The ISO Show

Putting work into Quality Management doesn't stop once you achieve ISO 9001. Continual Improvement is at the heart of every ISO Standard, but sometimes it's hard to know what good looks like beyond certification.

This is where Guidance Standards can lend a hand. ISO 9004 provides guidance for Quality Management Systems, and though its current iteration was published in 2018, its advice is more aligned with the 2026 version of ISO 9001 than the previous 2015 edition.

In this episode, Ian Battersby dives into the purpose of ISO 9004, its applicability to the new 2026 version of ISO 9001 and explores the clauses and differences between ISO 9001 and ISO 9004.

You'll learn

· What is ISO 9004?

· What's the main difference between ISO 9001 and ISO 9004?

· Is ISO 9004 due an update?

· Where do ISO 9001 and ISO 9004 connect?

· What are the other differences between ISO 9001 and ISO 9004

· Breaking down ISO 9004 by clause

Resources

· ISO 9004

· Isologyhub

In this episode, we talk about:

[02:30] Episode Summary – Ian Battersby dives into the guidance Standard for Quality Management, ISO 9004, looking at the key connections and differences between it and ISO 9001.

[02:45] What is ISO 9004? ISO 9004 is a Guidance Standard designed to support ISO 9001. Its latest iteration was published in 2018, which was 3 years on from ISO 9001's previous iteration, meaning much of its guidance aligns with the newer 2026 version of ISO 9001.

[03:35] What's the main difference between ISO 9001 and ISO 9004? There is a core distinction between the two:

ISO 9001 is a management system standard — it specifies requirements. An organisation can be audited and certified against it. Its job is to give confidence that an organisation can consistently deliver products and services that meet customer and applicable statutory/regulatory requirements.

ISO 9004 is guidance, not requirements — you can't be certified to it. It addresses the "quality of an organization" itself: the degree to which its inherent characteristics fulfil the needs and expectations of all relevant interested parties (not just customers), with the aim of sustained success over the long term, in a changing environment.

ISO 9001 gives confidence in what you produce or deliver and ISO 9004 gives confidence in what you are as an organisation. In short, the two complement each other.

Something worth noting: The 2018 edition of ISO 9004 deliberately repositioned itself as independent of ISO 9001 rather than an "add-on"; a change from earlier editions, which were more explicitly paired as a "consistent pair" with 9001.

[06:00] Is ISO 9004 due an update? ISO 9001 has been updated as of 2026, so should we expect ISO 9004 to follow suit?

The answer is no, there is no planned revision date currently, so the most current edition is still 2018.

[08:45] Where do ISO 9001 and ISO 9004 connect? There are a number of features of each Standard that connect.

Both sit under the same quality management principles from ISO 9000, so they share a common vocabulary and philosophical base, so there's no contradiction, just different altitude.

ISO 9001:2026 has an Annex which is very helpful in explaining requirements, but ISO 9004 can be read as picking up where 9001 stops. ISO 9001's clauses (context, leadership, planning, support, operation, evaluation, improvement, all clarified in the new ISO 9001 Annex) reappear in 9004 but are expanded and extended into strategic territory, eg, 9001's "leadership" clause vs 9004's full treatment of policy, strategy, and organisational identity.

An organisation that's already certified to 9001 has the infrastructure that 9004 assumes and builds on, so 9004 may be used as a maturity roadmap after certification, not before it.

Remember: ISO 9001 is the ground, 9004 is the sky you're reaching toward.

[10:50] What are the other differences between ISO 9001 and ISO 9004 – Other key differences include:

· Certifiable vs non-certifiable (single biggest practical difference for clients: no third-party audit, no certificate, so no external pressure to adopt it).

· Compliance / conformity mindset (ISO 9001) vs performance / excellence mindset (ISO 9004).

· Narrower interested-party scope (customer focus, mainly) vs broader (all relevant interested parties).

· Operational / tactical (ISO 9001) vs strategic / cultural (ISO 9004) — identity, values, culture literally appear as a clause heading in 9004 and have no equivalent requirement in 9001.

[12:20] Why this matters for organisations right now, with 9001:2026 just out – ISO 9001:2026 has actually pulled a bit closer to ISO 9004's territory.

The new 2026 version of ISO 9001 adds "quality culture and ethical behaviour" language and stronger strategic framing, which was already present in the 2018 version of ISO 9004.

This narrows the conceptual gap slightly, even without ISO 9004 itself being revised.

[13:05] Breaking down ISO 9004's Clauses 1-4 – 1–3: Scope, normative references, terms and definitions: standard preliminaries.

Clause 4 - Quality of an organization and sustained success: defines the core concept: quality of an organization is the degree to which its inherent characteristics fulfil the needs and expectations of customers and other relevant interested parties, and sets out what "managing for sustained success" means.

It's distinct from 9001, which focuses on quality of products / services.

It introduces broader concepts than ISO 9001 in relation to IPs, relationship management, and the varied expressions of needs and expectations.

[14:50] Breaking down ISO 9004's Clauses 5 & 6 –

Clause 5 - Context of an organization: identifying relevant interested parties and the external/internal issues affecting the organisation (it corresponds to but receives broader treatment than ISO 9001's equivalent clause).

It builds upon ISO 9001 clause regarding internal and external issues and proposes external factors such as globalisation, innovation & natural environment. It expands on internal factors to bring in strategy, complexity and maturity.

It invites top management to consider these issues and to determine which could result in risks to sustained success or opportunities to enhance sustained success

Clause 6 - Identity of an organization: This is the clause with no real ISO 9001 equivalent: it's where 9004 moves into genuinely strategic / organisational territory.

An organization is defined by its identity and context. The identity of an organization is determined by its characteristics, based on its mission, vision, values and culture.

These are all too vague in many organisations, but here it lays out what they should really mean:

· Mission: the organization's purpose for existing;

· Vision: aspiration of what an organization would like to become;

· Values: principles and/or thinking patterns intended to play a role in shaping the organization's culture and to determine what is important to the organization, in support of the mission and vision;

· Culture: beliefs, history, ethics, observed behaviour and attitudes that are interrelated with the identity of the organization

Note the word 'ethics', ISO 9004 is way ahead of ISO 9001 in addressing ethical behaviour.

[18:15] Breaking down ISO 9004's Clause 7 Leadership – Policy, strategy, objectives, and communication, all framed around driving sustained success rather than just QMS conformity.

It refers back to leaders promoting the mission, vision etc. It talks about them creating the environment in which people are engaged and committed to objectives. It also describes unity of purpose and direction (established by top management).

In 7.2 we have policy AND strategy.

ISO 9001 does require alignment to strategic direction, but here it guides us to develop strategy, either by a recognised model or one bespoke to the organisation. It even proposes that top management should make strategic decisions regarding competitive factors and provides a model for doing that, it then goes on to discuss the alignment of objectives.

It takes objectives way beyond ISO 9001 and considers framing them in terms of the organisation's positive impact on society and the environment, and it's people's engagement in society beyond merely business-related activities. Again, we see the ethical slant in ISO 9004 well before its inclusion in ISO 9001.

[18:15] Breaking down ISO 9004's Clauses 8 & 9 –

Clause 8 - Process management: Determining processes, assigning responsibility and authority, and managing processes. This clause contains fuller treatment than ISO 9001's process-approach requirements, but also one which discusses processes as means to fulfilling objectives.

Clause 9 - Resource management: Beginning with people (engagement, empowerment, competence), organizational knowledge.

Competent, engaged, empowered and motivated people are a key resource. Engagement of people enhances the organization's ability to create and deliver value for interested parties. Empowerment enhances the motivation of people to take responsibility for their work and its results.

9.3 covers organisational knowledge, which receives very scant treatment in ISO 9001, but is expanded upon greatly here.

Here it's described as:

'An intellectual asset which top management should manage as an essential element of the organization's sustained success.'

The rest of clause 9 gives very broad guidance on technology, infrastructure and work environment, externally provided resources. All much more detailed than the ISO 9001 equivalents.

In one part it discusses:

'Creative work methods and opportunities for greater involvement, to realize the potential of people in the organization.'

And notably it mentions natural resources, which doesn't appear in ISO 9001 at all.

[23:35] Breaking down ISO 9004's Clauses 10 &11 –

Clause 10 - Analysis and evaluation of an organization's performance: performance indicators, performance analysis and evaluation. ISO 9004 ties these back to policy commitments, needs and expectations of IPs, efficiency of processes, efficiency of resource use, finance, compliance, risks & opportunities.

It frames internal audit, not just in terms of conformity, but also in terms of opportunities, promotion of good practice, increasing understanding.

Clause 10.6 also introduces self-assessment

Clause 11 - Improvement, learning and innovation: Improvement here is defined as an activity to enhance performance, small-scale or organisation-wide.

It goes beyond ISO 9001 to encourage improvement and innovation through learning (learning doesn't appear in ISO 9001). It also has a whole sub-clause on innovation (11.4).

A note about Annex A of ISO 9004: It can be utilised as a self-assessment tool. It includes a maturity model plus detailed element-by-element assessment criteria, which organisations can use to score themselves against the concepts in the document.

If you'd like help with ISO 9001 or assistance with making best use of ISO 9004, feel free to reach out to us, we'd be happy to help.

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The need for Information Security has only increased as we become more dependent on technology to keep things running smoothly. Even in industries such as construction, which many may have assumed were largely exempt.

While not common, there are a few within the construction space that have taken the initiative to implement best practice information security Standards, such as todays' guest, AmcoGiffen.

In this episode, Ian Battersby is joined by James Butler, IT Director at AmcoGiffen, to dive into why they chose to implement ISO 27001, what they learned during the process and the benefits felt following certification.

You'll learn

· Who is James Butler?

· Who are AmcoGiffen?

· What was the main driver for ISO 27001 Implementation?

· What was the biggest gap identified during the Gap Anaylsis?

· What did AmcoGiffen learn from the Implementation journey?

· What are the main benefits of ISO 27001 Implementation?

· James' Top Tip

Resources

· AmcoGiffen

· ISO 27001

· Isologyhub

In this episode, we talk about:

[02:35] Episode Summary – Ian Battersby is joined by James Butler from AmcoGiffen to discuss their journey towards ISO 27001 certification, including the challenges faced and resulting benefits following certification.

[03:00] Who is James Butler? James Butler is the IT Director at AmcoGiffen.

One thing many may not know about him is that he's recently started taking swimming lessons aside his kids. Growing up, there weren't many opportunities to learn, so he's taking the time now to both set a good example for his children and to ensure he can keep them safe when in bodies of water in the future.

[05:40] Who are AmcoGiffen?: AmcoGiffen are a national contractor for construction and engineering throughout the UK. They are owned by the group company Renew Holdings.

Their projects range from rail, infrastructure, highways, environmental sectors to aviation.

[07:10] What was the main driver behind ISO 27001 Implementation? They had a couple of reasons:

1) They wanted to ensure that clients, stakeholders and shareholders had confidence in their ability to secure their data and information along with their employees data.

2) When you work in the public sector, ISO 27001 is becoming a necessary certification to have. James expects that within the next 5 years, it will be just as mandated as Cyber Essentials currently is.

