How Can Organizations Track Certification Readiness Across Different Departments?

When implementing ISO standards, it’s common for companies to have to align efforts between different departments, such as quality, operations, human resources, information technology, finance, and procurement. Being prepared for certification is not just about filling out documents, it’s also about ensuring that every department knows what they are obligated to do, has the necessary records, has the proper procedures, and can show compliance if audited.

A systematic plan for the ISO certification process assists organizations to make visibility between the various departments and recognize the gaps prior to the audit. Consistent monitoring – through shared compliance criteria, departmental assessments, tracking of evidence, internal audits and management reviews – can ensure that businesses track their progress and identify and resolve weaknesses before they impact on certification results.

Set up clear certification criteria

The first step in the process of tracking readiness is to know what the applicable ISO standard requires and how to convert the requirements into practical departmental responsibilities. An ISO standard can be applicable to the organisation as a whole but different clauses can have different impact on departments. HR can have competency and training records to manage for example, or access, information security measures and technology related evidence.

Organisations can develop a central compliance structure with each ISO requirement linked to the department responsible for implementing or supporting the requirement. This gives direction to the accountability and ensures that key requirements are not missed due to responsibility being shared across different departments.

Create Department-Level Readiness Criteria

After responsibilities are defined, each department in an organisation needs to establish what it means to be ready. A department’s readiness to produce a document does not automatically translate to readiness in the department. Readiness should take into account the processes implemented, their understanding by employees, maintenance of employee records, and production of evidence as needed.

For instance, a procurement department might require supplier evaluation, purchasing controls and supplier information documentation. HR department might need to have proof of competency, training, awareness and relevant employee records. These department-specific criteria enable management to determine progress based on the same expectations.

Access a Central Readiness Tracker.

Management can then get a good overview of certification preparation by using a centralized tracker. The tracker can contain the following items: the requirement, the responsible department, the process owner, documentation required, implementation status, when evidence will be found, gaps identified, corrective actions, and when the requirement will be completed.

The organization can use a compliance management platform, a spreadsheet, or a system in place.Organizations can use a compliance management system, spreadsheet, or system. The critical part is information is always up to date and available to authorized parties. A centralized system also minimizes the chance of having conflicting departmental records that are not in alignment with the certifying organizations’ goals.

Documentations and evidence to be monitored.

Documentation is an important component of the iso certification process, but organizations need to differentiate having a procedure and then putting it into practice. Records and other objective evidence can be viewed by auditors to ensure that processes are being followed consistently.

Departments should therefore keep records of evidence showing actual implementation. Evidence could be training records, inspection reports, meeting records, supplier evaluation, risk assessment, monitoring, corrective action records, internal audit records, or any combination of these. Documentation and tracking of evidence of availability can be used to determine when procedures are in place but not yet shown to be implemented.

Perform Internal Audits at the Department Level.

Internal audits can serve as an independent means of evaluating departments readiness prior to the certification audit. Organizations can assess portions of their operations in each department where applicable requirements are being used, rather than looking at just the central management system.

Auditors will be able to meet with staff members, review records, watch processes and compare what is actually being done to the procedures. Recordings should be ongoing and consistent, enabling management to identify the major gaps, minor problem areas, opportunities for development and improvements, and areas showing effective implementation.

Interior audits also benefit organizations by preventing them from having last-minute preparations. For repeated findings, management can investigate the root cause and implement any of the following: more training, process changes, resources, or management attention

Allocate blame for corrective actions.

Monitoring for readiness is not effective if learning gaps are not addressed. Each key issue must have an ‘owner’ and a clear ‘timeframe’. Departments should also be documenting the action taken, and confirming that the corrective action was able to resolve the root cause.

If it turns up that training logs are incomplete, you might need to fill in the missing records, for instance. Management may have to decide on why records were incomplete and whether or not the current training-record system is reliable. Corrective action tracking is then a link between readiness monitoring and continuous improvement.

Make use of Readiness Status Indicators.

Consistently assigning status categories to the needs in departments helps organizations to simplify management reporting. A requirement may be considered as completed, in progress, partially completed or requiring corrective action. The organization can also monitor evidence verification in isolation of implementation status.

By these indicators, management will be better able to target areas that need support from senior management. But status indicators should be backed up by data and not opinions. A department cannot be considered ‘Ready’ just because someone believes that all the requirements have been satisfied.

Examine how progress has been made across departments.

Comparisons across departments can assist management in recognizing trends. For instance, there could be gaps in employee awareness either within the same department or among multiple departments that have finished documentation. Or, there could be a situation where several departments struggle to keep records, as the organization’s document control is not well defined.

Systemic problems can be identified by comparing results from different departments; this can help uncover issues which might seem isolated problems. If the same type of gap is evident in multiple departments, then management should determine if a corrective action for the entire organization is more suitable than individual corrective actions.

Ensure that employees are aware and competent

The process related to the employee’s role is also a part of the certification readiness. Departments can track if employees have been trained appropriately, understand procedures applicable to their department and know what to say if an auditor asks questions about their department.

It is important for organisations to not plan on the employees memorising the answers for an audit. Rather, workers should be familiar with the way the management system operates in their respective workplaces. The evidence of competence and awareness should be retained, in line with the procedures established in the organisation, and as required by applicable ISO requirements.

Review the results of Risks and Process Performance

Documentation and audit checklists are not the only things that should be emphasized in the preparation for certification. Departments are also advised to take into account risks, objectives, performance indicators, operational controls, and activities for improvements associated with their processes.

Process performance is more of an indicator of readiness as it shows that the management system is “working” and is not just on paper. Management can monitor trends, recurring issues and customer related information, process results and corrective actions to see if departments are keeping up their controls.

Hold an Organization-Wide Readiness Review (OWRR).

Organizations can also have a final readiness review in all departments and relevant requirements prior to the certification audit. This review should ensure that documentation is under control, processes are in place, employees are aware of their responsibilities, evidence is present, internal audit issues have been identified and corrected, and that corrective action have been verified.

The final review may also illustrate connections amongst departments. For instance, HR training records can relate to operational competence, or procurement records to quality or requirements for supplier-control. In cases where departments rely on one another, but do not understand this, they will be reviewed separately, which is a potential source of errors.

Maintain Continuous Readiness

The certification preparation doesn’t stop at the certification audit. ISO management systems typically involve having processes, performance assessment, dealing with nonconformities, and striving for continual improvement. Departments should therefore, continue to follow up relevant requirements during the entire certification cycle.

A continuous monitoring approach will significantly facilitate future monitoring or re-certification activities as evidence and documentation will be part of routine activities. It also eliminates the stress of having to create a lot of documents at the last minute for an audit.

Conclusion

Monitoring the progress of the department helps organisations to have a clear idea of their status prior to an external audit. Linking the ISO requirements to the responsible departments, keeping track of evidence, organising the internal audits, assigning corrective actions and reviewing process performance can help to bring visibility throughout the organisation’s management system. An effective ISO certification procedure can also assist the departments in achieving shared compliance goals rather than creating procedures individually.

Long term readiness is about embedding compliance into the everyday business, not a one-off project. The iso certification process becomes more systematic and manageable when departments keep records, process them according to a certain procedure, monitor their performance and fill any gaps identified.