Advertise on podcast: The ISO Show

Putting work into Quality Management doesn't stop once you achieve ISO 9001. Continual Improvement is at the heart of every ISO Standard, but sometimes it's hard to know what good looks like beyond certification. This is where Guidance Standards can lend a hand. ISO 9004 provides guidance for Quality Management Systems, and though its current iteration was published in 2018, its advice is more aligned with the 2026 version of ISO 9001 than the previous 2015 edition. In this episode, Ian Battersby dives into the purpose of ISO 9004, its applicability to the new 2026 version of ISO 9001 and explores the clauses and differences between ISO 9001 and ISO 9004. You'll learn ·      What is ISO 9004? ·      What's the main difference between ISO 9001 and ISO 9004? ·      Is ISO 9004 due an update? ·      Where do ISO 9001 and ISO 9004 connect? ·      What are the other differences between ISO 9001 and ISO 9004 ·      Breaking down ISO 9004 by clause     Resources ·      ISO 9004 ·      Isologyhub     In this episode, we talk about: [02:30] Episode Summary – Ian Battersby dives into the guidance Standard for Quality Management, ISO 9004, looking at the key connections and differences between it and ISO 9001.   [02:45] What is ISO 9004? ISO 9004 is a Guidance Standard designed to support ISO 9001. Its latest iteration was published in 2018, which was 3 years on from ISO 9001's previous iteration, meaning much of its guidance aligns with the newer 2026 version of ISO 9001.   [03:35] What's the main difference between ISO 9001 and ISO 9004? There is a core distinction between the two: ISO 9001 is a management system standard — it specifies requirements. An organisation can be audited and certified against it. Its job is to give confidence that an organisation can consistently deliver products and services that meet customer and applicable statutory/regulatory requirements. ISO 9004 is guidance, not requirements — you can't be certified to it. It addresses the "quality of an organization" itself: the degree to which its inherent characteristics fulfil the needs and expectations of all relevant interested parties (not just customers), with the aim of sustained success over the long term, in a changing environment. ISO 9001 gives confidence in what you produce or deliver and ISO 9004 gives confidence in what you are as an organisation. In short, the two complement each other. Something worth noting: The 2018 edition of ISO 9004 deliberately repositioned itself as independent of ISO 9001 rather than an "add-on"; a change from earlier editions, which were more explicitly paired as a "consistent pair" with 9001. [06:00] Is ISO 9004 due an update? ISO 9001 has been updated as of 2026, so should we expect ISO 9004 to follow suit? The answer is no, there is no planned revision date currently, so the most current edition is still 2018. [08:45] Where do ISO 9001 and ISO 9004 connect? There are a number of features of each Standard that connect. Both sit under the same quality management principles from ISO 9000, so they share a common vocabulary and philosophical base, so there's no contradiction, just different altitude. ISO 9001:2026 has an Annex which is very helpful in explaining requirements, but ISO 9004 can be read as picking up where 9001 stops. ISO 9001's clauses (context, leadership, planning, support, operation, evaluation, improvement, all clarified in the new ISO 9001 Annex) reappear in 9004 but are expanded and extended into strategic territory, eg, 9001's "leadership" clause vs 9004's full treatment of policy, strategy, and organisational identity. An organisation that's already certified to 9001 has the infrastructure that 9004 assumes and builds on, so 9004 may be used as a maturity roadmap after certification, not before it. Remember: ISO 9001 is the ground, 9004 is the sky you're reaching toward. [10:50] What are the other differences between ISO 9001 and ISO 9004 – Other key differences include: ·      Certifiable vs non-certifiable (single biggest practical difference for clients: no third-party audit, no certificate, so no external pressure to adopt it). ·      Compliance / conformity mindset (ISO 9001) vs performance / excellence mindset (ISO 9004). ·      Narrower interested-party scope (customer focus, mainly) vs broader (all relevant interested parties). ·      Operational / tactical (ISO 9001) vs strategic / cultural (ISO 9004) — identity, values, culture literally appear as a clause heading in 9004 and have no equivalent requirement in 9001. [12:20] Why this matters for organisations right now, with 9001:2026 just out – ISO 9001:2026 has actually pulled a bit closer to ISO 9004's territory. The new 2026 version of ISO 9001 adds "quality culture and ethical behaviour" language and stronger strategic framing, which was already present in the 2018 version of ISO 9004. This narrows the conceptual gap slightly, even without ISO 9004 itself being revised. [13:05] Breaking down ISO 9004's Clauses 1-4 – 1–3: Scope, normative references, terms and definitions: standard preliminaries. Clause 4 - Quality of an organization and sustained success: defines the core concept: quality of an organization is the degree to which its inherent characteristics fulfil the needs and expectations of customers and other relevant interested parties, and sets out what "managing for sustained success" means. It's distinct from 9001, which focuses on quality of products / services. It introduces broader concepts than ISO 9001 in relation to IPs, relationship management, and the varied expressions of needs and expectations. [14:50] Breaking down ISO 9004's Clauses 5 & 6 – Clause 5 - Context of an organization: identifying relevant interested parties and the external/internal issues affecting the organisation (it corresponds to but receives broader treatment than ISO 9001's equivalent clause). It builds upon ISO 9001 clause regarding internal and external issues and proposes external factors such as globalisation, innovation & natural environment. It expands on internal factors to bring in strategy, complexity and maturity. It invites top management to consider these issues and to determine which could result in risks to sustained success or opportunities to enhance sustained success Clause 6 - Identity of an organization: This is the clause with no real ISO 9001 equivalent: it's where 9004 moves into genuinely strategic / organisational territory. An organization is defined by its identity and context. The identity of an organization is determined by its characteristics, based on its mission, vision, values and culture. These are all too vague in many organisations, but here it lays out what they should really mean: ·      Mission: the organization's purpose for existing; ·      Vision: aspiration of what an organization would like to become; ·      Values: principles and/or thinking patterns intended to play a role in shaping the organization's culture and to determine what is important to the organization, in support of the mission and vision; ·      Culture: beliefs, history, ethics, observed behaviour and attitudes that are interrelated with the identity of the organization Note the word 'ethics', ISO 9004 is way ahead of ISO 9001 in addressing ethical behaviour. [18:15] Breaking down ISO 9004's Clause 7 Leadership – Policy, strategy, objectives, and communication, all framed around driving sustained success rather than just QMS conformity. It refers back to leaders promoting the mission, vision etc. It talks about them creating the environment in which people are engaged and committed to objectives. It also describes unity of purpose and direction (established by top management). In 7.2 we have policy AND strategy. ISO 9001 does require alignment to strategic direction, but here it guides us to develop strategy, either by a recognised model or one bespoke to the organisation. It even proposes that top management should make strategic decisions regarding competitive factors and provides a model for doing that, it then goes on to discuss the alignment of objectives. It takes objectives way beyond ISO 9001 and considers framing them in terms of the organisation's positive impact on society and the environment, and it's people's engagement in society beyond merely business-related activities.  Again, we see the ethical slant in ISO 9004 well before its inclusion in ISO 9001. [18:15] Breaking down ISO 9004's Clauses 8 & 9 – Clause 8 - Process management: Determining processes, assigning responsibility and authority, and managing processes. This clause contains fuller treatment than ISO 9001's process-approach requirements, but also one which discusses processes as means to fulfilling objectives. Clause 9 - Resource management: Beginning with people (engagement, empowerment, competence), organizational knowledge. Competent, engaged, empowered and motivated people are a key resource. Engagement of people enhances the organization's ability to create and deliver value for interested parties. Empowerment enhances the motivation of people to take responsibility for their work and its results. 9.3 covers organisational knowledge, which receives very scant treatment in ISO 9001, but is expanded upon greatly here. Here it's described as: 'An intellectual asset which top management should manage as an essential element of the organization's sustained success.' The rest of clause 9 gives very broad guidance on technology, infrastructure and work environment, externally provided resources.  All much more detailed than the ISO 9001 equivalents. In one part it discusses: 'Creative work methods and opportunities for greater involvement, to realize the potential of people in the organiza

The need for Information Security has only increased as we become more dependent on technology to keep things running smoothly. Even in industries such as construction, which many may have assumed were largely exempt. While not common, there are a few within the construction space that have taken the initiative to implement best practice information security Standards, such as todays' guest, AmcoGiffen. In this episode, Ian Battersby is joined by James Butler, IT Director at AmcoGiffen, to dive into why they chose to implement ISO 27001, what they learned during the process and the benefits felt following certification. You'll learn ·      Who is James Butler? ·      Who are AmcoGiffen? ·      What was the main driver for ISO 27001 Implementation? ·      What was the biggest gap identified during the Gap Anaylsis? ·      What did AmcoGiffen learn from the Implementation journey? ·      What are the main benefits of ISO 27001 Implementation? ·      James' Top Tip     Resources ·      AmcoGiffen ·      ISO 27001 ·      Isologyhub     In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by James Butler from AmcoGiffen to discuss their journey towards ISO 27001 certification, including the challenges faced and resulting benefits following certification. [03:00] Who is James Butler? James Butler is the IT Director at AmcoGiffen. One thing many may not know about him is that he's recently started taking swimming lessons aside his kids. Growing up, there weren't many opportunities to learn, so he's taking the time now to both set a good example for his children and to ensure he can keep them safe when in bodies of water in the future. [05:40] Who are AmcoGiffen?: AmcoGiffen are a national contractor for construction and engineering throughout the UK. They are owned by the group company Renew Holdings. Their projects range from rail, infrastructure, highways, environmental sectors to aviation. [07:10] What was the main driver behind ISO 27001 Implementation? They had a couple of reasons: 1)    They wanted to ensure that clients, stakeholders and shareholders had confidence in their ability to secure their data and information along with their employees data. 2)    When you work in the public sector, ISO 27001 is becoming a necessary certification to have. James expects that within the next 5 years, it will be just as mandated as Cyber Essentials currently is. AmcoGiffen already proudly hold Cyber Essentials Plus, and saw ISO 27001 certification as the next natural step to provide that extra level of assurance. [08:35] How long did it take to achieve ISO 27001? It was discussed for a while before committing, but the whole process took around 12 months from start to certification. At first, they did want to challenge themselves with a shorter timeframe, but after starting the process they realised that a shorter time restraint was adding unnecessary pressure and wouldn't have resulted in a good Management System that could be used. So, they took a step back and allowed more time for the system to be properly integrated into the business, which was that part that took the longest, as documentation is the easier part to deal with. [10:55] What was the biggest gap identified during the Gap Analysis? – For AmcoGiffen, the biggest gap was documentation. They already had a lot in place where controls were concerned thanks to their existing Cyber Essentials Plus certification, but the actual documentation of processes, objectives and risks were lacking. ISO 27001 allowed them to put the structure in place to manage this. Their key message throughout the implementation process was: 'we need documentation for the right purpose'. [09:55] What did AmcoGiffen learn from the Implementation journey? ISO 27001 helped to create a priority list, while also allowing them reflect and realise they should be documenting a lot more, not just to meet Standard requirements but because it's the right and responsible thing to do. One such example is making sure that there's enough information to allow someone to pick up a task if it's passed to them. They went to great pains to ensure the whole implementation wasn't forced, and as a result they passed both their Stage 1 and Stage 2 Assessments with no non-conformities or observations! AmcoGiffen also had the benefit of strong leadership commitment and involvement throughout the Implementation. James stresses the need to have Leadership buy-in from day one, otherwise you have to fight an uphill battle of making cases for the changes that you need to make as a result of implementing a Management System. He also make a point of ensuring you understand your stakeholders requirements, as ISO 27001 is not just an IT Standard, it touches on aspects like HR and physical security, aspects they may actively be involved with. If possible, it's best to bring them in and involve them in the initial planning so you're all on the same page of why you want to achieve Certification. [15:20] When did AmcoGiffen achieve Certification? – They completed they Stage 2 Assessment in July of 2026 and received the certificate in September of 2026.   [15:50] What are the benefits of ISO 27001 Certification? – James states that the benefits started from day 1 of the implementation process. The initial Gap Analysis allowed them to really look at how they currently operated, what were their strengths and weaknesses, where potential opportunities were. It gave them the chance to gather people from all corner of the business to come together and discuss their current processes, get feedback on how they could be improved, and ensure the updated processes would fit in with how they actually worked. James states that IT professionals can have a tendency to over complicate things, so he ensured that the system remained something that could be easily understood and integrated into the business. One other thing they implemented early was a mature Risk Register, this was so they could be driven by the actual risks facing the business and not just by who was shouting the loudest. Ultimately, ISO 27001 has provided a lot more organisational structure and more direction on priorities. [18:55] James' Top Tips – Do it for the right reason, don't do it as just a tick box exercise. If you're simply doing it for a badge on the website, then it's unlikely it will be providing any real benefit as it requires effort to keep the momentum of continual improvement going. Secondly, get Leadership buy-in before committing to certification. The process will be difficult without that endorsement from the top down. Lastly, challenge yourself to remove friction. The system has to work for the business, not just the auditors of the system. The key is to make the right information available to the right people at the right time. Don't just bog them down with endless processes and manuals, keep it simple and easy to understand as that's how a system gets integrated successfully.   [21:50] James' book recommendation – The subtle art of not giving a f*ck – Mark Manson [23:45] James' favourite quote – 'Keep it simple'   If you'd like to learn more about AmcoGiffen, check out their website. If you'd like help with ISO 27001 Implementation or on-going support, feel free to reach out to us, we'd be happy to help. We'd love to hear your views and comments about the ISO Show, here's how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Many of you will be familiar with ISO 9001, the leading Quality Management Standard, which provides a solid foundation for managing any business. However, for certain industries, ISO 9001 alone is not enough. The built environment is one such sector, as it requires more rigorous controls to keep projects on track, ensuring safety of all involved and processes that enable documented accountability for each and every step until project delivery. BS 99001 was introduced in 2022, not to replace ISO 9001 but rather to add to existing quality management systems for those in the built environment sector. In this episode, Ian Battersby is joined by Darren Morrow, Senior Consultant at Blackmores, to explain what BS 99001 is, how it addresses challenges unique to the built environment sector and explore the clauses and how they differ from ISO 9001. You'll learn ·      What is the built environment sector? ·      Why was BS 99001 created? ·      What is BS 99001's relationship with ISO 9001? ·      How does BS 99001 differ from ISO 9001? ·      Exploring the clauses of BS 99001 ·      Where is BS 99001 going in the industry?     Resources ·      Isologyhub ·      BS 99001   In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by Darren Morrow to explore BS 99001, Quality Management for the Built Environment. Join them as they discuss the reason for the Standards creation, it's relation to ISO 9001 and an overview of it's main clauses. [03:30] What do we mean by the Built Environment Sector? The sector covers the whole human-made environment: ·      buildings (homes, workplaces, hospitals, schools, entertainment), ·      infrastructure (roads, rail, bridges, utilities), ·      public space (parks, squares, streets etc) On top of that, you could also add the urban environment on a large scale, the way cities and towns are planned, developed over time, connected Any profession involved could apply this standard: ·      Design and planning (town planners, architects, interior designers, landscape architects) ·      Engineering (civils, structural, M&E, transport, environmental (planning our waste, water etc) ·      Construction (delivery, PMs, QSs, SMs, trades, contractors) ·      Management (of estates/facilities, property developers, agents, surveyors, valuers) ·      Policy, regulation, compliance (local authorities, planning officials, building control, regulatory authorities, enforcement agencies) [05:00] Why was BS 99001 created?: Despite the widespread adoption of 9001 across the industry (and it being a prerequisite in many circumstances), there has continued to be a series of significant incidents, numerous reports and national enquiries. These all point to an issue with quality that a generic standard appears to have failed to address.  When this is the case, it's a sign that something more sector specific is necessary to avoid repeating the same mistakes. The UK Building Safety Act is now being enforced, which has added more implications and requirements on contractors. BS 99001 can help to support compliance with this due to its focus on responsibilities, competency and accountabilities. [09:45] What is BS 99001's relationship with ISO 9001?: BS 99001 doesn't modify or replace ISO 9001, it builds on it for the built environment sector. ISO 9001 creates a solid foundation for any business, but because of this it is deliberately vague in it's requirements. BS 99001 in comparison is very prescriptive with what it what's businesses to do, record and evidence. [10:30] How does BS 99001 differ from ISO 9001? BS 99001 is very much aware of the project based nature of its targeted sector, so the requirements are written with this in mind. Its requirements are written to ensure all parties involved in construction projects are included, accountability is its foundation, and it looks to help facilitate a lessons learned environment for compliant businesses. [11:30] BS 99001 Clauses: 4 Context - We're all used to this clause, but there's a note to consider the nature of the interested parties, as it's a lot more prescriptive and includes: ·      Members of the public are suggested first (users of stations, tenants in social housing) ·      Owners and operators of assets (ie, the built end product) ·      Project funders/investors ·      Project owners/sponsors ·      Project teams It also requires context documents specifically taking into account commitments to social, economic and environmental sustainability. So ESG is being embedded from the start. These interested parties encourage open forums between not only all those involved in the actual construction, but those that will be affected by the project and end product. This commitment to social, economic and environmental sustainability is a theme that continues throughout the whole Standard. Some businesses that already hold certification to Standards such as ISO 14001 and ISO 45001 think they may already have all of this covered, and in many ways they would be correct, however those typically apply to the business as a whole whereas BS 99001 incorporates everything in and around the project rather than treating projects as a separate entity – which is how other ISO Standards act in this sector. [15:40] BS 99001 Clauses: 5 Leadership – The specific requirement states: 'Top management shall ensure that a competent person is appointed as the management representative with oversight of quality for projects the organization is involved in or plans to be involved in' This may seem like an old-fashioned approach, however the need for competency in this sector is paramount. Organisational roles, responsibilities and authorities for Quality Management roles with clear competence and impartiality / independence criteria are explicitly stated. What was once a role that may have not held the power to stop a project like Health & Safety roles, now has that ability. If something is raised as a quality concern, then there is a strong argument for that becoming a safety risk down the line. It's better to fix something early on than to have it become a bigger problem, therefore, significance to the roles that point out these issues have been given the power they deserve in the project management process. [20:00] BS 99001 Clauses: 6 Planning – Risk management is an essential part of BS 99001, Clause 6 is where the requirements for risks and opportunities is explicitly stated, however, these are references multiple times throughout the Standard. There are specific Risk requirements to take account of are: ·      Projects it is involved in or plans to be involved in; ·      The process of construction and the subsequent use of the asset; ·      The organization as a whole; and ·      Society the economy and the environment. Many construction companies will be tendering for multiple jobs, so it's a good opportunity to build a robust risk register that gets added to with each project. Learning from one project should be used to help you to bid for the next one. Keeping track of these should also be done so you can inform your interested parties of the risks involved, and any subsequent lessons learnt should also be of value to your supply chain. One key group that often gets overlooked is the Funders, they'll have a particular interest in the risks and to have all the knowledge available about what they're funding. Having records to answer their questions will keep them happy or at least informed. Objective requirements include: ·      Quality objectives for each project, to reflect contractual and other requirements ·      Evidence of the following considerations in objectives: ·      Defined scope, time, cost and project lifecycle ·      Social, economic and environmental commitments ·      Collaboration with interested parties In ISO 9001, the objectives are set from the business level, but in BS 99001 these are aimed at the project level. [24:10] BS 99001 Clauses: 7 Support – As mentioned, people and competence is a big focus for BS 99001. Evidence for competence arrangements include: ·      Project / contract specific roles and responsibilities - formally assigned ·      Formal process(es) for determining competence ·      Competence arrangements relating to all people working on the organisation's behalf There are also verification processes for all external providers, including the need for: ·      Authorities for approval of operations, processes, design, production, inspection and tests ·      Competence arrangements for management representative(s) specifically regarding quality ·      Evidence that competence arrangements take into account requirements of interested parties It's up to the business to make sure they can prove people are competent for the roles they are assigned, which is why there is a lot of detail in this area. Documented information is also key, as this provides a traceable and auditable path of accountability. Again, BS 99001 is a lot more prescriptive on this clause when compared to ISO 9001. BS 99001 requires documentation of: ·      Process(es) to ensure awareness of statutory / regulatory requirements specifically relating to documented information (eg, building information, product safety, structure, maintenance, retention timeframes) ·      Approval methods and authorities for the different types of documented information ·      Communication / availability / control of changes to documented information to interested parties Now this doesn't mean you have to drown yourself in paperwork! These can all be stored as ele

Many businesses do not own the property they operate in, this can lead to complex questions over who has ownership over certain property and facility related legal obligations. Managing areas such as waste transfer, electrical, gas and aircon servicing etc could feasibly be managed by both landlords and those leasing the property, and it's important to establish who manages what to ensure all legal requirements are met. In this episode, Ian Battersby discusses the complexities of leasehold compliance, including how to establish key responsibilities, examples of what legal and ISO related requirements need to be met and what evidence you need to be keeping a record of.   You'll learn ·      What is leasehold compliance? ·      What areas do you need to consider within leasehold compliance? ·      Establishing responsibility ·      What subject areas relate to ISO compliance? ·      How to plan for leasehold compliance and gathering evidence     Resources ·      Isologyhub ·      PAS 79 ·      BS 5839   In this episode, we talk about: [02:35] Episode Summary – Ian Battersby discusses leasehold compliance, including establishing responsibilities and gathering evidence to ensure your legal and related ISO requirements are being met.    [02:45] What is leasehold compliance? Many organisations don't actually own the property where they operate, it's very common for businesses to lease property. A landlord will lease the property to a client and often appoint a building manager, managing agent to run it on their behalf and act as the interface with all the leaseholders. Sometimes, the building manager will be part of a large organisation which also provide facilities management services. Often they'll only offer the most basic of services and will contract another party to provide further facilities management. Whichever party provides general facility management services will almost certainly need to contract another layer of providers responsible for specialist services such as waste transfer, electrical / gas / aircon servicing. Sometimes, the leaseholder will directly contract a third party for a service (air con, electrical, PAT, cleaning).So all in all, it can be quite a complex picture of responsibility! [05:10] The complexities of leasehold compliance: It can be tricky navigating through this and demonstrating that you've fulfilled all your own legal obligations as well as gaining assurance that other parties have done what they need to do to protect you and your employees. Often, those charged with liaising with the building manager are not experts in Health & Safety, Environment, Facilities Management and compliance. It might be the office manager who picks up this role. In some cases, you have an absolute duty, even where the landlord has complete control over the service which is provided to you (e.g. waste management). [06:45] Establishing Responsibility: Establish who owns what, who is responsible for things such as building fabric, installed services, the contracting of support services. But, regardless of actual ownership and the direct responsibility for a particular aspect of a building, there is always an interrelationship, a dependence between building, infrastructure elements. For instance, you may use a whole floor which has been fitted out for your own purposes, you own the electrical installation from the walls inwards, but that links into the electrics beyond your own shell. You may have certain responsibilities in your own area for firefighting equipment, fire doors etc, but fire safety also depends on things like: ·      The escape routes ·      The building's fire alarm ·      Emergency lighting ·      Protection of the common areas such as the lobby If the building isn't safe beyond your own demise, your own demise isn't safe. While you may not have direct control over these aspects and your legal responsibilities, leases may leave the burden on you to seek evidence. Although there should be demonstration of various compliance obligations throughout the pre-let enquiries process. You may even be lucky enough to have a lease clause which requires landlord to complete or contribute towards compliance reporting.  [08:30] What subject areas relate to ISO compliance?: Standards where leasehold compliance is particularly relevant include ISO 14001 environmental management and ISO 45001 Health & Safety management. For both of these, there may be a need for you to provide your own evidence or seek assurance from a third party. The examples we're providing here apply to office locations and for more complex, more industrial, more heavily commercial premises. Considerations / requirements for either one of both of these Standards include: Energy performance certificates: Legally required documentation. They rate the energy efficiency of a property from A to G, and they have to be provided prior to leasing and on leasing. These can apply to a whole building or just a wing or floor of a building. These can be verified online via a .gov portal. As of the 1st of April 2023, any commercial property in England or Wales must have a minimum energy performance certificate rating of E. However, this is set to change after consultation, so from April 2031 you won't be able to let property unless it's in the A or B band. Recommendations Report: This supplements the previously discussed energy rating. This report, as the name suggests, provides recommendations for improving efficiency. If you're already rated an A or A+, then there may not be too many recommendations. But C and below will have some that will improve your building over time. It's important to note that there is no mandatory obligation to action these recommendations, and some provided can be quite generic and not at all applicable. However, you should seek through the landlord and ask if they're following through on any of the recommendations to improve energy performance, particularly if you will be looking to renew leases around the time that the law changes. Air Conditioning: If your building is relatively new, less than five years, you will really need to see the installation and commissioning information associated with air conditioning. There should be records of building control, electrical installation, commissioning certificates, and also a test which is called a TN 44. This test is legally required once on installation and then again after every 5 years. It needs to be carried out by an accredited energy assessor, who can be verified via the same Government portal as the Energy performance certificates. This applies to any system with an effective rated output of more than 12 kilowatts, which quite simply, is nearly all commercial offices. The TN 44 test will also provide a report which includes recommendations on how to use the equipment, the management regime for its setting points for temperatures and other such advice to keep it working as efficiently as possible. The person responsible for air conditioning is responsible for this certificate. If you own the aircon in your demise, it's yours, if the landlord owns the aircon, it's theirs. F Gases: Any system which contains fluorinated greenhouse gases, so what we call F gases, needs to be inspected regularly to ensure that none of the gas leaks and to ensure that they're operating at optimum efficiency. This can includes things such as air conditioning, heat pumps, Fire Protection (aerosols and foams) and is often used in various parts of Industrial Manufacturing. If there are any leaks, they need to be logged, replacements need to be made, recharge needs to be done, and all this needs recording in a logbook. When it comes to servicing of anything that uses F Gases, you need to check the competence of those individuals. Refcom has a register of accredited / approved companies that provide these services. Fire Risk Assessments: Fire Risk Assessments are legally required documentation which needs to be carried out by a competent person. There isn't a prescribed frequency on fire risk assessments, but you should really be reviewing them at least annually and doing a full reassessment on a three-year period – or when there has been a significant change to the layout / occupation of the building. There is a mandatory way of completing a fire risk assessment, PAS 79, which is a publicly available specification. So you need to check that yours are being done in alignment with this Standard as this provides proper risk evaluation and an action plan which is prioritized according to the level of risk. It may also be worth checking with your insurance organization or any local authorities whether they have a prescribed frequency for your fire risk assessments. Fire Alarms: You will no doubt have a fire alarm within your building, this may be the landlords own fire alarm system or it may be one you as the leasehold business own. As a starting point, you need to understand who has ownership of this. On installation and commissioning, you must comply with certain standards. For the UK this is BS 5839, which requires building control, a commissioning certificate, handover certification, the correct drawings, a manual, a logbook, specific training to the owners and users of the system. Every six months you should have a competent person complete maintenance, servicing and inspection to ensure that the way the fire alarm was installed is the way it remains in compliance with BS 5839. As well as a six-monthly inspection, there is also a competent person test and inspection over elements over and above that, which requires certificate issuing annually. There's also a full test and inspection of the wiring underpinning the fire alarm system. This isn't prescribed, but it's commonly c