AmcoGiffen already proudly hold Cyber Essentials Plus, and saw ISO 27001 certification as the next natural step to provide that extra level of assurance.

[08:35] How long did it take to achieve ISO 27001? It was discussed for a while before committing, but the whole process took around 12 months from start to certification.

At first, they did want to challenge themselves with a shorter timeframe, but after starting the process they realised that a shorter time restraint was adding unnecessary pressure and wouldn't have resulted in a good Management System that could be used.

So, they took a step back and allowed more time for the system to be properly integrated into the business, which was that part that took the longest, as documentation is the easier part to deal with.

[10:55] What was the biggest gap identified during the Gap Analysis? – For AmcoGiffen, the biggest gap was documentation.

They already had a lot in place where controls were concerned thanks to their existing Cyber Essentials Plus certification, but the actual documentation of processes, objectives and risks were lacking.

ISO 27001 allowed them to put the structure in place to manage this. Their key message throughout the implementation process was: 'we need documentation for the right purpose'.

[09:55] What did AmcoGiffen learn from the Implementation journey? ISO 27001 helped to create a priority list, while also allowing them reflect and realise they should be documenting a lot more, not just to meet Standard requirements but because it's the right and responsible thing to do.

One such example is making sure that there's enough information to allow someone to pick up a task if it's passed to them.

They went to great pains to ensure the whole implementation wasn't forced, and as a result they passed both their Stage 1 and Stage 2 Assessments with no non-conformities or observations!

AmcoGiffen also had the benefit of strong leadership commitment and involvement throughout the Implementation. James stresses the need to have Leadership buy-in from day one, otherwise you have to fight an uphill battle of making cases for the changes that you need to make as a result of implementing a Management System.

He also make a point of ensuring you understand your stakeholders requirements, as ISO 27001 is not just an IT Standard, it touches on aspects like HR and physical security, aspects they may actively be involved with. If possible, it's best to bring them in and involve them in the initial planning so you're all on the same page of why you want to achieve Certification.

[15:20] When did AmcoGiffen achieve Certification? – They completed they Stage 2 Assessment in July of 2026 and received the certificate in September of 2026.

[15:50] What are the benefits of ISO 27001 Certification? – James states that the benefits started from day 1 of the implementation process.

The initial Gap Analysis allowed them to really look at how they currently operated, what were their strengths and weaknesses, where potential opportunities were.

It gave them the chance to gather people from all corner of the business to come together and discuss their current processes, get feedback on how they could be improved, and ensure the updated processes would fit in with how they actually worked.

James states that IT professionals can have a tendency to over complicate things, so he ensured that the system remained something that could be easily understood and integrated into the business.

One other thing they implemented early was a mature Risk Register, this was so they could be driven by the actual risks facing the business and not just by who was shouting the loudest.

Ultimately, ISO 27001 has provided a lot more organisational structure and more direction on priorities.

[18:55] James' Top Tips – Do it for the right reason, don't do it as just a tick box exercise. If you're simply doing it for a badge on the website, then it's unlikely it will be providing any real benefit as it requires effort to keep the momentum of continual improvement going.

Secondly, get Leadership buy-in before committing to certification. The process will be difficult without that endorsement from the top down.

Lastly, challenge yourself to remove friction. The system has to work for the business, not just the auditors of the system. The key is to make the right information available to the right people at the right time. Don't just bog them down with endless processes and manuals, keep it simple and easy to understand as that's how a system gets integrated successfully.

[21:50] James' book recommendation – The subtle art of not giving a f*ck – Mark Manson

[23:45] James' favourite quote – 'Keep it simple'

If you'd like to learn more about AmcoGiffen, check out their website.

If you'd like help with ISO 27001 Implementation or on-going support, feel free to reach out to us, we'd be happy to help.

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Many of you will be familiar with ISO 9001, the leading Quality Management Standard, which provides a solid foundation for managing any business. However, for certain industries, ISO 9001 alone is not enough.

The built environment is one such sector, as it requires more rigorous controls to keep projects on track, ensuring safety of all involved and processes that enable documented accountability for each and every step until project delivery.

BS 99001 was introduced in 2022, not to replace ISO 9001 but rather to add to existing quality management systems for those in the built environment sector.

In this episode, Ian Battersby is joined by Darren Morrow, Senior Consultant at Blackmores, to explain what BS 99001 is, how it addresses challenges unique to the built environment sector and explore the clauses and how they differ from ISO 9001.

You'll learn

· What is the built environment sector?

· Why was BS 99001 created?

· What is BS 99001's relationship with ISO 9001?

· How does BS 99001 differ from ISO 9001?

· Exploring the clauses of BS 99001

· Where is BS 99001 going in the industry?

Resources

· Isologyhub

· BS 99001

In this episode, we talk about:

[02:35] Episode Summary – Ian Battersby is joined by Darren Morrow to explore BS 99001, Quality Management for the Built Environment. Join them as they discuss the reason for the Standards creation, it's relation to ISO 9001 and an overview of it's main clauses.

[03:30] What do we mean by the Built Environment Sector? The sector covers the whole human-made environment:

· buildings (homes, workplaces, hospitals, schools, entertainment),

· infrastructure (roads, rail, bridges, utilities),

· public space (parks, squares, streets etc)

On top of that, you could also add the urban environment on a large scale, the way cities and towns are planned, developed over time, connected

Any profession involved could apply this standard:

· Design and planning (town planners, architects, interior designers, landscape architects)

· Engineering (civils, structural, M&E, transport, environmental (planning our waste, water etc)

· Construction (delivery, PMs, QSs, SMs, trades, contractors)

· Management (of estates/facilities, property developers, agents, surveyors, valuers)

· Policy, regulation, compliance (local authorities, planning officials, building control, regulatory authorities, enforcement agencies)

[05:00] Why was BS 99001 created?: Despite the widespread adoption of 9001 across the industry (and it being a prerequisite in many circumstances), there has continued to be a series of significant incidents, numerous reports and national enquiries. These all point to an issue with quality that a generic standard appears to have failed to address. When this is the case, it's a sign that something more sector specific is necessary to avoid repeating the same mistakes.

The UK Building Safety Act is now being enforced, which has added more implications and requirements on contractors. BS 99001 can help to support compliance with this due to its focus on responsibilities, competency and accountabilities.

[09:45] What is BS 99001's relationship with ISO 9001?: BS 99001 doesn't modify or replace ISO 9001, it builds on it for the built environment sector.

ISO 9001 creates a solid foundation for any business, but because of this it is deliberately vague in it's requirements. BS 99001 in comparison is very prescriptive with what it what's businesses to do, record and evidence.

[10:30] How does BS 99001 differ from ISO 9001? BS 99001 is very much aware of the project based nature of its targeted sector, so the requirements are written with this in mind. Its requirements are written to ensure all parties involved in construction projects are included, accountability is its foundation, and it looks to help facilitate a lessons learned environment for compliant businesses.

[11:30] BS 99001 Clauses: 4 Context - We're all used to this clause, but there's a note to consider the nature of the interested parties, as it's a lot more prescriptive and includes:

· Members of the public are suggested first (users of stations, tenants in social housing)

· Owners and operators of assets (ie, the built end product)

· Project funders/investors

· Project owners/sponsors

· Project teams

It also requires context documents specifically taking into account commitments to social, economic and environmental sustainability. So ESG is being embedded from the start.

These interested parties encourage open forums between not only all those involved in the actual construction, but those that will be affected by the project and end product.

This commitment to social, economic and environmental sustainability is a theme that continues throughout the whole Standard.

Some businesses that already hold certification to Standards such as ISO 14001 and ISO 45001 think they may already have all of this covered, and in many ways they would be correct, however those typically apply to the business as a whole whereas BS 99001 incorporates everything in and around the project rather than treating projects as a separate entity – which is how other ISO Standards act in this sector.

[15:40] BS 99001 Clauses: 5 Leadership – The specific requirement states:

'Top management shall ensure that a competent person is appointed as the management representative with oversight of quality for projects the organization is involved in or plans to be involved in'

This may seem like an old-fashioned approach, however the need for competency in this sector is paramount. Organisational roles, responsibilities and authorities for Quality Management roles with clear competence and impartiality / independence criteria are explicitly stated. What was once a role that may have not held the power to stop a project like Health & Safety roles, now has that ability.

If something is raised as a quality concern, then there is a strong argument for that becoming a safety risk down the line. It's better to fix something early on than to have it become a bigger problem, therefore, significance to the roles that point out these issues have been given the power they deserve in the project management process.

[20:00] BS 99001 Clauses: 6 Planning – Risk management is an essential part of BS 99001, Clause 6 is where the requirements for risks and opportunities is explicitly stated, however, these are references multiple times throughout the Standard.

There are specific Risk requirements to take account of are:

· Projects it is involved in or plans to be involved in;

· The process of construction and the subsequent use of the asset;

· The organization as a whole; and

· Society the economy and the environment.

Many construction companies will be tendering for multiple jobs, so it's a good opportunity to build a robust risk register that gets added to with each project. Learning from one project should be used to help you to bid for the next one.

Keeping track of these should also be done so you can inform your interested parties of the risks involved, and any subsequent lessons learnt should also be of value to your supply chain.

One key group that often gets overlooked is the Funders, they'll have a particular interest in the risks and to have all the knowledge available about what they're funding. Having records to answer their questions will keep them happy or at least informed.

Objective requirements include:

· Quality objectives for each project, to reflect contractual and other requirements

· Evidence of the following considerations in objectives:

· Defined scope, time, cost and project lifecycle

· Social, economic and environmental commitments

· Collaboration with interested parties

In ISO 9001, the objectives are set from the business level, but in BS 99001 these are aimed at the project level.

[24:10] BS 99001 Clauses: 7 Support – As mentioned, people and competence is a big focus for BS 99001. Evidence for competence arrangements include:

· Project / contract specific roles and responsibilities - formally assigned

· Formal process(es) for determining competence

· Competence arrangements relating to all people working on the organisation's behalf

There are also verification processes for all external providers, including the need for:

· Authorities for approval of operations, processes, design, production, inspection and tests

· Competence arrangements for management representative(s) specifically regarding quality

· Evidence that competence arrangements take into account requirements of interested parties

It's up to the business to make sure they can prove people are competent for the roles they are assigned, which is why there is a lot of detail in this area.

Documented information is also key, as this provides a traceable and auditable path of accountability. Again, BS 99001 is a lot more prescriptive on this clause when compared to ISO 9001.

BS 99001 requires documentation of:

· Process(es) to ensure awareness of statutory / regulatory requirements specifically relating to documented information (eg, building information, product safety, structure, maintenance, retention timeframes)

· Approval methods and authorities for the different types of documented information

· Communication / availability / control of changes to documented information to interested parties

Now this doesn't mean you have to drown yourself in paperwork! These can all be stored as electronic records.

This clause also sees a lot of repetition with areas such as risk, however this is simply the nature of Standards. They operate on the Plan Do Check Act cycle, you plan to do something, you do it, you check, you've done it, and you act on it.

