ISO Certification Achieved: What Happens Next?

Achieving ISO certification is an important milestone. It demonstrates that your organisation has implemented a management system that meets an internationally recognised standard.

Once the certificate arrives, however, it can be tempting to return to business as usual and leave the system untouched until the next assessment.

ISO certification is not a one-off exercise. The certificate confirms that the required arrangements were in place at the time of assessment. The longer-term value comes from continuing to use, review and improve them.

Keep the system current

Businesses rarely stand still. Employees, services, suppliers, technology, premises and responsibilities can all change.

Your management system should continue to reflect how the organisation operates. This does not mean constantly rewriting documents. It means periodically checking that policies, procedures, risks, responsibilities and objectives remain accurate and relevant.

Complete meaningful internal audits

Internal audits should look at how activities actually operate, rather than simply repeating a clause-by-clause checklist.

This may include sampling customer projects, supplier records, training information, environmental data, risk assessments, security reports or improvement actions.

A good internal audit confirms what is working, identifies gaps and highlights practical opportunities to improve.

Follow actions through to completion

Nonconformities, observations and opportunities for improvement should be recorded, assigned and followed through.

Actions should only be closed when there is evidence that they have been completed and, where necessary, that they have addressed the original issue.

Maintaining a clear improvement log prevents actions from becoming lost between assessments and provides useful evidence of continual improvement.

Monitor useful information

Organisations should monitor information that helps them understand whether the management system is effective. Depending on the standard, this might include:

• Progress against objectives.

• Customer feedback and complaints.

• Environmental consumption and waste.

• Health and safety incidents.

• Information security reports.

• Supplier performance.

• Audit findings and improvement actions.

  
  

The aim is not simply to collect figures for an auditor. Unexpected results should be investigated and used to identify risks, problems or improvement opportunities.

Make management review worthwhile

Management review should be a genuine business review, not an annual ISO meeting completed shortly before the external assessment.

It should bring together objectives, performance results, audit findings, incidents, feedback, risks, changes and improvement actions. Senior management can then decide whether the system remains suitable and whether any changes or additional resources are needed.

Avoid the annual audit panic

When the system is maintained throughout the year, preparing for a surveillance assessment should be straightforward.

Documents will already be current, audits will have been completed, objectives will have been reviewed and actions will have been followed up. The assessment becomes an independent check of a working system rather than a last-minute search for evidence.

The goal is not to create more paperwork. It is to maintain a system that remains current, provides reliable information and helps the organisation make better decisions.

If your organisation has achieved ISO certification and would benefit from practical ongoing support, Keystone Standards can help you maintain, review and continually improve your management system.