Corporate Services? · What is Damian’s role at Wavenet? · How do Wavenet manage their ISO certifications? · How has ISO Support helped you over the past year? · What has Damian learned while managing ISO Standards? · What are the benefits of ISO certification? · Damain’s top tip for anyone considering ISO Implementation Resources · · · · In this episode, we talk about: [00:30] Episode Summary – We welcome back onto the podcast to discuss how he maintains Wavenet’s seven ISO certifications, and the explore the benefits gained from an integrated ISO Management System. [03:05] Who is Damian Edwards? Damian is the Head of Standards at Wavenet, and has featured on the ! One lesser known fact about Damian, is that he a ‘Dance dad’, supporting his daughter through all of her lessons and competitions. He’s very proud of her latest achievement of qualifying for the World Championship for Irish dancing in her age group. [05:05] Who are Wavenet? Wavenet is an IT provider, providing IT network communications, security and resilience services. They are UK based with 1,600 employees based in their Solihull head office. Wavenet were formed in 2000, but have grown through acquisition, one of which was Damians previous company, Daisy Corporate Services. When Daisy was acquired, both businesses were of a similar size, so the process looked more like a merger in practice. A large part of that was uniting the ISO Standards managed by both businesses, so Damian had his hands full with ISO integration, amending audit schedules and managing extension to scope audits. [06:30] How did Damian manage integrating management systems during Wavenet’s acquisition of Daisy Corporate Services? One of the biggest challenges was the extension to scope that needed to happen due to the increase in sites. Thankfully, as Wavenet were used to acquisitions, they had dedicated acquisition project managers that assist with managing the integration. At the start, there are some teething problems as both businesses will still be using their respective processes for a while. However, once system that helped was a system called ‘ServiceNow’, which is where issue tickets could be logged, monitored and actioned in one centralised system. [08:15] What is Damian’s role at Wavenet? Damian is the Head of Standards, which includes both ISO Standards and ESG related regulatory compliance. ISO certifications are more often than not a prerequisite or a condition of a bid over a contract, without them, Wavenet wouldn’t win any business. They also create a foundation of trust for Wavenet’s clients in the realms of Information Security, quality and environmental management. Wavenet are currently certified to the following Standards: · Quality Management · Service Management · Information Security Management · Business Continuity Management · Health & Safety Management · Environmental Management · Energy Management In addition to maintaining all of these certifications, Damian also strives to utilise them to drive continual improvement within the business. [10:30] How do Wavenet manage their ISO certifications? Damian is directly responsible for five of those ISO Standards, however there are some where he doesn’t have the expertise to fully manage the requirements. ISO 27001 and ISO 45001 for example require skilled people at the helm, so Wavenet have dedicated managers to handle those areas. One of Damians key responsibilities is juggling all of the audits to make sure each element is covered, and he’s put a lot of work into integrating those audits where possible to get the most out of their time and resources. Though, it’s important to note that you can’t integrate everything, as each standard will have some unique requirements. Areas that you can integrate however include elements such as: · Context · Audit Programme · Corrective Actions When you do have a lot of Standards, some elements can get watered down if you try to integrate everything. Policy for example, if you have five Standards and decide to integrate all related policies into a single document, it will become long and unruly, which will lead to people unwilling to read it. So, you have to take care to ensure focus on certain elements to make those more accessible for the staff that need it. Another aspect that needed additional consideration was Wavenet’s risk profile, with their amount of sites and services, it’s very varied. Too much for a single person to be aware of all the risks, which is where Damian’s subject area experts can provide additional insight to fill the gaps. Damian is also keen to combine external audits where possible to both reduce cost and possible duplication of effort, as many Standard do share common subject areas, this can be done across multiple Standards. Certification Bodies are usually quite happy to work with you on this! Damians key take away is, that there isn’t one solution that fits every business when managing this many Standards. It was a very trial and error process, especially with the ever changing landscape of a business, but Standards are also designed with flexibility in mind, so with the right people in place it’s certainly manageable. [16:05] How has Blackmores’ ISO Support helped? Blackmores has assisted Wavenet with their ISO 45001, ISO 50001 and (Facilities Management) implementation. ISO 41001 was later dropped as it was no longer applicable for the business. Standards can be quite hard to apply to your own business when looking at them at face value, the requirements sound generic because they’re designed to apply to every type of business. This is where Blackmores experience as a consultancy can help with interpretation and practicalities of how a Standard will apply to your way of working. Blackmores will also assist with internal audits, which help identify non-conformities that may have been missed if it were not for a fresh pair of eyes. As Damian states: “I would rather have them identified before an external audit” as this gives you a chance to resolve issues or put an action plan in place before it gets to that stage. Damain also reminds everyone to not be afraid of your auditor, internal or external. They are not maliciously looking for problems, they simply help to highlight issues which can be resolved sp you can improve as a business. No Management System is perfect, the important thing is that you can recognise when something needs addressing, and how you go about doing so. [19:30] What has Damian learned while managing ISO Standards? Damian has learned to not think of ISO as a tick box exercise, it’s a tool to help businesses improve. He has also learned that you don’t need to reinvent the wheel when Implementing a Management System. You likely already have much of what’s required in place, but not monitored or organised regularly. For example, aspects such as ‘Management Review’ may already be happening in existing meetings with top management, you simply need to ensure these are minuted, cover what needs to be discussed in regards to the Management System, and make note of any gaps that need to be addressed. Businesses like Wavenet that have been in operation for 26 years know what they’re doing, and are likely already following best practice. You don’t need to restructure your business to meet an ISO Standard, but rather integrate the Standard requirements with how you already operate. If done correctly, it should become a simple part of your day-today tasks. Damian jokingly states: “What’s my role? I sometimes say it’s to do as little as possible”, as the more a business is aligned with a Standard, the less you will have to do to upkeep that. [22:55] What benefits have Wavenet experienced as a result of their ISO certifications? As mentioned earlier, a lot of won business is due to ISO certification. Certain certifications are simply a tender or client requirement. Standards such as ISO 50001 tackle their energy consumption. It’s focus on reducing that will inevitably lead to reduced business costs. Since implementing the Standard, Wavenet now have monthly meetings to monitor energy use, which gives them a good basis to make informed decisions on where energy use is concerned. Damian has found that over time, good practice has been so embedded that people are using it in their everyday behaviors without even realising it. He’s heard people in their resolutions team use terminology like ‘root cause’ without knowing where it came from. He’s seen team making use of skill matrix’s when evaluating the competence of certain teams such as engineering for client visits. So, people within the business are using ISO terminology and techniques to ensure best practice without being explicitly asked to. It simply works as a method to drive the business effectively when implemented correctly. [26:15] Damian’s top tip for aspiring ISO implementors: Apart from approaching a consultancy like Blackmores to help if it’s your first time going through the process, it’s got to be leadership commitment. Top management need to be actively promoting ISO within the business, and they should be involved with the process. You need everyone’s buy-in to make a system work, and that is made much easier if it’s driven from the top down. Another tip is that a Management System should be a team effort. It shouldn’t just be the responsibility of one person, you need input from everyone in the business to ensure you’ve covered all angles and risks that could affect your business. Lastly, look at what you already have in place and try and integrate the Standard into that. Don’t make more work for yourself if you don’t have to, you likely already have the bones in place. [28:20] Damian’s book recommendation: The Thursday Murder Book Club – by Richard Osmond [29:10] Damian’s favourite quote? “Hard work beats talent when talent doesn't beat work hard.” And: “You miss 100% of the shots you don't take” To learn more about Wavenet, check out their and keep up-to-date with their latest news via their If you’d like any assistance with your ISO Implementation or need any additional ISO Support, contact us, we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41675575
info_outline
#251 Driving The Demand For GHG Emissions - How Davies Group Tackled Carbon Verification
06/10/2026
#251 Driving The Demand For GHG Emissions - How Davies Group Tackled Carbon Verification
Carbon verification is quickly becoming a necessary step for many businesses, whether due to regulatory compliance, market demand or as part of a voluntary scheme. The drivers for this demand are varied, as is the approach many take for their path towards carbon verification. This can look very different depending on the industry you operate in and can be difficult to tackle for more service based industries, such as today’s guest, Davies Group, who are a service provider for the insurance industry. In this episode Mel is joined by Gillie Fairbrother, Global Responsible Business Officer at Davies Group, to discuss the findings of Mel’s thesis regarding the demand and drivers of GHG verification for organisations across the globe, and how Davies Groups’ carbon verification journey factors into the findings. You’ll learn · Who is Gillie Fairbrother and who are Davies Group? · What factor triggered the decision for independent carbon verification at Davies Group? · At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard? · What did Davies Group's GHG inventory and reporting look like before independent verification was introduced? · Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally? · · What is the gap between organisations knowing they should verify emissions and actually doing it? · Was competitive positioning part of the Davies Group case for carbon verification? · What was the most significant finding from the first carbon verification engagement? · How has verification changed the internal culture and engagement with the sustainability programme at Davies Group? · How have Davies Group supported suppliers with calculating their carbon emissions? · Where does Gillie see the expectations of institutional partners and large clients in insurance and professional services heading? · What was a specific moment where Gillie can recall that this mattered more than she had expected? Resources · · · In this episode, we talk about: [00:30] Episode Summary – We introduce , Global Responsible Business Officer at Davies Group, to discuss their participation in Mel’s thesis research into the demand for GHG emissions, exploring Davies Group’s own reasoning and journey. [02:05] Who is Gillie Fairbrother and who are Davies Group? A route into sustainability as a career wasn’t as readily available to Gillie when she attended university, so it has been something of a self-made path. She has previously run a wellness business in the past and has experience working with sustainable brands and has done a lot of cultural advocacy, particularly in the LGBTQ space. Taking the lead for ESG within the corporate space was a dream come true for Gillie, and she has done this for a number of US based tech firms to her current position for Davies Group. Davies Group are a service provider for the insurance industry, who operate in 22 countries. [03:40] What factor triggered the decision for independent carbon verification at Davies Group? Mel’s research found that 29% of organisations cite market-driven factors as their primary reason for seeking GHG verification, compared with just 12% who cite regulatory compliance. For Davies Group, their decision was led by market demand. They looked client requests versus client contractual obligations, and carbon verification was increasingly coming up in those contractual obligations. Gillie herself has always been an advocate for working both sustainably and responsibly, promoting the revenue benefits that can be gained from doing so. However, as much as it is perceived to be the right thing to do, she doesn’t want businesses to simply think of it as the ‘nice thing to do’. These should be central components to how your business operates. So in part, Davies Group saw this demand not only in the market, but as simply the right way to do business. [05:30] At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard? Davies Group already operate in a highly regulated market, and so already have very strong governance practices in place. Gillie didn’t really have to worry about making too many improvements in the governance or purpose aspects of ESG compliance. They participated in TCFD on a voluntary basis to highlight a possible risk from a climate perspective that could affect things like supply chain, physical sites, or the industry in general to leadership. Thankfully, the leadership saw this as a risk worth looking into more, and were willing to quantify it properly and ensure that their data was as accurate as possible and in a place where it could be audited by a 3rd party. [07:40] What did Davies Group's GHG inventory and reporting look like before independent verification was introduced? Before Gillie joined, these aspects were managed by a 3rd party due to lack of in-house expertise to manage it. When Gillie joined, she worked closely with that 3rd party to continue the work. Davies Group is quite a complex business, it operates with 3 different divisions that have multiple service lines. At the time, they did their best with the Excel spreadsheets that they had create to track various GHG emissions, but it was not as good as it could have been. They’ve since grown their processes, included more in-house talent and are doing more to gain knowledge from their stakeholders, data owners and building relationships with various teams across the business. While they are still working on Excel spreadsheets, they have advanced to reasonable assurance. Gillie is now looking into external tools to help improve their data management, but this would cost a fair bit of money that could be better used currently on reducing environmental impact. [10:30] Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally? Gillie cites employees, as they’re an industry where 30% of the workforce is likely going to retire in the next 10 years, so they're trying to attract a younger group of talent who want to work for a business that has a good purpose and is a good company. Acting sustainably and responsibly is a huge part of attracting that new young talent. The second more important stakeholders are their clients. Davies Group is a private equity backed business, if they’re not making money then they simply cease to exist as a business. Clients now have a keen interest in responsibly run businesses, and many now seek proof to claims. Next in the list is investors, who have an interest in the regulatory requirements that the business is subjected to. Lastly, Gillie cites suppliers as even if they aren’t actively putting pressure on the business to report their emissions, without their support and cooperation, Davies Group can’t meet their own goals. [12:40] What was a particularly memorable conversation with a Stakeholder that helped drive further improvement? Gillie recalls one conversation with a new employee where they asked to be more involved with their sustainability group. When she talked to them more, she discovered that one of the main reasons that employee sought them out was due to the responsible business page on their website, and that out of the 3 businesses they were applying to, Davies Group was the only one that had a page like that. [37:00] What is the gap between organisations knowing they should verify emissions and actually doing it? Mel’s research found that 86% of organisations report increased stakeholder demand for transparency in GHG reporting – yet 52% remain unverified. Gillie states that there could be a lot of reasons for this, including budget, resourcing or something as simple as a piece of wording in a contract where a client might say we request versus we require. This is why Gillie is always in conversation with clients, whether that be the sales team or the sustainability teams at our clients, to understand their goals and make sure they can all align in their goals. The market is certainly the leading cause for many businesses as Government regulation tends to lag behind. [17:20] Was competitive positioning part of the Davies Group case for carbon verification? For Davies Group, it was initially a contractual requirement to complete their carbon verification. So, in their case, it was an easy decision as otherwise they could potentially lose business. However, Gillie also regularly meets with senior leadership and reports into their responsible business board committee every quarter. There they consider the growing appetite for sustainability driven demands, and how they want to leading the way in their industry. The key determining factor is whether it’s relevant to them, whether that’s for sustainability or for their community impact strategy. Davies Group tend to focus on education and investment in our communities, as that’s where their expertise sits. It’s all about materiality as businesses need to focus on what’s relevant to them. [19:20] What was the most significant finding from the first carbon verification engagement? For Gillie, it was the clarity and transparency that had been game changing. Especially within their real estate portfolio. Davies Group don’t own any of their offices, they’re all leased. As they calculated and verified the carbon footprint, the quality of the data got better and that enabled them to have better conversations with their real estate team to understand how a building worked, whether it be a lease, including services or whether it be separate. As a result, they’ve been able to set a renewable energy target for all UK offices. [19:20] How has verification changed the internal culture and engagement with the sustainability programme at Davies Group? Mel’s research identifies a strong correlation between verification status and organisational confidence, with 85% of verified organisations expressing pride in their sustainability progress, compared with 50% of unverified ones. Gillie’s been writing the sustainability report for Davies Group for the past 6 years, and she can feel the difference after having their emissions verified as it adds an extra layer of credibility. She’s also wary of stepping into bragging territory about all their sustainability achievements, without reflecting on the reality. There can be a conflict between writing what the stakeholders want to hear versus what is accurate and true. Having independent 3rd party verification gives you the confidence to back any claims made. [24:10] How have Davies Group supported suppliers with calculating their carbon emissions? Gillie is particularly proud of an industry wide collaboration project that had close to 100 SMEs go through a Net Zero training programme that was provided by a third party. Gillie joined many of the sessions and was so pleased to see sustainability champions emerge through the process where people suddenly got really invested and starting asking rather complex questions. They’re still gathering feedback from those sessions, but already 80% - 90% have calculated a starting carbon footprint and put in place an action plan to help reduce their impact. This year, Davies Group have also kicked off a huge training and engagement plan with their service delivery teams who are making the decisions about their suppliers. They’ve also engaged with over 400 employees in their UK groups for property claims on sustainable solutions, getting their ideas, understanding the challenges and coming out with some outcomes so they can measure the carbon of their claims process and look to reduce it. Gillie teases the pending results, so keep an eye on their socials to find out more! [27:50] Key advice from Gillie: Focus your supply chain effort on your biggest emissions rather than your biggest spend, and tackle this in small groups. [29:30] Where does Gillie see the expectations of institutional partners and large clients in insurance and professional services heading – and at what point does she think verified GHG data becomes a non-negotiable baseline in your market? Many businesses have been waiting on legislation and regulations to point the way, and in a sense, they will always be waiting as these things develop with our understanding and technology available. However, businesses have done a good job of stepping up as those regulations lag behind. There’s a lot of mixed press regarding sustainability, with some professionals feeling as if the topic has come off the boil as article cite the loss of dedicated sustainability officers. The reality on the ground is that these roles are now much more embedded into the business, they’re not being removed, simply passed onto roles such as the Chief Operating Officer to ensure sustainability targets are being met. The bottom line is that the momentum for sustainability isn’t going away, and that need to verify emissions is only going to grow. The key thing now is to move on from simple calculation into action, which is what Gillie is trying to drive right now. [32:05] What was a specific moment where Gillie can recall that this mattered more than she had expected? Gillie is so proud of what their small and mighty team at Davies Group has done for their social impact. When initially established, they were only in 1 country, they’ve now expanded to 22 countries and they've really focused their resources, time and effort on impacting community education and skills development, which she anticipates will have a full circle around to attracting talent into our industry. To see more about the impacts that Davies Group are orchestrating, check out their . If you’d like any assistance with your carbon verification journey, contact our partner , they’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41595670
info_outline
#250 Driving ISO Implementation – Meet the Consultant: Steve Mason
05/15/2026
#250 Driving ISO Implementation – Meet the Consultant: Steve Mason
How often have you heard someone say they aspire to be an ISO consultant? Likely not at all! That’s not surprising as it’s quite a niche world to find yourself in, yet despite that, there are still thousands of ISO professionals worldwide. We’re continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification. In this episode we introduce Steve Mason, a Principle isologist® at Blackmores, to share the journey of how he went from intern, to ISO Assessor, to ISO consultant and the challenges he’s faced while working with clients. You’ll learn · What is Steve’s role at Blackmores? · What does Steve enjoy outside of consultancy? · What path did Steve take to become an ISO Consultant? · What is the biggest challenge he’s faced when implementing ISO Standards? · What is Steve’s biggest achievement? Resources · · In this episode, we talk about: [00:30] Episode Summary – We introduce Steve Mason, a Principle Isologist® here at Blackmores, to discuss his journey towards becoming an ISO consultant who specialises in ISO 27001, ISO 27701, ISO 27018, ISO 27017 and ISO 20000-1. [02:40] What is Steve’s role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards. As part of that support, he: · Makes Standards understandable and accessible to clients · Conduct internal audits · Reviews and updates management system documentation · Facilitate management reviews · Train internal teams and prepare them for certification audits. Steve is the Standard champion for , , , ISO 27018 and at Blackmores, but he also deals with , and related projects and support. Steve’s other main role at Blackmore’s is as a Mental Health First Aider, which is shared with Minoo Agarwal. Together, they provide resources and offer support to the team. [06:00] The importance of Mental Health management in the workplace: Steve had faced bullying in previous roles, so preventing others from experiencing the same had become a big motivator for him taking on the role of Mental First Aider for Blackmores. He emphasizes it’s importance, and highlights 2 key Standards that you can use to help support mental first aid within your business. This includes ISO 45003 Mental Health in the Workplace and [09:10] What does Steve enjoy doing outside of consultancy?: Steve has a wide variety of interests and hobbies, including: Lay Minister: Steve is a Lay Minister in the United Reform Church and mainly based at the URC Chapel in Walkern, but can be found leading worship and preaching at Ashwell, Baldock, Stevenage and Knebworth chapels. Poetry: Steve enjoys writing poetry about anything and everything, racking up an impressive 190 poems so far. Some of his main inspirations include Wordsworth and Keats. If you ever see a poem on the Blackmores LinkedIn page, odds are, it was written by Steve! Classical Music: He’s a fan of classical music, anything by Beethoven, Mahler or Shostakovich specifically. He likes these composers in particular due to their stretching of the rules of music for the time. Exploring hidden London: Steve often goes on hidden London tours which explore disused underground stations which may have been shut down as long as 100 years ago! Buses and Trains: Steve was lucky enough to drive a bus in his past, of which he has the licence plate of sitting in his office. He collects bus and train models and will go out to snap a photo or two of their real world counterparts when he comes across them. History: Steve is a huge mystery buff, with a particular fondness for Richard III and the War of the Roses and the Anglo Saxon period of history. Family Tree: Steve has been tracing his family tree back as far as he can on his mother’s side, which extends as far back as 1547! Interestingly enough he found out that relatives from way back then got married in the church that he currently lives nearby and got qualified as a Lay Minister for the Church of England in Stevenage! Cats: He’s owned his fair share of feline friends through the years, with one particular tabby holding the name ‘Spartacus’. [22:35] What was Steve’s path towards becoming an ISO Consultant?: Steve was once told in the 1980s ‘There is no future in Standards; find another career, perhaps in Sales or Purchasing’. How wrong that turned out to be! He’s always worked with standards, from the first day he started work doing inspection in Goods Inwards, he was referring to them. The direction towards Management systems came in 1983 when he started implementing . From that day onward he had been involved in Management Systems. Steve completed a management apprenticeship at Racal-Guardall where he was able to do 3 months’ work experience in all departments, which helped him appreciate how companies function and how important it is to maintain good communication channels. He was at the end of this apprenticeship that the opportunity arose in the QA department to work on BS 5750. His career path has included other organisations such as Tektronix, BOC Ohmeda, Cirkit, Deta, TDK and BSI, all of which earned Steve a lot of experience in Manufacturing and Service and Distribution, mainly in Quality and Customer Service roles. Steve has always felt a bit like a closet consultant, even when he worked as an assessor at BSI. He feels as if Blackmores has enabled him to fully flourish and develop his portfolio of standards – not bad for a career where there was apparently no future in standards! [28:45] Born to be a consultant – Steve mentions that consultancy is a skill that many are born to be. You can train and learn the skills of course, but for some it comes very naturally and it can be hard to replicate that skillset in others. [30:15] What