There has been a lot of buzz around the upcoming Universal Project currently in development in Bedfordshire. It's estimated to generate around £50 billion in economic benefit, along with the creation of 20,000 jobs during its construction, and a further 8,000 jobs once it's operational. It's undoubtedly brought a lot of eyes towards the smallest county in the UK, and with it a lot of opportunity for local businesses to get involved with not only the main theme park itself, but the surrounding projects that aim to make Bedford and beyond a thriving tourist destination. For those wondering how to get involved, there is a dedicated group looking to share knowledge and tools to get you tender ready. In this episode, we are joined by Lorna Leonard, Managing Director of LBS, and Kirsty Maynard, Commercial Director of THSP, who are instrumental in running BedX, a group dedicated to sharing knowledge and tools to help businesses get tender ready for Universal and beyond. Listen to our roundtable discussion as we dive into why BedX was created, its main drivers, how it can support local businesses and how you can get involved. You'll learn ·      Who are Kirsty and Lorna? ·      What is BedX? ·      What were the main drivers behind the creation of BedX? ·      What are the group's main aims? ·      What are Kirsty and Lorna's roles within the group? ·      How can businesses get involved with and benefit from BedX? ·      What can businesses be doing now to get tender ready for Universal?     Resources ·      Bedfordshire Chamber of Commerce - BedX ·      BedX Webinars ·      Tender Diagnostic ·      Kirsty Maynard LinkedIn ·      Lorna Leonard LinkedIn   In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman and Carly Mowbray are joined by Lorna Leonard (LBSv) and Kirsty Maynard (THSP) to discuss the creation of BedX, and how it aims to support businesses with tender preparation ahead of the Universal and related projects currently underway in Bedfordshire.   [01:25] Who are Kirsty and Lorna?: Kirsty is the commercial director at THSP. THSP work with businesses across health and safety, HR and compliance, helping organizations make sure they've got the right systems, processes and people in place to operate safely, professionally and compliantly. THSP have been in operation since 1992 and support any type of organisation, from construction to food brands, global luxury retailers, major transport organizations, and complex international businesses operating in highly controlled environments. Lorna is the managing director of LBS. LBS is a business solutions company supporting sophisticated start-ups and growing corporations with outsourced finance department services, direction and solutions. She set-up the business 14 years ago, and has worked with organisations of all sizes, from blue chip companies to micro businesses of only 1 or 2 people. Regular listeners may recall Lorna from a previous episode, she also shares many insightful posts on LinkedIn and is certainly worth a follow! [07:05] What is BedX? It's A business-led working group powered by the Bedfordshire Chamber of Commerce. It was created to help Bedfordshire businesses understand, prepare for and win work from the major investments coming into the region, in particular, the universal destinations and experiences, the Luton Airport expansion and other on-going linked projects. BedX's role is to connect, inform and prepare, but they don't lobby, they don't represent the developers and they don't do politics. They are simply there to help local businesses get ready. [07:45] What were the main drivers behind the creation of BedX? The Universal park is certainly the banner piece for the group. It's what all the big numbers are attached to, including 5 billion pounds worth of inward economic investment, 20,000 jobs created and the five years' worth of construction. However, that is just one part of the upcoming development going on in Bedfordshire. The big project is seeing more funding going into the area to support transport networks and other venues as investors seek to make Bedfordshire a place worth staying for more than just the Universal Park. Other projects include the expansion of the Wixams Train Station, construction at the Luton Hoo, the new Luton Town Football Club and a new Data Centre at Quest Pit. BedX was created in response to all of these projects, not just Universal. It's to help local businesses navigate these opportunities, as this small county has rarely seen such a seismic shift in the amount of investment going into the area. Even though the deadline for Universal Park is 5 years away, supply chains are looking for support now, which is why it's better to start preparing sooner rather than later. [10:20] Making Bedfordshire a play to stay: It's also not just about the venues, to prepare for the influx of tourists there will be more investment in housing and transport and related routes such as the work currently going on at the Black Cat roundabout. Kirsty states that the Bedford County Council have a scrutiny committee, which is currently labelled as the Universal Scrutiny Committee, and are in discussion about a viable tourist strategy for Bedfordshire. So, there is no doubt that there will be many more small projects going ahead within a very short timeframe to get the area ready. [12:00] How LBS's expertise is instrumental within BedX: Businesses that want to get involved may not know how to get working capital or access potential available funding, which is where Lorna's and LBS's expertise comes in to support BedX's aims. With tenders as highly valued as this, it can throw businesses through a loop if they're not prepared. Lorna shares a story where she explains that she used to work for a company that made point of purchase display equipment, this company had a US subsidiary called Anshauser-Busch, who own Budweiser. That subsidiary put through an order directly through to their factory, requesting a huge order be manufactured and delivered within 180 days. The cost of which was upwards of $2.7 million, which was due to suppliers 150 days prior to Lorna's company at the time being paid. It was their first time working with that subsidiary, so there was no guarantee on payment. The lessons they learned ended up shaping how the company operated going forward. All this to say, if you're bidding for high value contracts, you need to think about the opportunity from every perspective. [14:40] Be realistic about what you bid for: Kirsty states she is really passionate about ensuring businesses are trying to grow responsibly, so that they understand those terms in the bid and that they're realistic about the size of contract that they should be bidding for. If you're looking for more guidance in this area, Katie from Bids and Tender Support provided a webinar on this topic for BedX. It's available to view on-demand on BedX's website. [16:25] Lorna's role within BedX: Lorna reminds us that a lot of the Tier 1 contractors started out as 1 or 2 person businesses. She states that, honestly, 90% of the companies that BedX help will not be in direct contact with one of those Tier 1 contractors. However, supply chains are just that, a chain, there are many opportunities to get involved further down the line. Lorna feels as if that's a large part of her role, keeping businesses focused on the opportunities they can access within that supply chain. She is also keen to help all the local businesses understand how this is going to affect them, because whether they get involved in the various projects being built or not, the whole area is going to be affected regardless. She points out an example where they needed to source a large number of electricians, and it turns out that Bedfordshire simply doesn't have enough! So BedX is helping to make the wider community aware of training opportunities like this that can open doors for local businesses. [18:45] Other considerations for businesses operating in Bedfordshire: Lorna points out a few other concerns that people had about the on-going development in the area, including the possibility of local contractors putting prices up due to all the other projects. Timeframes may also be affected by both on-going work and the fact that more businesses will be getting involved in the area's development. [19:15] What are the group's main aims?: BedX's main aim is to be an opportunity exchange, they sit in the middle as a conduit between the opportunities and the Bedfordshire businesses and help to inform, educate and prepare to be a part of it. They are there to support preparation local businesses are able to access emerging supply chains as that waterfall flows down into tier 2 and 3 and even into 4 and 5 over the course of the project. If you're not sure which of those tiers you'd likely sit in, BedX have a helpful household checklist to find out. [20:20] Getting ISO Ready for Universal: Kirsty mentions that she's seen a lot of recent Pre-Qualification Questionnaires (PQQ's) request that bidding companies are certified to ISO 27001 Information Security. Many will be familiar with the requests for ISO 9001 (Quality Management), ISO 14001 (Environmental Management) and ISO 45001 (Occupational Health & Safety), but ISO 27001 seems to be a more recent pre-requisite. This is particularly the case for any Government contracts, with them stating either Cyber Essentials or ISO 27001 must be in place for any bidding businesses. Carly points out that ISO 27001 in many cases is just the first step, as you can strengthen this with supporting Standards such as ISO 27701 (Privacy Information Management) and ISO 27017 & ISO 27018 (Cloud Security), which can give you an advantage over your competitors. If y

AI can be fantastic for relieving a lot of administrative burdens, allowing individuals to focus on more complex tasks that need a human touch. However, many are all too quick to install and integrate, which can lead to crucial vetting processes being skipped. So many applications have also integrated various AI features, and while you may have vetted the software before these were available, those new AI features still need scrutiny before widespread use within the business. In this episode, we dive into why there is a need for a more cautious approach to implementing AI and share some tips on basic Information Security checks you can do to ensure an AI application or integration is safe to use.   You'll learn ·      The link between AI and increasing data breaches ·      Recent incidents as a result of AI misuse or error ·      Key considerations for the implementation of AI technology ·      11 Information Security checks for AI tools     Resources ·      Isologyhub ·      ISO 42001 Webinar ·      IAF Accreditation Check   In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman explains the need for caution when exploring the implementation of AI tools, and provides guidance on some information security checks you can perform to ensure your data stays safe. [02:45] The link between AI and increasing data breaches: Data breaches tripled since the wide adoption of AI in early 2024 and studies are saying there is a clear link between these two events. Here in the UK alone, 32% of businesses experienced a cyber-attack or data breach in 2023, compared to 43% of businesses in 2025, with us already steadily on track to surpass that in 2026. Does this mean people shouldn't use AI at all? No, of course not, but we do need far more caution before you simply start using a tool. [03:35] Recent incidents as a result of AI misuse or error: ChatGPT copycat – There was a ChatGPT clone available as a web extension that was downloaded by some 1.5 million users. It functioned just like ChatGPT, answered queries and provided links to legit sources. But, in the background, it was scrapping passwords and gathering information that was to be sold off without users knowledge. Sage Copilot - The popular accounting software had to temporarily suspend Sage Copilot after a data-isolation flaw occurred. This incident caused an issue where users who prompted the AI to list recent invoices ended up with incorrectly surfaced financial records belonging to unrelated businesses. This was a major security issue, especially for an application thousands of businesses rely on to track their financial records. Google Gemini – Google Gemini was found to have been abused by bad actors for data reconnaissance. One particular group were building profiles on major cybersecurity and defense companies and were looking to gather specific technical job roles and salary information. Google's threat intelligence team characterized this activity as a blurring of boundaries between professional research and malicious reconnaissance. Their soft touch approach allowed the bad actors to craft tailored phishing personas and to further identify potential soft targets to compromise. [06:30] Key considerations for the implementation of AI technology: Any software or technology you plan on introducing into the business that will interact with your and your customers data should be subject to clear vetting procedures, with clear rules for use to follow. Before integrating an AI tool, ask yourself, is the tool you want to use: a)    Relevant b)    Safe c)    Ethical Ethical may sound strange, and will depend on what you're using an AI for. Take CV sorting for example, many studies have shown that AI's can have an inherited bias based on their training data. This has also now evolved into AI based recruitment tools preferring AI generated CV's over human written ones. From a safety standpoint, think about the data you are feeding into those recruitment tools, that's personally identifiable information, full names, phone numbers, emails and possibly even addresses. A full profile for an individual. Is that system your using closed, do you know if you consented to having any input data used for further training? Don't just assume that inputted data won't be used beyond your control. If that recruitment AI tool gets hacked, who do you think is liable for the breach? Is it the AI tool developer or the business that input the data? You think the answer would be clear, but the legality of all this is still being debated. [09:10] 11 Information Security checks for AI tools: #1: Have an AI Policy and AI Integration approval process in place - Many businesses will already have an AI policy in place, most are very generic, so we recommend looking at the guidance provided by ISO 42001 to see what good looks like for an AI policy. You should also create a clear approval process that any AI tools must pass BEFORE people start using them. This should be clearly communicated to the wider team, and there should be a method to manage these checks such as a ticketing system to kick off the process. #2: Understand where your data actually goes - Find out whether inputs are used to train the vendor's models. These inputs can include prompts, uploaded files or even customer data depending on what the tool is. You also need to find out how long that data is retained, and whether it's stored in a specific jurisdiction. You can look for answers to these in a DPA (Data Processing Agreement), don't rely on the basic marketing blurb they state on the website. If those answers aren't provided, contact the tools support or basic enquiries to find out. #3: Check for a SOC 2, ISO 27001, or equivalent certification – This is an easy check for vendor's security posture. Absence of certification shouldn't automatically disqualify a vendor or tool, but it should prompt more due diligence, not less. Even with a certification in place, you also need to double check that it's valid. ISO 27001 for example will need to be certified by a UKAS accredited certification body for those in the UK. For overseas, you will have your own ISO accreditation bodies, which can be verified on the IAF website. #4: Map out third-party and subprocessor risk - Most AI tools sit on top of other infrastructure like cloud hosting, underlying foundation models and additional analytics tools. You should ask for a subprocessor list to fully understand who else touches the data. #5: Test for prompt injection and data leakage - If the tool interacts with external content such as emails, documents or web pages, it can potentially be manipulated by malicious instructions hidden in that content. Businesses should ask vendors how they mitigate this and ideally test it themselves. #6: Clarify access controls and permission scoping - This is especially the case for AI agents or tools with system integrations. You need to establish if the tool operates with the same permissions as the user, or whether it has broader access. Overprivileged AI agents may operate independently with no human oversight. 