This repetition is there for a reason, documenting information especially as you need to prove that your final deliverable is safe, that it's operational and that it can be maintained.

While documentation may seem like a painful process in the early phases of a construction job, it will serve you well once the project is completed as when you get to the point of handover, everything is already done and all required information is readily available for those interested parties.

[31:55] BS 99001 Clauses: 9 Monitoring, measurement, analysis and evaluation – In ISO 9001, it's largely up to the organisation to determine what they monitor and measure, however in BS 99001 there are specific which must be measured, including:

[28:30] BS 99001 Clauses: 8 Operation – This, like in most other Standards, is where the bulk of additional requirements sits.

8.3 Design includes:

· Re-iterates the need to appropriate design processes at organisation and project level

· Clear definitions of roles and responsibilities

· Review, verification, validation, approvals and associated competences

· Inclusion of interested partes

· Compatibility between parties and their designs

· Design maturity/novelty

· Documentation needs

· Life-cycle

· Addressing of regulatory requirements, product safety

8.4 Control of externally provided products and services - Again, 9001 allows an organisation to determine its own controls over the supply chain (according to risk).

But here, the standard specifically acknowledges the issues with supply chain which partly gave rise to it. It starts with defining the authority to approve suppliers

The rest of clause 8 (Control of production and service provision) continues in similar detailed fashion, matching similar themes

When we get to 8.7 (Control of nonconforming process outputs, products and services), we see the need to define specific roles, responsibilities and processes

It also includes specific requirements for:

· Evidence of reports to design team regarding design root causes

· Close out of corrections

· Agreements of interested parties to corrective action

· Concession/design change notifications to design authority

[35:45] BS 99001 Clauses: 9 Internal Audit – BS 99001's internal audits must be risk-based and include projects. You also need to evidence audit results being reported to interested parties.

It also goes without saying that you need evidence of auditor competence.

Where Management review is concerned, you must include specific information on the performance of projects, and also evidence management review outputs being reported to interested parties.

[37:45] Where is BS 99001 going in the industry? – Currently, this is a Standard that applies more to bigger multi-million pound projects. However, Darren is seeing more of the requirements being pushed down the supply chain.

We do see that happen with the likes of ISO 9001, ISO 14001 and ISO 45001 certified organisations doing much the same with their supply chains. But BS 99001 differs as it explicitly promotes pushing its requirements down the supply chain, it's not just a passive affect, it's something to be actioned through leadership by promoting quality management.

[39:55] Top Tip – If this Standard is applicable you, we highly recommend you complete a Gap Analysis, even if you're already certified to ISO 9001. This Standard differs quite a bit and ISO 9001 misses the requirements that cover the project life-cycle, sustainability and social aspects that BS 99001 focuses on.

At a basic level, ensure that your skilled people have their competences ready and available for if a client requires that information.

[41:30] The advantage of BS 99001 – BS 99001 ensure that your business can plan well and protect itself with the required record keeping. If things go wrong, you have the documentation to protect yourself, and with the additional planning requirements, you can minimise the risk involved in projects before things have a chance to go wrong.

If you are in the Construction Industry, this Standard is worth looking into.

If you'd like any assistance with implementing or supporting BS 99001, get in touch with us, we'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Many businesses do not own the property they operate in, this can lead to complex questions over who has ownership over certain property and facility related legal obligations.

Managing areas such as waste transfer, electrical, gas and aircon servicing etc could feasibly be managed by both landlords and those leasing the property, and it's important to establish who manages what to ensure all legal requirements are met.

In this episode, Ian Battersby discusses the complexities of leasehold compliance, including how to establish key responsibilities, examples of what legal and ISO related requirements need to be met and what evidence you need to be keeping a record of.

You'll learn

· What is leasehold compliance?

· What areas do you need to consider within leasehold compliance?

· Establishing responsibility

· What subject areas relate to ISO compliance?

· How to plan for leasehold compliance and gathering evidence

Resources

· Isologyhub

· PAS 79

· BS 5839

In this episode, we talk about:

[02:35] Episode Summary – Ian Battersby discusses leasehold compliance, including establishing responsibilities and gathering evidence to ensure your legal and related ISO requirements are being met.

[02:45] What is leasehold compliance? Many organisations don't actually own the property where they operate, it's very common for businesses to lease property.

A landlord will lease the property to a client and often appoint a building manager, managing agent to run it on their behalf and act as the interface with all the leaseholders.

Sometimes, the building manager will be part of a large organisation which also provide facilities management services. Often they'll only offer the most basic of services and will contract another party to provide further facilities management.

Whichever party provides general facility management services will almost certainly need to contract another layer of providers responsible for specialist services such as waste transfer, electrical / gas / aircon servicing.

Sometimes, the leaseholder will directly contract a third party for a service (air con, electrical, PAT, cleaning).So all in all, it can be quite a complex picture of responsibility!

[05:10] The complexities of leasehold compliance: It can be tricky navigating through this and demonstrating that you've fulfilled all your own legal obligations as well as gaining assurance that other parties have done what they need to do to protect you and your employees.

Often, those charged with liaising with the building manager are not experts in Health & Safety, Environment, Facilities Management and compliance. It might be the office manager who picks up this role.

In some cases, you have an absolute duty, even where the landlord has complete control over the service which is provided to you (e.g. waste management).

[06:45] Establishing Responsibility: Establish who owns what, who is responsible for things such as building fabric, installed services, the contracting of support services.

But, regardless of actual ownership and the direct responsibility for a particular aspect of a building, there is always an interrelationship, a dependence between building, infrastructure elements.

For instance, you may use a whole floor which has been fitted out for your own purposes, you own the electrical installation from the walls inwards, but that links into the electrics beyond your own shell.

You may have certain responsibilities in your own area for firefighting equipment, fire doors etc, but fire safety also depends on things like:

· The escape routes

· The building's fire alarm

· Emergency lighting

· Protection of the common areas such as the lobby

If the building isn't safe beyond your own demise, your own demise isn't safe.

While you may not have direct control over these aspects and your legal responsibilities, leases may leave the burden on you to seek evidence.

Although there should be demonstration of various compliance obligations throughout the pre-let enquiries process. You may even be lucky enough to have a lease clause which requires landlord to complete or contribute towards compliance reporting.

[08:30] What subject areas relate to ISO compliance?: Standards where leasehold compliance is particularly relevant include ISO 14001 environmental management and ISO 45001 Health & Safety management.

For both of these, there may be a need for you to provide your own evidence or seek assurance from a third party. The examples we're providing here apply to office locations and for more complex, more industrial, more heavily commercial premises.

Considerations / requirements for either one of both of these Standards include:

Energy performance certificates:

Legally required documentation. They rate the energy efficiency of a property from A to G, and they have to be provided prior to leasing and on leasing. These can apply to a whole building or just a wing or floor of a building. These can be verified online via a .gov portal.

As of the 1st of April 2023, any commercial property in England or Wales must have a minimum energy performance certificate rating of E. However, this is set to change after consultation, so from April 2031 you won't be able to let property unless it's in the A or B band.

Recommendations Report:

This supplements the previously discussed energy rating. This report, as the name suggests, provides recommendations for improving efficiency. If you're already rated an A or A+, then there may not be too many recommendations. But C and below will have some that will improve your building over time.

It's important to note that there is no mandatory obligation to action these recommendations, and some provided can be quite generic and not at all applicable. However, you should seek through the landlord and ask if they're following through on any of the recommendations to improve energy performance, particularly if you will be looking to renew leases around the time that the law changes.

Air Conditioning:

If your building is relatively new, less than five years, you will really need to see the installation and commissioning information associated with air conditioning.

There should be records of building control, electrical installation, commissioning certificates, and also a test which is called a TN 44. This test is legally required once on installation and then again after every 5 years. It needs to be carried out by an accredited energy assessor, who can be verified via the same Government portal as the Energy performance certificates.

This applies to any system with an effective rated output of more than 12 kilowatts, which quite simply, is nearly all commercial offices.

The TN 44 test will also provide a report which includes recommendations on how to use the equipment, the management regime for its setting points for temperatures and other such advice to keep it working as efficiently as possible.

The person responsible for air conditioning is responsible for this certificate. If you own the aircon in your demise, it's yours, if the landlord owns the aircon, it's theirs.

F Gases:

Any system which contains fluorinated greenhouse gases, so what we call F gases, needs to be inspected regularly to ensure that none of the gas leaks and to ensure that they're operating at optimum efficiency.

This can includes things such as air conditioning, heat pumps, Fire Protection (aerosols and foams) and is often used in various parts of Industrial Manufacturing.

If there are any leaks, they need to be logged, replacements need to be made, recharge needs to be done, and all this needs recording in a logbook.

When it comes to servicing of anything that uses F Gases, you need to check the competence of those individuals. Refcom has a register of accredited / approved companies that provide these services.

Fire Risk Assessments:

Fire Risk Assessments are legally required documentation which needs to be carried out by a competent person.

There isn't a prescribed frequency on fire risk assessments, but you should really be reviewing them at least annually and doing a full reassessment on a three-year period – or when there has been a significant change to the layout / occupation of the building.

There is a mandatory way of completing a fire risk assessment, PAS 79, which is a publicly available specification. So you need to check that yours are being done in alignment with this Standard as this provides proper risk evaluation and an action plan which is prioritized according to the level of risk.

It may also be worth checking with your insurance organization or any local authorities whether they have a prescribed frequency for your fire risk assessments.

Fire Alarms:

You will no doubt have a fire alarm within your building, this may be the landlords own fire alarm system or it may be one you as the leasehold business own. As a starting point, you need to understand who has ownership of this.

On installation and commissioning, you must comply with certain standards. For the UK this is BS 5839, which requires building control, a commissioning certificate, handover certification, the correct drawings, a manual, a logbook, specific training to the owners and users of the system.

Every six months you should have a competent person complete maintenance, servicing and inspection to ensure that the way the fire alarm was installed is the way it remains in compliance with BS 5839.

As well as a six-monthly inspection, there is also a competent person test and inspection over elements over and above that, which requires certificate issuing annually.

There's also a full test and inspection of the wiring underpinning the fire alarm system. This isn't prescribed, but it's commonly conducted at 10-year intervals.

Fire Extinguishers:

You may own the fire extinguishers in your own demise or they may be owned by the landlord.

What you need to do is, if you own fire extinguishers within the organization, take responsibility for regular walk arounds to check that they're all in the right locations, the right numbers are present, that they are accessible, secure, fully charged in the green zone, undamaged, the seal is untampered, and the service date is correct.

Every year, you need a competent person to come in and check the fire extinguishers fully, record this in the fire logbook and provide a certificate of service for each of the extinguishers in use. Depending on the type of extinguishers you've got, you may need a five yearly or possibly longer frequency extended service.

Other Fire Suppression Systems:

You might have a fire sprinkler system which will require installation and commissioning certificates. Regular inspection maintenance service will then depend on the type of system, this could be anywhere between a quarterly, annually, five yearly, 10 yearly inspection regime.