is Steve’s favourite aspect of being a Consultant? Steve loves talking with clients and working with them to explore solutions that can address the requirements of the standards. His motto is ‘Mould the Standard to the organisation and not the organisation to the standard’ This means, always producing a management system that benefits the organisation first and then adjusting it to meet the requirements of the standard. Organisations that mould the business to the standard usually end up with a management system that is a ‘bolt-on’ and an uncomfortable, sometimes irrelevant, fit. Everyone in the organisation needs to feel that the management system is a natural fit to what they do. He also enjoys supporting his colleagues at Blackmores. We’re a business built on knowledge sharing, and there’s no point gatekeeping anything we’ve learned as a team. So consultants often get together to discuss lessons learned and ensure best practice is a shared experience. Ironically enough, one of Steve’s least favourite aspects of being a consultant is auditing! Mostly since he’s been doing it for some 40 years now, so he can be forgiven for finding the exercise a bit tedious at times. However, he never let’s that affect the end result of an audit. [37:00] What Standards does Steve specilaise in and why? Steve initially started with ISO 9001 but was steered towards ISO 27001 and ISO 20000-1 during his time as BSI. This was based upon his career path up to the point he joined BSI as they align assessors to familiar business and technical environments. In Blackmores, he has been able to develop these areas of Quality, Service and Risk by adding standards related to Business Continuity, PII and Cloud Security, Facilities Management and AI Management. Steve’s favourite standard is ISO 20000-1 which started off as an IT Service Management System but can also be used effectively for all services. He always refers to ISO 20000-1 as ‘ISO 9001 on Steroids’ because it is much more specific and focuses on the subject of service management. Sadly, ISO20000-1 is under rated, under sold and in some cases, never heard of – this is usually because contracts require IS O9001 but the people writing those contracts don’t actually know or understand what they are asking for. In simple terms it is a Service Quality Management System and Steve has come across organisations which have shoe-horned ISO 9001 into the business instead of using the natural fitting standard ISO 20000-1. Steve would advise any company that is providing a service with helpdesk support to look at ISO 20000-1, especially if they find that ISO 9001 isn’t working well for them. [43:00] What is the biggest challenge Steve had faced during a project and how did he overcome it?: Creating a management system in 10 days for a client which was due to lose a major contract because they had let their certification to ISO 9001 lapse between the 2008 and 2015 versions. Quite the undertaking in such a short amount of time! Steve refuses to claim full responsibility for the success however, as the client was totally invested in getting the system up and running and put in a lot of effort to work with Steve to get it done in time. If it had been any other standard, it would have been impossible, but because it was ISO 9001 and wthey were drawing on what had been in place previously it was possible. Generally, problems arise when there is limited or no Leadership support and commitment, because without this management systems can’t be set up in a way that benefits the organisation. All management systems must align with the Business Strategy and should be used to ensure that the strategy is achieved. If you’d like to learn more about the and , check out a few of our previous episodes. [50:10] What is Steve’s proudest achievement? Steve isn’t really one to collect achievements, so he cites winning 1st Prize at 6 years old in a fancy-dress competition, dressed as a Snowman was a proud achievement for 6 year old him. He is also proud of becoming a Lay Reader initially in the Church of England at 37 and latterly in the URC. Another highlight is appearing on The Chase back in 2017, successfully passing the auditions which saw 40,000 applicants. If you want to go see him go up against the Chasers, he was in Series 10 episode 119. He can’t point to any one ISO related project as he sees them all as an equal success. He puts all his effort into every project, and his success track shows this to be evident. [54:35] ISO 14001 Transition Webinar: If you currently hold a 2015 certificate for ISO 14001, then the countdown has already started to transition to the latest 2026 version. We’ll be covering the changes and what you need to do to comply and complete your transition in a webinar on the 29th May. If you’d like any assistance with implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41306110
info_outline
#249 How To Meet Documentation Requirements Within ISO
04/28/2026
#249 How To Meet Documentation Requirements Within ISO
Most ISO Standards are designed with implementation flexibility in mind. They set the framework without specifying an exact method to meet requirements, giving businesses the freedom to implement them how they see fit. One of the key requirements you can’t escape, however, is documentation. This is more than a list of key documents you must have in place, it encompasses how you develop, control and store documented information. In this episode, Ian Battersby dispels common myths around documentation in ISO, explains what the requirements actually mean in practice and how you address each one relevant to documented information. You’ll learn · Common misunderstandings about documentation within ISO · What do current ISO Standards require for Documented Information? · How do you determine what should be documented information? · How do modern Standards embed a flexible approach? · What is considered ‘documented information?’ · Breaking down clause 7.5 Documented information · How to address clause 7.5.2 Creating and Updating documentation · How to address 7.5.3 Control of documentation · A cautionary tale for modern approaches to Documentation Resources · In this episode, we talk about: [02:05] Episode Summary – Ian dives into the topic of documentation within ISO, dispelling the myths and breaking down the requirements you need to meet relevant to documented information. [02:40] Common misunderstandings about documentation within ISO: Taking as the prime example, the most common misunderstanding is that you need a policy manual. This is not true. This may have stemmed from previous versions of ISO 9001 where certain mandatory procedures were required, such as: · Control of Documents (Clause 4.2.3) · Control of Records (Clause 4.2.4) · Internal Audit (Clause 8.2.2) · Control of Nonconforming Product (Clause 8.3) · Corrective Action (Clause 8.5.2) · Preventive Action (Clause 8.5.3) There were also mandatory records such as Management Review, calibration, supplier evaluation, design/development reviews etc. With the introduction of the 2015 version of ISO 9001, the old terms ‘Procedure’ and ‘Record’ have changed into a single term now known as ‘Documented Information’, which breaks down those previous terms into the following: · Documented information to be maintained — Previously what would have been a procedure (i.e., describing how something should be done) · Documented information to be retained — Previously what would have been a record (i.e., evidence that something was done) [05:10] What do current ISO Standards require for Documented Information? The 2015 version of ISO 9001 received the following updates: · Removed the prescriptive language associated with the old terms · Gave organisations the flexibility to develop, control and store documented information · No longer dictates the form that documentation must take In practice, many people still use the terms procedure and record informally, because they are well understood and conveniently descriptive. But beware using language that reinforces old-fashioned ideas about how we create management systems. This newer language aligns with modern risk-based thinking, with direct references made to this being included in the Standard. But, while that sounds prescriptive, adopting risk-based thinking has allowed a less prescriptive approach to the standards. It allows you to consider what’s significant to you and so you can plan your system accordingly. [07:20] How do you determine what should be documented information? The effort you put into documenting something must be consistent with the risk If, for example, a process is important, if its outcome could be in doubt, if it’s complex to control, if it could lead to damage/harm, if there’s a regulatory requirement, then you should put some effort into documenting how it’s performed. But, if you maintain that documentation in response to the risk to your organisation and not in response to a prescriptive demand in standard, and if a process attracts less risk, then you can deliver it with less formality and less documentation to be maintained. The same goes for retaining documentation to evidence that you’ve done what you should. In short: more risk, more documentation retained to demonstrate that you’ve controlled it. [08:30] How do modern Standards embed a flexible approach? ISO Standards are deliberately flexible. The extent of documented information required depends on the size of your organisation, the complexity of your processes, your customers’ needs, your regulatory environment and the competence of your people. An organisation of only 10 people will have very different needs compared to one of 10,000, and both can fully conform to the standard. It’s about proportionality, not volume. [09:20] What is considered ‘documented information? ISO standards don’t care what you call the documents you maintain in order to govern how you deliver your daily work. Other than using the term process (and the process approach) to underpin how systems should interrelate, ISO 9001 doesn’t specify anything else. Would you like to use the term procedure? Or management procedure? Or SOP? Work instruction? Process map, guide, playbook, manual. Or is your activity embedded in an online system? A workflow? A board? It doesn’t matter, you can call it what you want, and as long as it’s controlled to the extent that it needs to be. [11:05] Breaking down clause 7.5 Documented information: ISO 9001 states: “7.5.1 General: The organization’s quality management system shall include: a) documented information required by this International Standard; b) documented information determined by the organization as being necessary for the effectiveness of the quality management system. NOTE The extent of documented information can differ from one organization to another due to: · the size of organization and its type of activities, processes, products and services; · the complexity of processes and their interactions; · the competence of persons.” This reinforces the fact that there is no ‘one size fits all’ approach. [12:15] How to address clause 7.5.2 Creating and Updating documentation: The Standard states: “When creating and updating documented information, the organization shall ensure appropriate.” Note that word, ‘appropriate’. It doesn’t indicate specifics, it indicates that you should choose certain things according to your own circumstances So the appropriate things which you should ensure are: Identification and description:(e.g. a title, date, author, or reference number) One trap many fall into, is the use of reference numbers. In most cases they are unnecessary. Only use them if they mean something or make life easier. Having reference numbers with department numbering can reinforce the silo mentality; ‘that’s their procedure, not ours’, so it’s best to avoid creating that situation by foregoing reference numbers if possible. What matters is that any users are able to easily verify that they have the right document, this can be done with a descriptive title, version numbers and a date for the version. Online documents may have details embedded in metadata or an information box that can make this process easier to implement. Format and media: You’ll need to consider language required for certain documentation, as international systems where there are multiple languages used by the workforce, may require additional versions. You’ll also need to establish which templates or layouts to use. Look and feel will likely be important in the organisation, so you’ll want to keep documents on brand. Other considerations include: · The use of process maps, flowcharts, diagrams, tables, or written text. · The software or application it is created in (e.g. Word, PDF, SharePoint) · Whether the document is paper-based or electronic Review and approval for suitability and adequacy: Documented information requires appropriate review of content, this is to make sure it does what it should and that all of the above is covered. You will also need sign-off by someone with the appropriate authority, and that authority is determined based on risk related to that document. [18:00] How to address 7.5.3 Control of documentation: Let’s break down each part of this clause: “To ensure that a) it is available and suitable for use, where and when it is needed;” - It must be circulated, hosted, displayed or whatever, so that those people who are required to see it, use it, know of its content can act on it. “b) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).” - It must be protected so that only the right people see it, so that any confidential information is not inappropriately shared, and no one can use or amend it without the appropriate authority. This is to ensure it remains in the manner it was intended and that its content can’t be altered, corrupted or destroyed. “7.5.3.2 For the control of documented information, the organization shall address the following activities, as applicable: a) distribution, access, retrieval and use; b) storage and preservation, including preservation of legibility; c) control of changes (e.g. version control); d) retention and disposition.” This clause adds some meat to the ideas discussed already “a) distribution, access, retrieval and use;” – This refers to who receives a document and by what means, whether the right people can access it and know what to do with it at the time they need it, while also considering the sensitivity. “b) storage and preservation, including preservation of legibility;” - The physical or electronic location of storage and its usefulness over time. You’ll need to ensure that physical things are safe from damage (fire, flood etc) and that electronic formats are protected from obsolescence. “c) control of changes (e.g. version control)” - Who is allowed to edit, authorise, publish, issue and host a document. Establish a method of ensuring only relevant, current information is accessible by the right people, and record the history of changes where necessary. “d) retention and disposition.” – Ask yourself: how long should documented information be kept? What’s useful? What’s regulatory? What does the customer want? What do you do when you don’t need it any more? What do you do to prevent access to obsolete information? [22:30] A cautionary tale for modern approaches to Documentation: These days, we’re seeing more and more systems relying solely on electronic documentation. This brings big advantages, but also risks. While there are excellent methods for document control in all sorts of hosting, sharing, collaboration platforms, they still need to be managed. Too often we see systems with multiple versions of similar documents, naming disasters, obsolete versions, poor formatting, lack of authority, breaches of confidentiality, and the simple inability to find what you want! Modern systems can help with documented information, but they don’t remove the need for managing documentation. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/41044495
info_outline
#248 How To Address Risk Management Within ISO
04/15/2026
#248 How To Address Risk Management Within ISO
Most ISO Standards take what’s known as a ‘risk-based approach’, which focuses on proactively identifying and mitigating potential risks while capitalising on opportunities. The methods for managing risk can be very varied, and many make the mistake of treating it as a separate task rather than as an integrated part of your existing processes. In this episode, Ian Battersby explains what risk management means in regard to ISO management, what this looks like in practice and breaks down different methods you can utilise for effective risk management. You’ll learn · What is risk? · Where is risk referenced in ISO Standards? · How do you identify risks and opportunities? · How can you document risks and opportunities? · What does a Risk Register look like? · How are risks categorised? · How many risks should you document? · How do you evaluate and rate risks? · How do you address opportunities? · How can ISO 31000 help? · How different ISO Standards define their relevant risks · Governance and risk management Resources · In this episode, we talk about: [02:05] Episode Summary – Ian dives into the topic of risk management within in ISO. Explaining what risk is, how they should be documented and evaluated and what methods you can use to do so. [02:45] Further info on risk management: If you want more guidance there is a dedicated risk management Standard (). [03:10] What is risk? Risk, as defined by ISO Standards is: “An effect of uncertainty on objective. An effect is a deviation from the expected. It can be positive, negative or both, and can address, create or result in opportunities and threats” So important to note that this includes both risks and opportunities. [03:40] Where is risk referenced in ISO Standards? The main risk related requirements can be found in Clause 6 Planning for most ISO Standards: 6.1 Actions to address risks and opportunities - There’s a positive and a negative aspect mentioned right from the start. However, these elements aren’t relegated to a few clauses. ISO Standards are built on a ‘risk-based approach’, which is directly mentioned within the introduction: “This International Standard employs the process approach, which incorporates the Plan-Do-Check-Act (PDCA) cycle and risk-based thinking Risk-based thinking enables an organization to determine the factors that could cause its processes and its management system to deviate from the planned results, to put in place preventive controls to minimize negative effects and to make maximum use of opportunities as they arise.” While it is prescriptive, it does allow flexibility for businesses to determine what risks are significant to them. Other places it’s mentioned in Standards includes Leadership: “Top management shall demonstrate leadership and commitment by: d) promoting the use of the process approach and risk-based thinking” It’s not just about adopting the risk-based approach, leaders have to promote it. The use of the word ‘shall’ indicates that this is not optional and cannot be delegated. [08:10] How do you identify risks and opportunities? The Planning clause directly references clause 4, which is Context of the organisation. Within that clause, businesses are required to think about the things which affect the way you operate, the world in which you work, the people and organizations you must consider, the obligations placed upon you. One key activity that typically happens at that stage is a , that’s not specified by the Standard but it’s a very popular method of identifying your risks and opportunities against multiple areas. The results of which can be fed back into Clause 6 Planning when it asks you to consider and do the following:- · Give assurance that the system can achieve its intended result(s); · Enhance desirable effects; · Prevent, or reduce, undesired effects; · Achieve improvement. · Plan actions to address these risks and opportunities; · Integrate and implement the actions into its system processes; · Evaluate the effectiveness of these actions. This is where you have the freedom to determine what significant risk means to your business. This also establishes the approach to risk management as proactive rather than reactive. [13:15] How can you document risks and opportunities? Just because you need to determine risks, you don’t necessarily need a risk management process or methodology based on the guidance in a standard like ISO 31000. There’s no requirement to even have a risk register! However, we do strongly recommend using one. If you choose not to use one, you could document each risk individually with the plan of action to mitigate it. This is fine, but a register allows you to see what’s happening across all risks. It allows comparison of different types, different categories, across different parts of the organisation, at different levels. It can support decision making and allocation of resource where there’s competition for that resource. It can prompt escalation and more significant management attention where it’s needed. It can also form a basis for reviewing the effectiveness of your processes. So, while not a firm requirement, it can be a very useful tool. [15:20] What does a Risk Register look like?: A typical Risk Register usually sits in a table or Excel document. You can number your SWOT and PESTLE findings and put them into this Risk Register. One of the columns included is interested parties affected by it, e.g. the risk that your processes deliver the wrong product directly relates to your customers; the risk of enforcement may relate to your board; the risk of terrible PR may affect your investors; the risk of polluting may affect the local population, enforcement agencies etc Certain standards also require you to determine compliance obligations associated with each interested party, so that may be useful to add as a column. Then, you need a column for detailing what the impact of the issue is (remember, both positive and negative). Then you need to evaluate each entry, this involves measuring the significance, the size and scale. When evaluating risks, you need to indicate which processes you have in place that control the risk. Then you need to rate the risks in their current (do-nothing) form. This is where it helps to have a register where different types and categories can be judged alongside each other, so you’ll be able to see what’s really important in one place. An organisation needs to decide what level of risk it’s prepared to accept; this may be a straightforward decision where a specific value triggers escalation and action, but it may be more complex, depending on the organisation you are in and the environment in which you operate. If the risk is acceptable, should you still commit resource to addressing it; there’s a balance in reducing risk overall; is it an easy win? Is it easy to do? If you feel you should address a risk, what method of risk treatment should you adopt? The actions you propose to take should then be set out in proper detail: who will do what by when? What resource? Basically detailing the measures to assess effectiveness. If a risk or a group of associated risks require an objective, state clearly and link to that objective. [21:35] How are risks categorised? The types of risks you will be focused on will depend on the ISO Standard you’re implementing. For example, for this will be the ability to consistently deliver the best we can to our customers. For the ultimate aim is to protect your workforce from harm. Regardless, you can get quite broad with the nature of your risks, including considerations such as the ability to fund right equipment and infrastructure; or any investment in a sustainable future; the competence of personnel; the safe working environment to deliver products/services; compliance with relevant legislation; forces affecting our market; stability of supply chains; reputation; social attitudes to work, technology etc But, regardless of whether you’re certified to a multitude of standards, operations are typically so interdependent that you can’t separate financial risks from operational ones etc. [23:55] How many risks should you document? It’s easy to get overwhelmed by generating a huge register when you’re a small organisation, but you should be realistic. Focus on what’s really significant. If you do a SWOT/PESTLE, if it generates lots of issues but not everything has to be treated as a risk and opportunity for the risk register. First, ask yourself, what will actually have an impact on you if it materialises? What is beyond control or influence? What requires just monitoring? A larger organisation will tend to generate a larger register, but this can be categorised in different ways: · Split by functions · Split by category (operational, safety, compliance, financial) · Significance; operational vs strategic or corporate · This can be done by the scale of the risk, any risk above a specific threshold could be escalated to the strategic level · There could be factors in the risk evaluation which include strategic significance · There could be specific subjects (eg, compliance) which you automatically escalate to a strategic level [25:55] How do you evaluate and rate risks? There are lots of complex and sophisticated ways of doing this. Certain sectors, industries, processes have specific needs and ways of evaluating risk. But, if you’re new to this, or there aren’t such complexities to consider, a very simple methodology is best. Keep to a simple matrix of consequences and likelihood. Consider what the impact would be if the risk materialised, and rate these from 1 to 5: 1 = the consequences are not significant, it would only be a slight impact on the organisation, minor disruption, small financial loss, little/no physical harm. 5 = the consequences are disastrous, it could materially affect the way the organisation operates, it could cause serious physical harm, it could lead to severe financial loss, it could totally prevent us delivering our products/services. Now consider the likelihood of the event occurring, again rating these from 1 to 5 That could be qualitative evaluation: · 1 = very rarely · 5 = happens regularly, or it’s certain to happen OR, it could be more quantitative · 1= once in ten/five years · 5 = daily/weekly Then multiply these numbers and plot them on a matrix. The matrix will then provide a visual heat map that indicates the level of risk and inform about the level of resource you should apply to addressing the risk. [29:15] How do you address opportunities? You can also evaluate opportunities in a similar manner. Rather than assessing negative consequences, you consider the positive impacts on the organisation when an event occurs. These are plotted in the same way on a matrix, but with appetite and tolerance rather than consequences and likelihood. Risk appetite can be defined as 'the amount and type of risk that an organisation is willing to take in order to meet their strategic objectives'. These appetites range from averse, cautious to an open, eager appetite. For example, a public sector risk appetite example could a local council adopting a "cautious" approach to financial management while having an "open" appetite for innovation in digital service delivery. This balances the need for fiscal responsibility with the desire for improved efficiency, often accepting higher risks for long-term environmental or social gains. Risk tolerance is the actual threshold that you can get away with, that your organisation can bear before action / escalation is needed; financial, operational, reputational, enforcement. This concept may not be for you if you’re at an early stage of development, but one to keep in mind. [32:00] How can ISO 31000 help? If we feel we should address a risk, what method of risk treatment should we adopt? ISO 31000 Risk Management Guidance suggestions include: · Avoiding the risk by deciding not to start or continue with the activity that gives rise to the risk; · Taking or increasing the risk in order to pursue an opportunity; · Removing the risk source; · Changing the likelihood; · Changing the consequences; · Sharing the risk (e.g. through contracts, buying insurance); · Retaining the risk by informed decision (no influence, cost too great) [33:40] How different ISO Standards define their relevant risks: ISO 45001 states: “The organization shall establish, implement and maintain a process(es) to: a) assess OH&S risks from the identified hazards, while taking into account the effectiveness of existing controls; b) determine and assess the other risks related to the establishment, implementation, operation and maintenance of the OH&S management system” Business Continuity states: “The organization shall implement and maintain a risk assessment process. The organization shall: a) identify the risks of disruption to the organization’s prioritized activities and to their required resources; b) analyse and evaluate the identified risks; c) determine which risks require treatment.” Be careful not to confuse these types of risk with organisational, system risks. [36:05] Governance and risk management: A Risk Register is not a static document. It need to be reported on regularly, such as during Management Review meetings. The register itself isn’t evidence of good risk management. It’s how you use it to demonstrate that your actions have addressed risks and opportunities which counts. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40883795
info_outline
#247 How do ISO 27001 Information Security and ISO 42001 AI Management compare?