'Human in the loop' has become a common phrase within cyber security for a reason, you always need a point of human oversight to ensure the AI is doing what it's supposed be doing and is doing so safely. #7: Ask about model update and versioning transparency - You need to ensure that the vendor won't just silently swap out the underlying model for its AI tools, as this can introduce sudden behaviour changes in the tool itself. Transparency is a key component of emerging AI security frameworks and regulations such as ISO 42001 and the EU AI Act. If a vendor isn't willing to tell you when they're making major changes to their tools, then it's not a vendor you want to entertain. #8: Evaluate the output reliability and hallucination risk in context - For security-adjacent or compliance-adjacent AI tools, factually wrong outputs are a risk. AI can have a tendency to 'hallucinate' data or outcomes and then present them as fact. So, ask the vendor what guardrails exist and whether their tools' outputs are auditable / traceable. They should know what data was used to train their models, or where their models are pulling data from. If they don't or can't control what data is being used, then it's not a tool you can 100% trust. #9: Review incident response and breach notification commitments - If the vendor is breached, do you how quickly you would be notified, and what their recovery process looks like? If you hold ISO 27001 and ISO 22301, or simply have a business continuity plan in place then you will already have similar procedures in place for peace of mind for your own customers, so why should you settle for any less? And just like your clients would expect, breach notifications and expected recovery times should be contractually defined, not just assumed. #10: Consider the supply-chain risk of the vendor itself - This tech is still relatively new, and so newer AI vendors may have smaller security teams and less mature processes than what you may be used to with more established providers.  However, startup pace doesn't mean you have to tolerate the start-up risk. Consider all of the previously mentioned steps, if they don't have a lot of that in place, then they may not be mature enough yet for you to go ahead with. This doesn't mean you have to automatically disqualify them, if they have a clear plan of action for growth, which shows a clear focus on increased security and transparency within a reasonable timeframe, then it's still worth considering. #11: AI tool monitoring and Kill switch – In addition to this initial vetting procedure, you should also have a process in place to continuously monitor these AI tools too. Many AI tools aren't static, th

The path towards becoming an ISO consultant is often a meandering one. It's not often a career that many aspire to, yet despite that, there are still thousands of ISO professionals worldwide. We're continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification.   In this episode we introduce Emma Coxhill, an isologist® at Blackmores, to share their recent journey into the world of ISO consultancy and how they've found their first year working with other organisations to help them achieve ISO certification. You'll learn ·      What is Emma's role at Blackmores? ·      What does Emma enjoy outside of consultancy? ·      What did Emma do before becoming an ISO consultant? ·      How has Emma found her first year as an ISO consultant? ·      What Standards has Emma worked with so far? ·      Has there been any unexpected elements to her role? ·      What is the biggest challenge Emma has had during a project so far and how did she overcome it? ·      What is Emma's biggest achievement?   Resources ·      Isologyhub ·      TISAX Webinar   In this episode, we talk about: [00:30] Episode Summary – We introduce Emma Coxhill, an Isologist® here at Blackmores, to discuss her recent entry into the world of ISO consultancy, including how she's found working on the other side to help other organisations achieve ISO certification. [03:30] What is Emma's role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards. Emma specialises in information security management systems (ISMS), but is branching out to other Standards as she takes on more clients. [04:30] What does Emma do in her free time? Emma is a big fan of the outdoors, enjoying long walks and exploring in general. It makes sense then that she also enjoys gardening. While it is a lot of work, she finds the result rewarding. Emma is also a big fan of movies, excluding horror films! She enjoys making the trip to see films on the big screen when she has the chance. Lastly, Emma is also a qualified life coach. This involves guiding people to get where they want to be in life, with the crucial distinction that it's not about telling people what to do, but rather providing the right questions and tools to help them achieve their goals quicker. These skills have evidently translated well into her role as an ISO consultant, as auditing is very similar in the fact that it's about giving people a different perspective. [06:55] What was Emma's previous role? Emma previously worked in admi and retail roles, with her last job being a sales admin at a company for 13 years. She first started at that company as a sales admin, moved onto business systems and around 2019 the request for them to earn ISO 27001 certification came in. Back then ISO 27001 was a 'nice to have' and not a 'need to have' like it is today. Emma jumped at the chance to join the team working on the ISO 27001 Implementation, taking part in the research, training and implementation tasks. The company managed to navigate their certification, even through the turbulence of COVID, and Emma was the one maintaining that ISMS for the following years. During that time she also implemented TISAX, an Information Security Standard specific to the automotive industry, which you can learn more about on one of our previous webinars hosted by Emma. Sadly, Emma was made redundant in 2025, but was fortunate to join the Blackmores team shortly after. [10:10] How has Emma found her first year as an ISO consultant? It's been challenging for Emma to adjust to being on the other side of the fence, helping others to achieve certification rather than being the one to implement a system firsthand. Thankfully there was plenty of opportunity to learn during her first year with Blackmores, including expanding her repertoire of Standards and being able to learn from other experienced consultants in the team. She's really enjoying working with a variety of clients, getting to learn about different industries and how different each company is in their operations. Emma is aware that she's just scratching the surface within her first year, and is eager to learn more. [12:20] What Standards has Emma worked with so far? ISO 27001 is the main one as it's the one that Emma learned to implement from scratch at her pervious job. Since joining the Blackmores Team she's also gained experience working with ISO 9001 (Quality Management), ISO 27701 (PII Management), ISO 17100 (Translation), ISO 42001 (AI Management) and TISAX. ISO 27001 remains her favourite out of all of them, and she's keen to learn more from Blackmores own Information Security guru, Steve Mason. [14:15] Has there been any unexpected elements to her role? One of the more unexpected aspects has been helping clients navigate various acquisitions. When she joined, Blackmores had an unusual amount of clients currently in the middle of this process. Dealing with ISO management in these situations can get tricky as you're having to marry up different styles of management as two companies merge. Emma's role was in helping them to navigate that transition. She was surprised as she expected to be dealing with companies that were business as usual for years, but ISO Management is at the heart of managing these types of changes. So, it was interesting to learn how involved an ISO consultant can get into the inner workings of a business to help ease the burden for all parties involved. [17:20] What is the biggest challenge Emma has had during a project so far and how did she overcome it? Emma is still relatively fresh to implementation projects, but has found the process to be quite straight forward with the both the Blackmores 7 step methodology and support from other team members. What has been a challenge was the promotion she was tasked with for TISAX. It was a new service offering for Blackmores due to her expertise, and she was involved in recording a podcast and hosting a webinar. Both activities she'd not had any prior experience with. She doesn't think of herself as a big presenter, so it seemed like a dauting task. Emma did a lot of practice and went our of her comfort zone to do the webinar, which was positively received by the audience. The experience certainly boosted her confidence in that area, and though it was a bit stressful at the time due to nerves, she felt like it was a good learning opportunity. [19:45] What is Emma's biggest achievement? Emma has various moments throughout her life, with an early one being the fact that she passed her driving test first time at the age of 17. Later in 2005, she went solo travelling for 5 months around Australia, New Zealand and Fiji. She did end up having to work for a bit of that trip to make up some additional funds, but that was a necessary evil. Other than that, she was amazed at all the different people she met during her travels and was so pleased that she was able to complete the trip. Lastly, she's proud to have joined the Blackmores team in 2025. She's recently helped her first client achieve certification from scratch, which felt like a reward in of itself to know they'd passed their ISO assessment.  If you'd like any assistance with implementing ISO standards, get in touch with us, we'd be happy to help! We'd love to hear your views and comments about the ISO Show, here's how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Everyone who goes to work should have the right to go home after work. This is a sentiment that wasn't necessarily formally recognised until the 1970's here in the UK.   Health & Safety often gets mocked for overly cautious or seemingly onerous tasks to meet certain regulations and Standards today, however these are in place for a reason. They save lives, plain and simple. In this episode, Ian Battersby makes the case for Health & Safety regulations, including why they were introduced, events that sparked the conversation for workplace safety and the impact regulations have had since their introduction. You'll learn ·      The decline in ISO 45001 adoption ·      The Health and Safety at Work Act ·      How much difference has this Act made since its introduction? ·      How do the US and UK differ in their approach to safety regulations?  ·      What events led to the creation of safety regulations in the UK? ·      Addressing broader health and safety risks – illness and long-term damage as a result of work ·      How to make health & safety manageable   Resources ·      HSE ·      ISO 45001 Support ·      Isologyhub   In this episode, we talk about: [02:05] Episode Summary – Ian Battersby makes the case for modern Health & Safety regulations, sharing why they were introduced, how they've impacted workplace safety statistics and how you can make health & safety more manageable.    [03:30] The decline in ISO 45001 adoption – From our standpoint as consultants, there has been less adoption of ISO 45001 when compared to other Standard such as ISO 9001 or ISO 27001. In years previous, it was a common Standard to implement either with or straight after ISO 9001. There are a number of reasons for this, including: ·      The appetite for ISO 45001 has reduced in favour of newer Standards ·      Supply chains not proposing it as a requirement ·      Our particular client base feel they are low risk in their respective industries To be fair, health and safety does get a bad reputation for being overbearing. It's been subject to many attacks from various media and lobbying groups, however, it's necessary to ensure we all stay safe at work. Let's look at some history… [05:00] The Health & Safety At Work Act: This act received Royal Assent in the UK on 31 July 1974, and came into force on 1 April 1975. To an extent it replaced and improved upon previous laws covering separate industries and activities: Factories, Mines & Quarries, Agriculture, etc It was enacted in response to a recognition that, although conditions for workers had improved over the century, there was still completely unnecessary harm being caused to many in the country's workforce. This is also the point when the Health and Safety Executive was formally established to enforce the law. It also provides a wealth of guidance to businesses, so we highly recommend checking out their website. They also have the legal duty to collect consolidated data on workplace injuries for the UK, and have provided an annual report since it's inception in 1975. [07:45] How much difference has this Act made since its introduction? In the year to 31/03/1975 when consolidated data was first recorded there were 651 deaths at work. The equates to more than 2.5 deaths in a single year per 100,000 workers. Comparatively, in 2024/25 124 people died in work, and while that's 124 too many, it's a big improvement. The rate per 100,000 workers is now 0.37, and you have to bear in mind that the workforce has grown, but overall that's a reduction of over 85%. [09:10] How do the US and UK differ in their approach to safety regulations? The Occupational Safety and Health Administration (OSHA) serves similar purpose in USA as HSE, but they have important differences in approach and independence. The HSE is independent of government to an extent and has no ministerial control, whereas OSHA sits within the Dept of Labor. It can also be argued that the OSHA approach is prescriptive in setting rules whereas HSE follows the more outcome-based principles of HASAWA: to reduce risk "so far as is reasonably practicable", which some argue is more sophisticated and produces better results. OSHA has also seen its powers to intervene, investigate and enforce curtailed at times due to certain political interests.   Looking at the numbers, the US Bureau of Labor Statistics published fatality rates for 2024: Census of Fatal Occupational Injuries: There were 5,070 fatal work injuries recorded in the United States in 2024, down 4.0% from 5,283 in 2023. The fatal work injury rate was 3.3 fatalities per 100,000 full-time equivalent workers in 2024, a decrease from 3.5 in 2023. That rate is notably higher than Great Britain's — 3.3 per 100,000 versus 0.37 — though the two figures aren't directly comparable. The BLS uses full-time equivalent workers as the denominator and covers a broader range of incident types, while the HSE's RIDDOR series uses a headcount of all workers and has specific exclusions (road traffic accidents, air and sea travel, etc.). The methodological differences mean a like-for-like comparison requires some care. [13:35] What events led to the creation of safety regulations in the UK? In the days of Victorian Britain, it's difficult to view the common working man, woman AND child as anything other than a commodity. Thousands died every year in industrial accidents during this era, and large-scale accidents in many industries weren't uncommon. Mining was particularly tragic, a few events include: ·      The Oaks Colliery explosion of 1866 killed around 360 men and boys. ·      Hartley Colliery in 1862 trapped and killed 204 miners when the single shaft collapsed (but individual deaths from falls, gas explosions, and equipment failures happened constantly and attracted no particular attention) ·      The Abercarn Colliery explosion in Monmouthshire (1878) killed 268 men. ·      The Albion Colliery explosion at Cilfynydd in Wales (1894) killed 290. These were not exceptional events, they were part of a continuous toll. In the 1860s alone, over 1,000 miners died annually in Britain. Textile mills, ironworks, shipyards, and construction sites all had very high casualty rates. Factory machinery had no guards. Children routinely worked in spaces too small for adults, climbing inside machinery to clean it while it was still running, or crawling under looms. Mill workers lost fingers, hands, and arms with regularity. The end of the Victorian era saw attempts at regulation, but without true enforcement. The Factories Act didn't appear until 1933 and it was bitterly opposed by many owners of mines and mills. Modern regulations exist today to prevent the tragedies of the past from happening again, they were hard fought for by workers and lobbyists, and in some ways we're still fighting to include the broader impacts work can have on an individual. [16:45] Addressing broader health and safety risks – This is in relation to harm accumulated over a lifetime of work with long-term and often fatal consequences. The suffering caused to workers exposed to hazardous conditions is immeasurable. For example, let's look at asbestos. The dangers of working with asbestos were recognised remarkably early, as far back as 1890s in France, and Asbestosis was formally recognised in 1930. This led to regulation in 1931, but only applying to the asbestos textile industry, excluding all the industries where its use was widespread such as construction, shipbuilding, anyone working in insulation etc Worse still, it wasn't even enforced! Then take mesothelioma, the distinctive and almost invariably fatal cancer of the lining of the lungs and abdomen. The connection between asbestos and mesothelioma was established in SA in 1960 when mining blue asbestos. Further research in the UK firmly established the link in the 60s. From the mid-60s, headlines were being made nationally when shipyard workers from the war era stared dying in large numbers. Unions began lobbying for protections and media coverage continued for years as cases multiplied across several areas and industries. Nevertheless, its manufacture and use continued. The Asbestos (Licensing) Regulations 1983 introduced licensing for the most hazardous asbestos removal work. Blue asbestos (crocidolite) was banned in 1985, followed by brown asbestos (amosite) in 1986, though white asbestos (chrysotile) remained legal until 1999. In the interim and since then thousands of people died and multiple legal cases have ensued. 