There should be evidence that there is some form of local regular inspection to check that there is no visible damage to a fire suppression system.

We would advise you to discuss with your landlord about what process exist for those inspections.

There are also fire doors that need both competent person checks on a six month to annual basis to check for the physical robustness for the opening and closing mechanisms for external escapes to open correctly.

But there should also be regular checks by local representatives within your organization of any fire doors within your own demise and from your own demise to check that they are physically sound and operate correctly.

The escape routes from those should also be checked by the landlord for any obstructions beyond your demise to see that there's an adequate, safe path from the building in the event of a fire.

Emergency Lighting:

There is again a regular monthly checking to see that emergency lighting comes on should the power go down.

Sometimes that's by flick testing, nowadays, some buildings have automated testing of their emergency lighting. This requires an annual inspection be a competent person, which will result in a test certificate as proof of inspection.

Gas servicing and electrical wiring inspection:

Gas servicing is required once a year by a gas safe, registered, competent person, and the resulting certificate will indicate whether there are any recommended actions.

With electrical installation and condition reports (EICRs), Electrical and fixed wiring is checked every five years and on installation and commissioning as well.

These have different levels of findings, including:

· C1, danger is present

· C2, potentially dangerous

· C3, improvements recommended

· And FI, further investigation

Anything which is a C1 and C2 needs to be addressed, anything which is an FI requires seriously looking into to see what the implications are.

If you have your own EICR for your own demise, you should be checking the content of that to see what the recommendations say, not just accepting the certificate as if it is the gospel says your equipment is safe.

If the landlord is responsible for an EICR in other parts of the building, you should liaise with the landlord to see what implications there are for you.

[29:15] How to plan for leasehold compliance and gathering evidence: What's your strategy for making sure you are safe and you know you're safe and you can provide assurance of that safety?

If you've got direct control of the contracting of any services, then it can be quite straightforward because you control the contractor:

· You should be verifying the contractor's competence.

· You should be verifying that they're providing the right service, maintenance, inspection, test documentation.

· You should have within that documentation recommendations, risks, actions that you can then take forward.

But if you rely on the landlord's agent, for instance:

· You have to rely on cooperation with them.

· You also have to rely on their own understanding of their obligations and their record keeping.

You'll need to approach them with a structured list to request all the things you need to meet your legal requirements. Work out a way to retrieve what you need, as they need it as well, so it should be straightforward once they've sourced it to provide you with it.

If you have any regular tenant, landlord, managing agent meetings, use those to review compliance and any progress on recommendations. If those meetings don't exist, perhaps you could set up some form of regular meeting where you can assess your level of compliance and monitor any movement in that.

Where you've received any record from a service, a maintenance, a test, a certification or an assessment, study that carefully. See where the risks are and follow through on relevant recommendations.

If you'd like any assistance with navigating leasehold compliance or implementing ISO standards, get in touch with us, we'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

There has been a lot of buzz around the upcoming Universal Project currently in development in Bedfordshire. It's estimated to generate around £50 billion in economic benefit, along with the creation of 20,000 jobs during its construction, and a further 8,000 jobs once it's operational.

It's undoubtedly brought a lot of eyes towards the smallest county in the UK, and with it a lot of opportunity for local businesses to get involved with not only the main theme park itself, but the surrounding projects that aim to make Bedford and beyond a thriving tourist destination.

For those wondering how to get involved, there is a dedicated group looking to share knowledge and tools to get you tender ready.

In this episode, we are joined by Lorna Leonard, Managing Director of LBS, and Kirsty Maynard, Commercial Director of THSP, who are instrumental in running BedX, a group dedicated to sharing knowledge and tools to help businesses get tender ready for Universal and beyond.

Listen to our roundtable discussion as we dive into why BedX was created, its main drivers, how it can support local businesses and how you can get involved.

You'll learn

· Who are Kirsty and Lorna?

· What is BedX?

· What were the main drivers behind the creation of BedX?

· What are the group's main aims?

· What are Kirsty and Lorna's roles within the group?

· How can businesses get involved with and benefit from BedX?

· What can businesses be doing now to get tender ready for Universal?

Resources

· Bedfordshire Chamber of Commerce - BedX

· BedX Webinars

· Tender Diagnostic

· Kirsty Maynard LinkedIn

· Lorna Leonard LinkedIn

In this episode, we talk about:

[02:25] Episode Summary – Stephanie Churchman and Carly Mowbray are joined by Lorna Leonard (LBSv) and Kirsty Maynard (THSP) to discuss the creation of BedX, and how it aims to support businesses with tender preparation ahead of the Universal and related projects currently underway in Bedfordshire.

[01:25] Who are Kirsty and Lorna?: Kirsty is the commercial director at THSP. THSP work with businesses across health and safety, HR and compliance, helping organizations make sure they've got the right systems, processes and people in place to operate safely, professionally and compliantly. THSP have been in operation since 1992 and support any type of organisation, from construction to food brands, global luxury retailers, major transport organizations, and complex international businesses operating in highly controlled environments.

Lorna is the managing director of LBS. LBS is a business solutions company supporting sophisticated start-ups and growing corporations with outsourced finance department services, direction and solutions. She set-up the business 14 years ago, and has worked with organisations of all sizes, from blue chip companies to micro businesses of only 1 or 2 people.

Regular listeners may recall Lorna from a previous episode, she also shares many insightful posts on LinkedIn and is certainly worth a follow!

[07:05] What is BedX? It's A business-led working group powered by the Bedfordshire Chamber of Commerce. It was created to help Bedfordshire businesses understand, prepare for and win work from the major investments coming into the region, in particular, the universal destinations and experiences, the Luton Airport expansion and other on-going linked projects.

BedX's role is to connect, inform and prepare, but they don't lobby, they don't represent the developers and they don't do politics. They are simply there to help local businesses get ready.

[07:45] What were the main drivers behind the creation of BedX? The Universal park is certainly the banner piece for the group. It's what all the big numbers are attached to, including 5 billion pounds worth of inward economic investment, 20,000 jobs created and the five years' worth of construction.

However, that is just one part of the upcoming development going on in Bedfordshire. The big project is seeing more funding going into the area to support transport networks and other venues as investors seek to make Bedfordshire a place worth staying for more than just the Universal Park.

Other projects include the expansion of the Wixams Train Station, construction at the Luton Hoo, the new Luton Town Football Club and a new Data Centre at Quest Pit.

BedX was created in response to all of these projects, not just Universal. It's to help local businesses navigate these opportunities, as this small county has rarely seen such a seismic shift in the amount of investment going into the area.

Even though the deadline for Universal Park is 5 years away, supply chains are looking for support now, which is why it's better to start preparing sooner rather than later.

[10:20] Making Bedfordshire a play to stay: It's also not just about the venues, to prepare for the influx of tourists there will be more investment in housing and transport and related routes such as the work currently going on at the Black Cat roundabout.

Kirsty states that the Bedford County Council have a scrutiny committee, which is currently labelled as the Universal Scrutiny Committee, and are in discussion about a viable tourist strategy for Bedfordshire. So, there is no doubt that there will be many more small projects going ahead within a very short timeframe to get the area ready.

[12:00] How LBS's expertise is instrumental within BedX: Businesses that want to get involved may not know how to get working capital or access potential available funding, which is where Lorna's and LBS's expertise comes in to support BedX's aims.

With tenders as highly valued as this, it can throw businesses through a loop if they're not prepared. Lorna shares a story where she explains that she used to work for a company that made point of purchase display equipment, this company had a US subsidiary called Anshauser-Busch, who own Budweiser.

That subsidiary put through an order directly through to their factory, requesting a huge order be manufactured and delivered within 180 days. The cost of which was upwards of $2.7 million, which was due to suppliers 150 days prior to Lorna's company at the time being paid.

It was their first time working with that subsidiary, so there was no guarantee on payment. The lessons they learned ended up shaping how the company operated going forward.

All this to say, if you're bidding for high value contracts, you need to think about the opportunity from every perspective.

[14:40] Be realistic about what you bid for: Kirsty states she is really passionate about ensuring businesses are trying to grow responsibly, so that they understand those terms in the bid and that they're realistic about the size of contract that they should be bidding for.

If you're looking for more guidance in this area, Katie from Bids and Tender Support provided a webinar on this topic for BedX. It's available to view on-demand on BedX's website.

[16:25] Lorna's role within BedX: Lorna reminds us that a lot of the Tier 1 contractors started out as 1 or 2 person businesses. She states that, honestly, 90% of the companies that BedX help will not be in direct contact with one of those Tier 1 contractors. However, supply chains are just that, a chain, there are many opportunities to get involved further down the line.

Lorna feels as if that's a large part of her role, keeping businesses focused on the opportunities they can access within that supply chain. She is also keen to help all the local businesses understand how this is going to affect them, because whether they get involved in the various projects being built or not, the whole area is going to be affected regardless.

She points out an example where they needed to source a large number of electricians, and it turns out that Bedfordshire simply doesn't have enough! So BedX is helping to make the wider community aware of training opportunities like this that can open doors for local businesses.

[18:45] Other considerations for businesses operating in Bedfordshire: Lorna points out a few other concerns that people had about the on-going development in the area, including the possibility of local contractors putting prices up due to all the other projects. Timeframes may also be affected by both on-going work and the fact that more businesses will be getting involved in the area's development.

[19:15] What are the group's main aims?: BedX's main aim is to be an opportunity exchange, they sit in the middle as a conduit between the opportunities and the Bedfordshire businesses and help to inform, educate and prepare to be a part of it.

They are there to support preparation local businesses are able to access emerging supply chains as that waterfall flows down into tier 2 and 3 and even into 4 and 5 over the course of the project.

If you're not sure which of those tiers you'd likely sit in, BedX have a helpful household checklist to find out.

[20:20] Getting ISO Ready for Universal: Kirsty mentions that she's seen a lot of recent Pre-Qualification Questionnaires (PQQ's) request that bidding companies are certified to ISO 27001 Information Security.

Many will be familiar with the requests for ISO 9001 (Quality Management), ISO 14001 (Environmental Management) and ISO 45001 (Occupational Health & Safety), but ISO 27001 seems to be a more recent pre-requisite.

This is particularly the case for any Government contracts, with them stating either Cyber Essentials or ISO 27001 must be in place for any bidding businesses.

Carly points out that ISO 27001 in many cases is just the first step, as you can strengthen this with supporting Standards such as ISO 27701 (Privacy Information Management) and ISO 27017 & ISO 27018 (Cloud Security), which can give you an advantage over your competitors.

If you've not got any Standards in place, or are just starting out on your implementation journey, you can get in contact with Blackmores as we'd be happy to guide you towards successful certification.

[25:00] Kirsty's role within BedX: Kirsty's role is focused on coordination, though all BedX organisers are volunteers, they still want to ensure that actions are followed up and completed.

Kirsty has a project planning background and brings those skills to the group. She also plays a key part in tender and procurement readiness, as she has years of experience with PQQ's from her work within the construction industry. She knows what good looks like when bidding for work, and ensures that knowledge is being passed on to those looking to bid for Universal and other Bedfordshire development projects.