04/01/2026
#247 How do ISO 27001 Information Security and ISO 42001 AI Management compare?
Information is increasingly becoming the number one priority for businesses. With so many of us reliant on tech to stay in operation, there is an inevitable increase in data breaches and incidents year-on-year. The addition of new AI driven technology has added a new layer of complexity to the information security landscape, regarding both the new risks using the technology brings as well as falling prey to more complex AI led scams. Thankfully ISO Standards are here to help, with ISO 27001 tackling general information security and ISO 42001 for effective AI Management. But how do these two compare, and is there merit in implementing both? In this episode, Ian Battersby is joined by Bas Von Hertom, Cyber Security Specialist at TUV Nord, to discuss what ISO 27001 and ISO 42001 are, the main differences between the Standards and how they can complement each other when integrated. You’ll learn · Who is Bas Von Hertom? · Who are TUV Nord? · What are ISO 27001 and ISO 42001? · How does ISO 42001 support regulatory frameworks such as the EU AI Act? · How do ISO 27001 and ISO 42001 differ in managing information security risks? · Other key differences between ISO 27001 and ISO 42001 · How much more work is involved for Implementing ISO 42001 if you already have ISO 27001 in place? · Can ISO 27001 and ISO 42001 be integrated? · What organisations should be implementing both Standards? · How are Certification Bodies quoting for ISO 27001 and ISO 42001? · Bas’s advice to leadership teams looking to build a case for full certification Resources · · In this episode, we talk about: [02:05] Episode Summary – Ian is joined by , Cyber Security Specialist at TUV Nord, to explore the differences between ISO 27001 and ISO 42001 and the benefits of integrating both Standards. [02:30] Who is Bas Von Hertom? Bas is the Cyber Security Specialist at TUV Nord. He is a lead auditor for Standards including , , and standards specifically for industrial automation. Bas had once stated around 5 years ago that he would never pursue a career in auditing, but once he came into contact with TUV Nord he decided to give it a go. Before joining TUV, he was a very hands-on systems administrator and many of those skills transferred well into auditing. [04:45] Who are TUV Nord? TUV Nord are a accredited Certification Body. They also offer services for testing and inspection. TUV have worked with a large range of sectors, from manufacturing and energy to IT, healthcare and even space. [06:25] What are ISO 27001 and ISO 42001? ISO 27001 is the Standard for Information Security Management, with compliant management systems being called an ISMS. It provides structure for identifying, assessing, and managing risks related to the information security while also ensuring availability and resilience on the information security. ISO 42001 AI Management is a much more recent Standard, being published in December of 2024. It focuses on ethical and effective AI management, with a system that applies to relevant products in addition to the wider business. [07:30] How does ISO 42001 support regulatory frameworks such as the EU AI Act? The sets out legal obligations that organisations offering AI products must comply with, however it only defines the rules rather than providing any implementation guidance. This is where ISO 42001 can fill the gaps, by providing a framework that will meet these regulatory requirements. [08:45] How do ISO 27001 and ISO 42001 differ in managing information security risks? Both Standards take a risk-based approach to their subject matter, but the nature of the risks that each address are what differ. ISO 27001 focuses on risks that relate to the protection of information assets based on confidentiality, integrity and availability of information. It’s also ensures that business objectives are clearly defined and aligned with business strategy. ISO 42001 on the other hand deals with a broader and more complex set of risks, because it also looks at ethical considerations. This can includes the monitoring and measurement of ethical risks such as AI bias and discrimination. It also looks at societal, legal and reputational risks as one of ISO 42001’s key values is creating trust within the AI space. [10:10] Other key differences between ISO 27001 and ISO 42001: Besides their subject matter, another key difference is the way objectives are framed and evaluated. In ISO 42001 these objectives have to be aligned with the Annexes within the Standard, which is something not commonly done when implementing ISO 27001. ISO 42001 also requires an ‘AI Impact Assessment’, which again, aligns with the systems objectives as the results of the AI Impact Assessment will describe the way bias, ethical and societal considerations impact other requirements within ISO 42001. [11:00] How much more work is involved for Implementing ISO 42001 if you already have ISO 27001 in place? If you already have ISO 27001 in place, you have a strong foundation for ISO 42001. ISO 27001 puts the fundamental base in place, with a governance structure, risk assessment processes, internal audits, corrective actions and methods for continual improvement. There’s a lot of overlap where the high-level requirements are concerned. However, ISO 42001 also looks at AI products and services, which differs from ISO 27001. ISO 42001 may also require additional training for those involved with the management systems and the AI products and services. [12:15] Can ISO 27001 and ISO 42001 be integrated? Yes, and in fact, Bas highly encourages it! If you intend to implement both Standards, it’s much more efficient to do so as an integrated management system. They both utilise the Annex SL format, a high-level structure that’s shared with most ISO Standards, so they’re designed to be integrated. This also saves on duplication of effort where documentation is concerned and also potentially on cost if you require additional support with implementation. [13:30] What organisations should be implementing both Standards? Both ISO 27001 and ISO 42001 can apply to any business. Most businesses are now utilising AI in some form, and ISO 42001 can apply to those using it just as much as it does to those developing their own AI tools or selling related services. However, sectors where ISO 42001 will likely become fundamental include the financial sector, where AI tools for fraud detection are becoming popular. There’s also a growing need for it within the medical field as AI is increasingly used for research and development. [14:30] How are Certification Bodies quoting for ISO 27001 and ISO 42001? There are a number of variables that Certification Bodies use to work out certification costs, these include size of the organisation and business complexity. This can be tricky to calculate for ISO 42001 as you need to consider the amount of AI systems used before you can provide a quote. The full requirements for this are described in ISO 42006, which is a guidance Standard. Most certification bodies will offer a discount for the combined certification to both Standards. An integrated approach is certainly something that Bas recommends, in addition to ensuring that you keep the same auditor or audit team throughout the implementation. By having one team for both systems, you can complete combined internal audits to save on time and resources. [16:20] Bas’s advice to leadership teams looking to build a case for full certification: First of all, don’t wait, just make a start. A lot of businesses make the mistake of waiting until it’s a common requirement within their market, which can leave you lagging behind the curve. Instead, strive to be one of the early adopters as that will give you a strategic advantage in the market. This is especially the case if you already have ISO 27001 in place. You already have the foundational knowledge to implement ISO 42001, so just make a start on looking at risks relevant to ISO 42001. Many businesses opt to implement certain Standard due to the demands of their clients, and ISO 42001 is likely to be added to that list. So it’s better to get a head start! Bas also recommends finding sources of guidance on ISO 42001 implementation. Whether that’s sourcing training or an external party to advise, it’s good to have other sources of knowledge of you’re not familiar with the Standard or ISO implementation as a whole. [21:30] Bas’s favourite quote: We don't rise to the level of our expectation, but we fall to the level of the systems that we use. If you’d like to find out more TUV Nord or are looking for ISO 27001 and ISO 42001 certification, We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40694780
info_outline
#246 Pedalling Towards Purpose – Forests Journey To B Corp Accreditation
03/19/2026
#246 Pedalling Towards Purpose – Forests Journey To B Corp Accreditation
Europe is only partially on track to meet its 2030 environment and sustainability objectives, and while some objectives are being scaled back, we are seeing the introduction of more regional regulations that require tangible annual sustainability reporting. Businesses that have built sustainability into their way of working from the start are leading the charge and defining what it means to operate responsibly. As with today’s guest, Forest, an e-bike provider that is not only 100% powered by renewable energy but has also achieved the coveted B Corp Accreditation. In this episode, Mel Blackmore is joined by Laura Elms, VP of Sustainability & Corporate Affairs at Forest, to discuss how they embedded sustainability from the start and explore their journey towards B Corp Accreditation. You’ll learn · Who are Forest? · Who is Laura? · Why was B Corp important to Forest from the start? · What other Standards do Forest currently hold? · What does Forest’s higher B Corp score of 99 mean in reality? · How did Forest embed sustainability into a business from day one rather than retrofitting it later? · How has Forest balanced growth with genuine environmental accountability? · What does tackling Scope 3 look like in urban mobility? · Why did they also attain Verra Validation, and why does third-party validation matter? · How do sustainability, communications and public policy intersect in Laura’s role? · Advice for those seeking B Corp Accreditation · B Corp Version 7 · What role do you think sustainable transport should play in helping cities to meet their net zero targets? Resources · · · In this episode, we talk about: [00:30] Episode Summary – Mel is joined by , VP of Sustainability & Corporate Affairs at Forest, to explore how they lead the way in sustainability including insight into their journey towards B Corp Accreditation. [01:10] Who are Forest? Forest is the only shared E-Bike operator to power its entire fleet with 100% renewable energy. It’s also one of the world’s first micro-mobility companies to have and . [01:40] Who is Laura and how did she get involved with sustainability? Laura admits that she had a rather non-linear approach to getting into sustainability. She started her career shortly after graduating in financial communications and investor relations. Working in her first firm, she worked closely with a women called Caroline who went on to found Forest along with two other co-founders. Caroline reached out to her 2 years after starting Forest and Laura felt it was a no-brainer as she had a pre-existing interest in sustainability, and had come to prefer the start-up space over a more corporate setting. As is typical with the nature of start-ups, Laura wore many hats from the outset as it was a small team of four. Sustainability was what she was most passionate about, and has been the area she nurtured for Forest over the course of her six years working with them. [03:40] Why was B Corp important to Forest from the start? Laura noticed that B Corp was gaining traction back when Forest started in 2020. She was curious about the intersection between B Corp and , particularly from a start-up perspective. When starting at Forest, she knew it would be a significant benefit to utilise renewable energy, but she felt like they needed to go above and beyond that. From there she researched B Corp and the costs involved, which were affordable as it’s relative to your revenue, which is a great advantage to start-ups. She was pleased to find that Forest could cover the 5 pillars of B Corp’s credentials, not only providing bikes for urban settings but also providing excellent governance and additional benefits to their surrounding community, workers and environment. In short, B Corp helped set the foundations for a good well rounded company that could grow. [05:15] What other Standards do Forest currently hold? Forest currently hold certification and are looking to implement in the near future. They currently operate within 18 boroughs in London, and are expanding from one central hub to several more warehouses, which is what will be covered under that ISO 14001 scope. With B Corp as their guiding North Star, they’re confident they have all the right foundations in place to grow as needed. [06:10] What does Forest’s higher B Corp score of 99 mean in reality? Within B Corp there are 5 pillars: · Community · Environment · Governance · Customers · Workers Its core focus is sustainability, but its approach is much more holistic and similar to the way ISO’s implement a system that encompasses how a business works rather than just a siloed focus on one area. B Corp looks at a multitude if areas, such as: · Reducing Scope 1, 2 & 3 emissions · Looking at your supply chain · Evaluating how your activities interact with your stakeholders To earn a B Corp score, you need to get certain marks and then you’re scored across the 5 pillars. Many businesses going for B Corp tend to do well in the sustainability area, but they struggle with other areas such as workers and customers. The framework is designed to be more holistic than simply focusing on sustainability, so If you focus too much in that area, it may come at a detriment to the other pillars. [08:20] How did Forest embed sustainability into a business from day one rather than retrofitting it later? Sustainability was Forest’s vision and mission right from the start. Their CEO and Founder had previously worked at a ride-hailing company called , and had led the Latin American operations there. Cabify was the first mobility company to offset all its emissions, this was prior to 2020 so it was seen as though-leader in the space. This inspired the now CEO of Forest with the concept of ‘Human Forest’, which was the idea that humans on bikes in a city can save CO2 by choosing bikes over carbon emitting modes of transport. Having it as a core part of the business from the start meant they didn’t have to worry about budgeting road-blocks or additional approval. It was simply a part of the brand. Laura can see why retrofitting the same level of sustainability commitment may be difficult for other businesses, as Forest had already baked in the price of renewable energy from the beginning and didn’t have to worry about that transition. Forest do differ in that unlike other larger companies that will be showing smoother trajectories towards net zero, they’re already there. They face the unique challenge of keeping it there as they grow, as more bikes and available geographical locations means more manufacturing and bigger scope 3 emissions. So their transition to net-zero will overall look a lot less linear. [11:15] How has Forest balanced growth with genuine environmental accountability? Forest have managed to reduce their carbon footprint by 53% year on year, even with their continued growth. Tackling environmental accountability can be something that gets businesses stuck in a rut, especially with any applicable regulations. As Laura quotes, often perfection is the enemy of good. Small incremental changes are better than trying to get it all right first time. In Forest’s case, to achieve that 53% reduction they looked at a more creative solution. Rather than manufacturing brand new bikes when needed, they reached out to the wider e-bike market to those that utilised their same manufacturer and asked if they had any spare bikes. This helped to massively bring down emissions that would have otherwise been created making new bikes, by accessing a second-hand market. This can’t be done indefinitely, but it’s a small action that has created a large impact for that year. Forest have also worked with manufacturers to help switch to using solar energy for the production process, which they are now monitoring to see how much this reduces emissions by. [13:50] What does tackling Scope 3 look like in urban mobility? Scope 3 for most businesses is their biggest source of emissions, typically accounting for around 80-90% of a businesses total emissions. For Forest this is closer to 100%. They’ve also noticed that compared to 3 years ago, the emissions are slightly less for things such as production and shipping of bikes. Laura admits that this may not be entirely due to the processes themselves getting more efficient, but as by-product of improving other areas such as technology or use of office spaces to help bring down the businesses overall emissions. At this stage, it’s getting the methodology right for scope 3, to ensure their data is as accurate as possible. This includes sending questionnaires to suppliers and making use of technology to improve data gathering and analysis. [15:45] Why did they also attain Verra Validation, and why does third-party validation matter? Laura at the time was looking to ensure the highest level of credibility possible, which started with B Corp, ISO certification and then Verra Validation. Verra was a leader in this space, and dominate the market in terms of carbon offsetting. Forest didn’t want to go through the whole process to sell offsets with Verra as it didn’t make sense for their business, but they did want the validation as another layer of credibility. [17:45] How do sustainability, communications and public policy intersect in Laura’s role? London, unlike most other major cities, does not have a single unified body, instead you have to negotiate borough by borough. Each one has the option to pick different operators and set their own requirements, which adds an extra layer of difficulty on top of existing sustainability regulations. Forest provided the perfect solution for various London boroughs who sought to reduce their overall carbon emissions. [19:05] Laura’s advice to organisations seeking B Corp Accreditation: Get in contact with B Corp itself. They done a lot to improve their platform, and there’s a lot you can do via the portal without their assistance. However, B Corp and their team at B Lab can give you more insight and context for the data they’re looking for. She also recommends that you incorporate B Corp as early on as you can as it helps to set a solid business foundation. Laura also recommends going beyond the B Corp portal after certification to reach out to the wider B Lab community, as there are a lot of fantastic brands to connect with. B Corp will often host in-person networking meetings where certified businesses can catch-up, review progress and share new ideas. [20:40] B Corp Version 7: B Corp have recently released (as of podcast publication) a new version of their requirements, raising standards once again. One of the new requirements includes verification of an organisations’ emissions, which includes products. Forest only just received their B Corp re-authentication in December 2025, and their next focus is obtaining ISO 14001 for their new warehouses. However, they do intend to stay B Corp accredited, so will likely look at meeting version 7 requirements following that. [21:45] What role do you think sustainable transport should play in helping cities to meet their net zero targets?: Transport makes up a third of UK emissions. Getting people onto more bikes and being more active will result in a significant reduction in emissions for our cities. When Forest asked their users: what would you otherwise have done in terms of transport if you didn't get on one of our bikes, 11% said that they would have gone in a car or a taxi. So an 11% modal shift, which is pretty significant! This doesn’t account for private bike owners either. For cities, there’s a big push to get HGVs off the road and to retrofit spaces to accommodate for more cycle traffic. It’s a lot to consider and will require a lot of work, but with transport making up a third of total UK emissions, it’s worth the effort for the benefits it will bring. If you’d like to find out more about Forest and follow along with their journey, check out the We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40540555
info_outline
#245 What’s The Difference Between TISAX and ISO 27001?
03/04/2026
#245 What’s The Difference Between TISAX and ISO 27001?
For those in the automotive industry, namely suppliers working with European OEM’s, you’re likely familiar with TISAX but not necessarily with the Standard that many of its requirements originate from. ISO 27001 is the leading Information Management Standard, and its Annex A forms the basis of TISAX, however there are many differences between the two. For Automotive suppliers looking to create a more holistic Information Security Management System, it can be beneficial to implement elements of both even if you don’t intend to certify to both. In this episode, Ian Battersby is joined by Emma Coxhill, isologist at Blackmores, to explore the differences between TISAX and ISO 27001, how existing ISO 27001 compliant management systems can be leveraged for TISAX compliance and the benefits of implementing both Standards for automotive suppliers. You’ll learn · How does TISAX differ from ISO 27001? · How does the recertification / annual surveillance for TISAX and ISO 27001 differ? · Can a company have TISAX without ISO 27001 and vice versa? · How can an existing ISO 27001 certification be leveraged for TISAX? · What are the additional benefits of implementing both TISAX & ISO 27001? · What is a reasonable timeframe for implementing TISAX? · The key role of Internal Audits · How can Blackmores support companies in implementing TISAX? Resources · · · In this episode, we talk about: [02:05] Episode Summary – Emma Coxhill joins Ian to dive into the key differences between v Information Security and TISAX, including the benefits of implementing both and how each can be leveraged to assist in the implementation of the other. [03:10] What is TISAX? TISAX was developed for the automotive industry by the German Association of the Automotive Industry, , and it's managed by the . It’s based on the Annex A controls, and was created for the automotive industry because they were looking to standardise the framework for assessing and sharing information security results between manufacturers and their suppliers. [04:20] How does TISAX differ from ISO 27001? ISO 27001 is a general Information Security management Standard, it can be applied to any business, whereas TISAX is only applicable to the automotive industry. ISO 27001 includes a framework of requirements that everyone must implement, whereas TISAX has a more customisable element. With TISAX you can select an applicable level and relevant subject areas for your operations. The last main difference is the fact that ISO 27001 certification ends in a certificate which can be shared and displayed wherever you want. TISAX in comparison has Labels, which are only available through the ENX portal where you have control over who can access them. [05:15] How does the recertification / annual surveillance for TISAX and ISO 27001 differ? The good news is that TISAX is a bit more forgiving than ISO when it comes to a recertification cycle. TISAX does not require an annual Surveillance like ISO 27001, instead once you’ve earned a Label it remains valid for 3 years. ISO 27001 in comparison requires an annual Surveillance for each year until the 3rd when you have your Recertification Audit. If you have a significant change to scope part way through your 3 years of TISAX, you will need to have a chat with your auditor to see if extra work is required. This will depend on your level, with higher levels likely to require some additional work and for you to adjust your scope within the ENX portal. Overall, a TISAX label is less of a burden than traditional Management System Standards like ISO 27001. However, TISAX is a lot more strict and will require more upfront preparation ahead of earning your Label. [07:30] Are Internal Audits required for TISAX? They are, but the amount and frequency are a lot more flexible than ISO 27001. You can do as many as you like, but at a bare minimum we recommend you conduct internal audits 6 months ahead of your TISAX label expiring to ensure you’re ready for re-certification. You can of course carry on with annual internal audits to make sure you’re on track. This can be handy if specific clients ask for further evidence of you following processes in accordance with TISAX requirements. [08:35] Can a company have TISAX without ISO 27001 and vice versa? You can! Both are independent Standards, however they do compliment each other. Organisations that hold both have a competitive advantage, as ISO 27001 applies to all industries and is more widely recognised. However, if you only operate in the automotive space, TISAX may be sufficient. If you supply to multiple sectors, it’s worth considering implementing both TISAX and ISO 27001. [09:25] How can an existing ISO 27001 certification be leveraged for TISAX? If you already hold an existing ISO 27001 certification, than you’re already 80% of the way there to TISAX compliance. As TISAX is based off of ISO 27001’s Annex A controls, a lot of the requirements cross over, so you will already have most of the foundations in place to cover TISAX. It will just be the more automotive specific requirements that will require some additional work. These requirements include considerations for: · Data Protection · Prototype protection · Assets · 3rd Party Suppliers The amount of additional work will also depend on the TISAX Level you’re aiming for, with Level 3 being the most demanding for these specific requirements. [10:55] What are the additional benefits of implementing both TISAX & ISO 27001? Benefits include: Robust Information Security – Having both TISAX and ISO 27001 forms a strong and versatile information security infrastructure that will cover all of your operations. Easy Integration – These two Standards complement each other, and can easily be integrated. If you already have ISO 27001 in place, you have already completed a majority of the framework and will be familiar with what’s required to earn and keep both your ISO certificate and TISAX Label. Customer Trust and Long-Term Resilience – TISAX is desired, if not an outright requirement for European based OEM’s to work with suppliers. They require this because TISAX is a trusted Standard, a Label displays your commitment to information security within the automotive industry. It also helps to put you in a better position to both safeguard data as well as respond in the event of a data / security incident. Wider market access – If you supply to more than just the automotive industry, than having ISO 27001 in place will grant you access to the wider market that will recognise that Standard over TISAX. [12:05] What is a reasonable timeframe for implementing TISAX? This will depend on a number of factors including the type of organisation, the number of sites, resources available etc. The key thing to note is that this is note a 2 week project, it will take a number of months to get everything in place for your external assessment. A good measure of if you’re ready is if you can score at least more than 2.71 on your self-assessment, and have completed a few internal audits to double check. If you already have ISO 27001 in place, than you’re looking at between 3 – 6 months. If you do not have ISO 27001 in place than you’re looking at 6 months minimum. For Level 2, you will need proof that ,you have everything in place, it’s all been communicated and the relevant individuals have been trained. Level 3 requires everything to be in place and operating for a certain amount of time, typically around 3 months is ideal to start building a library of evidence ahead of your external assessment. Emma’s top tip: Be honest in your self-assessment. It’s there to be a benchmark, and you need to reflect on the reality of your position if you’re to accurately assess what Level you are ready to be assessed against. [14:20] Core elements for success: As with any Standard, ISO or otherwise, TISAX will require leadership commitment in order to be successful. The requirements of TISAX need to come from the top down, just like with ISO 27001. The Leadership ultimately drive TISAX’s success, by ensuring the relevant resources are in place, and involved individuals have the necessary time to implement and maintain the Label. For those within the Automotive Sector, TISAX is becoming an absolute requirement. It’s being pushed as a tender requirement, so you may lose out on business if you opt to not earn a Label. [16:35] The key role of Internal Audits: As mentioned earlier, Internal Audits are a key part of the process for both TISAX and ISO 27001. It acts as a business health check to ensure you’re on the right path. They can help identify areas which may be non-conforming or simply highlight opportunities for improvement. For TISAX, there is not outright requirement for 3rd party audits ahead of your assessment, however we would recommend them as a fresh pair of eyes can reveal things you may have overlooked. An external auditor will also be more unbias and can provide an honest review and feedback as to what TISAX Level you are ready for. [18:25] How can Blackmores support you with TISAX Implementation?: We can provide as little or as much support as needed. This can include a fully guided implementation where we assist you through each step. This can apply to both TISAX and ISO 27001 if you wish to certify to both Standards. Other options include: · Assisting with your TISAX self-assessment (aka a Gap Analysis) · Conducting a Maturity Assessment · Conducting internal audits · On-site support during your TISAX assessment audit We are happy to provide whatever level of support you need. Blackmores do not provide a tick-box exercise, we pride ourselves on ensuring an implemented system works for you. [21:10] Upcoming TISAX Webinar – Join us on the 18th March 2026 at 2pm for a webinar where we’ll dive into TISAX further and provide practical guidance on how to complete the VDA Self-Assessment. Attendees will also get access to some freebies. So don’t delay, We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40309930
info_outline
#244 What is TISAX?