2218 people died of mesothelioma alone in 2023. Altogether it's estimated that workplace-related lung disease and cancers kill as many 13000 per year in the UK. Several thousand more are known to die of non-lung-related occupational diseases each year, but these aren't recorded as workplace deaths on certificates, so these people aren't included in HSE annual reporting. It doesn't stop at deaths either, there is an argument for the detriment that certain work can have on quality of life. Incidents and conditions such as: ·      accidents causing amputation and fracture ·      eye conditions from welding and other light sources ·      Deafness and hearing difficulties ·      HAVS, vibration white finger ·      Skin conditions from exposure ·      Musculoskeletal in low risk environments None of these are terminal and so often go unreported.   [23:25] How to make Health & Safety manageable – Some consider modern health and safety regulations to be over the top, but overarching law in the UK has the principle 'As Far As Is Reasonably Practicable'. One common area is in risk assessment, The Management of Health and Safety at Work Regulations states: "Every

Anyone that has undergone the ambitious task of Implementing an ISO Standard will know how much work goes into creating and maintaining a single ISO certification. Now imagine juggling seven ISO certifications! There's a key difference between those that simply collect badges and those that see the value each ISO certification can bring, as every Standard has their own requirements and guidance to tackle specific areas of quality, risk and sustainability. When implemented well, they create a solid well-rounded framework that can drive unparalleled continual improvement. In this episode Ian is joined by Damian Edwards, Head of Standards at Wavenet, to dive into how they manage the mammoth task of maintaining seven ISO Standards, the challenges with managing multiple ISO certifications and what benefits they've brought to the business since implementation.   You'll learn ·      Who is Damian Edwards? ·      Who are Wavenet? ·      How did Damian manage integrating management systems during Wavenet's acquisition of Daisy Corporate Services? ·      What is Damian's role at Wavenet? ·      How do Wavenet manage their ISO certifications? ·      How has ISO Support helped you over the past year? ·      What has Damian learned while managing ISO Standards? ·      What are the benefits of ISO certification? ·      Damain's top tip for anyone considering ISO Implementation   Resources ·      Wavenet ·      Wavenet Certifications ·      Blackmores – ISO Support Service ·      Isologyhub   In this episode, we talk about: [00:30] Episode Summary – We welcome Damian Edwards back onto the podcast to discuss how he maintains Wavenet's seven ISO certifications, and the explore the benefits gained from an integrated ISO Management System.   [03:05] Who is Damian Edwards? Damian is the Head of Standards at Wavenet, and has featured on the ISO Show before! One lesser known fact about Damian, is that he a 'Dance dad', supporting his daughter through all of her lessons and competitions. He's very proud of her latest achievement of qualifying for the World Championship for Irish dancing in her age group. [05:05] Who are Wavenet? Wavenet is an IT provider, providing IT network communications, security and resilience services. They are UK based with 1,600 employees based in their Solihull head office. Wavenet were formed in 2000, but have grown through acquisition, one of which was Damians previous company, Daisy Corporate Services. When Daisy was acquired, both businesses were of a similar size, so the process looked more like a merger in practice. A large part of that was uniting the ISO Standards managed by both businesses, so Damian had his hands full with ISO integration, amending audit schedules and managing extension to scope audits. [06:30] How did Damian manage integrating management systems during Wavenet's acquisition of Daisy Corporate Services? One of the biggest challenges was the extension to scope that needed to happen due to the increase in sites. Thankfully, as Wavenet were used to acquisitions, they had dedicated acquisition project managers that assist with managing the integration. At the start, there are some teething problems as both businesses will still be using their respective processes for a while. However, once system that helped was a system called 'ServiceNow', which is where issue tickets could be logged, monitored and actioned in one centralised system. [08:15] What is Damian's role at Wavenet? Damian is the Head of Standards, which includes both ISO Standards and ESG related regulatory compliance. ISO certifications are more often than not a prerequisite or a condition of a bid over a contract, without them, Wavenet wouldn't win any business. They also create a foundation of trust for Wavenet's clients in the realms of Information Security, quality and environmental management. Wavenet are currently certified to the following Standards: ·      ISO 9001 Quality Management ·      ISO 20000-1 Service Management ·      ISO 27001 Information Security Management ·      ISO 22301 Business Continuity Management ·      ISO 45001 Health & Safety Management ·      ISO 14001 Environmental Management ·      ISO 50001 Energy Management In addition to maintaining all of these certifications, Damian also strives to utilise them to drive continual improvement within the business.   [10:30] How do Wavenet manage their ISO certifications? Damian is directly responsible for five of those ISO Standards, however there are some where he doesn't have the expertise to fully manage the requirements. ISO 27001 and ISO 45001 for example require skilled people at the helm, so Wavenet have dedicated managers to handle those areas. One of Damians key responsibilities is juggling all of the audits to make sure each element is covered, and he's put a lot of work into integrating those audits where possible to get the most out of their time and resources. Though, it's important to note that you can't integrate everything, as each standard will have some unique requirements. Areas that you can integrate however include elements such as: ·      Context ·      Audit Programme ·      Corrective Actions When you do have a lot of Standards, some elements can get watered down if you try to integrate everything. Policy for example, if you have five Standards and decide to integrate all related policies into a single document, it will become long and unruly, which will lead to people unwilling to read it. So, you have to take care to ensure focus on certain elements to make those more accessible for the staff that need it. Another aspect that needed additional consideration was Wavenet's risk profile, with their amount of sites and services, it's very varied. Too much for a single person to be aware of all the risks, which is where Damian's subject area experts can provide additional insight to fill the gaps. Damian is also keen to combine external audits where possible to both reduce cost and possible duplication of effort, as many Standard do share common subject areas, this can be done across multiple Standards. Certification Bodies are usually quite happy to work with you on this! Damians key take away is, that there isn't one solution that fits every business when managing this many Standards. It was a very trial and error process, especially with the ever changing landscape of a business, but Standards are also designed with flexibility in mind, so with the right people in place it's certainly manageable. [16:05] How has Blackmores' ISO Support helped? Blackmores has assisted Wavenet with their ISO 45001, ISO 50001 and ISO 41001 (Facilities Management) implementation. ISO 41001 was later dropped as it was no longer applicable for the business. Standards can be quite hard to apply to your own business when looking at them at face value, the requirements sound generic because they're designed to apply to every type of business. This is where Blackmores experience as a consultancy can help with interpretation and practicalities of how a Standard will apply to your way of working. Blackmores will also assist with internal audits, which help identify non-conformities that may have been missed if it were not for a fresh pair of eyes. As Damian states: "I would rather have them identified before an external audit" as this gives you a chance to resolve issues or put an action plan in place before it gets to that stage. Damain also reminds everyone to not be afraid of your auditor, internal or external. They are not maliciously looking for problems, they simply help to highlight issues which can be resolved sp you can improve as a business. No Management System is perfect, the important thing is that you can recognise when something needs addressing, and how you go about doing so. [19:30] What has Damian learned while managing ISO Standards? Damian has learned to not think of ISO as a tick box exercise, it's a tool to help businesses improve. He has also learned that you don't need to reinvent the wheel when Implementing a Management System. You likely already have much of what's required in place, but not monitored or organised regularly. For example, aspects such as 'Management Review' may already be happening in existing meetings with top management, you simply need to ensure these are minuted, cover what needs to be discussed in regards to the Management System, and make note of any gaps that need to be addressed. Businesses like Wavenet that have been in operation for 26 years know what they're doing, and are likely already following best practice. You don't need to restructure your business to meet an ISO Standard, but rather integrate the Standard requirements with how you already operate. If done correctly, it should become a simple part of your day-today tasks. Damian jokingly states: "What's my role? I sometimes say it's to do as little as possible", as the more a business is aligned with a Standard, the less you will have to do to upkeep that. [22:55] What benefits have Wavenet experienced as a result of their ISO certifications? As mentioned earlier, a lot of won business is due to ISO certification. Certain certifications are simply a tender or client requirement. Standards such as ISO 50001 tackle their energy consumption. It's focus on reducing that will inevitably lead to reduced business costs. Since implementing the Standard, Wavenet now have monthly meetings to monitor energy use, which gives them a good basis to make informed decisions on where energy use is concerned. Damian has found that over time, good practice has been so embedded that people are using it in their everyday behaviors without even realising it. He's heard people in their resolutions

Watch the video interview here Carbon verification is quickly becoming a necessary step for many businesses, whether due to regulatory compliance, market demand or as part of a voluntary scheme. The drivers for this demand are varied, as is the approach many take for their path towards carbon verification. This can look very different depending on the industry you operate in and can be difficult to tackle for more service based industries, such as today's guest, Davies Group, who are a service provider for the insurance industry. In this episode Mel is joined by Gillie Fairbrother, Global Responsible Business Officer at Davies Group, to discuss the findings of Mel's thesis regarding the demand and drivers of GHG verification for organisations across the globe, and how Davies Groups' carbon verification journey factors into the findings. You'll learn ·      Who is Gillie Fairbrother and who are Davies Group? ·      What factor triggered the decision for independent carbon verification at Davies Group? ·      At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard? ·      What did Davies Group's GHG inventory and reporting look like before independent verification was introduced? ·      Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally? ·        ·      What is the gap between organisations knowing they should verify emissions and actually doing it? ·      Was competitive positioning part of the Davies Group case for carbon verification? ·      What was the most significant finding from the first carbon verification engagement? ·      How has verification changed the internal culture and engagement with the sustainability programme at Davies Group? ·      How have Davies Group supported suppliers with calculating their carbon emissions? ·      Where does Gillie see the expectations of institutional partners and large clients in insurance and professional services heading? ·      What was a specific moment where Gillie can recall that this mattered more than she had expected?   