A trait that many of the BedX team hold, Kirsty and Lorna especially, is the motivation to help people, and this group allows them to do so at scale.

[27:45] How can businesses get involved with BedX?: You don't need to be a member of the Bedfordshire Chamber of Commerce to get involved. Currently BedX's main focus is on knowledge sharing, so their main output in webinars.

They also have a tender diagnostic tool available, this is an online tool which takes just a few minutes to complete and will give you an idea of where you're already compliant and where there's work to be done.

They have also had 1 in-person event, that being their official launch in April of 2026, which was attended by members from the Bedfordshire business community and representatives from Universal, Sizewell C and Luton Rising. They expect to run more in-person events in future, so keep an eye on their LinkedIn for news on these! Lorna hints at an upcoming event planned for September 2026 😉

You can also sign up to the Bedfordshire Chambers Newsletter for more updates.

An 'Easy Guide To Social Reporting' is due out imminently. Those wanting to bid for Tier 1 contracts, social value is a legal responsibility, so if you're not sure on how to report on that, this is one for you to keep an eye out for.

For information you can access right now, they have:

· Contractor Tier Checklist

· Tender Diagnostic

· Working with Tier 1 contractors webinar (hosted by Henry from Kia)

· How to be tender or procurement ready webinar (Hosted by Kirsty)

· How to write a good bid webinar (Hosted by Katie Beryl from Tender and Bid Writing Services)

[31:10] What can businesses be doing now to get tender ready for Universal? One thing Lorna stresses is being visible. If you don't have a social presence or good SEO, then you may be missed as an option for those looking for specific services within these developing supply chains.

She also shares a story about the supply of the chocolate frogs that are sold at Universal Floria, which were all provided by a 2 person company. This highlights that it is possible for smaller local businesses to win big through these opportunities, but you need to be prepared. This is why Kirsty and Lorna both highly recommend making use of their Tender Diagnostic tool.

Being tender ready may seem like a daunting process, and it can quite difficult, but they are worth putting time into.

Also anything you can do to think about what you may need to change within the next few years. Think about how these developments are going to affect the traffic to the area, you might need to reconsider who your target market is depending on the whims of upcoming tourists. This can affect what services / products you offer and how you advertise going forward. The sooner you think about it, the better prepared you can be.

Lorna also recommends networking with local businesses. Bedfordshire is going to become a thriving hub, and the more connections you can make now, the better. Some of these tenders may require the collaboration of multiple businesses, which would be an all round win for everyone involved.

Networking also allows your name and brand to spread through word of mouth. If you're not in the room, it helps to have people who can vouch for you if your specific services are being sought out.

Lastly, Lorna and Kirsty just say to dream big. Just because you may be a small business does not mean you are automatically locked out of those big tenders, they are worth a try.

An important note, being local to Bedfordshire won't make up for gaps in the eyes of Universal and related projects, however, if you share equal capabilities as other companies outside of the county, then being local will tip you over.

[40:10] Evidence is key: Ultimately being tender ready is in your best interest. Contractors will be looking for evidence that you do what you say you do, so ensure you have Case Studies and the required certifications to back-up your claims.

Social Value is another big factor, which can account for up to 20% of a bid score, so this is another area where you need a clear trail of evidence.

Having a clear library of evidence to back up your claims, that align with how you operate will make you stand apart from the competition. So, start gathering this now if you haven't already.

If you'd like to get involved with BedX, check out their website.

If you'd like any assistance with implementing ISO standards, get in touch with us, we'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

AI can be fantastic for relieving a lot of administrative burdens, allowing individuals to focus on more complex tasks that need a human touch. However, many are all too quick to install and integrate, which can lead to crucial vetting processes being skipped.

So many applications have also integrated various AI features, and while you may have vetted the software before these were available, those new AI features still need scrutiny before widespread use within the business.

In this episode, we dive into why there is a need for a more cautious approach to implementing AI and share some tips on basic Information Security checks you can do to ensure an AI application or integration is safe to use.

You'll learn

· The link between AI and increasing data breaches

· Recent incidents as a result of AI misuse or error

· Key considerations for the implementation of AI technology

· 11 Information Security checks for AI tools

Resources

· Isologyhub

· ISO 42001 Webinar

· IAF Accreditation Check

In this episode, we talk about:

[02:25] Episode Summary – Stephanie Churchman explains the need for caution when exploring the implementation of AI tools, and provides guidance on some information security checks you can perform to ensure your data stays safe.

[02:45] The link between AI and increasing data breaches: Data breaches tripled since the wide adoption of AI in early 2024 and studies are saying there is a clear link between these two events. Here in the UK alone, 32% of businesses experienced a cyber-attack or data breach in 2023, compared to 43% of businesses in 2025, with us already steadily on track to surpass that in 2026.

Does this mean people shouldn't use AI at all? No, of course not, but we do need far more caution before you simply start using a tool.

[03:35] Recent incidents as a result of AI misuse or error:

ChatGPT copycat – There was a ChatGPT clone available as a web extension that was downloaded by some 1.5 million users. It functioned just like ChatGPT, answered queries and provided links to legit sources. But, in the background, it was scrapping passwords and gathering information that was to be sold off without users knowledge.

Sage Copilot - The popular accounting software had to temporarily suspend Sage Copilot after a data-isolation flaw occurred. This incident caused an issue where users who prompted the AI to list recent invoices ended up with incorrectly surfaced financial records belonging to unrelated businesses. This was a major security issue, especially for an application thousands of businesses rely on to track their financial records.

Google Gemini – Google Gemini was found to have been abused by bad actors for data reconnaissance. One particular group were building profiles on major cybersecurity and defense companies and were looking to gather specific technical job roles and salary information. Google's threat intelligence team characterized this activity as a blurring of boundaries between professional research and malicious reconnaissance. Their soft touch approach allowed the bad actors to craft tailored phishing personas and to further identify potential soft targets to compromise.

[06:30] Key considerations for the implementation of AI technology: Any software or technology you plan on introducing into the business that will interact with your and your customers data should be subject to clear vetting procedures, with clear rules for use to follow.

Before integrating an AI tool, ask yourself, is the tool you want to use:

a) Relevant

b) Safe

c) Ethical

Ethical may sound strange, and will depend on what you're using an AI for. Take CV sorting for example, many studies have shown that AI's can have an inherited bias based on their training data. This has also now evolved into AI based recruitment tools preferring AI generated CV's over human written ones.

From a safety standpoint, think about the data you are feeding into those recruitment tools, that's personally identifiable information, full names, phone numbers, emails and possibly even addresses. A full profile for an individual. Is that system your using closed, do you know if you consented to having any input data used for further training? Don't just assume that inputted data won't be used beyond your control.

If that recruitment AI tool gets hacked, who do you think is liable for the breach? Is it the AI tool developer or the business that input the data? You think the answer would be clear, but the legality of all this is still being debated.

[09:10] 11 Information Security checks for AI tools:

#1: Have an AI Policy and AI Integration approval process in place - Many businesses will already have an AI policy in place, most are very generic, so we recommend looking at the guidance provided by ISO 42001 to see what good looks like for an AI policy.

You should also create a clear approval process that any AI tools must pass BEFORE people start using them. This should be clearly communicated to the wider team, and there should be a method to manage these checks such as a ticketing system to kick off the process.

#2: Understand where your data actually goes - Find out whether inputs are used to train the vendor's models. These inputs can include prompts, uploaded files or even customer data depending on what the tool is. You also need to find out how long that data is retained, and whether it's stored in a specific jurisdiction.

You can look for answers to these in a DPA (Data Processing Agreement), don't rely on the basic marketing blurb they state on the website. If those answers aren't provided, contact the tools support or basic enquiries to find out.

#3: Check for a SOC 2, ISO 27001, or equivalent certification – This is an easy check for vendor's security posture. Absence of certification shouldn't automatically disqualify a vendor or tool, but it should prompt more due diligence, not less.

Even with a certification in place, you also need to double check that it's valid. ISO 27001 for example will need to be certified by a UKAS accredited certification body for those in the UK. For overseas, you will have your own ISO accreditation bodies, which can be verified on the IAF website.

#4: Map out third-party and subprocessor risk - Most AI tools sit on top of other infrastructure like cloud hosting, underlying foundation models and additional analytics tools. You should ask for a subprocessor list to fully understand who else touches the data.

#5: Test for prompt injection and data leakage - If the tool interacts with external content such as emails, documents or web pages, it can potentially be manipulated by malicious instructions hidden in that content. Businesses should ask vendors how they mitigate this and ideally test it themselves.

#6: Clarify access controls and permission scoping - This is especially the case for AI agents or tools with system integrations. You need to establish if the tool operates with the same permissions as the user, or whether it has broader access.

Overprivileged AI agents may operate independently with no human oversight. 'Human in the loop' has become a common phrase within cyber security for a reason, you always need a point of human oversight to ensure the AI is doing what it's supposed be doing and is doing so safely.

#7: Ask about model update and versioning transparency - You need to ensure that the vendor won't just silently swap out the underlying model for its AI tools, as this can introduce sudden behaviour changes in the tool itself.

Transparency is a key component of emerging AI security frameworks and regulations such as ISO 42001 and the EU AI Act. If a vendor isn't willing to tell you when they're making major changes to their tools, then it's not a vendor you want to entertain.

#8: Evaluate the output reliability and hallucination risk in context - For security-adjacent or compliance-adjacent AI tools, factually wrong outputs are a risk.

AI can have a tendency to 'hallucinate' data or outcomes and then present them as fact. So, ask the vendor what guardrails exist and whether their tools' outputs are auditable / traceable.

They should know what data was used to train their models, or where their models are pulling data from. If they don't or can't control what data is being used, then it's not a tool you can 100% trust.

#9: Review incident response and breach notification commitments - If the vendor is breached, do you how quickly you would be notified, and what their recovery process looks like?

If you hold ISO 27001 and ISO 22301, or simply have a business continuity plan in place then you will already have similar procedures in place for peace of mind for your own customers, so why should you settle for any less?

And just like your clients would expect, breach notifications and expected recovery times should be contractually defined, not just assumed.

#10: Consider the supply-chain risk of the vendor itself - This tech is still relatively new, and so newer AI vendors may have smaller security teams and less mature processes than what you may be used to with more established providers.

However, startup pace doesn't mean you have to tolerate the start-up risk. Consider all of the previously mentioned steps, if they don't have a lot of that in place, then they may not be mature enough yet for you to go ahead with.

This doesn't mean you have to automatically disqualify them, if they have a clear plan of action for growth, which shows a clear focus on increased security and transparency within a reasonable timeframe, then it's still worth considering.

#11: AI tool monitoring and Kill switch – In addition to this initial vetting procedure, you should also have a process in place to continuously monitor these AI tools too.

Many AI tools aren't static, they'll update and become better or possibly introduce issues as they will inevitably face the risk of bugs and other technical problems as they roll out updates. If a tool is consistently encountering issues, continuous monitoring allows this to be flagged up as a security issue.

Which is where you'll also need a kill switch in place if an AI tool is behaving unsafely. It's important that you know how to isolate it and remove it from your systems.