02/25/2026
#244 What is TISAX?
The modern automotive industry faces many new challenges, as vehicles evolve with more complex data requirements and supply chains become increasingly interconnected, major Original Equipment Manufacturers (OEMs) require certain Standards as a mark of trust from potential suppliers. Currently, this trust is codified in TISAX (Trusted Information Security Assessment Exchange). For businesses that have not previously dealt with Standards, TISAX can be seen as a daunting regulatory hurdle. However, a TISAX label is more than a compliance check, it’s a recognised mark that your organisation has robust information security measures in place specific to the automotive industry, including considerations for protecting key intellectual property and prototype innovations. In this episode, Ian Battersby is joined by Emma Coxhill, isologist at Blackmores, to explore what TISAX is, who it applies to, what it requires and how OEM’s and automotive suppliers can take their first steps towards earning a TISAX label. You’ll learn · What is TISAX? · Who is TISAX applicable to? · Why is TISAX important? · What are the 3 assessment levels within TISAX? · What are the 3 different subject areas within TISAX? · How is TISAX implemented? · Why does TISAX use labels instead of certificates – and how can people verify these? · What is the ENX portal and how does this help with supplier onboarding? · Where should companies start if they want to earn a TISAX label? Resources · · · In this episode, we talk about: [02:05] Episode Summary – Emma Coxhill joins Ian to dive into the topic of TISAX, including who it’s applicable to, why it’s important and how businesses can make a start on earning a TISAX label. [03:40] What is TISAX? TISAX was developed for the automotive industry by the German Association of the Automotive Industry, , and it's managed by the . It’s based on the Annex A controls, and was created for the automotive industry because they were looking to standardise the framework for assessing and sharing information security results between manufacturers and their suppliers. [04:40] Who is TISAX applicable to? While applicable to the automotive industry, it encompasses quite a lot of businesses within this. This is because is applies to any organisation that handles sensitive data relating to vehicle development, manufacture and marketing. So, this can include any company providing car parts, vehicle software, cloud services, testing labs, engineering etc. Basically, any service providers to OEMs (original equipment manufacturers) will be applicable. TISAX can also be applicable for those dealing with automotive related events, marketing and photography, as new models are protected IP and will require related business to prove that they have the correct security requirements to ensure any potential prototypes are protected. [06:50] Why is TISAX important? Mainly, it gives the automotive industry a trusted, standardised way to ensure information security across the entire supply chain. Without it, the OEMs and suppliers can conduct their own audits, but it'll be their own interpretations or what is considered an adequate level of security. The industry saw this as an open door to chaos, so TISAX was created to protect highly confidential automotive information and support compliance with relevant data protection laws. However, now it’s not so much a ‘nice to have’ Standard as it is a requirement to trade, especially within Europe. It’s fast becoming a tender requirement, and many OEMs won’t make it past the procurement process without a valid TISAX label. The ENX portal, where labels are registered, can also help speed up the on-boarding process. So, the whole TISAX system has been built for ease of access to help manufacturers choose suppliers that prioritise information security. [09:00] What’s the consequence of not having a TISAX label? A loss of opportunities. Those within the automotive industry that don’t have a valid label will be seen as a security risk, leaving them at a competitive disadvantage. [10:30] What are the 3 levels within TISAX? Unlike ISO 27001, TISAX has levels that depend on the level of data sensitivity that you’re dealing with. Level 1: Self-assessment – Considered as ‘normal risk’ with general processing of data. Level 2: Remote Audit – Applicable to those dealing with confidential information such as design documents or internal projects. This requires both a self-assessment and an audit. Level 3: On-site Assessment – Highly confidential information, so this applies to those dealing with sensitive research, development information or prototype data etc. This requires a physical on-site assessment, as the qualified TISAX auditor will need to ensure that you have the appropriate physical security measures in place. Most businesses will require level 2, but if you’re looking to work with high-spec OEMs, then level 3 is more desirable. [12:00] What are the 3 subject areas within TISAX? The 3 main areas are as follows: Information Security: This covers general information security controls such as relevant policies, access controls, risk management, incident handling and secure operations. Prototype Protection: This focuses on safeguarding physical and digital prototypes, design data, test vehicles and confidential development information. Data Protection: This ensures proper handling of personal data in line with legal requirements such as If you’re just doing a self-assessment, you can pick the areas which are most relevant to you. If you’ve been requested to earn a TISAX label, they will usually provide you with their preference on subject areas. Many will opt to take information security, but data protection is also quite common. The prototype section is more specialist and not applicable to all businesses. [14:00] How is TISAX implemented? There are a few stages to gaining a TISAX label: Awareness – Learn the requirements for TISAX and planning for the project ahead. This may include asking your clients about what they expect of your from an information security perspective and working out costs for assessments and any additional support. The ENX website has a lot of really useful info, including a handbook and a copy of the self-assessment. Preparation – This is where you need to complete your TISAX scope and register yourself on the ENX portal. Your scope needs to specify your selected level (1,2 or 3) and the subject areas you’ll be focusing on. You also need to include the locations within scope, which have to be listed one by one (not simply ‘all offices in the UK’ for example). Self-Assessment – The template for this can be downloaded from the ENX website. This is essentially a Gap Analysis that grades your current level of compliance with the TISAX requirements. It includes a scoring mechanism, where you’ll be aiming to get a 2.71, as that’s the pass rate. This self-assessment will highlight what gaps you need to fill before going ahead with an external assessment. Implementation – This is where you will bridge those gaps highlighted in the Self-assessment. This will involve creating the required documentation requested by TISAX and updating existing systems to align with requirements. Before going ahead with external assessments, we highly recommend you conduct some internal audits to ensure you’re ready. External Assessment – Whether this is remote or on-site, you need an official TISAX auditor to perform the assessment. A list of approved TISAX auditors is available on the ENX portal, we recommend getting a few quotes to get the best price. We also recommend requesting a kick-off meeting so you can have a chat with your auditor about the requirements and how they’d like to review the required evidence of compliance. The Assessments are similar to that of an ISO certification, it’s broken down into 2 segments. One is a document/evidence review and the other is done with both parties present to go through their findings, review further evidence and to question any gaps found. Again, similar to ISO, you may receive either minor non-conformities, non-conformities, opportunities for improvement or observations in their final report. If you get any non-conformities, you’ll need to provide an action plan within 2 weeks following from your assessment to address them. You will then be allowed a few months to implement the corrections, which will be reviewed and approved by the auditor before receiving your label. If you only received opportunities for improvement then you’ll get a label straight away. [20:40] Why does TISAX use labels instead of certificates – and how can people verify these? Taking ISO 27001 as a comparison, that certification has a blanket framework that can apply to every business. While you can exclude small bits, the vast majority applies to everyone. TISAX is more scaled based on the level of security you’re dealing with. Businesses can pick both different levels and different subject areas for their Label. Another key difference is that Labels can only be verified through the ENX portal, this is where other TISAX clients can see who has what Label, including the details of level and selected subject areas. Business can still chose to state TISAX compliance on their website, but the details regarding the level of compliance only need to be seen be relevant individuals. [22:05] What is the ENX portal and how does this help with supplier onboarding? The ENX portal is accessible through the ENX website. It does require a fee to make an account, but this is where everything related to TISAX is managed. This is where you will upload your scope and findings and it’s where Labels are assigned and documented for suppliers to search for. There are options for how much information you want to disclose within those public searches, allowing you to select the need for contacting for further information. The ENX portal can help massively in reducing the amount of supplier questionnaires you need to fill in, as those looking for automotive suppliers will simply look up your TISAX Label to verify if you have the required level of security to continue with the procurement process. [24:50] Where should companies start if they want to earn a TISAX label? If you’re just diving in, we recommend you do some research first to fully understand what you’re expected to do to earn a Label and how much the process will cost. Next you’ll need to define your scope, so look at what sites need to be included and identify relevant client requirements in relation to TISAX. This is to ensure you’re going for the right Level and subject areas. Next evaluate your internal resource for the project and related budget. As mentioned, you will need to pay to register on the ENX portal and you need to consider Assessment costs and any additional support costs should you need consultancy services. You’ll also need to assign individuals to manage the project, which will include completing the self-assessment, updating your policies, procedures and documentation to align with the requirements and possibly conduct training if required. This isn’t a 2 week project, realistic timescales will vary, but generally if you’re starting from scratch you’re looking at 9-12 months. If you have ISO 27001 in place already this could be reduced to 6-8 months. As with anything Standard related, leadership commitment is a big factor as you’ll need their help and support to ensure the projects success. If you need additional help, reach out to consultants such as Blackmores to help guide you through the process. [28:05] Upcoming TISAX Webinar – Join us on the 18th March 2026 at 2pm for a webinar where we’ll dive into TISAX further and provide practical guidance on how to complete the VDA Self-Assessment. Attendees will also get access to some freebies. So don’t delay, We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40225905
info_outline
#243 How Can You Leverage AI for ESG and Sustainability Reporting
02/18/2026
#243 How Can You Leverage AI for ESG and Sustainability Reporting
Annual sustainability and ESG reporting is now becoming a necessity for many businesses, whether driven by region specific regulations and legislation, industry expectations or client demand. However, doing so is definitely easier said than done. It requires a complex network of data being gathered from multiple sources which then needs to be collated, analysed and summarised in a cohesive report for leadership and possible public publication. Thankfully, there have been developments in new AI driven technology that can help ease this annual burden, allowing you to focus on utilising the results to make meaningful sustainability impacts. In this episode Mel Blackmore is joined by Darayush Mistry, Head of Product at Pulsora, to discuss how AI can make a difference in ESG and sustainability reporting, including its benefits, pitfalls and the balance of utilising AI while considering its environmental impact. You’ll learn · Who is Darayush? · Who are Pulsora? · When did Darayush realise how AI could be utilised for ESG and sustainability reporting? · What are the positives of AI in this space? · Why is AI for ESG and sustainability reporting becoming more necessary? · What are the risks involved in using AI for ESG and sustainability reporting? · Where is AI making a real difference in reporting? · What parts of ESG and sustainability reporting need human judgement? · How does AI help collate data from multiple sources? · How might regulators react to AI being utilised in reporting? · How can businesses utilise AI while still considering it’s environmental impact? · Darayush’s advise to sustainability leaders looking to explore AI solutions Resources · · · In this episode, we talk about: [00:25] Episode Summary – Mel is joined by Darayush Mistry, Head of Product at Pulsora to discuss the use of AI tools in ESG and Sustainability reporting, how you can leverage this technology and what risks you need to be aware of before doing so. [02:40] Who is Darayush Mistry? Darayush has been working with enterpirise software for the past 2 decades. This technology is used by companies to help operationalise their business. He began his career at a company called , which operated in the CRM space, spending 10 years there before moving onto the world of sustainability. Darayush recalls how everyone was so used to working from a set of spreadsheets just 20 years ago, whereas now most will use a central CRM for business operations. This is an area that sustainbilty reporting seems to have lagged behind, with many still trying to collate their data from multiple spreadsheets and other external sources rather than having a dedicated central system. This is why he was eager to work with Pulsora, to bring similar solutions to businesses as he once had with CRM’s in the past. [05:25] Who are Pulsora? Pulsora are an AI-forward SaaS (software as a service) platform. The Pulsora platform helps businesses to operationalise their sustainability initiatives, which includes data collation, calculation and reporting features. This is set up for scope 1, 2 and 3 level reporting, with considerations for climate related goals, waste water monitoring, biodiversity and policy oriented information. Darayush’s role as Head of Product means he sits at the intersection between customers and Pulsora’s engineering and design teams. His job is to ensure that whatever Pulsora created ultimately provides value to their customers in the form of successful sustainability outputs. [07:50] When did Darayush realise how AI could be utilised for ESG and sustainability reporting? Darayush can pinpoint a time four years prior when he first stepped into a more sustainability focused role, speaking to the co-founders of Pulsora back in 2021 they were sharing experiences of using the then early versions of AI tools such as ChatGPT and Gemini. It clicked for them then that they could do something similar for sustainability reporting, making it as easy as possible while still being accurate. It wasn’t until 2 years later that they had a product to launch with Pulsora AI in late 2024. This initial product allowed users to write long from narrative responses for carbon disclosures. Regulations like require a comprehensive disclosure, but not everyone is an expert in parsing the data to write that, so Pulsora AI helped get past that writers block, to give people the building blocks for that professional disclosure. [11:55] What are the positives and negatives of AI in this space? The biggest benefits include: · Giving professionals and sustainability teams more time back to achieve their desired outcomes. · Cutting down on spending time in spreadsheets and on calculations on an annual basis. · Reduction of repetitive tasks · Ease of data collection from multiple sources and locations · Ease of data calculation · Allowing for pre-audit of data using AI tools · Highlighting data gaps when rationalizing the data [17:20] Why is AI for ESG and sustainability reporting becoming more necessary? People are starting to move on from the mindset of ‘Let’s try AI’ to ‘Let’s use AI’. Time is one of the most precious resources we have, and any tool that can help accelerate more mundane tasks so that people can focus on making results happen should be a priority. Sustainability teams are under increasing pressure to produce tangible results, something that can be made easier with the help of AI tools. [20:06] What are the risks of using AI in ESG and Sustainability reporting? Don’t treat AI as this magic wand, it’s a tool you can leverage. At the moment, it’s good at certain tasks, but it cannot act on its own. In order to progress, sustainability teams need to push on the initiatives to produce results. People know their business best, and though AI can infer certain information and produce a result, it may not always be the best solution for you. You still need that human input into areas such as strategy and action planning. Darayush reminds us of Amara’s Law: “We as humans severely overestimate technology outcomes in the short-term, and severely underestimate that in the long-term” Don’t fall into the trap of thinking AI can do everything. [22:30] Where is AI making a real difference in reporting? Data collection, ad-hoc sustainability reporting and providing insights into the data provided. It can also help with providing a starting point for carbon disclosures or options for various strategies that you could explore. Currently, the biggest one is data collection, as it can help do this efficiently and consistently, allowing for improved accuracy in your overall sustainability data. [25:20] What parts of ESG and sustainability reporting need human judgement? Darayush states that these are complementary to each other, it should never be all of one and none of the other. There will be elements that need more human in the loop and areas where it’s required less. It’s applicable in degrees. One example of where the human input will be higher is in completing a materiality assessment and figuring out how to execute your decarbonisation strategy, which will require your knowledge and experience of how the business operates, it’s core values and what your ultimate goals are. AI can do the heavy lifting in areas such as sustainability reporting, as it can collate all the data and create initial reports very fast. But, at the end of the day, humans still need to understand these outputs and provide their own judgement. ‘AI’ today isn’t true AI, they’re LLM’s with a great capacity to collect data, analyse it and provide outputs that can be starting points. It cannot replace human judgement, as we provide the nuance in context and experience needed to apply those results effectively. AI responses operate in a perfect world where everything is an easy step by step process, which we all know does not reflect reality. [29:40] How does AI help collate data from multiple sources? Older technologies like OCR (optical Character Recognition) was the go to years ago when scanning various different documents like spreadsheets, PDF’s, receipts etc. This required specific code to be written to read these docs accurately, this would then feed into pipelines to bring this data together. This code was quite rigid, so any changes to document layouts would cause things to break. AI in comparison is much more adaptable, it’s capable of reading much more natural language and extracting what’s required for its designated task. It also provides a much more friendly UI (user interface), meaning you don’t need an IT specialist to utilise the technology. [33:15] How might regulators react to AI being utilised in reporting? Based on Darayush’s previous experience in the finance sector when people were using dedicated platforms for financial reporting, the regulators didn’t care where the data came from or how it was collated, they just card if it was accurate. Regulators want transparency, accuracy and a big part of this is providing an audit trail so they can see where the data came from. They simply want businesses to follow their guidelines, the how you get from A to B is of little importance so long as the result is accurate. If anything, the existence of these tools will raise the bar of expectations from regulators, as businesses should be able to provide the required information with these tools readily available. [36:30] How can businesses utilise AI while still considering it’s environmental impact? – AI can certainly aid the sustainability industry in certain areas, such as reporting, but it’s a resource intensive tool. It consumes a lot of energy and water. Like with most emerging technology, the sustainability impact usually isn’t addressed until much later. Much like with mobile phones, which create tonnes of E-waste every year, not to mention the mined material required to make them. It’s factors like this which eventually get regulators involved to help reduce the overall harm caused. AI is yet to go through this evolution, but both regulator and consumer pressure is building to reduce the impact of AI. This will inevitably lead to innovation as companies seek to find more sustainable ways to cool data centres and reduce the resource burden. On the flip side, AI can help save energy in other ways, such as time taken to complete the tasks for a human, which will include travelling to an office and amount of time they use a device for the task. This also has its own carbon footprint, which can comparatively be reduced by using AI to complete the tasks in minutes as opposed to hours or days. The bottom line as of the start of 2026 is, we know there is a resource issue when it comes to AI, and companies are looking at better ways to address it as the technology develops. [42:20] Darayush’s advise to sustainability leaders looking to explore AI solutions – Identify a problem space where you can apply AI in a measured way an start using it. The only way you can find out how it impacts you is to use the technology. Currently, AI shines is areas such as collating data from multiple sources and locations, so if that’s an issue you’re tackling where sustainability reporting is concerned, that’s a good place to start with utilising AI. If you’d like to learn more about Pulsora, check out We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40149320
info_outline
#242 Surface Print – The Commercial Advantage of ISO 14001 for SME’s
02/11/2026
#242 Surface Print – The Commercial Advantage of ISO 14001 for SME’s
