Management System Maintenance
Certification is the start, not the end. Most surveillance audit findings come from things that were in place at certification but weren’t kept up. I help you keep your management system current between audits, with a fixed amount of time each month or quarter. You stay accountable for the system; I keep the routine work moving.
Led by Levent Şakar, IRCA-certified ISO 27001 and ISO 9001 Lead Auditor.
Keeping the system working
A management system needs regular attention to stay effective: risks change, actions slip and records go out of date. Maintenance gives that work a fixed rhythm, so the system is ready for the external auditor without a scramble beforehand.
| Standards | ISO/IEC 27001:2022, ISO/IEC 27701, ISO 9001, ISO/IEC 20000-1 |
|---|---|
| How it runs | A set number of days each month or quarter, agreed for at least twelve months, remote or on site. |
| Fee | Fixed monthly or quarterly fee. |
Who it's for
- Certified organisations without a dedicated person to run the management system
- Organisations approaching their first surveillance audit
What it covers
- Keeping the risk register and Statement of Applicability up to date
- Tracking objectives and measures
- Following up nonconformities and corrective actions
- Preparing inputs for management review
- Getting ready for surveillance and recertification audits
What you receive
- A short report each period on status, open actions and what is coming up
- Current records, ready for the external auditor
- A list of open actions with owners and dates
Choose a rhythm
Monthly
One day a month. Suits organisations with frequent change, or with a surveillance audit due within the year.
Quarterly
Two days a quarter. Suits stable organisations that need a regular check rather than continuous support.
Before an external audit
Two additional days in the month before a surveillance or recertification audit, to check readiness and close remaining actions.
Internal audit is not included and is arranged separately. See Internal Audit.
Already certified and want it kept on track?
A short call is usually enough to work out what level of support makes sense.