AI tools are more ingrained that your typical software, often designed to work in tandem with existing apps rather than as a standalone system. This will mean that some tools will have access to possibly sensitive data, something that needs to be protected if the AI tool experiences issues that could lead to that data being compromised.

The relevant staff, likely your IT team, need to have a clear process for what to do in those scenarios.

If you'd like any assistance with implementing ISO standards, get in touch with us, we'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The path towards becoming an ISO consultant is often a meandering one. It's not often a career that many aspire to, yet despite that, there are still thousands of ISO professionals worldwide.

We're continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification.

In this episode we introduce Emma Coxhill, an isologist® at Blackmores, to share their recent journey into the world of ISO consultancy and how they've found their first year working with other organisations to help them achieve ISO certification.

You'll learn

· What is Emma's role at Blackmores?

· What does Emma enjoy outside of consultancy?

· What did Emma do before becoming an ISO consultant?

· How has Emma found her first year as an ISO consultant?

· What Standards has Emma worked with so far?

· Has there been any unexpected elements to her role?

· What is the biggest challenge Emma has had during a project so far and how did she overcome it?

· What is Emma's biggest achievement?

Resources

· Isologyhub

· TISAX Webinar

In this episode, we talk about:

[00:30] Episode Summary – We introduce Emma Coxhill, an Isologist® here at Blackmores, to discuss her recent entry into the world of ISO consultancy, including how she's found working on the other side to help other organisations achieve ISO certification.

[03:30] What is Emma's role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards.

Emma specialises in information security management systems (ISMS), but is branching out to other Standards as she takes on more clients.

[04:30] What does Emma do in her free time? Emma is a big fan of the outdoors, enjoying long walks and exploring in general.

It makes sense then that she also enjoys gardening. While it is a lot of work, she finds the result rewarding.

Emma is also a big fan of movies, excluding horror films! She enjoys making the trip to see films on the big screen when she has the chance.

Lastly, Emma is also a qualified life coach. This involves guiding people to get where they want to be in life, with the crucial distinction that it's not about telling people what to do, but rather providing the right questions and tools to help them achieve their goals quicker.

These skills have evidently translated well into her role as an ISO consultant, as auditing is very similar in the fact that it's about giving people a different perspective.

[06:55] What was Emma's previous role? Emma previously worked in admi and retail roles, with her last job being a sales admin at a company for 13 years.

She first started at that company as a sales admin, moved onto business systems and around 2019 the request for them to earn ISO 27001 certification came in.

Back then ISO 27001 was a 'nice to have' and not a 'need to have' like it is today. Emma jumped at the chance to join the team working on the ISO 27001 Implementation, taking part in the research, training and implementation tasks.

The company managed to navigate their certification, even through the turbulence of COVID, and Emma was the one maintaining that ISMS for the following years.

During that time she also implemented TISAX, an Information Security Standard specific to the automotive industry, which you can learn more about on one of our previous webinars hosted by Emma.

Sadly, Emma was made redundant in 2025, but was fortunate to join the Blackmores team shortly after.

[10:10] How has Emma found her first year as an ISO consultant? It's been challenging for Emma to adjust to being on the other side of the fence, helping others to achieve certification rather than being the one to implement a system firsthand.

Thankfully there was plenty of opportunity to learn during her first year with Blackmores, including expanding her repertoire of Standards and being able to learn from other experienced consultants in the team.

She's really enjoying working with a variety of clients, getting to learn about different industries and how different each company is in their operations.

Emma is aware that she's just scratching the surface within her first year, and is eager to learn more.

[12:20] What Standards has Emma worked with so far? ISO 27001 is the main one as it's the one that Emma learned to implement from scratch at her pervious job.

Since joining the Blackmores Team she's also gained experience working with ISO 9001 (Quality Management), ISO 27701 (PII Management), ISO 17100 (Translation), ISO 42001 (AI Management) and TISAX.

ISO 27001 remains her favourite out of all of them, and she's keen to learn more from Blackmores own Information Security guru, Steve Mason.

[14:15] Has there been any unexpected elements to her role? One of the more unexpected aspects has been helping clients navigate various acquisitions. When she joined, Blackmores had an unusual amount of clients currently in the middle of this process.

Dealing with ISO management in these situations can get tricky as you're having to marry up different styles of management as two companies merge. Emma's role was in helping them to navigate that transition.

She was surprised as she expected to be dealing with companies that were business as usual for years, but ISO Management is at the heart of managing these types of changes. So, it was interesting to learn how involved an ISO consultant can get into the inner workings of a business to help ease the burden for all parties involved.

[17:20] What is the biggest challenge Emma has had during a project so far and how did she overcome it? Emma is still relatively fresh to implementation projects, but has found the process to be quite straight forward with the both the Blackmores 7 step methodology and support from other team members.

What has been a challenge was the promotion she was tasked with for TISAX. It was a new service offering for Blackmores due to her expertise, and she was involved in recording a podcast and hosting a webinar. Both activities she'd not had any prior experience with.

She doesn't think of herself as a big presenter, so it seemed like a dauting task. Emma did a lot of practice and went our of her comfort zone to do the webinar, which was positively received by the audience.

The experience certainly boosted her confidence in that area, and though it was a bit stressful at the time due to nerves, she felt like it was a good learning opportunity.

[19:45] What is Emma's biggest achievement? Emma has various moments throughout her life, with an early one being the fact that she passed her driving test first time at the age of 17.

Later in 2005, she went solo travelling for 5 months around Australia, New Zealand and Fiji. She did end up having to work for a bit of that trip to make up some additional funds, but that was a necessary evil. Other than that, she was amazed at all the different people she met during her travels and was so pleased that she was able to complete the trip.

Lastly, she's proud to have joined the Blackmores team in 2025. She's recently helped her first client achieve certification from scratch, which felt like a reward in of itself to know they'd passed their ISO assessment.

If you'd like any assistance with implementing ISO standards, get in touch with us, we'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Everyone who goes to work should have the right to go home after work. This is a sentiment that wasn't necessarily formally recognised until the 1970's here in the UK.

Health & Safety often gets mocked for overly cautious or seemingly onerous tasks to meet certain regulations and Standards today, however these are in place for a reason. They save lives, plain and simple.

In this episode, Ian Battersby makes the case for Health & Safety regulations, including why they were introduced, events that sparked the conversation for workplace safety and the impact regulations have had since their introduction.

You'll learn

· The decline in ISO 45001 adoption

· The Health and Safety at Work Act

· How much difference has this Act made since its introduction?

· How do the US and UK differ in their approach to safety regulations?

· What events led to the creation of safety regulations in the UK?

· Addressing broader health and safety risks – illness and long-term damage as a result of work

· How to make health & safety manageable

Resources

· HSE

· ISO 45001 Support

· Isologyhub

In this episode, we talk about:

[02:05] Episode Summary – Ian Battersby makes the case for modern Health & Safety regulations, sharing why they were introduced, how they've impacted workplace safety statistics and how you can make health & safety more manageable.

[03:30] The decline in ISO 45001 adoption – From our standpoint as consultants, there has been less adoption of ISO 45001 when compared to other Standard such as ISO 9001 or ISO 27001. In years previous, it was a common Standard to implement either with or straight after ISO 9001. There are a number of reasons for this, including:

· The appetite for ISO 45001 has reduced in favour of newer Standards

· Supply chains not proposing it as a requirement

· Our particular client base feel they are low risk in their respective industries

To be fair, health and safety does get a bad reputation for being overbearing. It's been subject to many attacks from various media and lobbying groups, however, it's necessary to ensure we all stay safe at work. Let's look at some history…

[05:00] The Health & Safety At Work Act: This act received Royal Assent in the UK on 31 July 1974, and came into force on 1 April 1975.

To an extent it replaced and improved upon previous laws covering separate industries and activities: Factories, Mines & Quarries, Agriculture, etc

It was enacted in response to a recognition that, although conditions for workers had improved over the century, there was still completely unnecessary harm being caused to many in the country's workforce.

This is also the point when the Health and Safety Executive was formally established to enforce the law. It also provides a wealth of guidance to businesses, so we highly recommend checking out their website.

They also have the legal duty to collect consolidated data on workplace injuries for the UK, and have provided an annual report since it's inception in 1975.

[07:45] How much difference has this Act made since its introduction? In the year to 31/03/1975 when consolidated data was first recorded there were 651 deaths at work. The equates to more than 2.5 deaths in a single year per 100,000 workers.

Comparatively, in 2024/25 124 people died in work, and while that's 124 too many, it's a big improvement. The rate per 100,000 workers is now 0.37, and you have to bear in mind that the workforce has grown, but overall that's a reduction of over 85%.

[09:10] How do the US and UK differ in their approach to safety regulations? The Occupational Safety and Health Administration (OSHA) serves similar purpose in USA as HSE, but they have important differences in approach and independence.

The HSE is independent of government to an extent and has no ministerial control, whereas OSHA sits within the Dept of Labor.

It can also be argued that the OSHA approach is prescriptive in setting rules whereas HSE follows the more outcome-based principles of HASAWA: to reduce risk "so far as is reasonably practicable", which some argue is more sophisticated and produces better results.

OSHA has also seen its powers to intervene, investigate and enforce curtailed at times due to certain political interests.

Looking at the numbers, the US Bureau of Labor Statistics published fatality rates for 2024: Census of Fatal Occupational Injuries:

There were 5,070 fatal work injuries recorded in the United States in 2024, down 4.0% from 5,283 in 2023. The fatal work injury rate was 3.3 fatalities per 100,000 full-time equivalent workers in 2024, a decrease from 3.5 in 2023.

That rate is notably higher than Great Britain's — 3.3 per 100,000 versus 0.37 — though the two figures aren't directly comparable. The BLS uses full-time equivalent workers as the denominator and covers a broader range of incident types, while the HSE's RIDDOR series uses a headcount of all workers and has specific exclusions (road traffic accidents, air and sea travel, etc.). The methodological differences mean a like-for-like comparison requires some care.

[13:35] What events led to the creation of safety regulations in the UK? In the days of Victorian Britain, it's difficult to view the common working man, woman AND child as anything other than a commodity.

Thousands died every year in industrial accidents during this era, and large-scale accidents in many industries weren't uncommon.

Mining was particularly tragic, a few events include:

· The Oaks Colliery explosion of 1866 killed around 360 men and boys.

· Hartley Colliery in 1862 trapped and killed 204 miners when the single shaft collapsed (but individual deaths from falls, gas explosions, and equipment failures happened constantly and attracted no particular attention)

· The Abercarn Colliery explosion in Monmouthshire (1878) killed 268 men.

· The Albion Colliery explosion at Cilfynydd in Wales (1894) killed 290.

These were not exceptional events, they were part of a continuous toll. In the 1860s alone, over 1,000 miners died annually in Britain.

Textile mills, ironworks, shipyards, and construction sites all had very high casualty rates. Factory machinery had no guards. Children routinely worked in spaces too small for adults, climbing inside machinery to clean it while it was still running, or crawling under looms. Mill workers lost fingers, hands, and arms with regularity.