A Standard like ISO 14001 may seem more appropriate for large enterprises looking to address their environmental footprint, however it can apply to any business no matter the size. All businesses produce waste, and we can all do more to save energy, resources and money in the process. For some SME’s, tackling resource wastage through effective environmental management can make a huge difference. Such is the case for today’s guest, Surface Print, a family owned wallpaper manufacturer managed by its 4th generation. In this episode, Ian Battersby is joined by James Watson, Managing Director of Surface Print, to discuss why they implemented ISO 14001, the related resource challenges for SME’s seeking ISO Standards and benefits gained from certification. You’ll learn · Who is James? · Who is Surface Print? · Are there any other Standards Surface Print have to adhere to as a wallpaper manufacturer? · Did those other Standards help with understanding the process for ISO implementation? · What was the driver behind ISO 14001 implementation? · How long did it take them to achieve ISO 14001? · Have they considered any other ISO Standards? · What were the challenges for an SME seeking ISO certification? · What were the benefits of implementing ISO 14001? · How have Surface Print leveraged ISO 14001 in marketing and communications? · James’ top tip Resources · · · · In this episode, we talk about: [02:05] Episode Summary – Managing Director of Surface Print joins Ian to discuss their journey towards certification, the challenges involved with ISO implementation for SME’s and the benefits felt after certification. [03:25] Who is James Watson? James Watson is the Managing Director of Surface Print, a wallpaper factory that is a family-owned business based in Lancashire. Both he and he sister are the current directors, he 88 year old father is still involved within the business. They are the 4th generation in their family to be involved with wallpaper, starting with their great-grandfather, Walter Watson, who started the business all the way back in the 1880s! [04:35] Who are Surface Print? Surface Print operate in both analogue and digital printing, with 10 large analogue printing presses and 6 state-of-the-art HP digital presses. They have two elements to the company, with Surface Print handling 3rd party printing and white labelling for interior design brands. The second is , which is the original design branch that sells their designs worldwide. Surface Print are not a volume printer, they focused on high-quality manufacturing with a key focus on attention to detail. All the manufacturing occurs at the UK factory. Their typical clientele include the likes of John Lewis, Harrods and other high-end interior stores. Their 1838 Wall Coverings branch recently had a collaboration for the past 3 years with the Victoria and Abbot Museum in London, where they were allowed access to their archive for inspiration on designs. [07:35] Are there any other Standards Surface Print have to adhere to as a wallpaper manufacturer? Mainly it’s the Construction Products Regulation , which is specifically for construction products used in buildings. They also needed to get FSC certified as they were dealing with paper and wood pulp. [08:20] Did those other Standards help with understanding the process for ISO implementation? James quite honestly admits that no, none of the previous mandatory regulations helped with understanding the ISO process. As they understood that it was going to be quite the task, they outsourced help from Blackmores to assist with implementation. Alison Henshaw from our Team worked alongside Surface Print’s ISO committee to break down the Standard and offer valuable consultancy on aspects such as legislation. [09:05] What was the driver for ISO 14001 Implementation? Wallpaper manufacturing is very heavy waste. Analogue machines can have up to 10% - 20% waste per production order. With that much waste, it can quickly make the entire process very inefficient. There was also the spend on energy and gas to consider as all of those prices are increasing year-on-year. ISO 14001 could solve both of these issues while saving them a significant amount of money. [10:15] How long did it take Surface Print to achieve ISO 14001? In total, around 12 months. It would have been quicker, but there were some administration issues with the Certification Body that delayed the final Assessment. [11:55] Have Surface Print considered any other ISO Standards? As they’re only just into their first year of ISO 14001 certification, they’ve opted to stay focused on maturing that system before opting to go for any other Standards. [08:20] What were the challenges for an SME seeking ISO certification? Surface Print initially struggled with the administration side of ISO 14001, things like keeping on top of document and process updates, updating the legal register etc. This is where Blackmores Consultant Alison came in to bridge the gap and ensure they kept all the necessary paperwork up-to-date. They also needed more technical expertise in the area of environmental management. Their ISO committee weren’t ISO experts and so there was a gap of knowledge between understanding the ISO Standard and how to apply it to the business, which is where Alison helped once again to guide them on their journey. [13:35] What were the benefits of implementing ISO 14001? Their ISO 14001 certification affects every decision made. It’s not just about environmental management, it’s about managing your business as a whole. The Standards actively require leadership commitment, so it starts from the top down. It’s led to a more cohesive structure to making business decisions and thinking from a more environmental perspective. There have also been cost savings. Manufacturing in the UK is generally very expensive, so the more environmentally focused you can be results in savings on energy and resources. For example, Surface Print use a lot of electricity for both the machines and drying process involved in wallpaper manufacturing. They now measure their monthly energy usage against the rolls of wallpaper produced. They also installed solar panels which saved them a significant amount of electricity usage over the last year. They’re also investing in newer equipment to help with efficiency, making plans on how to reduce gas usage. It's also helped with their general business administration as documentation needs to be kept up-to-date. The whole process is now a lot more thorough, and has greatly improved their general monitoring and measurement processes. They also have confidence in their regulatory and legal compliance, as ISO Standards have this as a basic requirement. Many opt to use a Legal Register to help keep all this information in one location. Surface Print also found that they can answer client questions quicker due to the amount of documented information at their fingertips, this now includes more environmental based questions, which are cropping up more often. [18:35] How have Surface Print leveraged ISO 14001 in marketing and communications? Surface Print often get asked by potential brand clients ‘What’s the benefit of working with you?’, to which they can answer with a sustainability statement which lists all of the benefits. The first point of which is ISO 14001 certification, which is a globally recognised mark of effective environmental management. They ensure that their environmentally conscious stance is first and foremost in marketing and external communications. This is not done out of a forced obligation, Surface Print have chosen to do the right thing, which is becoming the norm. To not think about the environment, especially in high-waste industries, is generally frowned upon. [20:25] James’ top tip for those thinking about implementing an ISO Standard – ISO implementation can cost a fair amount up-front, but the cost saving benefits within a year can supersede that investment. You will see a lot of big improvements at the start, once your system matures you can expect to see those improvements slow in rate while still driving continual improvement at a steady pace. With the addition of effective monitoring and measurement, those improvements are quantifiable, so you can really see the results of your investment. [23:25] James’ book recommendation – Guinness Book of World Records [23:55] James’ favourite quote – “You can take a horse to water, but you can’t make it drink” If you’d like to learn more about Surface Print, check out We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/40071265
info_outline
#241 Raise your Game With The Leadership Powerup Gameplan
01/28/2026
#241 Raise your Game With The Leadership Powerup Gameplan
An ISO Management System can’t survive without Leadership engagement. It was seen as such an essential aspect that ‘Leadership commitment’ became a key requirement of many ISO Standards back in 2015 when the Annex SL format was adopted. It’s easy to see why. An effective Management System will provide vital information for top management to make decisions on processes, policies and strategic direction. So, how do you get leadership involved with your ISO management system? In this episode, Steph Churchman is joined by Sarah Ball, the Service Improvement Manager at Blackmores, to discuss why leadership involvement is so crucial to effective ISO management, and explains how you can get their buy in whether you’ve got a mature system or are newly implementing ISO Standards. You’ll learn · What is the isologyhub? · What issue is the Leadership Powerup tackling? · Who is the Leadership Powerup aimed at? · What are the six steps in the Leadership Powerup Gameplan? Resources · · · · In this episode, we talk about: [02:05] Episode Summary – Blackmores Service Improvement Manager joins Steph on this episode to talk about the crucial role leadership plays in ISO management, and how you can get the most out of their involvement. [00:45] What is the isologyhub? The isologyhub is our online learning platform for all things ISO. Its main feature is the ISO Roadmap, a 7-step guided approach to implementing your own bespoke compliant Environmental Management System. Since it’s creation, it’s grown to hold a library of over 200+ ISO related resources. The content available varies from quick accessible content such as ISO templates, ISO handbooks and short from video training we call Coffee Break Training which explain key elements of ISO Standards. This goes onto more in-depth content such as our ISO Pathways which take you through 3 levels of learning to help you progress from Learner to leader in your chosen subject area. There’s other exclusive content on there which you can dip into, including ISO templates, training videos and previous workshops covering topics such as ESG and AI management. We also have a number of Gameplans, which are essentially guides where people can work through a particular set of information about a topic and get practical guidance that can be applied within their own organisation. [02:05] What issue is the Leadership Powerup tackling? In the past, it was quite easy for leadership to lose interest in the Management System once it had been implemented. This was in part due to how Standards used to be written, and would result in the system being delegated to specific individuals. In 2015 this, along with a number of other issues, were addressed and a new clause structure was introduced. This means that Leadership Commitment now isn’t optional, as it’s a direct requirement of all ISO Standards (Clause 5 typically). The Leadership Powerup Gameplan aims to help leadership understand their role in making the Management System effective for the wider business. It helps to assess their current level of commitment and guides you through a path of improvement to get them to be a positive ambassador for the Management System. Where leadership is concerned, it’s important to remember that you’re leading by example. If you don’t care about the Management System, why should anyone else? For those that want more of a deep dive on Leadership’s role within ISO, check out a [06:05] Who is the Leadership Powerup aimed at?: As a minimum it should be the individual or team that have day-to-day responsibilities relating to the management system. Ideally you would also want a member of leadership, as you’ll need their input to gauge the current level of commitment. [06:50] What are the six steps in The Leadership Powerup?: Step 1: Evaluate Leadership – For this step it’s important that you’re 100% honest in your reflection of how leadership are currently promoting and engaging with the management system. It includes a workbook to help you self-score, though we recommend getting a team involved who can help shape a full perspective their engagement in reality. The included workbook also contains examples of key causes for a lack of leadership engagement. It walks you through the reasons for these causes, as it’s only through understanding why something is happening is when you can seek to resolve the issues. Step 2: Boosting Knowledge - This section works through what good looks like in terms of effective leadership commitment. You need to be able to understand the ideal end point before you can plan on how to get there. Included in this section are key definitions and videos that break down what good looks like for leadership commitment. Step 3: Planning Your Process – During this step you will plan on how to reach your end goal. By this point you will have assessed your current level of leadership commitment and you will have a good idea of what good looks like. Included in this step is another workbook that will guide your planning process to answer the following questions: · What do you want to achieve by the end of the Gameplan? · What does good leadership engagement look like for us specifically in this business? There’s also a helpful section on understanding how processes interact, which is a fundamental part of ISO management. It’s about how your business operates as one big system and not as siloed departments and processes. Having leadership understand that big picture so that they can communicate that impacts to certain teams does affect the whole business. Step 4: Deliver Data – This section is all about information. Leaders love data as it helps them to make informed business decisions. This step guides you through what sort of data you should be gathering and how it can be presented to leadership. This is crucial as it links back to one of the fundamentals of quality management, that being data-driven decision making. This could be in the form of customer feedback or employee feedback, or in other metrics such as health & safety incident etc. It’s all about making the most of this data. Step 5: Strengthening Strategy – It’s very important that your ISO management system . This is a key way that you can get leadership involved in the management system, as the business direction will already be a key focus for them. Ensuring the management system not only aligns but helps to facilitate that will ensure that it stays at the forefront of their minds. This step provides you with guidance on how to go about aligning leadership priorities and management system priorities. Step 6: Consolidating Compliance – This step is about ensuring that you are doing what you say you’re doing. The key part of leadership involvement includes leading by example, such as reviewing policies and updating them if they are no longer working for the business. It’s about continuous review and implementation of key feedback and communication of changes happening within the management system from top management down. This Gameplan can be useful for businesses where the Management System has been in place for a while and may not require their direct attention once certification has been achieved. In order to drive effective continual improvement, it’s key that they still keep that management system at the core of their activities. It can also be helpful when there is a change in leadership, and new individuals may not know what their level of involvement should be. If you’d like to become a member of the isologyhub, we have an exclusive 20% discount available for listeners, simply Contact Us and quote: Isologyhub20 to claim that discount. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39907840
info_outline
#240 Revitalise your Audits with the Audit Accelerator Gameplan
01/21/2026
#240 Revitalise your Audits with the Audit Accelerator Gameplan
Internal Audits are a key part of any ISO Implementation journey, they are also a necessary vehicle to drive continual improvement. For those with more mature ISO Management Systems, it can be easy for Internal Audits to become a bit of a rinse and repeat exercise. This can lead to stagnation of meaningful results, especially if you’re asking the same people the same questions year on year. So how can you revitalise the Audit process? In this episode, Steph Churchman is joined by Sarah Ball, the Service Improvement Manager at Blackmores, to discuss the challenges associated with repeated internal audits, and how you can refresh the process to ensure you get meaningful results to drive continual improvement. You’ll learn · What is an Isologyhub Gameplan? · What issue is the Audit Accelerator tackling? · Who is the Audit Accelerator aimed at? · What are the five steps in the Audit Accelerator Gameplan? Resources · · In this episode, we talk about: [02:05] Episode Summary – Blackmores Service Improvement Manager joins Steph on this episode to talk about the challenges many face when completing internal audits in an annual basis, and how these can be refreshed to ensure valuable output. [00:45] What is the isologyhub? The isologyhub is our online learning platform for all things ISO. Its main feature is the ISO Roadmap, a 7-step guided apprach to implementing your own bespoke compliant Environmental Management System. Since it’s creation, it’s grown to hold a library of over 200+ ISO related resources. The content available varies from quick accessible content such as ISO templates, ISO handbooks and short from video training we call Coffee Break Training which explain key elements of ISO Standards. This goes onto more in-depth content such as our ISO Pathways which take you through 3 levels of learning to help you progress from Learner to leader in your chosen subject area. There’s other exclusive content on there which you can dip into, including our full workshop recordings which have covered topics such as utilising ISO Standards for ESG compliance, how to integrate ISO Standards and how to complete an AI impact Assessment. [02:10] What is an isologyhub Gameplan? Gameplans have been designed to be actionable pieces of content within the Isologyhub. They are guides where people can work through a particular set of information about a topic and practical guidance that can be applied within the own organisation. Each game plan is structured around a kind of area that is quite commonly a difficult area for many organisations managing ISO Standards. Each Gameplan also includes a number of Workbooks to help you through each step, whether as an individual or as part of a team. [04:00] What issue is the Audit Accelerator tackling? internal audits are a fundamental part of any ISO management system, but it's also something that can get a little bit stale when you've had a management system for a while. It can tend to feel a little bit like a rinse and repeat exercise where you're having similar conversations with the same people about the same processes, which isn’t what internal audits should be. The reason they're in the standards in the first place, is to help push continual improvement. For example, if you've got a quality management system, you’ll be looking to ensure that processes are being followed, but also where there are opportunities to improve. This is where a lot of people drop the ball in mature systems. Internal Audits can be intimidating for some, and can be rushed as just something that needs to get done. But by rushing them, by not talking the proper time to speak to different individuals, you are missing out on valuable information that can ultimately help you improve your services and way of working. The Audit Accelerator Gameplan was designed to help you to really get the most out of those internal audits, give the process a bit of a refresh and rethink how you're approaching your audit planning. It also provides guidance on how you can get better engagement from the wider business with audits. Refreshing the process will help you to gain new perspectives, and ensure that internal audits becomes a positive experience that everyone can engage with, no matter what level they are at within the business. [08:15] Who is the Audit Accelerator aimed at?: The person who's responsible, or personal team who is responsible for coordinating the internal audit plans within an organisation. It's aimed at those so that they can help the wider business to understand what audits are about, and also so that they can also look at how they're planning audits. [09:15] What are the five steps in The Audit Accelerator?: Step 1: Check – This step helps you to assess where you currently are with your Audit Program. It includes a workbook with a checklist that you can work through, this will give you a score to indicate how well you’re doing and where you can improve. It asks questions such as: · How effective are the audits that you're doing in your business? · Are there areas that you could perhaps make improvements? Step 2: Challenging Assumptions - This step provides information about what the purpose of internal audits are, why people have misconceptions about them, what some of the common fears and concerns are about audits, so that you can start addressing them within your business. This can include simply talking to your colleagues in a more positively framed way about Internal Audits. Another suggestion is changing the name ‘Internal Audit’, especially if it has negative connotations within the business. The Standard doesn’t say they have to be called anything, as long as you’re asking people about how things are done, ensuring processes are being followed and allowing people to suggest improvements, the way you go about doing to (including the name) can be done in whatever way works best for your business. This step also includes the main workbook that you will work through for the rest of the steps. Step 3: Change It Up – This sections includes a few different videos about different ways of planning audits and different ways of explaining audits to your colleagues so that they feel a little bit more comfortable about them and understand the benefits and real opportunities that come from participating in audits as well. Step 4: Collaboration – This step stresses that it’s really important that Internal Audits is not something driven solely by just one person. Everyone has a positive part to play in the process. This includes Management, as they need to hear audit feedback and make changes where required. This helps to show that audits drive meaningful change, and should encourage everyone to have their say. So, this step is really about making sure that management, audit planners and auditees understand their role in the process. Step 5: Check Again – This involved going back to that initial assessment of where you were when you started the Gameplan, and reassessing after you've implemented some of these improvements through the improvement workbook and seeing if you have moved the goalpost from that initial assessment. Hopefully you’ll have a much higher score to show how much you’ve progressed after following the Gameplan steps. If you’d like to become a member of the isologyhub, we have an exclusive 20% discount available for listeners, simply Contact Us and quote: Isologyhub20 to claim that discount. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39810180
info_outline
#239 2025 ISO Standard Wrap Up and Looking Ahead
12/17/2025
#239 2025 ISO Standard Wrap Up and Looking Ahead
It’s been a busy year for ISO Standards, with that set to ramp up in 2026 thanks to upcoming Standard transitions. Before we dive into a new year, we’d like to take a step back and highlight some of the key ISO milestones from 2025. In this episode, Steph Churchman, Communications Manager at Blackmores, looks back at the major Standard updates from 2025, including changes to existing Standards, new ISO’s published and key upcoming changes you need to be aware of for 2026. You’ll learn · What ISO Standards have been updated in 2025? · What new ISO Standards were published in 2025? · What Standards are due to be published in 2026? · What ISO transitions do you need to be aware of in 2026? Resources · In this episode, we talk about: [02:05] Episode Summary – Steph reviews major ISO Standard updates from 2025, including changes to existing ISO Standards, new Standards published and what you need to know going into 2026. [02:34] What ISO Standards have been updated in 2025?: :2025: This is the Standard for Privacy Information Management and it recently received an update in October 2025. Key updates to this Standard include: · This is now a stand-alone Standard and can be implemented without an existing ISO 27001 ISMS in place. · The addition of further guidance for data processors and controllers. · Provides greater clarity on managing personal data within AI and digital ecosystems · More focus on organisational leadership involvement. · The update now aligns ISO 27701 more closely with global regulations such as GDPR, CCPA and LGPD. :2025, the Standard for Anti-bribery. This one was well overdue an update, with its last version being 2016! It’s update arrived on 2nd Feb 2025, and included: - · Text harmonisation with the other ISO 37000 family of Standards, such as ISO 37301 (compliance management systems), ISO 37000 (governance of organisations) and ISO 37008 (internal investigations of organisations) to ensure consistency and easier integration. · The latest version now formally introduces the concept of anti-bribery culture and emphasises its importance for the effectiveness of the management system. · A greater emphasis on the role of top management and their involvement in overseeing the management system. · A new requirement has been added for awareness and training as fundamental asset for management system results. · It also receives the added climate change amendment, which many ISO’s already embedded back in 2024 – learn more about that here. · And lastly, there’s more comprehensive definitions of conflict-of-interest as well as procedures to raise awareness on reporting potential and actual conflicts. ISO 50002, the standard for energy audits. This isn’t a certifiable standard, but rather a guidance document to support the energy management standard ISO 50001. The recent update has now split this Standard into 3 parts: · : General requirements with guidance for use. · : Guidance for conducting an energy audit in buildings. · : Guidance for conducting an energy audit in processes Most of the revisions focused on strengthening and adding further clarification to energy auditing principles such as Competency, Confidentiality, Objectivity, access to equipment, resources and information, Evidence-based approach and Risk-based approach Lastly, this update also clearly specifies the requirements for energy auditor competence. [07:10] What new ISO Standards were published in 2025? ISO 42006 - Requirements for bodies providing audit and certification of artificial intelligence management systems. This is a guidance Standard that actually relates to certification bodies rather than businesses choosing to implement . It builds on ISO 17021-1 and ensures that certification bodies operate with the competence and rigour necessary to assess organisations developing, deploying or offering AI systems. While one that you as a business may not have to worry about, it’s a positive addition to the growing ISO 42000 family of Standards, which are currently the only global frameworks for best practice for AI Management. Biodiversity - Considering biodiversity in the strategy and operations of organizations. ISO 17298 ultimately aims to help organizations of all types and sizes understand how they depend on and impact nature – and take concrete action to address it. It includes guidance to help you: · Understand your biodiversity impacts, dependencies and risks · Identify opportunities for green growth and nature-positive finance · And develop and implement a credible biodiversity action plan [09:45] What new ISO Standards are due to be published in 2026? ISO 53001 management system requirements for the United Nations Sustainable Development Goals. Many businesses have already done the hard work behind aligning their ESG activities with the UN SDG’s, and will soon be able to benefit from certification to an internationally recognised Standard to help manage and improve their performance against those SDG goals. The Standard provides a framework for an SDG management system that will: · Enhance the organization’s SDG performance. · Fulfil compliance obligations. · Achieve selected SDG objectives. · Create trust and confidence to relevant existing and future stakeholders If you wanted to get a head-start, the guidance document ISO 53002: Guidelines for contributing to the United Nations Sustainable Development Goals is available to ISO 14060: Net Zero Aligned Organisations. This Standard details requirements for how any type of organization can demonstrate that their net zero strategy is achievable, and that they are making credible and verifiable progress towards contributing to global net zero in line with the Paris Agreement. There are a lot of country specific legislation and regulations now in effect, or soon to be in effect, but there is a lack of clarity around what it actually means to be Net Zero. This is where ISO 14060 comes in, to create a globally accepted definition of what it means for an organisation to be net zero. In addition, this Standard will also: · Define what constitutes a credible net zero strategy at an organisational level · Establish how targets should be set, measured and delivered · Require organisations to align with the goals of the Paris Agreement · Build on existing ISO standards such as ISO 14064 for GHG verification and ISO 14068-1 for Carbon Neutrality · Have a focus on organisational claims, not product or event-level claims · And lastly it will be globally applicable and adaptable across sectors. [12:50] What ISO Standard updates do you need to be aware of for 2026?: The anticipated update to the leading environmental management system Standard, , is expected to be published in Q1 of 2026. It doesn’t appear to have many major changes, but rather just further guidance and clarification in a few areas, including: · Modernised terminology and harmonised structure that aligns with other ISO Standards · Stronger focus on environmental conditions · Clearer EMS scope with life-cycle perspective · Again, we see a greater focus on leadership accountability · Refined risk-based planning · Introduction of a new change-management clause · Extended operational control to suppliers · Restructured management review · And an expanded Annex A for explanatory notes is also due a revision. It was expected out around a similar time as ISO 14001, but following its public comment round, it’s gone back under revision to make more changes after that feedback. As a result, this has pushed the expected publication date to either Q3 or possibly even Q4 of 2026. Now despite it going back into revision following feedback, the changes are still expected to be minor. Some of the expected changes include: · Impact of digital transformation – such as AI · Improved supply chain resilience · Proactive risk management and risk-based thinking · Quality culture and awareness of ethical behaviors · And increased attention to customer satisfaction Looking even further forward, will also be up for revision soon, though that isn’t expected to be published until 2027. We’ll give you more details as soon as a draft version has been made available. All of these transitions will include a 3-year grace period, so there’s no need to panic. Over the next year, we’ll cover these changes in more detail, and will provide a variety of ISO Support options to help you manage and complete your ISO transitions. That’s it from us for 2025! We look forward to brining you more ISO knowledge in 2026 😊 We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39437920
