The management system

This page explains what a management system is, how ISO 9001, ISO 14001 and ISO 45001 are built, how a system is kept up to date and what the certification audit looks at.

What a management system is

A management system is the set of interrelated processes, rules, responsibilities and records an organisation uses to set its policy and objectives and to achieve them in a controlled way.

ISO 9001 (quality), ISO 14001 (environment) and ISO 45001 (occupational health and safety) share the same high-level structure, called the Harmonized Structure. For this reason they can be run as one integrated system.

The PDCA cycle

All three standards follow the Plan – Do – Check – Act cycle. The clause numbers are the same in each standard.

PDCA

  1. Plan Clauses 4–6

    Context, interested parties, risks and opportunities, objectives and planning.

  2. Do Clauses 7–8

    Support and operation: resources, competence, communication, documented information and operational control.

  3. Check Clause 9

    Monitoring, measurement, internal audit and management review.

  4. Act Clause 10

    Nonconformity, corrective action and continual improvement.

The building blocks

  • Processes

    Each process has inputs, outputs and an owner. The system shows how the processes interact.

  • Objectives

    Objectives are measurable, monitored and updated.

  • Documented information

    What must be documented, and the records that prove the system works. The term replaces the old “documents and records”.

  • Internal audit

    The organisation checks itself at planned intervals.

  • Management review

    Top management reviews results, changes and resources, and decides on improvements.

  • Improvement

    Nonconformities are handled: the root cause is found and corrective actions are taken.

How it should work over time

A management system is not a binder written once for the certificate. It is part of everyday work.

  • It is kept up to date when the organisation changes: new activities, sites, people, laws, risks or editions of the standards.
  • Its objectives and risks are reviewed.
  • Records are produced as part of normal work.
  • The internal audit and the management review are carried out every year.

A system that is kept up to date reflects how the organisation really works.

What the certification audit looks at

The audit assesses mainly the management system – whether it meets the requirements of the standard – and how the processes are actually applied.

The system

  • Policy, objectives and responsibilities
  • Processes and how they interact
  • Documented information
  • Internal audit and management review

The practice

  • Processes observed where the work is done, especially on site
  • Talks with the people who carry them out
  • A check that what is written matches what is done

What is an audit and how it is carried out Audit methods: on-site and remote audits

You may already have more than you think

Many organisations that are not yet certified already produce data and records, for example:

  • orders
  • delivery checks
  • customer complaints
  • maintenance logs
  • waste registers
  • competence records
  • incident reports
  • legal compliance documents
  • defined processes
  • objectives
  • responsibilities
  • internal audit
  • management review

These records are often scattered and not connected. A management system links them in a structure with defined processes, objectives, responsibilities, internal audit and management review.

Impartiality

As an accredited certification body under ISO/IEC 17021-1, D.A.S. Certification carries out audits and issues certificates. For this reason it cannot help an organisation build its management system: doing so would mean auditing its own work, which is a conflict of interest. D.A.S. Certification does not provide management system consultancy. An organisation may prepare on its own or with an independent consultant of its own choosing; D.A.S. Certification does not recommend any consultant, and this choice has no influence on the audit or on the certification decision.

Impartiality statement

Continue reading

Questions about the process?

Write to us at info@dascertification.eu

All contact details