The end of the Victorian era saw attempts at regulation, but without true enforcement. The Factories Act didn't appear until 1933 and it was bitterly opposed by many owners of mines and mills.

Modern regulations exist today to prevent the tragedies of the past from happening again, they were hard fought for by workers and lobbyists, and in some ways we're still fighting to include the broader impacts work can have on an individual.

[16:45] Addressing broader health and safety risks – This is in relation to harm accumulated over a lifetime of work with long-term and often fatal consequences. The suffering caused to workers exposed to hazardous conditions is immeasurable.

For example, let's look at asbestos. The dangers of working with asbestos were recognised remarkably early, as far back as 1890s in France, and Asbestosis was formally recognised in 1930.

This led to regulation in 1931, but only applying to the asbestos textile industry, excluding all the industries where its use was widespread such as construction, shipbuilding, anyone working in insulation etc

Worse still, it wasn't even enforced!

Then take mesothelioma, the distinctive and almost invariably fatal cancer of the lining of the lungs and abdomen. The connection between asbestos and mesothelioma was established in SA in 1960 when mining blue asbestos.

Further research in the UK firmly established the link in the 60s. From the mid-60s, headlines were being made nationally when shipyard workers from the war era stared dying in large numbers. Unions began lobbying for protections and media coverage continued for years as cases multiplied across several areas and industries.

Nevertheless, its manufacture and use continued.

The Asbestos (Licensing) Regulations 1983 introduced licensing for the most hazardous asbestos removal work. Blue asbestos (crocidolite) was banned in 1985, followed by brown asbestos (amosite) in 1986, though white asbestos (chrysotile) remained legal until 1999.

In the interim and since then thousands of people died and multiple legal cases have ensued.

2218 people died of mesothelioma alone in 2023. Altogether it's estimated that workplace-related lung disease and cancers kill as many 13000 per year in the UK. Several thousand more are known to die of non-lung-related occupational diseases each year, but these aren't recorded as workplace deaths on certificates, so these people aren't included in HSE annual reporting.

It doesn't stop at deaths either, there is an argument for the detriment that certain work can have on quality of life. Incidents and conditions such as:

· accidents causing amputation and fracture

· eye conditions from welding and other light sources

· Deafness and hearing difficulties

· HAVS, vibration white finger

· Skin conditions from exposure

· Musculoskeletal in low risk environments

None of these are terminal and so often go unreported.

[23:25] How to make Health & Safety manageable – Some consider modern health and safety regulations to be over the top, but overarching law in the UK has the principle 'As Far As Is Reasonably Practicable'.

One common area is in risk assessment, The Management of Health and Safety at Work Regulations states:

"Every employer shall make a suitable and sufficient assessment of—

(a) the risks to the health and safety

Where the employer employs five or more employees, they shall record—

(a) the significant findings of the assessment"

The keyword being 'significant' there. If you work in lower risk industries, you aren't being forced to make unnecessary risk assessments, only when significant risks are present do you need to complete a risk assessment.

For more guidance, check out the HSE guidance on office-based risk assessments.

[25:55] Ian poses a question: Can you seriously say that the drop in deaths and injuries suffered by the common worker would have dropped at the rate it has without regulatory intervention? Can all employers (or other vested interests) be trusted to do the right thing through good will and voluntary mechanisms alone?

If you'd like any assistance with your ISO 45001 Implementation or need any additional ISO Support, contact us, we'd be happy to help.

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Anyone that has undergone the ambitious task of Implementing an ISO Standard will know how much work goes into creating and maintaining a single ISO certification. Now imagine juggling seven ISO certifications!

There's a key difference between those that simply collect badges and those that see the value each ISO certification can bring, as every Standard has their own requirements and guidance to tackle specific areas of quality, risk and sustainability. When implemented well, they create a solid well-rounded framework that can drive unparalleled continual improvement.

In this episode Ian is joined by Damian Edwards, Head of Standards at Wavenet, to dive into how they manage the mammoth task of maintaining seven ISO Standards, the challenges with managing multiple ISO certifications and what benefits they've brought to the business since implementation.

You'll learn

· Who is Damian Edwards?

· Who are Wavenet?

· How did Damian manage integrating management systems during Wavenet's acquisition of Daisy Corporate Services?

· What is Damian's role at Wavenet?

· How do Wavenet manage their ISO certifications?

· How has ISO Support helped you over the past year?

· What has Damian learned while managing ISO Standards?

· What are the benefits of ISO certification?

· Damain's top tip for anyone considering ISO Implementation

Resources

· Wavenet

· Wavenet Certifications

· Blackmores – ISO Support Service

· Isologyhub

In this episode, we talk about:

[00:30] Episode Summary – We welcome Damian Edwards back onto the podcast to discuss how he maintains Wavenet's seven ISO certifications, and the explore the benefits gained from an integrated ISO Management System.

[03:05] Who is Damian Edwards? Damian is the Head of Standards at Wavenet, and has featured on the ISO Show before!

One lesser known fact about Damian, is that he a 'Dance dad', supporting his daughter through all of her lessons and competitions. He's very proud of her latest achievement of qualifying for the World Championship for Irish dancing in her age group.

[05:05] Who are Wavenet? Wavenet is an IT provider, providing IT network communications, security and resilience services. They are UK based with 1,600 employees based in their Solihull head office.

Wavenet were formed in 2000, but have grown through acquisition, one of which was Damians previous company, Daisy Corporate Services. When Daisy was acquired, both businesses were of a similar size, so the process looked more like a merger in practice.

A large part of that was uniting the ISO Standards managed by both businesses, so Damian had his hands full with ISO integration, amending audit schedules and managing extension to scope audits.

[06:30] How did Damian manage integrating management systems during Wavenet's acquisition of Daisy Corporate Services? One of the biggest challenges was the extension to scope that needed to happen due to the increase in sites.

Thankfully, as Wavenet were used to acquisitions, they had dedicated acquisition project managers that assist with managing the integration.

At the start, there are some teething problems as both businesses will still be using their respective processes for a while. However, once system that helped was a system called 'ServiceNow', which is where issue tickets could be logged, monitored and actioned in one centralised system.

[08:15] What is Damian's role at Wavenet? Damian is the Head of Standards, which includes both ISO Standards and ESG related regulatory compliance.

ISO certifications are more often than not a prerequisite or a condition of a bid over a contract, without them, Wavenet wouldn't win any business. They also create a foundation of trust for Wavenet's clients in the realms of Information Security, quality and environmental management. Wavenet are currently certified to the following Standards:

· ISO 9001 Quality Management

· ISO 20000-1 Service Management

· ISO 27001 Information Security Management

· ISO 22301 Business Continuity Management

· ISO 45001 Health & Safety Management

· ISO 14001 Environmental Management

· ISO 50001 Energy Management

In addition to maintaining all of these certifications, Damian also strives to utilise them to drive continual improvement within the business.

[10:30] How do Wavenet manage their ISO certifications? Damian is directly responsible for five of those ISO Standards, however there are some where he doesn't have the expertise to fully manage the requirements.

ISO 27001 and ISO 45001 for example require skilled people at the helm, so Wavenet have dedicated managers to handle those areas.

One of Damians key responsibilities is juggling all of the audits to make sure each element is covered, and he's put a lot of work into integrating those audits where possible to get the most out of their time and resources.

Though, it's important to note that you can't integrate everything, as each standard will have some unique requirements. Areas that you can integrate however include elements such as:

· Context

· Audit Programme

· Corrective Actions

When you do have a lot of Standards, some elements can get watered down if you try to integrate everything. Policy for example, if you have five Standards and decide to integrate all related policies into a single document, it will become long and unruly, which will lead to people unwilling to read it. So, you have to take care to ensure focus on certain elements to make those more accessible for the staff that need it.

Another aspect that needed additional consideration was Wavenet's risk profile, with their amount of sites and services, it's very varied. Too much for a single person to be aware of all the risks, which is where Damian's subject area experts can provide additional insight to fill the gaps.

Damian is also keen to combine external audits where possible to both reduce cost and possible duplication of effort, as many Standard do share common subject areas, this can be done across multiple Standards. Certification Bodies are usually quite happy to work with you on this!

Damians key take away is, that there isn't one solution that fits every business when managing this many Standards. It was a very trial and error process, especially with the ever changing landscape of a business, but Standards are also designed with flexibility in mind, so with the right people in place it's certainly manageable.

[16:05] How has Blackmores' ISO Support helped? Blackmores has assisted Wavenet with their ISO 45001, ISO 50001 and ISO 41001 (Facilities Management) implementation. ISO 41001 was later dropped as it was no longer applicable for the business.

Standards can be quite hard to apply to your own business when looking at them at face value, the requirements sound generic because they're designed to apply to every type of business. This is where Blackmores experience as a consultancy can help with interpretation and practicalities of how a Standard will apply to your way of working.

Blackmores will also assist with internal audits, which help identify non-conformities that may have been missed if it were not for a fresh pair of eyes. As Damian states: "I would rather have them identified before an external audit" as this gives you a chance to resolve issues or put an action plan in place before it gets to that stage.

Damain also reminds everyone to not be afraid of your auditor, internal or external. They are not maliciously looking for problems, they simply help to highlight issues which can be resolved sp you can improve as a business.

No Management System is perfect, the important thing is that you can recognise when something needs addressing, and how you go about doing so.

[19:30] What has Damian learned while managing ISO Standards? Damian has learned to not think of ISO as a tick box exercise, it's a tool to help businesses improve.

He has also learned that you don't need to reinvent the wheel when Implementing a Management System. You likely already have much of what's required in place, but not monitored or organised regularly.

For example, aspects such as 'Management Review' may already be happening in existing meetings with top management, you simply need to ensure these are minuted, cover what needs to be discussed in regards to the Management System, and make note of any gaps that need to be addressed.

Businesses like Wavenet that have been in operation for 26 years know what they're doing, and are likely already following best practice. You don't need to restructure your business to meet an ISO Standard, but rather integrate the Standard requirements with how you already operate. If done correctly, it should become a simple part of your day-today tasks.

Damian jokingly states: "What's my role? I sometimes say it's to do as little as possible", as the more a business is aligned with a Standard, the less you will have to do to upkeep that.

[22:55] What benefits have Wavenet experienced as a result of their ISO certifications? As mentioned earlier, a lot of won business is due to ISO certification. Certain certifications are simply a tender or client requirement.

Standards such as ISO 50001 tackle their energy consumption. It's focus on reducing that will inevitably lead to reduced business costs. Since implementing the Standard, Wavenet now have monthly meetings to monitor energy use, which gives them a good basis to make informed decisions on where energy use is concerned.

Damian has found that over time, good practice has been so embedded that people are using it in their everyday behaviors without even realising it. He's heard people in their resolutions team use terminology like 'root cause' without knowing where it came from.

He's seen team making use of skill matrix's when evaluating the competence of certain teams such as engineering for client visits. So, people within the business are using ISO terminology and techniques to ensure best practice without being explicitly asked to. It simply works as a method to drive the business effectively when implemented correctly.