info_outline
#238 Umony's ISO 42001 Journey - Setting the Standard for effective AI Management
12/12/2025
#238 Umony's ISO 42001 Journey - Setting the Standard for effective AI Management
AI has become inescapable over the past years, with the technology being integrated into tools that most people use every day. This has raised some important questions about the associated risks and benefits related to AI. Those developing software and services that include AI are also coming under increasing scrutiny, from both consumers and legislators, regarding the transparency of their tools. This ranges from how safe they are to use to where the training data for their systems originates from. This is especially true of already heavily regulated industries, such as the financial sector. Today’s guest saw the writing on the wall while developing their unique AI software, that helps the financial sector detect fraud, and got a jump start on becoming accredited to the world’s first best practice Standard for AI, ISO 42001 AI Management. In this episode, Mel Blackmore is joined by Rachel Churchman, The Global Head of GRC at Umony, to discuss their journey towards ISO 42001 certification, including the key drivers, lessons learned, and benefits gained from implementation. You’ll learn · Who is Rachel? · Who are Umony? · Why did Umony want to implement ISO 42001? · What were the key drivers behind gaining ISO 42001 certification? · How long did it take to implement ISO 42001? · What was the biggest gap identified during the Gap Analysis? · What did Umony learn from implementing ISO 42001? · What difference did bridging this gap make? · What are the main benefits of ISO 42001? · The importance of accredited certification · Rachel’s top tip for ISO 42001 Implementation Resources · · In this episode, we talk about: [02:05] Episode Summary – Mel is joined by Rachel Churchman, The Global Head of GRC at Umony, to explore their journey towards certification. [02:15] Who is Rachel?: Rachel Churchman is currently The Global Head of GRC (Governance, Risk and Compliance) at Umony, however keen listeners to the show may recognise her as she was once a part of the Blackmores team. She originally created the ISO 42001 toolkit for us while starting the Umony project under Blackmores but made the switch from consultant to client during the project. [04:15] Who are Umony? Umony operate in the financial services industry. For context, in that industry every form of communication matters, and there are regulatory requirements for firms to capture, archive and supervise all business communications. That covers quite a lot! From phone calls, to video calls, instant messaging etc, and failures to capture that info can lead to fines. Umony are a compliance technology company operating within the financial services space, and provide a platform that can capture all that communications data and store that securely. [05:55] Why did Umony embark on their ISO 42001 journey? Umony have recently developed an AI platform call CODA, which uses advanced AI to review all communications to detect financial risks such as market abuse, fraud or other misconduct. This will flag those potential high-risk communications to a human to continue the process. The benefit of this is that rather than financial institutions only being able to monitor a very small set of communications due to it being a very labour intensive task, this AI system would allow for monitoring of 100% of communications with much more ease. Ultimately, it’s taking communications capture from reactive compliance to proactive oversight. [08:15] Led by industry professionals: Umony have quite the impressive advisory board, made up of both regulatory compliance personnel as well as AI technology experts. This includes the likes of Dr.Thomas Wolfe, Co-Founder of , former Chief Compliance Officer at and the CEO of the . [09:00] What were the key drivers behind obtaining ISO 42001 certification? Originally, Rachel had been working for to assist Umony with their transition back in early 2024. At the time, they had just started to develop their AI platform CODA. Rachel learned about what they were developing and mentioned that a new Standard was recently published to address AI specifically. After some discussion, Umony felt that ISO 42001 would be greatly beneficial as it took a proactive approach to effective AI management. While they were still in the early stages of creating CODA they wanted to utilise best practice Standards to ensure that the responsible and ethical development of this new AI system. When compared to ISO 27001, ISO 42001 provided more of a secure development lifecycle and was a better fit for CODA as it explores AI risks in particular. These risks include considerations for things like transparency of data, risk of bias and other ethical risks related to AI. At the time, no one was asking for companies to be certified to ISO 42001, so it wasn’t a case of industry pressure for Umony, they simply knew that this was the right thing to do. Rachel was keen to sink her teeth into the project because the Standard was so new that Umony would be early adopters. It was so new, that certification bodies weren’t even accredited to the Standard when they were implementing the Standard. [12:20] How long did it take to get ISO 42001 certified? Rachel started working with Anna Pitt-Stanley, COO of Umony, around April 2024. However the actual project work didn’t start until October 2024, Umony already had a fantastic head start with ISO 27001 in place, and so project completion wrapped up around July of 2025. They had their pre-assessment with in July, which Rachel considered a real value add for ISO 42001 as it gave them more information from the assessors point of view for what they were looking for in the Management System. This then led onto Stage 1 in August 2025 and Stage 2 in early September 2025. That is an unusually short period of time between a Stage 1 & 2, but they were in remarkably good shape at the end of Stage 1 and could confidently tackle Stage 2 in quick succession. The BSI technical audit finished at the end of September, so in total from start to finish the Implementation of ISO 42001 took just under 12 months. [15:50] What was the biggest gap identified during the Gap Analysis? A lot of the AI specific requirements were completely new to this Standard, so processes and documentation relating to things like ‘AI Impact Assessment’ had to be put in place. ISO 42001 includes an Annex A which details a lot of the AI related technical controls, these are unique to this Standard, so their current ISO 27001 certification didn’t cover these elements. These weren’t unexpected gaps, the biggest surprise to Rachel was the concept of an AI life cycle. This concept and its related objectives underpin the whole management system and its aims. It covers the utilisation or development of AI all the way through to the retirement of an AI system. It’s not a standalone process and differs from ISO 27001’s secure development life cycle, which is a contained subset of controls. ISO 42001’s AI life cycle in comparison is integrated throughout the entire process and is a main driver for the management system. [19:30] What difference did bridging this gap make? After Umony understood the AI life cycle approach and how it applied to everything, it made implementing the Standard a lot easier. It became the golden thread that ran through the entire management system. They were building into an existing ISMS, and as a result it created a much more holistic management system. It also helped with the internal auditing, as you can’t take a process approach to auditing in ISO 42001 because controls can’t be audited in isolation. [21:30] What did Umony learn from Implementing ISO 42001? Rachel in particular learned a lot, not just with ISO 42001 but with AI itself. AI is new to a lot of people, herself included, and it can be difficult to distinguish what is considered a risk or opportunity regarding AI. In reality, it’s very much a mix of the two. There’s a lot of risk around data transparency, bias and data poisoning as well as new risks popping up all the time due to the developing technology. There’s also a creeping issue of shadow IT, which is where employees may use hardware of software that hasn’t been verified or validated by the company. For example, many people have their own Chat GPT accounts, but do you have oversight of what emplyees may be putting into that AI tool to help with their own tasks? On a more positive note, there are so many opportunities that AI can provide. Whether that’s productivity, helping people focus more on the strategic elements of their role or reduction of tedious tasks. Umony is a great example of where an AI has been developed to serve a very specific purpose, preventing or highlighting potential fraud in a highly regulated industry. They’re not the only one, with many others developing equally crucial AI systems to tackle some of our most labour-intensive tasks. In terms of experience with Implementing ISO 42001, Rachel feels it cemented her opinion that an ISO Standard provides a best practice framework that is the right way to go about managing AI in an organisation. Whether you’re developing it, using it or selling it, ISO 42001 puts in place the right guardrails to make sure that AI is used responsibly, ethically, and that people understand the risks and opportunities associated with AI. [26:30] What benefits were gained from Implementing ISO 42001? The biggest benefit is having those AI related processes in place, regardless of if you go for certification. Umony in particular were keen to ensure that their certification was accredited, as this is a recognised certification. With Umony being part of such a regulated industry, it made sense that this was a high priority. As a result, they went with BSI as their Certification Body, who were one of the first CB’s in the UK to get IAF accredited, quickly followed by UKAS accreditation. [27:55] The Importance of accredited certification: Sadly, a new Standard creates a lot of tempting offers from cowboy certification bodies that operate without a recognised accreditation. They will offer a very quick and cheap route to certification, usually provided through a generic management system which isn’t reflective of how you work. Their certificate will also not hold up to scrutiny as it’s not accredited with any recognisable body. For the UK this is UKAS, who is the only body in the UK under the IAF that is able to certify companies to be able to provide a valid accredited certificate. There’s are easily available tools to help identify if a certificate is accredited or not, so it’s best to go through the proper channels in the first place! Other warning signs of cowboy companies to look out for include: · Off the shelf Management system provided for a fee · Offering of both consultancy and certification services – no accredited CB can provide both to a client, as this is a conflict of interest. · A 5 – 10 year contract It’s vital that you use an accredited Certification Body, as they will leave no stone unturned when evaluating your Management System. They are there to help you, not judge you, and will ensure that you have the upmost confidence in your management system once you’ve passed assessment. Umony were pleased to have only received 1 minor non-conformity through the entire assessment process. A frankly astounding result for such a new and complex Standard! [32:15] Rachel’s top tip: Firstly, get a copy of the Standard. Unlike a lot of other Standards where you have to buy another Standard to understand the first one, ISO 42001 provides all that additional guidance in its annexes. Annex B in particular is a gold mine for knowledge in understanding how to implement the technical controls required for ISO 42001. It also points towards other helpful supporting Standards as well, that cover aspects like AI risks and AI life cycle in more detail. Rachel’s second tip is: You need to scope out your Management System before you start diving into the creation of the documentation. This scoping process is much more in-depth for ISO 42001 than with other ISO Standards as it gets you to understand your role from an AI perspective. It helps determine whether you’re an AI user, producer or provider, it also gets you to understand what the management system is going to cover. This creates your baseline for the AI life cycle and AI risk profile. These you need to get right from the start, as they guide the entire management system. If you’ve already got an ISO Standard in place, you cannot simply re-use the existing scope, as it will be different for ISO 42001. If you’re struggling, CB’s like BSI can help you with this. [35:20] Rachel’s Podcast recommendation: with Stephen Bartlett. [32:15] Rachel’s favourite quote: “What’s the worst that can happen?” – An extract from a course, where the full quote is: “First ask yourself what is the worst that can happen? Then, you prepare to accept it and then proceed to improve on the worst.” If you’d like to learn more about Umony and their services, We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39380415
info_outline
#237 Gap Analysis – The First Step In ISO Implementation
11/26/2025
#237 Gap Analysis – The First Step In ISO Implementation
When embarking on your ISO journey, a crucial first step is evaluating your current level of compliance and identifying what gaps need to be filled to gain certification or fully align with a Standard. This is typically done by conducting a Gap Analysis. This exercise sets the foundations for your ISO Implementation project, from setting key actions and objectives, to resourcing and establishing a project timeline. In this episode, Ian Battersby dives into the purpose of a Gap Analysis, who should be involved in the exercise and what inputs and outputs you should expect to have from conducting a Gap Analysis. You’ll learn · What is a Gap Analysis? · What is the aim of a Gap Analysis? · What is the process of conducting a Gap Analysis? · Who should be involved in a Gap Analysis? · What inputs should be included in a Gap Analysis? · What outputs can you expect from a Gap Analysis? Resources · In this episode, we talk about: [02:05] Episode Summary – Ian Battersby dives into the first step on any ISO Implementation journey, breaking down what a Gap Analysis is, it’s purpose and what you should expect to get out of conducting one. [02:50] What is a Gap Analysis?: Simply put, it’s the start of the process. It’s a key to understanding where an organisation is right now and establishing what it needs to do on its journey to ISO certification. But it’s not just for certification, as certification isn’t always what people are trying to achieve. Many businesses opt to align themselves to a standard to ensure they’re doing the right thing, but may not go through with full certification. [04:05] Who is the aim of a Gap Analysis? The objective of a Gap Analysis is to carry out a review of your organisation against the requirements of the respective standard. This will help to establish the following: · Areas where you conform to the standard, where you may have established the required processes, procedures, roles, responsibilities, systems, methods, documents · Areas of nonconformity, where such things will need to be developed · You may partly conform, so it’s important to understand that as well From that understanding, you can build key actions, timescales and responsibilities for implementing an ISO Standard. It’s also very useful to leadership; to clarify what’s needed, to look at priorities, to resource what’s required and to establish a timeline to your end goal. [06:25] What is the process of conducting a Gap Analysis? It’s important to do this in a very structured manner. It’s also important to get access to existing documentation and personnel in key roles; they’ll be helpful during the gap analysis in providing understanding. You’ll need to evaluate your current level of compliance against the following clauses within your desired ISO Standard(s): 4 Context: Understanding the world in which you operate, the people and organisations which are important to you. This is where you will determine the scope of your system (what to include, what parts of the standard are relevant). 5 Leadership: Top management’s commitment, how involved they are, their accountability and their commitment to resourcing, promoting, to giving people authority through clear roles and responsibilities. 6 Planning: This is about assessing risks and opportunities; understanding the uncertainty caused by your operating environment (context). It also involves setting objectives and then establishing meaningful plans to address the risks/opportunities and objectives; mitigations; establishing controls; operational processes. 7 Support: This is where you look at people, competence Infrastructure and environment (are your facilities/equipment appropriate to what you need to do). You will also need to identify what you need to monitor and measure to demonstrate the effectiveness of your ISO Management System. Next, you need to cover awareness and communication, i.e. how do you make people aware of your system, policy, processes; what do you tell other interested parties? Lastly, ensure you address how you control the documentation which supports your system. 8 Operation: This address the delivery of a product or service to the customer, including all the processes for doing so. For example, this clause defines what’s required when designing, developing, controlling externally provided products/services and controlling anything which goes wrong. This is typically the clause that contains the largest difference between ISO Standard, with each one focusing requirements on it’s topic focus. For example, includes requirements for emergency preparedness and response in the event of an environmental incident. 9 Performance evaluation: This is where you review and report on the results of the monitoring and measurement that you’ve put in place. For those familiar with ISO, this is where the internal audit and management review requirements sit. 10 Improvement: This clause states requirements for addressing any non-conformities that pop-up during your Internal Audits. It also encourages you to address opportunities for improvement to help drive continual improvement and innovation. [13:50] Who should be involved in a Gap Analysis? One key myth that we’d like to clear up is that not everyone in the business needs to be involved in this process, however, we do recommend the following are included: The person responsible for the day-to-day running of the Management System. This may not be known at this early stage, which is fine as the purpose of the Gap Analysis is to identify gaps such as this. Leadership; someone in a senior role; responsible for resourcing the system, communicating its importance to the workforce; responsible for setting the strategic direction and objectives. People who understand the context of the organisation; understanding interested parties (stakeholders); needs of customers and others; the regulatory environment Those involved in risk management; operational, financial, commercial, regulatory, safety or environmental. Someone with knowledge of the legal requirements and how they’re evaluated; relative to specific standard. Anyone setting objectives related to the specific standard. Those with knowledge of competence arrangements; not just those responsible for co-ordinating the Management System, but across the board, for delivering operational processes. Those responsible for facilities and equipment; maintenance, service, test, inspection, etc. People responsible for developing and delivering operational processes. People with knowledge of how things are monitored or measured; possibly operations people, data analysis or those who report performance to management. Those who control nonconformity and those who run improvement processes. It can be quite a range of people! However, in smaller organisations there may be quite a limited number who likely wear many hats. Again, that’s not a problem, as the Gap Analysis exists to discover that. [21:55] What inputs should be included in a Gap Analysis? This can include a number of things, as not everything will necessarily be a document. Typically, we as consultants will look at: · Management System manual or System Scope · Organisational chart · Mission, vision, values and culture · SWOT/PESTLE and Interested Parties · Policy relevant to the standard · Job descriptions · Risk and opportunities analysis; methodology · Objectives · Legislation register and methods of evaluation · Competence arrangements, training records · Management System awareness, training completion · Details of version and document control in place · Monitoring and measuring plans (KPIs, SLAs, internal performance metrics) · Internal audit programme and audit reports · Management review records · Agendas for any regular management meetings · Nonconformities, incident report and corrective action records · Customer complaints/feedback · Emergency Plans · Process Documentation · Examples of process documentation: · Change control documentation · Sales, tendering, order processing · Procedures for the design and development of products and services · Design and development records stating inputs, verification and validation activities, outputs, and approval of changes · Procedures to approve products and services for release to customers including quality checks · Supplier / third party evaluation and onboarding documents · Non-conformity/complaint information · Traceability documentation [29:40] What is the output from a Gap Analysis? We look at all of this and compare it against the requirements of the Standard to see where you currently stand. In our case, we do this on a spreadsheet with a simple scoring system to give you an overview of what you already have in place and what needs to be addressed. In many cases, businesses already have a lot of the required documentation, but don’t have it tied together in one cohesive system. So a large part of implementation is consolidating that existing documentation, process ect. Into an accessible and easily understood system. The key thing to remember is that this is not an audit. The evidence required does not have to be as detailed as an audit; some things can be taken on trust or face value. At this stage we aren’t demonstrating anything to a certification body, and you are not being judged. We are simply looking at what needs to be done to achieve full Implementation or certification. If you’d like assistance with carrying out a Gap Analysis, , we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39178465
info_outline
#236 Taking Data Complexity From Spreadsheets To Supply Chains With Pulsora
11/19/2025
#236 Taking Data Complexity From Spreadsheets To Supply Chains With Pulsora