Resources ·      Davies Group ·      Davies Group LinkedIn ·      Carbonology – Carbon Verification Services   In this episode, we talk about: [00:30] Episode Summary – We introduce Gillie Fairbrother, Global Responsible Business Officer at Davies Group, to discuss their participation in Mel's thesis research into the demand for GHG emissions, exploring Davies Group's own reasoning and journey. [02:05] Who is Gillie Fairbrother and who are Davies Group? A route into sustainability as a career wasn't as readily available to Gillie when she attended university, so it has been something of a self-made path. She has previously run a wellness business in the past and has experience working with sustainable brands and has done a lot of cultural advocacy, particularly in the LGBTQ space. Taking the lead for ESG within the corporate space was a dream come true for Gillie, and she has done this for a number of US based tech firms to her current position for Davies Group. Davies Group are a service provider for the insurance industry, who operate in 22 countries. [03:40] What factor triggered the decision for independent carbon verification at Davies Group? Mel's research found that 29% of organisations cite market-driven factors as their primary reason for seeking GHG verification, compared with just 12% who cite regulatory compliance. For Davies Group, their decision was led by market demand. They looked client requests versus client contractual obligations, and carbon verification was increasingly coming up in those contractual obligations. Gillie herself has always been an advocate for working both sustainably and responsibly, promoting the revenue benefits that can be gained from doing so. However, as much as it is perceived to be the right thing to do, she doesn't want businesses to simply think of it as the 'nice thing to do'. These should be central components to how your business operates. So in part, Davies Group saw this demand not only in the market, but as simply the right way to do business. [05:30] At what point did the leadership team recognise that unverified carbon data represented a credibility and governance risk that was inconsistent with that professional standard? Davies Group already operate in a highly regulated market, and so already have very strong governance practices in place. Gillie didn't really have to worry about making too many improvements in the governance or purpose aspects of ESG compliance. They participated in TCFD on a voluntary basis to highlight a possible risk from a climate perspective that could affect things like supply chain, physical sites, or the industry in general to leadership. Thankfully, the leadership saw this as a risk worth looking into more, and were willing to quantify it properly and ensure that their data was as accurate as possible and in a place where it could be audited by a 3rd party. [07:40] What did Davies Group's GHG inventory and reporting look like before independent verification was introduced? Before Gillie joined, these aspects were managed by a 3rd party due to lack of in-house expertise to manage it. When Gillie joined, she worked closely with that 3rd party to continue the work. Davies Group is quite a complex business, it operates with 3 different divisions that have multiple service lines. At the time, they did their best with the Excel spreadsheets that they had create to track various GHG emissions, but it was not as good as it could have been. They've since grown their processes, included more in-house talent and are doing more to gain knowledge from their stakeholders, data owners and building relationships with various teams across the business. While they are still working on Excel spreadsheets, they have advanced to reasonable assurance. Gillie is now looking into external tools to help improve their data management, but this would cost a fair bit of money that could be better used currently on reducing environmental impact. [10:30] Which specific stakeholders were asking the hardest questions about Davies Group's sustainability data, and how did those questions land internally? Gillie cites employees, as they're an industry where 30% of the workforce is likely going to retire in the next 10 years, so they're trying to attract a younger group of talent who want to work for a business that has a good purpose and is a good company. Acting sustainably and responsibly is a huge part of attracting that new young talent. The second more important stakeholders are their clients. Davies Group is a private equity backed business, if they're not making money then they simply cease to exist as a business. Clients now have a keen interest in responsibly run businesses, and many now seek proof to claims. Next in the list is investors, who have an interest in the regulatory requirements that the business is subjected to. Lastly, Gillie cites suppliers as even if they aren't actively putting pressure on the business to report their emissions, without their support and cooperation, Davies Group can't meet their own goals. [12:40] What was a particularly memorable conversation with a Stakeholder that helped drive further improvement? Gillie recalls one conversation with a new employee where they asked to be more involved with their sustainability group. When she talked to them more, she discovered that one of the main reasons that employee sought them out was due to the responsible business page on their website, and that out of the 3 businesses they were applying to, Davies Group was the only one that had a page like that. [37:00] What is the gap between organisations knowing they should verify emissions and actually doing it? Mel's research found that 86% of organisations report increased stakeholder demand for transparency in GHG reporting – yet 52% remain unverified. Gillie states that there could be a lot of reasons for this, including budget, resourcing or something as simple as a piece of wording in a contract where a client might say we request versus we require. This is why Gillie is always in conversation with clients, whether that be the sales team or the sustainability teams at our clients, to understand their goals and make sure they can all align in their goals. The market is certainly the leading cause for many businesses as Government regulation tends to lag behind. [17:20] Was competitive positioning part of the Davies Group case for carbon verification? For Davies Group, it was initially a contractual requirement to complete their carbon verification. So, in their case, it was an easy decision as otherwise they could potentially lose business. However, Gillie also regularly meets with senior leadership and reports into their responsible business board committee every quarter. There they consider the growing appetite for sustainability driven demands, and how they want to leading the way in their industry. The key determining factor is whether it's relevant to them, whether that's for sustainability or for their community impact strategy. Davies Group tend to focus on education and investment in our communities, as that's where their expertise sits. It's all about materiality as businesses need to focus on what's relevant to them. [19:20] What was the most significant finding from the first carbon verification engagement? For Gillie, it was the clarity and transparency that had been game changing. Especially within their real estate portfolio. Davies Group don't own any of their offices, they're all leased. As they calculated and ver

How often have you heard someone say they aspire to be an ISO consultant? Likely not at all! That's not surprising as it's quite a niche world to find yourself in, yet despite that, there are still thousands of ISO professionals worldwide. We're continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification.   In this episode we introduce Steve Mason, a Principle isologist® at Blackmores, to share the journey of how he went from intern, to ISO Assessor, to ISO consultant and the challenges he's faced while working with clients. You'll learn ·      What is Steve's role at Blackmores? ·      What does Steve enjoy outside of consultancy? ·      What path did Steve take to become an ISO Consultant? ·      What is the biggest challenge he's faced when implementing ISO Standards? ·      What is Steve's biggest achievement?   Resources ·      Isologyhub ·      ISO 14001:2026 What's Changed And How to Comply Webinar Registration   In this episode, we talk about: [00:30] Episode Summary – We introduce Steve Mason, a Principle Isologist® here at Blackmores, to discuss his journey towards becoming an ISO consultant who specialises in ISO 27001, ISO 27701, ISO 27018, ISO 27017 and ISO 20000-1. [02:40] What is Steve's role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards. As part of that support, he: ·      Makes Standards understandable and accessible to clients ·      Conduct internal audits ·      Reviews and updates management system documentation ·      Facilitate management reviews ·      Train internal teams and prepare them for certification audits. Steve is the Standard champion for ISO 27001, ISO 27701, ISO 27017, ISO 27018 and ISO 20000-1 at Blackmores, but he also deals with ISO 9001, ISO 41001, ISO 22301 and ISO 42001 related projects and support. Steve's other main role at Blackmore's is as a Mental Health First Aider, which is shared with Minoo Agarwal. Together, they provide resources and offer support to the team. [06:00] The importance of Mental Health management in the workplace: Steve had faced bullying in previous roles, so preventing others from experiencing the same had become a big motivator for him taking on the role of Mental First Aider for Blackmores. He emphasizes it's importance, and highlights 2 key Standards that you can use to help support mental first aid within your business. This includes ISO 45003 Mental Health in the Workplace and BS 30480 Suicide and the Workplace. [09:10] What does Steve enjoy doing outside of consultancy?: Steve has a wide variety of interests and hobbies, including: Lay Minister: Steve is a Lay Minister in the United Reform Church and mainly based at the URC Chapel in Walkern, but can be found leading worship and preaching at Ashwell, Baldock, Stevenage and Knebworth chapels. Poetry: Steve enjoys writing poetry about anything and everything, racking up an impressive 190 poems so far. Some of his main inspirations include Wordsworth and Keats. If you ever see a poem on the Blackmores LinkedIn page, odds are, it was written by Steve! Classical Music: He's a fan of classical music, anything by Beethoven, Mahler or Shostakovich specifically. He likes these composers in particular due to their stretching of the rules of music for the time. Exploring hidden London: Steve often goes on hidden London tours which explore disused underground stations which may have been shut down as long as 100 years ago! Buses and Trains: Steve was lucky enough to drive a bus in his past, of which he has the licence plate of sitting in his office. He collects bus and train models and will go out to snap a photo or two of their real world counterparts when he comes across them. History: Steve is a huge mystery buff, with a particular fondness for Richard III and the War of the Roses and the Anglo Saxon period of history. Family Tree: Steve has been tracing his family tree back as far as he can on his mother's side, which extends as far back as 1547! Interestingly enough he found out that relatives from way back then got married in the church that he currently lives nearby and got qualified as a Lay Minister for the Church of England in Stevenage! Cats: He's owned his fair share of feline friends through the years, with one particular tabby holding the name 'Spartacus'. [22:35] What was Steve's path towards becoming an ISO Consultant?:  Steve was once told in the 1980s 'There is no future in Standards; find another career, perhaps in Sales or Purchasing'. How wrong that turned out to be! He's always worked with standards, from the first day he started work doing inspection in Goods Inwards, he was referring to them. The direction towards Management systems came in 1983 when he started implementing BS 5750. From that day onward he had been involved in Management Systems. Steve completed a management apprenticeship at Racal-Guardall where he was able to do 3 months' work experience in all departments, which helped him appreciate how companies function and how important it is to maintain good communication channels. He was at the end of this apprenticeship that the opportunity arose in the QA department to work on BS 5750. His career path has included other organisations such as Tektronix, BOC Ohmeda, Cirkit, Deta, TDK and BSI, all of which earned Steve a lot of experience in Manufacturing and Service and Distribution, mainly in Quality and Customer Service roles. Steve has always felt a bit like a closet consultant, even when he worked as an assessor at BSI. He feels as if Blackmores has enabled him to fully flourish and develop his portfolio of standards – not bad for a career where there was apparently no future in standards! [28:45] Born to be a consultant – Steve mentions that consultancy is a skill that many are born to be. You can train and learn the skills of course, but for some it comes very naturally and it can be hard to replicate that skillset in others. [30:15] What is Steve's favourite aspect of being a Consultant? Steve loves talking with clients and working with them to explore solutions that can address the requirements of the standards. His motto is 'Mould the Standard to the organisation and not the organisation to the standard' This means, always producing a management system that benefits the organisation first and then adjusting it to meet the requirements of the standard. Organisations that mould the business to the standard usually end up with a management system that is a 'bolt-on' and an uncomfortable, sometimes irrelevant, fit. Everyone in the organisation needs to feel that the management system is a natural fit to what they do. He also enjoys supporting his colleagues at Blackmores. We're a business built on knowledge sharing, and there's no point gatekeeping anything we've learned as a team. So consultants often get together to discuss lessons learned and ensure best practice is a shared experience. Ironically enough, one of Steve's least favourite aspects of being a consultant is auditing! Mostly since he's been doing it for some 40 years now, so he can be forgiven for finding the exercise a bit tedious at times. However, he never let's that affect the end result of an audit. [37:00] What Standards does Steve specilaise in and why? Steve initially started with ISO 9001 but was steered towards ISO 27001 and ISO 20000-1 during his time as BSI. This was based upon his career path up to the point he joined BSI as they align assessors to familiar business and technical environments. In Blackmores, he has been able to develop these areas of Quality, Service and Risk by adding standards related to Business Continuity, PII and Cloud Security, Facilities Management and AI Management. Steve's favourite standard is ISO 20000-1 which started off as an IT Service Management System but can also be used effectively for all services. He always refers to ISO 20000-1 as 'ISO 9001 on Steroids' because it is much more specific and focuses on the subject of service management. Sadly, ISO20000-1 is under rated, under sold and in some cases, never heard of – this is usually because contracts require IS O9001 but the people writing those contracts don't actually know or understand what they are asking for. In simple terms it is a Service Quality Management System and Steve has come across organisations which have shoe-horned ISO 9001 into the business instead of using the natural fitting standard ISO 20000-1. Steve would advise any company that is providing a service with helpdesk support to look at ISO 20000-1, especially if they find that ISO 9001 isn't working well for them. [43:00] What is the biggest challenge Steve had faced during a project and how did he overcome it?: Creating a management system in 10 days for a client which was due to lose a major contract because they had let their certification to ISO 9001 lapse between the 2008 and 2015 versions. Quite the undertaking in such a short amount of time! Steve refuses to claim full responsibility for the success however, as the client was totally invested in getting the system up and running and put in a lot of effort to work with Steve to get it done in time. If it had been any other standard, it would have been impossible, but because it was ISO 9001 and wthey were drawing on what had been in place previously it was possible. Generally, problems arise when there is limited or no Leadership support and commitment, because without this management systems can't be set up in a way that benefits the organisation. All manag

Most ISO Standards are designed with implementation flexibility in mind. They set the framework without specifying an exact method to meet requirements, giving businesses the freedom to implement them how they see fit. One of the key requirements you can't escape, however, is documentation. This is more than a list of key documents you must have in place, it encompasses how you develop, control and store documented information. In this episode, Ian Battersby dispels common myths around documentation in ISO, explains what the requirements actually mean in practice and how you address each one relevant to documented information. You'll learn ·      Common misunderstandings about documentation within ISO ·      What do current ISO Standards require for Documented Information? ·      How do you determine what should be documented information? ·      How do modern Standards embed a flexible approach? ·      What is considered 'documented information?' ·      Breaking down clause 7.5 Documented information ·      How to address clause 7.5.2 Creating and Updating documentation ·      How to address 7.5.3 Control of documentation ·      A cautionary tale for modern approaches to Documentation   Resources ·      Isologyhub   In this episode, we talk about: [02:05] Episode Summary – Ian dives into the topic of documentation within ISO, dispelling the myths and breaking down the requirements you need to meet relevant to documented information. [02:40] Common misunderstandings about documentation within ISO: Taking ISO 9001 as the prime example, the most common misunderstanding is that you need a policy manual. This is not true. This may have stemmed from previous versions of ISO 9001 where certain mandatory procedures were required, such as: ·      Control of Documents (Clause 4.2.3) ·      Control of Records (Clause 4.2.4) ·      Internal Audit (Clause 8.2.2) ·      Control of Nonconforming Product (Clause 8.3) ·      Corrective Action (Clause 8.5.2) ·      Preventive Action (Clause 8.5.3) There were also mandatory records such as Management Review, calibration, supplier evaluation, design/development reviews etc. With the introduction of the 2015 version of ISO 9001, the old terms 'Procedure' and 'Record' have changed into a single term now known as 'Documented Information', which breaks down those previous terms into the following: ·      Documented information to be maintained — Previously what would have been a procedure (i.e., describing how something should be done) ·      Documented information to be retained — Previously what would have been a record (i.e., evidence that something was done) [05:10] What do current ISO Standards require for Documented Information? The 2015 version of ISO 9001 received the following updates: ·      Removed the prescriptive language associated with the old terms ·      Gave organisations the flexibility to develop, control and store documented information ·      No longer dictates the form that documentation must take In practice, many people still use the terms procedure and record informally, because they are well understood and conveniently descriptive. But beware using language that reinforces old-fashioned ideas about how we create management systems. This newer language aligns with modern risk-based thinking, with direct references made to this being included in the Standard. But, while that sounds prescriptive, adopting risk-based thinking has allowed a less prescriptive approach to the standards. It allows you to consider what's significant to you and so you can plan your system accordingly. [07:20] How do you determine what should be documented information? The effort you put into documenting something must be consistent with the risk If, for example, a process is important, if its outcome could be in doubt, if it's complex to control, if it could lead to damage/harm, if there's a regulatory requirement, then you should put some effort into documenting how it's performed. But, if you maintain that documentation in response to the risk to your organisation and not in response to a prescriptive demand in standard, and if a process attracts less risk, then you can deliver it with less formality and less documentation to be maintained. The same goes for retaining documentation to evidence that you've done what you should. In short: more risk, more documentation retained to demonstrate that you've controlled it. [08:30] How do modern Standards embed a flexible approach? ISO Standards are deliberately flexible. The extent of documented information required depends on the size of your organisation, the complexity of your processes, your customers' needs, your regulatory environment and the competence of your people. An organisation of only 10 people will have very different needs compared to one of 10,000, and both can fully conform to the standard. It's about proportionality, not volume. [09:20] What is considered 'documented information? ISO standards don't care what you call the documents you maintain in order to govern how you deliver your daily work. Other than using the term process (and the process approach) to underpin how systems should interrelate, ISO 9001 doesn't specify anything else. Would you like to use the term procedure?  