[26:15] Damian's top tip for aspiring ISO implementors: Apart from approaching a consultancy like Blackmores to help if it's your first time going through the process, it's got to be leadership commitment.

Top management need to be actively promoting ISO within the business, and they should be involved with the process. You need everyone's buy-in to make a system work, and that is made much easier if it's driven from the top down.

Another tip is that a Management System should be a team effort. It shouldn't just be the responsibility of one person, you need input from everyone in the business to ensure you've covered all angles and risks that could affect your business.

Lastly, look at what you already have in place and try and integrate the Standard into that. Don't make more work for yourself if you don't have to, you likely already have the bones in place.

[28:20] Damian's book recommendation: The Thursday Murder Book Club – by Richard Osmond

[29:10] Damian's favourite quote? "Hard work beats talent when talent doesn't beat work hard."

And:

"You miss 100% of the shots you don't take"

To learn more about Wavenet, check out their website and keep up-to-date with their latest news via their LinkedIn page.

If you'd like any assistance with your ISO Implementation or need any additional ISO Support, contact us, we'd be happy to help.

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Watch the video interview here

Carbon verification is quickly becoming a necessary step for many businesses, whether due to regulatory compliance, market demand or as part of a voluntary scheme.

The drivers for this demand are varied, as is the approach many take for their path towards carbon verification. This can look very different depending on the industry you operate in and can be difficult to tackle for more service based industries, such as today's guest, Davies Group, who are a service provider for the insurance industry.

In this episode Mel is joined by Gillie Fairbrother, Global Responsible Business Officer at Davies Group, to discuss the findings of Mel's thesis regarding the demand and drivers of GHG verification for organisations across the globe, and how Davies Groups' carbon verification journey factors into the findings.

You'll learn

· Who is Gillie Fairbrother and who are Davies Group?

· What factor triggered the decision for independent carbon verification at Davies Group?

· At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard?

· What did Davies Group's GHG inventory and reporting look like before independent verification was introduced?

· Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally?

·

· What is the gap between organisations knowing they should verify emissions and actually doing it?

· Was competitive positioning part of the Davies Group case for carbon verification?

· What was the most significant finding from the first carbon verification engagement?

· How has verification changed the internal culture and engagement with the sustainability programme at Davies Group?

· How have Davies Group supported suppliers with calculating their carbon emissions?

· Where does Gillie see the expectations of institutional partners and large clients in insurance and professional services heading?

· What was a specific moment where Gillie can recall that this mattered more than she had expected?

Resources

· Davies Group

· Davies Group LinkedIn

· Carbonology – Carbon Verification Services

In this episode, we talk about:

[00:30] Episode Summary – We introduce Gillie Fairbrother, Global Responsible Business Officer at Davies Group, to discuss their participation in Mel's thesis research into the demand for GHG emissions, exploring Davies Group's own reasoning and journey.

[02:05] Who is Gillie Fairbrother and who are Davies Group? A route into sustainability as a career wasn't as readily available to Gillie when she attended university, so it has been something of a self-made path.

She has previously run a wellness business in the past and has experience working with sustainable brands and has done a lot of cultural advocacy, particularly in the LGBTQ space.

Taking the lead for ESG within the corporate space was a dream come true for Gillie, and she has done this for a number of US based tech firms to her current position for Davies Group.

Davies Group are a service provider for the insurance industry, who operate in 22 countries.

[03:40] What factor triggered the decision for independent carbon verification at Davies Group? Mel's research found that 29% of organisations cite market-driven factors as their primary reason for seeking GHG verification, compared with just 12% who cite regulatory compliance.

For Davies Group, their decision was led by market demand. They looked client requests versus client contractual obligations, and carbon verification was increasingly coming up in those contractual obligations.

Gillie herself has always been an advocate for working both sustainably and responsibly, promoting the revenue benefits that can be gained from doing so. However, as much as it is perceived to be the right thing to do, she doesn't want businesses to simply think of it as the 'nice thing to do'.

These should be central components to how your business operates. So in part, Davies Group saw this demand not only in the market, but as simply the right way to do business.

[05:30] At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard? Davies Group already operate in a highly regulated market, and so already have very strong governance practices in place.

Gillie didn't really have to worry about making too many improvements in the governance or purpose aspects of ESG compliance.

They participated in TCFD on a voluntary basis to highlight a possible risk from a climate perspective that could affect things like supply chain, physical sites, or the industry in general to leadership.

Thankfully, the leadership saw this as a risk worth looking into more, and were willing to quantify it properly and ensure that their data was as accurate as possible and in a place where it could be audited by a 3rd party.

[07:40] What did Davies Group's GHG inventory and reporting look like before independent verification was introduced? Before Gillie joined, these aspects were managed by a 3rd party due to lack of in-house expertise to manage it.

When Gillie joined, she worked closely with that 3rd party to continue the work. Davies Group is quite a complex business, it operates with 3 different divisions that have multiple service lines.

At the time, they did their best with the Excel spreadsheets that they had create to track various GHG emissions, but it was not as good as it could have been.

They've since grown their processes, included more in-house talent and are doing more to gain knowledge from their stakeholders, data owners and building relationships with various teams across the business.

While they are still working on Excel spreadsheets, they have advanced to reasonable assurance. Gillie is now looking into external tools to help improve their data management, but this would cost a fair bit of money that could be better used currently on reducing environmental impact.

[10:30] Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally? Gillie cites employees, as they're an industry where 30% of the workforce is likely going to retire in the next 10 years, so they're trying to attract a younger group of talent who want to work for a business that has a good purpose and is a good company. Acting sustainably and responsibly is a huge part of attracting that new young talent.

The second more important stakeholders are their clients. Davies Group is a private equity backed business, if they're not making money then they simply cease to exist as a business. Clients now have a keen interest in responsibly run businesses, and many now seek proof to claims.

Next in the list is investors, who have an interest in the regulatory requirements that the business is subjected to.

Lastly, Gillie cites suppliers as even if they aren't actively putting pressure on the business to report their emissions, without their support and cooperation, Davies Group can't meet their own goals.

[12:40] What was a particularly memorable conversation with a Stakeholder that helped drive further improvement? Gillie recalls one conversation with a new employee where they asked to be more involved with their sustainability group.

When she talked to them more, she discovered that one of the main reasons that employee sought them out was due to the responsible business page on their website, and that out of the 3 businesses they were applying to, Davies Group was the only one that had a page like that.

[37:00] What is the gap between organisations knowing they should verify emissions and actually doing it? Mel's research found that 86% of organisations report increased stakeholder demand for transparency in GHG reporting – yet 52% remain unverified.

Gillie states that there could be a lot of reasons for this, including budget, resourcing or something as simple as a piece of wording in a contract where a client might say we request versus we require.

This is why Gillie is always in conversation with clients, whether that be the sales team or the sustainability teams at our clients, to understand their goals and make sure they can all align in their goals.

The market is certainly the leading cause for many businesses as Government regulation tends to lag behind.

[17:20] Was competitive positioning part of the Davies Group case for carbon verification? For Davies Group, it was initially a contractual requirement to complete their carbon verification. So, in their case, it was an easy decision as otherwise they could potentially lose business.

However, Gillie also regularly meets with senior leadership and reports into their responsible business board committee every quarter. There they consider the growing appetite for sustainability driven demands, and how they want to leading the way in their industry. The key determining factor is whether it's relevant to them, whether that's for sustainability or for their community impact strategy.

Davies Group tend to focus on education and investment in our communities, as that's where their expertise sits. It's all about materiality as businesses need to focus on what's relevant to them.

[19:20] What was the most significant finding from the first carbon verification engagement? For Gillie, it was the clarity and transparency that had been game changing. Especially within their real estate portfolio.

Davies Group don't own any of their offices, they're all leased. As they calculated and verified the carbon footprint, the quality of the data got better and that enabled them to have better conversations with their real estate team to understand how a building worked, whether it be a lease, including services or whether it be separate.

As a result, they've been able to set a renewable energy target for all UK offices.

[19:20] How has verification changed the internal culture and engagement with the sustainability programme at Davies Group? Mel's research identifies a strong correlation between verification status and organisational confidence, with 85% of verified organisations expressing pride in their sustainability progress, compared with 50% of unverified ones.

Gillie's been writing the sustainability report for Davies Group for the past 6 years, and she can feel the difference after having their emissions verified as it adds an extra layer of credibility.

She's also wary of stepping into bragging territory about all their sustainability achievements, without reflecting on the reality. There can be a conflict between writing what the stakeholders want to hear versus what is accurate and true.

Having independent 3rd party verification gives you the confidence to back any claims made.

[24:10] How have Davies Group supported suppliers with calculating their carbon emissions? Gillie is particularly proud of an industry wide collaboration project that had close to 100 SMEs go through a Net Zero training programme that was provided by a third party.

Gillie joined many of the sessions and was so pleased to see sustainability champions emerge through the process where people suddenly got really invested and starting asking rather complex questions.

They're still gathering feedback from those sessions, but already 80% - 90% have calculated a starting carbon footprint and put in place an action plan to help reduce their impact.

This year, Davies Group have also kicked off a huge training and engagement plan with their service delivery teams who are making the decisions about their suppliers.

They've also engaged with over 400 employees in their UK groups for property claims on sustainable solutions, getting their ideas, understanding the challenges and coming out with some outcomes so they can measure the carbon of their claims process and look to reduce it. Gillie teases the pending results, so keep an eye on their socials to find out more!

[27:50] Key advice from Gillie: Focus your supply chain effort on your biggest emissions rather than your biggest spend, and tackle this in small groups.

[29:30] Where does Gillie see the expectations of institutional partners and large clients in insurance and professional services heading – and at what point does she think verified GHG data becomes a non-negotiable baseline in your market? Many businesses have been waiting on legislation and regulations to point the way, and in a sense, they will always be waiting as these things develop with our understanding and technology available.

However, businesses have done a good job of stepping up as those regulations lag behind.

There's a lot of mixed press regarding sustainability, with some professionals feeling as if the topic has come off the boil as article cite the loss of dedicated sustainability officers. The reality on the ground is that these roles are now much more embedded into the business, they're not being removed, simply passed onto roles such as the Chief Operating Officer to ensure sustainability targets are being met.

The bottom line is that the momentum for sustainability isn't going away, and that need to verify emissions is only going to grow. The key thing now is to move on from simple calculation into action, which is what Gillie is trying to drive right now.

[32:05] What was a specific moment where Gillie can recall that this mattered more than she had expected? Gillie is so proud of what their small and mighty team at Davies Group has done for their social impact.

When initially established, they were only in 1 country, they've now expanded to 22 countries and they've really focused their resources, time and effort on impacting community education and skills development, which she anticipates will have a full circle around to attracting talent into our industry.

To see more about the impacts that Davies Group are orchestrating, check out their LinkedIn page.

If you'd like any assistance with your carbon verification journey, contact our partner Carbonology, they'd be happy to help!

We'd love to hear your views and comments about the ISO Show, here's how:

● Share the ISO Show on Twitter or Linkedin

● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List