One of the common pain points when calculating your carbon emissions is simply gathering the data. When collating data from different departments and suppliers, it can be easy to get overwhelmed. The struggle doesn’t stop there, as after obtaining all that data you have to find the best way to capture and display it in a way that’s useable for the necessary number crunching. Many will turn to an old favourite, spreadsheets, but these can quickly become very unwieldy and impractical if you’ve got a lot of data to process. Thankfully, there’s a lot of new tech and tools available to help make this task both approachable and integrated within your business. In this episode, Mel Blackmore is joined by Jessica Matthys, Lead Product Manager at Pulsora, to discuss how you can take data complexity from spreadsheets to supply chains, diving into data fragmentation, optimisation and how this can all be balanced for practicality. You’ll learn · Who is Jessica Matthys? · Who are Pulsora? · What does data complexity mean in the context of carbon accounting? · What are the requirements for CSRD in California? · What are the biggest pain points relating to data collection? · How can you prevent data fragmentation across your business? · What does ‘Comprehensive data’ mean in the context of sustainability? · How can Pulsora help a business take their carbon data from spreadsheets to integrated data systems? · How can you make you carbon data more auditable and traceable? · How can new carbon focused technology, such as AI tools, help with seeking investment? · How can you get information from your supply chain to cover scope 3 emissions? Resources · · · & · In this episode, we talk about: [00:25] Episode Summary – Mel Blackmore is joined by Jessica Matthys, Lead Product Manager at Pulsora, to explore how you can take data complexity from spreadsheets to supply chains, diving into data fragmentation, optimisation and how this can all be balanced for practicality. [01:40] Who is Jessica Matthys: Is the Lead Product Manager for carbon solutions at Pulsora. She’s been with Pulsora for a year and a half, but has worked within the ESG / carbon / sustainability space for over 8 years in total. Something that people might not know about Jessica is that her passion for sustainability started much earlier than her working career, starting in high school where she opted to live on a farm for one semester. That unique experience of working closely with nature and animals set her on the path that she still walks today. [02:30] Who are Pulsora? Pulsora is an end to end sustainability management AI powered platform. They can manage anything from data collection and carbon accounting all the way towards ESG reporting and audit support. The focus of their platform is auditability and transparency . [04:40] What does data complexity mean in the context of carbon accounting? Jessica breaks this down into three main elements: Disparate nature of data – When compiling data for greenhouse gas accounting, you have to take a lot into consideration including your own production and consumption in addition to all the upstream and downstream relationships across your value chain. The data for all of this will be scattered and will need to be brought together in order to get a full comprehensive view of your emissions data. Missing primary data – Some data may be very difficult to obtain, say from a supplier in a remote region, so in those cases you may need to make estimations to fill those gaps. However, you need to establish a proven and trusted methodology that can be repeated for such instances. Auditability and transparency – Your data needs to be robust enough to hold up to scrutiny in an audit. New and upcoming regulatory requirements will have stricter rules around how you collect and report your emissions. We can see this in regulations such as and within CSRD that will affect businesses in California. There’s a new focus on mandatory reporting as opposed to voluntary, so you will need to ensure your data is in a good place to be audited when this starts to effect other organisations globally. [07:30] What are the requirements for CSRD in California? There are two main climate bills coming into effect in California in 2026, these are SB-253 and SB-261, which are supported by CARB (California Air Resources Board). These two regulations affect businesses who are either doing business in, have employees located in, or selling products over a certain revenue threshold in California. Affected businesses will be required to report on their scope 1, 2 and 3 emissions. There isn’t anything new in these regulations that we haven’t already seen in other European focused requirements, aside from the mandatory element. The first deadline for this reporting is expected to be due by June 2026, and this first year they will only be expecting reports for your scope 1 and 2 data. SB-261 has a slightly different focus, with it requiring climate risk reporting. This is similar to existing frameworks like or . This report can be published publicly and you just need to submit a link to that report to the appropriate bodies in California. The deadline for this one is fast approaching, with it being set at 1st January 2026. [11:10] What are the biggest pain points relating to data collection?: Jessica shares an example of a company that came to Pulsora with a spreadsheet that they dubbed ‘the monster spreadsheet’ that contained 100+ tabs with hundreds of people adding to it. It got to the point where it was always crashing and simply became a burden to use. It’s a fairly common story, though maybe not to this extreme, that companies find they quickly outgrow spreadsheets as a form of manual data collection. There is also the question of the quality of data provided, how can they trust the insights gained from the data provided from so many different sources? At Pulsora, they’ve made use of AI within their platform that can help bring all that data together and analyse it to identify any anomalies and duplicated data. They’ve also focused on creating collaborative workflows, so all communications regarding collection of emissions data can be kept under one roof, meaning you have a fully traceable and auditable trail for all data collected. [15:10] How can you prevent data fragmentation across your business? Pulsora have made use of AI to prevent data fragmentation, they have achieved this with agentic AI, which is AI that can coordinate between different paths and can make decisions without a human in the loop. A use case for this might be where you have a company with thousands of suppliers, but would only be able to get emissions data from the handful of long-term suppliers that are happy to work with them. AI can assist with the remaining suppliers by looking for any published information those suppliers have, and take that emissions and financial data to create an intensity factor for the supplier. This can then make an informed estimate for how many emissions equate from so much spend with that supplier. The AI will of course keep a trail for all it’s sourced data so a human can review this and ensure the information is correct if needed. [18:45] What does ‘Comprehensive data’ mean in the context of sustainability? When gathering emissions data, a business has to consider what part of its operations creates the most emissions. This will differ depending on the sector and nature of your business. Whether you’re a B2B business or a manufacturer, you need to confirm where your largest emissions source. It’s imperative that your emissions inventory is reflective of your business and its impact. There will also be gaps in the data you want / need to collect. You still need to ensure that data in any reporting provided is reflective of your operations, you can’t just leave that data out, especially as there are now tools to help fill those gaps. AI for example can identify representative data to help bridge those gaps to provide a comprehensive inventory. [22:35] How can Pulsora help a business take their carbon data from spreadsheets to integrated data systems?: Jessica uses a company, Franklin Templeton, to explain the process. In this case, the company is a global asset manager and they used Workday for a lot of their HR, procurement and financial data. When it came to collating emissions data, they didn’t realise that 95% of the information needed was already stored in Workday. For other companies that are quire energy intensive, there’s a high chance that you already have a comprehensive system with most of the data required. In Franklin Templeton’s case, they helped them to transfer this over into the Pulsora system with an existing out-of-the-box migration tool for Workday. For the HR data Pulsora were able to assist with ESG reporting. The Pulsora system was able to apply emissions factors to the transferred data automatically, which helped to create a comprehensive view of their scope 1, 2 and 3 emissions. Jessica give another example for a glass manufacturing company called Seagen who are based in Turkey. While they didn’t have the monster spreadsheet situation, they had a fairly good system in place but it wasn’t quite reaching the mark in terms of being able to report against multiple different carbon frameworks. Pulsora’s system help to quantify their data, quite a task in of itself due to how high their emissions were, and it also helped to apply all this gathered data to those carbon frameworks. They also utilised Pulsora to help gather various metrics from 7 business units across 100 sites, that aided in audit preparation and insurance. [29:00] How can you make you carbon data more auditable and traceable?: If you’re just starting out on your emissions journey, we highly recommend looking to the GHG protocol for guidance on the scope 1,2 and 3 definitions and what’s required of each for reporting. The first step you should take is to determine what scopes and categories are relevant to your business according to the GHG protocol. There are a few different approaches including a percentage based approach or ones that include more detailed data analysis. The second step is emission factors, which is essentially a process of taking your business activities and translating that into emissions. You need to establish a consistent approach to documenting these emission factors, and those emissions factors will be determined by your region. UK for example use factors, the US have and Europe uses . There are global data sets available as well, such as . The main key is establishing your methodology early on, and be consistent in your approach while documenting everything in line with that agreed methodology. For a more structured approach to carbon emissions reporting, that includes auditability and traceability at it’s core are ISO Standards such as and . [32:45] How can new carbon focused technology, such as AI tools, help with seeking investment? Jessica shares a sneak peak into a new feature that Pulsora have recently released to help with seeking investment, which is invoice reading. This feature allows users to upload invoices to the Pulsora system, and it will extract the required data without the need for manual input. This aids in the auditability and traceability within the system as this data is displayed right alongside the evidence it was extracted from. The system can also compare file content to spot and flag up any anomalies, so you can ensure your data is as accurate as possible before going through a formal audit process with a third-party such as . That stamp of approval from a successful third-party audit can then be used for raising capital and sharing with stakeholders. [35:55] How can you get information from your supply chain to cover scope 3 emissions?: Jessica provides some helpful tips for scope 3 emissions, including:- Don’t worry about getting primary information from all of your suppliers. You only need enough data to identify your decarbonization plans and strategy to share with stakeholders with a high degree of confidence. You don’t have to get it 100% perfect. Prioritise your suppliers – Consider how much you spend with each supplier, how good are your relationships with them? What impact do your suppliers have on your emissions? You should target the ones that are the most impactful. A lack of response doesn’t always mean a lack of data - Some supplier just won’t respond to your data requests, but there are ways you can still get some information, such as 10 based emission factors to get a baseline. With publicly available data about specific sectors and regions, you can get pretty close to the info you need. Get creative – There are other ways to gather data, such as using similar more responsive suppliers as a baseline. You could hold an industry group meeting to talk about improving data transparency and data sharing. This process will be beneficial for all involved by driving both costs and emissions down through a collaborative effort. Create a sphere of influence, drive the change you want to see within your supply chain. Create a Supplier Sustainability Strategy – Again, a consistent and planned approach will encourage engagement. Lastly, don’t sweat it if you can’t always get the data you want. Making a start is more important than getting it perfect. A lot of frameworks are quite forgiving and allow you time to mature your systems to a level where reporting can be repeated on an annual basis. [40:30] What book would Jessica recommend? A Costa Rica travel book. Jessica simply love the country and it’s culture, it’s also highly immersive in nature and mostly operates on renewable energy. [40:30] What is Jessica’s favourite quote? “If you were born with the weakness to fall, you were born with the strength to rise” Ruby Carr – extract from her poetry book ‘Milk and Honey’ If you’d like to learn more about , check out their website. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39092225
info_outline
#235 PUBLIC’s 3-Month Journey towards ISO 9001, ISO 14001 and ISO 20000-1
11/12/2025
#235 PUBLIC’s 3-Month Journey towards ISO 9001, ISO 14001 and ISO 20000-1
An ISO project can typically be completed within 6 – 12 months depending on an organisations size and complexity. Anyone who’s been through the process of ISO Implementation knows that there is a lot of work involved in that time span, from coordinating teams, gathering and creating documentation to auditing your processes. Now imagine doing that for 3 ISO Standards simultaneously within 3 months! Which is exactly what today’s guest, PUBLIC, have achieved. While it’s not a timeframe we recommend, their efforts deserve to be celebrated, and displays what good project management with dedicated individuals can accomplish. In this episode, Ian Battersby is joined by Biba Gonzalez, Senior Associate of Business Operations at PUBLIC, to discuss their 3-month dash to implement ISO 9001, ISO 14001 and ISO 20000-1, and explore the challenges and benefits experienced during the process. You’ll learn · Who is Biba Gonzalez? · Who are PUBLIC? · What was the main driver behind ISO 9001, ISO 14001 and ISO 20000-1 Implementation? · What was the biggest gap identified during the Gap Analysis? · What did Biba learn from the experience of implementing 3 standards at once? · What are the main benefits of ISO 9001, ISO 14001 and ISO 20000-1? · Biba’s top tip Resources · · In this episode, we talk about: [02:05] Episode Summary – Ian is joined by Biba Gonzalez, Senior Associate of Business Operations at PUBLIC, to learn more about their 3-month whirlwind journey towards , & implementation. [02:30] Jumping in at the deep end: Biba was tasked with obtaining certification to 3 ISO Standard on returning from maternity leave in July 2025. PUBLIC already held certification, but were looking to achieve ISO 9001 & ISO 14001 before Christmas of 2025. This was quite the task, especially since Biba had no previous experience with ISO Standards! [04:15] Who is Biba? Biba is the Senior Associate of Business Operations at PUBLIC. She has been the driving force behind PUBLIC’s ISO 9001, ISO 14001 and ISO 20000-1 implementation. One fact that not many people might know about her is that she has had a private audience with the pope, by complete accident! Simply a case of wrong queue at the right time while on a family vacation. [06:50] Who are PUBLIC? PUBLIC are a digital transformation partner. They work within the private sector to help improve public services, by providing procurement services, online safety programmes and other digitally enabled services. [08:00] What were the main drivers behind achieving ISO 9001, ISO 14001 and ISO 20000-1?: PUBLIC work with a number of Government departments, and while bidding for various frameworks they noticed a trend in requests for bidding companies to have ISO 9001 and ISO 14001 certification. While not always a strict requirement, it was certainly a desirable trait that was preferred of bidding companies. There’s also an increasing number of tenders asking for more environmental requirements, such as carbon emission reporting. What used to be a ‘nice to have’ is now becoming a requirement, and PUBLIC sought to have these requirements met via the relevant ISO Standards. [09:40] A tight timescale: When Biba had arrived back from maternity leave in July, PUBLIC has already booked in assessment dates with a Certification Body. This left quite a tight timeline of just 3-months to get all 3 Standards implemented to a level that could pass a Stage 1 Assessment. They already had an ISO 27001 system in place, but there was still a lot of work to do. A lot had been discussed about the implementation of additional standards in Biba’s absence, but no practical steps had been taken aside from booking the audit dates. She certainly had her work cut out for her as most ISO project typically last between 6 – 12 months! Due to all her hard work, and some assistance from Blackmores, PUBLIC passed their Stage 1 assessment with flying colours and are in a good place to tackle their Stage 2 Assessment in late November 2025. [11:40] What was the biggest gap identified during the Gap Analysis? Thankfully PUBLIC didn’t have any huge gaps to fill. Due to their previous work with Government departments, they had a lot of the pieces just not together in a cohesive system. They did identify early on that they wanted a system that worked for them in the long term and were conscious of creating something that fit their way of working. With so many ISO Standards, the upkeep alone would have been overwhelming so they aimed to combine as much as they could into one Business Management System rather than opting to silo each individual Management System. [13:00] What were the benefits of Implementing ISO 9001, ISO 14001 & ISO 20000-1? Biba states that the implementation of these ISO Standards took their business to the next level. Coming from a relatively small start-up, there was some of the micro business mentality that remained despite their growth in recent years. ISO Standards helped to keep everyone adhering to the same requirements. PUBLIC have taken a more hollistic approach to ISO implementation to both make it as simple as possible for everyone to work within, while also driving continual improvement within the business. Having established processes means that everyone is singing from the same song sheet, and provides traceable processes that can be questioned and amended if and when issues occur. [16:15] Additional benefits felt from ISO Implementation: There is greater accountability with the Management system in place. There is also the added benefits of being able to bid and win new business opportunities. [17:25] Biba’s top tip for ISO Implementation: Don’t try and implement an ISO Standard (or multiple!) in just 3 months. While PUBLIC managed to do so, it was a lot of hard work squeezed into a very tight timeframe, and Biba wouldn’t recommend anyone try to match their level of ambition in this regard. Secondly she adds, make the Management System work for you and your business. ISO Standards by their nature read to be fairly generic, and that’s by design, so that you have the freedom to implement them in a way that makes sense to you. There is no point implementing an obtuse system that no one wants to interact with, the key is to embed it into the way you already work, with a view to use it as a tool to drive continual improvement as the system matures. [19:00] Looking to the future: Biba is optimistic about the business, as they’re looking to grow by 20% next year, supported by all the work done to Implement ISO 9001, ISO 14001 and ISO 20000-1. While they have had to change aspects of how they worked prior, due to being a small business the nature of approvals and ways of working were on a more individual basis, whereas now there is a team-based approach. It’s been a learning curve, but ultimately one that will serve them well as they grow over the next few years. [21:30] Biba’s book recommendation: the Sunday Times number one bestseller exposing the gender bias women face every day by Caroline Criado Perez [24:05] Biba’s favourite quote: “Not my circus, not my monkey” an idiom which Biba’s sure a lot of Operations Directors can sympathise with If you’d like to learn more about PUBLIC, We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/39005940
info_outline
#234 Finding The Root Cause In ISO Management
10/30/2025
#234 Finding The Root Cause In ISO Management
Continual Improvement is at the heart of ISO Management, a large part of which is dedicated to ensuring issues don’t reoccur. This is more than just putting a plaster on it and calling it a day, it’s about finding the root cause. This not only eliminates wasted time, effort and money with firefighting repeated mistakes, but also drives meaningful improvement. Over the years, many techniques have been developed to help with finding cause. In this episode, Ian Battersby explores the need to find the root cause of issues in ISO Management and explains some key techniques for root cause analysis that you can put into practice to help stop recurring issues. You’ll learn · What is meant by ‘finding cause’? · Why do you need to find the cause? · Where is finding cause specified in ISO Standards? · Finding cause in practice · What are the 5 Why’s? · What is the fish bone / Ishikawa? · What is FMEA? · What is fault tree analysis? · How do these techniques work in practice? Resources · In this episode, we talk about: [02:05] Episode Summary – Ian dives into finding cause within ISO Management, explaining various techniques to help you prevent recurring issues. [03:15] What is meant by ‘Finding cause’? When an output from a process is not what was expected, then it is classed as a non-conformity which will need to be addressed through corrective action. Before you can put that action into place, you need to identify the root cause for the issue. It’s about putting right what went wrong. [04:00] Why do you need to find cause? Ian gives an example of a reactive response to resolving an issue, it didn’t get to the root of why the mistake happened in the first place. Finding cause is necessary to stop issues from repeating, rather than simply firefighting issues as they occur. ISO terminology has updated to reflect this over the years. There used to be a term called ‘Preventive action’, but this has since been changed to ‘Corrective action’ following on from the 2015 Annex SL update to many ISO Standards. This reflects the new risk-based approach to ISO management. The terms are largely the same in nature, but preventive action was widely misunderstood and so this was renamed and clarified following 2015. [05:55] Where is finding cause specified in ISO Standards? As with many aspects of ISO, the need for finding cause can be found in a few places within a Standard, including: - Clause 6.1.1 Planning: It specifies the need to determine risks and opportunities that need to be addressed. This is because they will affect the desired outcome of your Management System. It’s also a good place to start thinking about how to reduce those risks. Evaluating your strengths and weaknesses also gives you the chance to contemplate whether your existing processes are good at delivering what you want. Clause 10 Improvement: The Standard states something to the effect of ‘the organisation shall determine and select opportunities for improvement and implement any necessary actions to address those opportunities’ These opportunities will focus on improving products and services, which includes correcting, preventing or reducing undesired results. Also included under clause 10 is a subclause that directly addresses non-conformities and corrective action. These specify not only the need to resolve issues as they arise, but to evaluate the need for action to eliminate the root cause. Additional requirements include the need to review these actions and determine if they are actually effective. Ian goes into Clause 10 in more detail in a podcast specifically looking at opportunities for improvement. [14:20] Finding cause in practice – Why a methodology is necessary: Ian provides an example where an employee may lack confidence completing a certain activity. Their lack of competence could lead to a process being delivered incorrectly. That adverse quality outcome would then likely end up with the customer who would raise a complaint, in this instance that could be a damaged product. The damaged product is what needs correcting, from your perspective you would be looking at what caused that to prevent recurrence. Without knowing the initial cause, you would need to determine whether it’s a production issue or a human error. These types of scenarios can branch out further than the initial quality issue. For example, if that damaged product causes harm, then it turns into a health & safety risk. If products need to be scrapped, then there’s an environmental factor. Complaints related to product quality may also not be recorded in a standard non-conformity system, and could easily be missed for a full investigation to find root cause. This is why it’s important to have a consistent approach, in both logging issues and evaluating them to determine cause. [18:10] What are the 5 Why’s? This is one of the more popular methods that people use to determine cause. It’s simply a case of asking why a scenario happened, usually 5 times, though you can ask more or less depending on how long it takes to reach the core issue. It doesn’t require much training and all it requires is an open and honest response to the questions. This method can get answers quickly and is often utilised as an early problem solving technique. [19:30] What is the fish bone / Ishikawa? This is a more visual method to find cause. Depicting a fish skeleton that categorises possible causes and groups these accordingly. These causes are then discussed for a few minutes, typically with teams of people in order to gain different perspectives to help pull apart complex problems into their contributing factors. This method is particularly useful in cases where there isn’t a single underlying cause. [20:30] What is FMEA? FMEA or Failure Modes and Effects Analysis is a more structured technique and acts like a risk assessment in reverse. It looks at what can go wrong, what the effect of failure is and then how critical that failure is to the outcome of what you're trying to do. It uses risk priorities to decide what’s more important. [21:15] What is Fault Tree Analysis? This method utilises a top-down logical approach. It’s a diagrammatic representation of what’s going wrong. It asks, does this happen? Yes or no or both, and branches down paths that explore the issue. It allows for quantitative measures with a number output that can help determine how likely recurrence will be. It’s a method that is often used in engineering and manufacturing processes. [22:55] Scatter Diagrams: Scatter diagrams are a good tool to find correlation. They help visualise the relationship between two variables. If you have data rich environments, these can really help you plot out those relationships and make those links that otherwise may have been missed. [23:40] The 5 Why’s in more detail: The 5 Why’s is a great starting technique as it requires little training. Ian provides an example of using the 5 Why’s, with the scenario of a worker who has injured themselves while cutting some wood. Using the 5 Why’s, he asks these questions: · Why did the workers hand slip while cutting the wood? – They were holding the material in one had without the use of any clamping device to keep it steady. · Why was the material being held by hand instead of using a clamp? Because there was no clamping device available. · Why was there no clamping device available on the table? The design of that workstation didn’t take into consideration the need for a permanent clamping fixture. · Why wasn’t that taken into consideration for the workstation? The risk assessment for that workstation was overlooked. From this exercise, you can see how you can get to the root of an issue by simply asking ‘Why’ a number of times. Again, it can be more or less than 5 times, the name is simply a guideline. [25:40] The Fishbone / Ishikawa method in more detail: Another favoured simple technique for finding cause is the fishbone method. It utilises 6 categories to get to the root of an issue, those being:- · Machine: Addressing the equipment or technology that you use to deliver products and services. · Method: The way in which you deliver products and services. · Material: The raw inputs into your processes. · Measurement: The data and metrics that you use to monitor the successful delivery of your products and services. · Mother Nature: The environment and conditions in which you’re operating. · Man – Although this has now been updated to ‘People’, addresses the human element of product and service delivery. This is a great method for instances where there may be multiple root issues, so you can categorise and analyse each of them with multiple perspectives involved as this is considered a more collaborative method for root cause. [28:15] Record your findings: We dive more into this in a , but essentially, it’s a requirement of every ISO Standard to address these non-conformities as they occur. Going through the process of root cause and rectifying the issue will need documentation to prove that you are actively addressing these issues, as well as doing as much as you can to prevent recurrence. There is no defined way to do this in the Standard, so it can be documented via forms, intranets, other digital systems etc. Documenting all the evidence of resolving issues may seem arduous at times, but it will ultimately lead to genuine continual improvement, and will lead to reduced overall error. If you’d like any assistance with ISO Implementation or support, we’d be happy to help. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/38841740