Or management procedure? Or SOP? Work instruction? Process map, guide, playbook, manual. Or is your activity embedded in an online system? A workflow? A board? It doesn't matter, you can call it what you want, and as long as it's controlled to the extent that it needs to be. [11:05] Breaking down clause 7.5 Documented information: ISO 9001 states: "7.5.1 General: The organization's quality management system shall include: a) documented information required by this International Standard; b) documented information determined by the organization as being necessary for the effectiveness of the quality management system. NOTE The extent of documented information can differ from one organization to another due to: ·      the size of organization and its type of activities, processes, products and services; ·      the complexity of processes and their interactions; ·      the competence of persons." This reinforces the fact that there is no 'one size fits all' approach. [12:15] How to address clause 7.5.2 Creating and Updating documentation: The Standard states: "When creating and updating documented information, the organization shall ensure appropriate." Note that word, 'appropriate'.  It doesn't indicate specifics, it indicates that you should choose certain things according to your own circumstances So the appropriate things which you should ensure are: Identification and description:(e.g. a title, date, author, or reference number) One trap many fall into, is the use of reference numbers. In most cases they are unnecessary. Only use them if they mean something or make life easier. Having reference numbers with department numbering can reinforce the silo mentality; 'that's their procedure, not ours', so it's best to avoid creating that situation by foregoing reference numbers if possible. What matters is that any users are able to easily verify that they have the right document, this can be done with a descriptive title, version numbers and a date for the version. Online documents may have details embedded in metadata or an information box that can make this process easier to implement.   Format and media: You'll need to consider language required for certain documentation, as international systems where there are multiple languages used by the workforce, may require additional versions. You'll also need to establish which templates or layouts to use. Look and feel will likely be important in the organisation, so you'll want to keep documents on brand. Other considerations include: ·      The use of process maps, flowcharts, diagrams, tables, or written text. ·      The software or application it is created in (e.g. Word, PDF, SharePoint) ·      Whether the document is paper-based or electronic Review and approval for suitability and adequacy: Documented information requires appropriate review of content, this is to make sure it does what it should and that all of the above is covered. You will also need sign-off by someone with the appropriate authority, and that authority is determined based on risk related to that document. [18:00] How to address 7.5.3 Control of documentation: Let's break down each part of this clause: "To ensure that a)    it is available and suitable for use, where and when it is needed;" - It must be circulated, hosted, displayed or whatever, so that those people who are required to see it, use it, know of its content can act on it. "b) it is adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity)." - It must be protected so that only the right people see it, so that any confidential information is not inappropriately shared, and no one can use or amend it without the appropriate authority. This is to ensure it remains in the manner it was intended and that its content can't be altered, corrupted or destroyed. "7.5.3.2 For the control of documented information, the organization shall address the following activities, as applicable: a) distribution, access, retrieval and use; b) storage and preservation, including preservation of legibility; c) control of changes (e.g. version control); d) retention and disposition." This clause adds some meat to the ideas discussed already "a) distribution, access, retrieval and use;" – This refers to who receives a document and by what means, whether the right people can access it and know what to do

Most ISO Standards take what's known as a 'risk-based approach', which focuses on proactively identifying and mitigating potential risks while capitalising on opportunities. The methods for managing risk can be very varied, and many make the mistake of treating it as a separate task rather than as an integrated part of your existing processes. In this episode, Ian Battersby explains what risk management means in regard to ISO management, what this looks like in practice and breaks down different methods you can utilise for effective risk management. You'll learn ·      What is risk? ·      Where is risk referenced in ISO Standards? ·      How do you identify risks and opportunities? ·      How can you document risks and opportunities? ·      What does a Risk Register look like? ·      How are risks categorised? ·      How many risks should you document? ·      How do you evaluate and rate risks? ·      How do you address opportunities? ·      How can ISO 31000 help? ·      How different ISO Standards define their relevant risks ·      Governance and risk management   Resources ·      Isologyhub   In this episode, we talk about: [02:05] Episode Summary – Ian dives into the topic of risk management within in ISO. Explaining what risk is, how they should be documented and evaluated and what methods you can use to do so.    [02:45] Further info on risk management: If you want more guidance there is a dedicated risk management Standard (ISO 31000). [03:10] What is risk? Risk, as defined by ISO Standards is: "An effect of uncertainty on objective. An effect is a deviation from the expected. It can be positive, negative or both, and can address, create or result in opportunities and threats" So important to note that this includes both risks and opportunities. [03:40] Where is risk referenced in ISO Standards? The main risk related requirements can be found in Clause 6 Planning for most ISO Standards: 6.1 Actions to address risks and opportunities - There's a positive and a negative aspect mentioned right from the start. However, these elements aren't relegated to a few clauses. ISO Standards are built on a 'risk-based approach', which is directly mentioned within the introduction: "This International Standard employs the process approach, which incorporates the Plan-Do-Check-Act (PDCA) cycle and risk-based thinking Risk-based thinking enables an organization to determine the factors that could cause its processes and its management system to deviate from the planned results, to put in place preventive controls to minimize negative effects and to make maximum use of opportunities as they arise." While it is prescriptive, it does allow flexibility for businesses to determine what risks are significant to them. Other places it's mentioned in Standards includes Leadership: "Top management shall demonstrate leadership and commitment by: d) promoting the use of the process approach and risk-based thinking" It's not just about adopting the risk-based approach, leaders have to promote it. The use of the word 'shall' indicates that this is not optional and cannot be delegated. [08:10] How do you identify risks and opportunities? The Planning clause directly references clause 4, which is Context of the organisation. Within that clause, businesses are required to think about the things which affect the way you operate, the world in which you work, the people and organizations you must consider, the obligations placed upon you. One key activity that typically happens at that stage is a SWOT and PESTLE, that's not specified by the Standard but it's a very popular method of identifying your risks and opportunities against multiple areas. The results of which can be fed back into Clause 6 Planning when it asks you to consider and do the following:- ·      Give assurance that the system can achieve its intended result(s); ·      Enhance desirable effects; ·      Prevent, or reduce, undesired effects; ·      Achieve improvement. ·      Plan actions to address these risks and opportunities; ·      Integrate and implement the actions into its system processes; ·      Evaluate the effectiveness of these actions. This is where you have the freedom to determine what significant risk means to your business. This also establishes the approach to risk management as proactive rather than reactive. [13:15] How can you document risks and opportunities? Just because you need to determine risks, you don't necessarily need a risk management process or methodology based on the guidance in a standard like ISO 31000. There's no requirement to even have a risk register! However, we do strongly recommend using one. If you choose not to use one, you could document each risk individually with the plan of action to mitigate it. This is fine, but a register allows you to see what's happening across all risks. It allows comparison of different types, different categories, across different parts of the organisation, at different levels. It can support decision making and allocation of resource where there's competition for that resource. It can prompt escalation and more significant management attention where it's needed. It can also form a basis for reviewing the effectiveness of your processes. So, while not a firm requirement, it can be a very useful tool. [15:20] What does a Risk Register look like?: A typical Risk Register usually sits in a table or Excel document. You can number your SWOT and PESTLE findings and put them into this Risk Register. One of the columns included is interested parties affected by it, e.g. the risk that your processes deliver the wrong product directly relates to your customers; the risk of enforcement may relate to your board; the risk of terrible PR may affect your investors; the risk of polluting may affect the local population, enforcement agencies etc Certain standards also require you to determine compliance obligations associated with each interested party, so that may be useful to add as a column. Then, you need a column for detailing what the impact of the issue is (remember, both positive and negative). Then you need to evaluate each entry, this involves measuring the significance, the size and scale. When evaluating risks, you need to indicate which processes you have in place that control the risk.  Then you need to rate the risks in their current (do-nothing) form. This is where it helps to have a register where different types and categories can be judged alongside each other, so you'll be able to see what's really important in one place. An organisation needs to decide what level of risk it's prepared to accept; this may be a straightforward decision where a specific value triggers escalation and action, but it may be more complex, depending on the organisation you are in and the environment in which you operate. If the risk is acceptable, should you still commit resource to addressing it; there's a balance in reducing risk overall; is it an easy win?  Is it easy to do? If you feel you should address a risk, what method of risk treatment should you adopt? The actions you propose to take should then be set out in proper detail: who will do what by when?  What resource?  Basically detailing the measures to assess effectiveness.  If a risk or a group of associated risks require an objective, state clearly and link to that objective. [21:35] How are risks categorised? The types of risks you will be focused on will depend on the ISO Standard you're implementing. For example, for ISO 9001 this will be the ability to consistently deliver the best we can to our customers. For ISO 45001 the ultimate aim is to protect your workforce from harm. Regardless, you can get quite broad with the nature of your risks, including considerations such as the ability to fund right equipment and infrastructure; or any investment in a sustainable future; the competence of personnel; the safe working environment to deliver products/services; compliance with relevant legislation; forces affecting our market; stability of supply chains; reputation; social attitudes to work, technology etc But, regardless of whether you're certified to a multitude of standards, operations are typically so interdependent that you can't separate financial risks from operational ones etc. [23:55] How many risks should you document? It's easy to get overwhelmed by generating a huge register when you're a small organisation, but you should be realistic. Focus on what's really significant. If you do a SWOT/PESTLE, if it generates lots of issues but not everything has to be treated as a risk and opportunity for the risk register.   First, ask yourself, what will actually have an impact on you if it materialises?  What is beyond control or influence?  What requires just monitoring? A larger organisation will tend to generate a larger register, but this can be categorised in different ways: ·      Split by functions ·      Split by category (operational, safety, compliance, financial) ·      Significance; operational vs strategic or corporate ·      This can be done by the scale of the risk, any risk above a specific threshold could be escalated to the strategic level ·      There could be factors in the risk evaluation which include strategic significance ·      There could be specific subjects (eg, compliance) which you automatically escalate to a strategic level [25:55] How do you evaluate and rate risks? There are lots of complex and sophisticated ways of doing this. Certain sectors, industries, processes have specific needs and ways of evaluating risk. But, if you're new to this, or there aren't such complexities to consider, a ve

