Governance & ISO
The systems, decisions and standards behind better organisations.
Explore how management systems turn policies into decisions, responsibilities and evidence. This section connects ISO preparation with the work that happens between audits: setting a useful scope, reviewing performance, assigning actions and checking whether controls work. Start with the articles below when you need to prepare a management review, clarify ownership or organise evidence for a decision.
Start with the work you need to do
Reader worksheets →Page 1 of 2 · Articles 1–24 of 26. Browse the numbered pages to explore the complete collection.
How do you write a quality objective your team can act on?
Turn a vague quality goal into a measurable target, a resourced plan and an honest review decision, using a completed fictional example.
Who can audit a process when everyone helps run it?
A small team can separate process knowledge from audit judgement. Use a worked assignment record to check competence, conflicts and unresolved coverage.
How to write an audit finding someone can act on
Turn an audit observation into a clear finding with a worked fictional record. Check the requirement, event timeline and limits before issuing the conclusion.
Companies House identity checks need a record for every role
A verified person can still have open director and PSC submissions. A worked UK role register shows which dates and evidence to track separately.
The missing records your audit sample cannot find
Choose internal audit sampling methods around a complete population. Separate targeted tests from broader conclusions and record the limits of your evidence.
The employee leaves but the service account stays
A managed service account still needs an accountable owner. Review permissions, dependencies and human access when a Canadian application's sponsor leaves.
A PAIA manual should guide the next request
Make the route to a record clear while keeping a South African private body's access decision separate from the contents of its PAIA manual.
ISO 27001 asset inventory needs a business owner
Connect information assets to accountable owners, supporting services and lifecycle changes so a UAE team can investigate gaps in its inventory.
ISO 37001 2025 transition decisions before the deadline
Global ACI sets 28 February 2027 as the end of the accredited certification transition. GCC organisations need a controlled change plan that reaches culture, conflicts and the anti-bribery function.
When a supplier concession is justified—and when stock must stay on hold
Keep a nonconforming delivery on hold until an authorised, limited concession records the evidence, affected quantity and release conditions.
A conflicts register cannot make a procurement impartial
A conflicts declaration is only the start. Connect interests to procurement decisions, completed mitigation and continuing review under the applicable UK regime.
The supplier is certified—but does the certificate cover your order?
A genuine certificate can still be irrelevant to the entity, site or activity behind a purchase order.
A whistleblowing inbox needs somewhere safe to go
A reporting address is only the beginning. A credible response needs an alternative recipient, controlled access and a decision trail.
Start the ISO 9001:2026 transition with an evidence map
Map affected processes, decisions and evidence before changing a quality management system for ISO 9001:2026.
Approve the operating change before releasing the new procedure
Define the baseline, assess affected work and verify readiness before a changed process goes live across UAE and overseas teams.
Define the acceptance decision before inspecting incoming goods
Connect the purchase specification, lot identity, inspection evidence and release authority before incoming goods enter use.
Document control ends where the work is done
A revision is only useful when staff can retrieve and apply it. Use a release-and-retrieval check to control obsolete copies across distributed teams.
Build an audit programme around the decisions that matter
Choose audit coverage from operational change, uncertainty and consequence, then record why the sample is sufficient for the decision it supports.
Record the reasoning behind a board decision
Preserve the options, assumptions and reasons behind a board decision, including the conditions that should bring it back for reconsideration.
Route customer complaints with evidence and clear ownership
Design a complaint intake record that preserves the customer concern, assigns an accountable owner and separates response deadlines from verified resolution.
Build a competence matrix around authorised tasks
Connect task requirements, observed evidence and work authorisation so a competence matrix shows more than training attendance or course completion.
Make delegated approvals traceable across UAE operations
Define who may approve each decision, the limits of that authority and the evidence needed when UAE teams delegate across entities or time zones.
Check calibration evidence against the measurement you use
Review instrument identity, calibration range and uncertainty against the measurement task before accepting a certificate into the equipment register.
Supplier cyber assurance before contract renewal
A practical renewal review for UK procurement teams and Irish suppliers, with service-level evidence checks and a documented exception decision.
Read a management system through its decisions
A useful management review brings together the information leaders need to act. Look for the difference between an input, a decision and an action: what changed, who can approve a response, who will do the work and what would demonstrate completion. An attractive pack of slides is only part of that process.
For AI management systems, begin with the purpose and boundaries of each use case. Articles on ISO/IEC 42001 examine responsibilities, information flows and the situations that should trigger another review. They are preparation guides, not certification services or reproductions of an ISO standard.
Use the source links, publication dates and stated scope in each article to judge its relevance to your organisation. Worked examples are illustrative. If you need a formal conformity decision, refer to the applicable standard and an appropriately qualified reviewer. The sustainability, risk and AI sections offer related perspectives on evidence and implementation.