info_outline
#233 Clyde & Co Achieves ISO 50001 - Setting the Standard for Energy Management within the Legal Sector
10/15/2025
#233 Clyde & Co Achieves ISO 50001 - Setting the Standard for Energy Management within the Legal Sector
When thinking of sectors that need effective energy management, the ones that typically come to mind include the likes of transportation and manufacturing. However, energy management is something that any business can benefit from. Such is the case with today’s feature, Clyde & Co, a global law firm who made the decision to Implement ISO 50001 energy management to tackle the largest part of their sustainability impact. In this episode, Ian Battersby is joined by Paul Barnacle, Head of Health, Safety, Security and Environment at Clyde & Co, to discuss their journey towards ISO 50001, including the challenges associated with implementation and benefits gained from certification. You’ll learn · Who is Paul Barnacle? · Who is Clyde & Co? · What was the main driver behind obtaining ISO 50001? · How long did it take to achieve certification? · What was the biggest gap found during the Gap Analysis? · What has Paul learned as a result of ISO 50001 Implementation? · What are the benefits of gaining ISO 50001 certification? · Paul’s top tip Resources · · · In this episode, we talk about: [00:25] Episode Summary – We invite guest Paul Barnacle, Head of Health, Safety, Security and Environment at Clyde & Co, onto the show to share his journey with implementing ISO 50001, including the associated challenges and benefits from gaining certification. [02:50] Who is Paul Barnacle? is the Head of Health, Safety, Security and Environment at Clyde & Co , and was the lead for the ISO 50001 Implementation project. One thing that many may not know about Paul is that he’s an avid angler, whether rain or shine, he’s dedicated to getting the next big catch. [04:45] Who are Clyde & Co? Clyde & Co are a global law firm that helps organisations navigate risk and maximise opportunities across sectors such as insurance, professional services, aviation, marine, construction and energy. The firm has over 500 partners with a total headcount of 5,500 people operating across 70 offices around the world. [05:40] Who is included within the ISO 50001 scope for Clyde & Co? For those that aren’t aware, an ISO scope can be against an entire business, a single department or even against a specific product / service. For Clyde & Co, their ISO 50001 scope extends across 9 offices in the UK and Republic or Ireland. [06:15] What were the main drivers behind ISO 50001 Implementation? – One of the main drivers links back to Clyde & Co’s Net Zero Strategy, which included the need to identify which sustainability focused ISO Standard would help them the most. Following a lot of internal conversation with their Chief Sustainability Officer, they settled on ISO 50001 as they were seeking more visibility on their energy consumption and help with identifying opportunities for improvement. Ultimately taking the first steps to tackle their scope 1 and 2 emissions. [07:05] Why ISO 50001 over ISO 14001? Environmental Management was considered, however they don’t have any industrial processes, so other environmental factors outside of energy aren’t very applicable to a business like Clyde & Co. Seeing as energy was their largest environmental expenditure, ISO 50001 naturally seemed like the best fit. [08:10] How long did it take to achieve ISO 50001? Paul started the Implementation journey back in early August of 2024, and completed the Stage 2 Assessment by April 11th 2025, so a total of nine months. [09:00] What was the biggest gap identified during the Gap Analysis? Paul highlights how key the Gap Analysis was to the whole process, as it gave them a clear picture of the amount of work involved with completing the implementation. One of the biggest gaps identified was the fact that they didn’t have a structured management system in place. There was a lack of knowledge when it came to ISO implementation, so some of the terminology was a bit lost on Paul to start with! They also lacked key documentation such as continual improvement log and Register of Energy Saving Opportunities. [10:10] What were the benefits of ISO 50001 implementation? There are a number of benefits, including:- · ISO 50001 allows a business to have a lot more visibility on their energy consumption · ISO 50001 certification demonstrates a proactive approach for energy management to clients and prospects. · The data provided by ISO 50001 allows for more informed decisions on energy saving and reduction opportunities, allowing you to target your biggest emission sources and spot any anomalies. [11:45] Client influence: Clyde & Co were seeing an increase in requests from clients regarding their energy performance indicators and related KPI’s. They were also being asked about what they were doing in relation to reducing their scope 1 and 2 emissions. This exercise allowed them to address both, in addition to setting up the infrastructure to continuously monitor this year on year. As a result of ISO 50001 implementation, Clyde & Co now plan to communicate the reduction in their energy consumption on a quarterly basis with staff across all regions. [13:50] Additional Improvement as a result of ISO 50001: Paul enjoys the renewed communication between teams that hadn’t really interacted prior to ISO 50001 implementation. Previously the energy management team were fairly siloed in the business, but now they’re getting tech champions involved and asking anyone to contribute to the energy performance indicators. It's created a connected culture that encourages new ideas from all corners of the business. They’ve helped to facilitate this through the use of their intranet with dedicated mailboxes where people can submit any questions or suggestions for improvement. They’ve also got QR codes set-up for easy access for mailbox submissions. [15:55] Paul’s Top Tip: Get a copy of whichever Standard you intend to Implement and read it thoroughly. It’s key that you understand what the Standard is asking for. If you’re struggling with the ISO terminology, the Standards will include a glossary of terms and definitions to help you. You can also do what Clyde & Co did, which is hire ISO consultants that specialise in ISO implementation. They will help you interpret the Standard and help you establish a Management system that is both compliant with the Standard and also integrates with the way you work. For ISO 50001 specifically, Paul highlights the need for strong data. Energy monitoring will require some number crunching, so you need those figures to be as accurate as possible to get the best results. [15:55] Paul’s book recommendation: by David MacKay [15:55] Paul’s favourite quote: “The best way to predict the future, is to create it.” – Abraham Lincoln If you’d like to learn more about , check out their website. We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/38589465
info_outline
#232 Introducing BS 30480 Intervention, Prevention And Support For People Affected By Suicide
10/08/2025
#232 Introducing BS 30480 Intervention, Prevention And Support For People Affected By Suicide
The topic of suicide is all too often a discussion avoided due to its tragic and uncomfortable nature. However, the reality is that there are 6,000 deaths by suicide in the UK each year, with in excess of 727,000 deaths annually worldwide. In recent years there has been more awareness about the topic, with a range of resources targeted to help with the prevention and support of those affected. For businesses seeking further guidance, a new Standard is on the horizon. In this episode, Ian Battersby is joined by Marcus Long, Chief Executive at IIOA, who shares his inspirational story of working through an unthinkable tragedy and creating a silver lining that aims to tackle the intervention, prevention and support for people affected by suicide. You’ll learn · Who are IIOA? · Who is Marcus Long? · What was the catalyst behind BS 30480? · Who is involved with the development of BS 30480? · What does this Standard hope to achieve? · How does this Standard compare to other ISO Standards? · How will this Standard develop within the next year? · The cost of suicide · What are the benefits of BS 30480? · How can you get involved? Resources · · · In this episode, we talk about: [00:25] Episode Summary – We invite guest Marcus Long, Chief Executive at IIOA, onto the show to talk about his involvement with the development of BS 30480, a Standard dedicated to the intervention, prevention and support for people affected by suicide. [01:30] Who are IIOA? The IIOA are the Independent International Organisation for Assurance, which is a trade association for global assurance bodies. Their members carry out certification to a wide range of ISO Standards, related Standard schemes, product certification and the provision of validation and verification training. [02:30] Who is Marcus Long? Before becoming the Chief Executive at IIOA, Marcus worked for the national Standards body side of BSI. There he was involved with ISO Standard development and later moved into certification. He’s had 20 years’ experience within the field of ISO Standards, and spent most of that time pushing the benefits and value of quality infrastructure. One thing many may not know about Marcus is that he spent 48 hours underwater! While not in one stint, Marcus is an avid scuba diver, and has been taking trips under the waves since 1990, with his cumulative underwater adventures reaching 48 hours total to date. [05:30] What was the catalyst behind BS 30480? Marcus experienced an unthinkable tragedy in October of 202, when his son Adam took his life at the age of 21. In the following three years, Marcus sought to find some sort of silver lining to give him some peace. After a while, he turned to look at the industry he worked within, Standards, which is focused on solving problems and finding solutions. Ultimately, it’s aim is to make the world a better place, whether that’s through sustainability, quality or Health & Safety. So why couldn’t that principle be applied to something as difficult and heartbreaking as suicide. With that idea in mind, Marcus got talking to some national standards bodies in different countries around the globe, in addition to ISO, to see if the idea could spark some interest. These discussions reached BSI, who were currently also working on creating a Standards on the topic of menstrual health and menopause in the workplace. Marcus appreciated that they were willing to touch on topics that many shied away from. [08:50] The conception of BS 30480 – The first steps taken included hosting workshops at the Houses of Parliament in February of 2024. There Marcus brought together a wide range of people with different experiences, and asked them if they thought this Standard was a good idea and gather what how they would like to see something like this work in practice. With that encouragement and feedback, Marcus set to work on setting a scope and deciding who should be involved in the development process. [11:05] Who is involved with the development of BS 30480? As with many ISO’s, the development team are made up of a wide range of people, including people from academia and business owners. Marcus ensured that healthcare specialists and those who’ve assisted in suicide prevention schemes were also included. All of these individuals had the same passion to help reduce the rate of suicide within the UK. [13:10] What does this Standard hope to achieve? The sad reality is that in many instances, it’s a reactive response to suicide. What Marcus hope BS 30480 can achieve is to encourage the creation of suicide prevention strategies. This turns that reactive response into a proactive one in terms of preventing the worst from happening. As quoted from the Standard: “ The aim is to make workplaces more suicide safe, more conducive to suicide prevention, more supportive of those who have been exposed to suicide and more knowledgeable and confident in talking about suicide and taking actions that prevent suicide.” [15:30] How does this Standard compare to other ISO Standards? This Standard differs from ISO Standards such as and in the fact that it’s a guidance Standard, so not one that can be certified to. It provides guidelines and guidance that businesses use, and select the parts that are most relevant to them. The Standard also includes a number of Appendix’s that provide more practical guidance to help give businesses a clearer idea on how certain elements can be implemented, for example, the creation and deployment of a suicide prevention plan. So rather than a rigid set of requirements, think of it as a collection of practical ideas and solutions that can aid in the prevention of suicide. [18:20] How will this Standard develop within the next year? BS 30480 is expected to be published in November 2025, as they’ve just finished the consultation period in August 2025, which was met with a very positive response. Marcus would love to see this Standard move into the international stage by becoming an ISO, but for now it’s being published as a British Standard. There are plans to create training and host webinars to spread awareness about the Standard, so keep an eye out on BSI’s socials for more about that! The standard is set to enter a phased communication strategy: Phase 1: The launch of the Standard, which has already had some preparation as various other Standard bodies and those involved have been spreading awareness throughout the drafting process. Phase 2: Public awareness – Marcus and those involved in the creation of BS 30480 will be ramping up public dialogue on what the Standard is about and what it can achieve for people. Phase 3: Engagement – Actively getting business to engage with dialogue around suicide prevention, as this is a topic that some businesses are scared to even tough. But if we’re to tackle it, it needs to be discussed. There is scope for this Standard to fit in with the likes of ISO 45001 (Occupational H&S) and ISO 45003 (Mental Health in the workplace). Marcus also discusses the opportunities for this to help less traditional workplaces such as educational institutions, sports clubs, charities & youth clubs. [23:30] The cost of suicide: As much as it seems inappropriate to put a price on suicide, there is more to it that the emotional and societal devastation. A report by The Samaritans suggested that each death by suicide resulted in a cost of £500,000. This is due to related costs for emergency healthcare systems and loss of productivity. Marcus emphasizes that if we are to get more businesses, Government and local Governments on board, all impacts of suicide need to be discussed in addition to the benefits of suicide prevention. While odd to approach it from a cost perspective, it’s more often than not the language that businesses speak. They need to be informed of the investment required in people, time and cost just as much as they need to be aware of the many benefits of effective and proactive suicide prevention. [26:40] What are the benefits of BS 30480? The ultimate aim is to make workplaces a safer and better place. This Standard can also provide a means of effectively measuring social value, which is often times a rather nebulous metric to grasp. This Standard is here to save lives, and its practical guidance can help businesses create a clear path of actions to help those who may suspect that a colleague is in need of help. [28:25] How can you get involved? Marcus’ biggest ambition is for BS 30480 to assist with saving lives, but if it’s to achieve it’s main aim, it needs advocates. Whether from trade associations, other Standards bodies or just from individuals, spread the word and encourage businesses to adopt the guidance provided. You can register your interest in BS 30480 through , this ensures you get updates on the Standards progress and any training opportunities. If you’d like learn more about BS 30480, feel free to contact Marcus Long via We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/38509135
info_outline
#231 Evaluating Compliance within ISO Management
09/24/2025
#231 Evaluating Compliance within ISO Management
When stating ISO Management System ‘compliance’, that in reality means the conformance to ISO Standard requirements, compliance in ISO terminology actually refers to compliance with legal and other statutory regulations. It may sound like semantics, but the difference is distinct for a reason, as you don’t get a ‘non-compliance’ for not meeting requirements, rather you get a ‘non-conformity’. When it comes to compliance with the law as required by ISO Standards, you need more than a Legal Register to prove compliance. In this episode, Ian Battersby dives into what is meant by compliance in ISO, how this relates to legal and statutory requirements, and how businesses can effectively evaluate compliance. You’ll learn · What is the difference between ‘Compliance’ and ‘Conformity’? · What are the different types of compliance requirements? · How do Acts and Regulations work in tandem? · Who enforces legal compliance requirements? · Where do these requirements sit in ISO Standards? · How do you prove compliance within ISO management? · How do you evaluate effective compliance? Resources · · In this episode, we talk about: [00:30] Upcoming webinar: If you’d like to learn more about the benefits of integrated management systems, feel free to register for our [01:30] Episode Summary – Ian Battersby discusses the topic of compliance within ISO Standards, and how you can effectively evaluate it within your Management System. [02:30] What is the difference between ‘Compliance’ and ‘Conformity’? It’s a common misconception that you ‘comply’ with an ISO Standard, when in reality, you conform to an ISO Standard, hence why you can receive a ‘non-conformity’ in audits and not ‘noncompliance’. When we talk about compliance within ISO Management, this refers to compliance with the law, regulations and other statutory requirements, as this is a requirement within all ISO Standards. [03:50] What are the different types of compliance requirements? There are many different types of law, Ian focuses on what is known as statute law legislation, as this is distinct from common law, case law and constitutional conventions. Statute law legislation is clearly written and can be cited in something like a Legal Register, or Register of Compliance Obligations. There are different types of legislation that you’ll need to document, including: Primary Legislation: These are put in place by acts of UK Parliament and may have involvement from devolved administrations as well. Statutory compliance refers to compliance with primary legislation. An example of this type of legislation includes the . Secondary or delegated legislation: Those primary Acts often require a lot more detail regarding the practicalities of applying them, which is delivered through Secondary or delegated legislation, otherwise more commonly known as regulations. These have more input from relevant public bodies to provide the requirements that can be applied. Both regulations are issues under Statutory Instruments (SI's), which are the formal legal vehicle that gives them effect. Put simply, regulations are the rules and Statutory Instruments are the legal mechanism which brings those rules into effect. [06:05] How Acts and Regulations work in tandem: Taking the Health & Safety at Work Act as an example, at the start this was quite a broad and generic act, it wasn’t until years later that the came about to support the Act. This was further bolstered with the Management of . Both regulations were developed through consultation between Government departments and other bodies such as the Health & Safety Executive. These regulations gave companies much more detail on what’s actually required in order to comply with the Health & Safety at Work Act. [06:50] Who enforces legal requirements? – It’s not just the police that enforce legal requirements, there are a number of other bodies independent of government and the judiciary that can enforce regulations and prosecute for breaches caused by organisations and individuals. This can include bodies such as The Health & Safety Executive, The Financial Conduct Authority, The Environment Agency and the Information Commissioners Office. There are more for other areas, and these are often the bodies involved in the development of specific regulations. [07:45] Where do these requirements sit in ISO Standards? As Is the case with ISO Standards, the requirement for compliance is sprinkled throughout the whole document. Starting with Clause 4 Context. Here ‘Interested parties’ are a focus, of which regulatory bodies can be considered an interested party, as they control the regulations that you are required to comply with by law. Even if you don’t think you fall under specific legislation, there are still general applicable business laws that all businesses must comply with. So this exercise is not simply a case of running a Management System, it’s also about running an effective business. Ian highlights clause 6.1.3 in , which states the need to determine legal requirements applicable to your business, whereas in this clause talks about compliance obligations. Despite the difference in wording, they are essentially looking for the same thing, which is detailing what legal requirements you need to comply with. In it also states that any products or services offered should meet customer and applicable statutory and regulatory requirements. This is then further strengthened in the Leadership clause as leaders are required to ensure that their commitments meet all customer requirements, but also any applicable regulatory and statutory requirements associated with the products and service. This is phrasing that is repeated throughout ISO 9001. Going back to ISO 45001 and ISO 14001, both also require an evaluation of compliance, both the part of monitoring and measuring and the results of them to be submitted through your management review process. The Standards are very clear in that they require you to determine the frequency and methods for evaluation of compliance. [12:00] How do you prove compliance within ISO management? In ISO 45001 there is an appendix that give examples of what you can monitor and measure for the fulfilment and evaluation of legal requirements. As mentioned, many organisations opt to use a Legal Register which states all applicable legislation for your business that will be evaluated in an Internal Audit, but proving genuine compliance is much more than just acknowledging the legislation itself. For larger organisations, this can be a very burdensome task, especially if you find yourself in a position where legal requirements aren’t being met. Ian provides an example to illustrate how to prove effective compliance: Waste removal is something that every business has to do, whether they do so through a waste management contractor, or through a landlord, the law states that any waste you generate must be removed, transferred, processed, treated, etc. by licenced organisation in a very specifically regulated fashion. You as an organisation or your landlord may receive an annual season ticket which includes the required demonstration of compliance, which can be in the form of West Carrier license number, the types of waste, the classification codes under the European or waste catalogue, dates and signatures. Now if you run into an instance where something on that waste transfer note was incorrect, like a wrong address or waste type, how do you prove that you were still compliant in the actual activity of removing waste? An Audit will pick up on the note discrepancies and you may be faced with being non-compliant. A way to ensure that you have a record of compliance is to keep electronic copies of all your waste transfer notes, and keep them in a central location, or even possibly linked within your Legal Register if possible. Despite the discrepancy, you will be able to prove that you have a prior record of compliance. Ian gives another example, you may have air conditioning in your area of work that’s due for a service. The contractor will need to verify the engineer before you engage with them, including a check to see if they’re competent under F Gas Regulations and hold a valid REFCOM Registration Certificate. If you wait to check / validate their certificates of competence, you may run into a situation where they may have an expired certificate at the time that they serviced your aircon, and so that may render that service as inadequate under your legal requirements. To avoid this, you should reference that you’ve evaluated the contractor within your Legal Register, this would include a check on their registration number and dates of when their F Gas competency certificates are valid, ensuring your service falls within those dates. In short, to demonstrate compliance, you should be keeping on-going records in relation to your legal requirements. These should also be readily available and easily accessible. [20:35] How do you evaluate effective compliance: Legal requirements such as the Health & Safety at Work Act are much broader, and it can be difficult to know exactly what records you need to keep to prove compliance. This is where the supporting regulations can provide the required detail and provide a much clearer picture of what evidence is required. One example is the requirement to carry out sufficient risk assessments, which requires you to identify hazards, assess risks, determine control measures you know, communicate those to people, and review of those assessments regularly. You as the business will need to create a programme to manage the risk assessment process, and this should be documented somewhere, including a note of your review and action dates. This risk assessment list should also be linked within your Legal Register. In short, one of the most effective ways to show and evaluate compliance is to ensure that all relevant evidence is linked or attached in some way to a Legal Register or Register of Compliance Obligations. These evidence documents should be active and hold a record of previous actions and any planned upcoming actions. You could also schedule regular inspections of your legal compliance, to evaluate your level of compliance against different requirements on an on-going basis. The resulting reports can also be linked within the Legal Register. Don’t just rely on Internal Audits to cover your legal compliance evaluation. Utilise dedicated legal compliance inspections, link all relevant evidence within your legal register and have on-going reviews and updates throughout the year. If you’d like any assistance with implementing ISO standards, we’d be happy to help! We’d love to hear your views and comments about the ISO Show, here’s how: ● Share the ISO Show on T or ● Leave an honest review on or . Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: | | | | |
/episode/index/show/theisoshow/id/38336320