Information is increasingly becoming the number one priority for businesses. With so many of us reliant on tech to stay in operation, there is an inevitable increase in data breaches and incidents year-on-year. The addition of new AI driven technology has added a new layer of complexity to the information security landscape, regarding both the new risks using the technology brings as well as falling prey to more complex AI led scams.   Thankfully ISO Standards are here to help, with ISO 27001 tackling general information security and ISO 42001 for effective AI Management. But how do these two compare, and is there merit in implementing both? In this episode, Ian Battersby is joined by Bas Von Hertom, Cyber Security Specialist at TUV Nord, to discuss what ISO 27001 and ISO 42001 are, the main differences between the Standards and how they can complement each other when integrated.   You'll learn ·      Who is Bas Von Hertom? ·      Who are TUV Nord? ·      What are ISO 27001 and ISO 42001? ·      How does ISO 42001 support regulatory frameworks such as the EU AI Act? ·      How do ISO 27001 and ISO 42001 differ in managing information security risks? ·      Other key differences between ISO 27001 and ISO 42001 ·      How much more work is involved for Implementing ISO 42001 if you already have ISO 27001 in place? ·      Can ISO 27001 and ISO 42001 be integrated? ·      What organisations should be implementing both Standards? ·      How are Certification Bodies quoting for ISO 27001 and ISO 42001? ·      Bas's advice to leadership teams looking to build a case for full certification   Resources ·      TUV Nord ·      Isologyhub   In this episode, we talk about: [02:05] Episode Summary – Ian is joined by Bas Von Hertom, Cyber Security Specialist at TUV Nord, to explore the differences between ISO 27001 and ISO 42001 and the benefits of integrating both Standards. [02:30] Who is Bas Von Hertom? Bas is the Cyber Security Specialist at TUV Nord. He is a lead auditor for Standards including ISO 27001, ISO 42001, TISAX and standards specifically for industrial automation. Bas had once stated around 5 years ago that he would never pursue a career in auditing, but once he came into contact with TUV Nord he decided to give it a go. Before joining TUV, he was a very hands-on systems administrator and many of those skills transferred well into auditing. [04:45] Who are TUV Nord? TUV Nord are a UKAS accredited Certification Body. They also offer services for testing and inspection. TUV have worked with a large range of sectors, from manufacturing and energy to IT, healthcare and even space. [06:25] What are ISO 27001 and ISO 42001? ISO 27001 is the Standard for Information Security Management, with compliant management systems being called an ISMS. It provides structure for identifying, assessing, and managing risks related to the information security while also ensuring availability and resilience on the information security. ISO 42001 AI Management is a much more recent Standard, being published in December of 2024. It focuses on ethical and effective AI management, with a system that applies to relevant products in addition to the wider business. [07:30] How does ISO 42001 support regulatory frameworks such as the EU AI Act? The EU AI Act sets out legal obligations that organisations offering AI products must comply with, however it only defines the rules rather than providing any implementation guidance. This is where ISO 42001 can fill the gaps, by providing a framework that will meet these regulatory requirements. [08:45] How do ISO 27001 and ISO 42001 differ in managing information security risks? Both Standards take a risk-based approach to their subject matter, but the nature of the risks that each address are what differ. ISO 27001 focuses on risks that relate to the protection of information assets based on confidentiality, integrity and availability of information. It's also ensures that business objectives are clearly defined and aligned with business strategy. ISO 42001 on the other hand deals with a broader and more complex set of risks, because it also looks at ethical considerations. This can includes the monitoring and measurement of ethical risks such as AI bias and discrimination. It also looks at societal, legal and reputational risks as one of ISO 42001's key values is creating trust within the AI space. [10:10] Other key differences between ISO 27001 and ISO 42001: Besides their subject matter, another key difference is the way objectives are framed and evaluated. In ISO 42001 these objectives have to be aligned with the Annexes within the Standard, which is something not commonly done when implementing ISO 27001. ISO 42001 also requires an 'AI Impact Assessment', which again, aligns with the systems objectives as the results of the AI Impact Assessment will describe the way bias, ethical and societal considerations impact other requirements within ISO 42001. [11:00] How much more work is involved for Implementing ISO 42001 if you already have ISO 27001 in place? If you already have ISO 27001 in place, you have a strong foundation for ISO 42001. ISO 27001 puts the fundamental base in place, with a governance structure, risk assessment processes, internal audits, corrective actions and methods for continual improvement. There's a lot of overlap where the high-level requirements are concerned. However, ISO 42001 also looks at AI products and services, which differs from ISO 27001.   ISO 42001 may also require additional training for those involved with the management systems and the AI products and services. [12:15] Can ISO 27001 and ISO 42001 be integrated? Yes, and in fact, Bas highly encourages it! If you intend to implement both Standards, it's much more efficient to do so as an integrated management system. They both utilise the Annex SL format, a high-level structure that's shared with most ISO Standards, so they're designed to be integrated. This also saves on duplication of effort where documentation is concerned and also potentially on cost if you require additional support with implementation. [13:30] What organisations should be implementing both Standards? Both ISO 27001 and ISO 42001 can apply to any business. Most businesses are now utilising AI in some form, and ISO 42001 can apply to those using it just as much as it does to those developing their own AI tools or selling related services. However, sectors where ISO 42001 will likely become fundamental include the financial sector, where AI tools for fraud detection are becoming popular. There's also a growing need for it within the medical field as AI is increasingly used for research and development. [14:30] How are Certification Bodies quoting for ISO 27001 and ISO 42001? There are a number of variables that Certification Bodies use to work out certification costs, these include size of the organisation and business complexity. This can be tricky to calculate for ISO 42001 as you need to consider the amount of AI systems used before you can provide a quote. The full requirements for this are described in ISO 42006, which is a guidance Standard. Most certification bodies will offer a discount for the combined certification to both Standards. An integrated approach is certainly something that Bas recommends, in addition to ensuring that you keep the same auditor or audit team throughout the implementation. By having one team for both systems, you can complete combined internal audits to save on time and resources.   [16:20] Bas's advice to leadership teams looking to build a case for full certification: First of all, don't wait, just make a start. A lot of businesses make the mistake of waiting until it's a common requirement within their market, which can leave you lagging behind the curve. Instead, strive to be one of the early adopters as that will give you a strategic advantage in the market. This is especially the case if you already have ISO 27001 in place. You already have the foundational knowledge to implement ISO 42001, so just make a start on looking at risks relevant to ISO 42001. Many businesses opt to implement certain Standard due to the demands of their clients, and ISO 42001 is likely to be added to that list. So it's better to get a head start! Bas also recommends finding sources of guidance on ISO 42001 implementation. Whether that's sourcing training or an external party to advise, it's good to have other sources of knowledge of you're not familiar with the Standard or ISO implementation as a whole. [21:30] Bas's favourite quote: We don't rise to the level of our expectation, but we fall to the level of the systems that we use. If you'd like to find out more TUV Nord or are looking for ISO 27001 and ISO 42001 certification, check out their website. We'd love to hear your views and comments about the ISO Show, here's how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Watch the video interview here Europe is only partially on track to meet its 2030 environment and sustainability objectives, and while some objectives are being scaled back, we are seeing the introduction of more regional regulations that require tangible annual sustainability reporting.  Businesses that have built sustainability into their way of working from the start are leading the charge and defining what it means to operate responsibly. As with today's guest, Forest, an e-bike provider that is not only 100% powered by renewable energy but has also achieved the coveted B Corp Accreditation. In this episode, Mel Blackmore is joined by Laura Elms, VP of Sustainability & Corporate Affairs at Forest, to discuss how they embedded sustainability from the start and explore their journey towards B Corp Accreditation. You'll learn ·      Who are Forest? ·      Who is Laura? ·      Why was B Corp important to Forest from the start? ·      What other Standards do Forest currently hold? ·      What does Forest's higher B Corp score of 99 mean in reality? ·      How did Forest embed sustainability into a business from day one rather than retrofitting it later? ·      How has Forest balanced growth with genuine environmental accountability? ·      What does tackling Scope 3 look like in urban mobility? ·      Why did they also attain Verra Validation, and why does third-party validation matter? ·      How do sustainability, communications and public policy intersect in Laura's role? ·      Advice for those seeking B Corp Accreditation ·      B Corp Version 7 ·      What role do you think sustainable transport should play in helping cities to meet their net zero targets?   Resources ·      Forest ·      B Corp Accreditation ·      Carbonology   In this episode, we talk about: [00:30] Episode Summary – Mel is joined by Laura Elms, VP of Sustainability & Corporate Affairs at Forest, to explore how they lead the way in sustainability including insight into their journey towards B Corp Accreditation. [01:10] Who are Forest? Forest is the only shared E-Bike operator to power its entire fleet with 100% renewable energy. It's also one of the world's first micro-mobility companies to have B Corp Accreditation and Verra Validation. [01:40] Who is Laura and how did she get involved with sustainability? Laura admits that she had a rather non-linear approach to getting into sustainability. She started her career shortly after graduating in financial communications and investor relations. Working in her first firm, she worked closely with a women called Caroline who went on to found Forest along with two other co-founders. Caroline reached out to her 2 years after starting Forest and Laura felt it was a no-brainer as she had a pre-existing interest in sustainability, and had come to prefer the start-up space over a more corporate setting. As is typical with the nature of start-ups, Laura wore many hats from the outset as it was a small team of four. Sustainability was what she was most passionate about, and has been the area she nurtured for Forest over the course of her six years working with them. [03:40] Why was B Corp important to Forest from the start? Laura noticed that B Corp was gaining traction back when Forest started in 2020. She was curious about the intersection between B Corp and ESG, particularly from a start-up perspective. When starting at Forest, she knew it would be a significant benefit to utilise renewable energy, but she felt like they needed to go above and beyond that. From there she researched B Corp and the costs involved, which were affordable as it's relative to your revenue, which is a great advantage to start-ups. She was pleased to find that Forest could cover the 5 pillars of B Corp's credentials, not only providing bikes for urban settings but also providing excellent governance and additional benefits to their surrounding community, workers and environment. In short, B Corp helped set the foundations for a good well rounded company that could grow. [05:15] What other Standards do Forest currently hold? Forest currently hold ISO 9001 certification and are looking to implement ISO 14001 in the near future. They currently operate within 18 boroughs in London, and are expanding from one central hub to several more warehouses, which is what will be covered under that ISO 14001 scope. With B Corp as their guiding North Star, they're confident they have all the right foundations in place to grow as needed. [06:10] What does Forest's higher B Corp score of 99 mean in reality? Within B Corp there are 5 pillars: ·      Community ·      Environment ·      Governance ·      Customers ·      Workers Its core focus is sustainability, but its approach is much more holistic and similar to the way ISO's implement a system that encompasses how a business works rather than just a siloed focus on one area. B Corp looks at a multitude if areas, such as: ·      Reducing Scope 1, 2 & 3 emissions ·      Looking at your supply chain ·      Evaluating how your activities interact with your stakeholders To earn a B Corp score, you need to get certain marks and then you're scored across the 5 pillars. Many businesses going for B Corp tend to do well in the sustainability area, but they struggle with other areas such as workers and customers. The framework is designed to be more holistic than simply focusing on sustainability, so If you focus too much in that area, it may come at a detriment to the other pillars. [08:20] How did Forest embed sustainability into a business from day one rather than retrofitting it later? Sustainability was Forest's vision and mission right from the start. Their CEO and Founder had previously worked at a ride-hailing company called Cabify, and had led the Latin American operations there. Cabify was the first mobility company to offset all its emissions, this was prior to 2020 so it was seen as though-leader in the space. This inspired the now CEO of Forest with the concept of 'Human Forest', which was the idea that humans on bikes in a city can save CO2 by choosing bikes over carbon emitting modes of transport. Having it as a core part of the business from the start meant they didn't have to worry about budgeting road-blocks or additional approval. It was simply a part of the brand. Laura can see why retrofitting the same level of sustainability commitment may be difficult for other businesses, as Forest had already baked in the price of renewable energy from the beginning and didn't have to worry about that transition. Forest do differ in that unlike other larger companies that will be showing smoother trajectories towards net zero, they're already there. They face the unique challenge of keeping it there as they grow, as more bikes and available geographical locations means more manufacturing and bigger scope 3 emissions. So their transition to net-zero will overall look a lot less linear. [11:15] How has Forest balanced growth with genuine environmental accountability? Forest have managed to reduce their carbon footprint by 53% year on year, even with their continued growth. Tackling environmental accountability can be something that gets businesses stuck in a rut, especially with any applicable regulations. As Laura quotes, often perfection is the enemy of good. Small incremental changes are better than trying to get it all right first time. In Forest's case, to achieve that 53% reduction they looked at a more creative solution. Rather than manufacturing brand new bikes when needed, they reached out to the wider e-bike market to those that utilised their same manufacturer and asked if they had any spare bikes. This helped to massively bring down emissions that would have otherwise been created making new bikes, by accessing a second-hand market. This can't be done indefinitely, but it's a small action that has created a large impact for that year. Forest have also worked with manufacturers to help switch to using solar energy for the production process, which they are now monitoring to see how much this reduces emissions by.   [13:50] What does tackling Scope 3 look like in urban mobility? Scope 3 for most businesses is their biggest source of emissions, typically accounting for around 80-90% of a businesses total emissions. For Forest this is closer to 100%. They've also noticed that compared to 3 years ago, the emissions are slightly less for things such as production and shipping of bikes. Laura admits that this may not be entirely due to the processes themselves getting more efficient, but as by-product of improving other areas such as technology or use of office spaces to help bring down the businesses overall emissions. At this stage, it's getting the methodology right for scope 3, to ensure their data is as accurate as possible. This includes sending questionnaires to suppliers and making use of technology to improve data gathering and analysis. [15:45] Why did they also attain Verra Validation, and why does third-party validation matter? Laura at the time was looking to ensure the highest level of credibility possible, which started with B Corp, ISO certification and then Verra Validation. Verra was a leader in this space, and dominate the market in terms of carbon offsetting. Forest didn't want to go through the whole process to sell offsets with Verra as it didn't make sense for their business, but they did want the validation as another layer of credibility. [17:45] How do sustainability, communications and public policy intersect in Laura's role?  London, unlike most other major cities, does not have a single unified body, instead you have to negotiate borough by borough. Each one has the