The International Organization for Standardization (ISO) defines a management system as a set of procedures an organisation needs to follow in order to meet its objectives. A management system standard provides a model to follow when setting up and operating a management system. Some of the top-level benefits of a successful management system include:
- enhanced use of resources
- improved risk management
- increased customer satisfaction by meeting product/service expectations
ISO has published many management system standards for topics ranging from quality and environment to information security and business continuity management. For this reason, and to help accomplish their business objectives, most organisations have more than one management system standard in place. With this comes a need to integrate and combine the standards in effective ways, because uncoordinated systems take up extra time and resources.
Most organisations have more than one management system standard. Existing management system standards often have different structures, requirements and terminology, so integration is challenging. Uncoordinated systems take up extra time and resources. At CRI Group we can help you address this problem. By adopting these standards together in an integrated way, ISO 31000, ISO 37001 and ISO 19600 will produce less duplication, confusion and misunderstandings.
Management system auditors use a core set of generic requirements across disciplines and industry sectors. In the future, all ISO management system standards will have the same high-level structure, identical core text, as well as common terms and definitions:
Clause 1: Scope
It sets out the intended outcomes of the management system. The outcomes are industry specific and should be aligned with the context of the organisation (see clause 4).
Clause 2: Normative references
This section provides details of the reference standards or publications relevant to the particular standard.
Clause 3: Terms and definitions
The clause explains terms and definition applicable to the specific standard in addition to any formal related terms and definitions standard.
Clause 4: Context of the organisation
The section describes why the organisation exists. The organisation needs to identify internal and external issues that can impact on its intended outcomes, as well as all stakeholders and their expectations. It also needs to document its scope and set the boundaries of the management system. Clause 4 has four subclauses: 4.1) Understanding the organisation and its context; 4.2) Understanding the needs and expectations of stakeholders; 4.3) Determining the scope of the management system, and 4.4) The management system
Clause 5: Leadership
Top management is accountable for all management systems. They need to integrate the management system into core business process, ensure the system achieves its intended outcomes and allocate the necessary resources. Top management is also responsible for communicating the importance of the system to heighten employee awareness and involvement. Clause 5 has three sub-clauses: 5.1) Leadership and commitment; 5.2) Policy; and 5.3) Organisational roles, responsibilities and authorities
Clause 6: Planning
Having identified risks and opportunities, the organisation needs to specify how these risks will be managed. This proactive approach replaces preventive actions and reduces the need for corrective actions later. The objectives of the management system should be measurable, monitored, communicated, aligned to the policy of the system and updated when needed. Clause 6 has two sub-clauses: 6.1) Actions to address risks and opportunities, and 6.2) Management system objectives and planning to achieve them.
Clause 7: Support
After addressing the context, commitment and planning, organisations need to look at the support needed to meet their goals and objectives. This includes resources, targeted internal and external communications, as well as documented information that replaces previously used terms such as documents, documentation and records. Clause 7 has five sub-clauses: 7.1) Resources; 7.2) Competence; 7.3) Awareness; 7.4) Communication; 7.5) Documented information.
Clause 8: Operation
The bulk of the management system requirements specific to the topic under consideration are within this single clause. Clause 8 addresses both in-house and outsourced processes, while overall management of the process includes adequate criteria to control these processes, as well as ways to manage planned and unintended change. Clause 8 has only one sub-clause: 8.1) Operational planning and control
Clause 9: Performance evaluation
Decisions are required on how performance will be monitored, measured, analysed and evaluated. Internal audit activities are part of the process to ensure the management system conforms to the requirements of the organisation and is successfully implemented and maintained. Management review, evaluates whether the management system is suitable, adequate and effective. Clause 9 has three subclauses: 9.1) Monitoring, measurement, analysis and evaluation; 9.2) Internal audit; 9.3) Management review;
Clause 10: Improvement
Clause 10 looks at ways to address non-conformities and corrective action, as well as strategies for improvement on a continual basis. The requirement for continual improvement in performance and enhanced delivery of stakeholder expectations should be embedded in all management system standards. Clause 10 has two sub-clauses: 10.1) Non-conformity and corrective action; and 10.2) Continual improvement.
At CRI Group, our experts can help your organisation implement ISO 37001, ISO 31000, and ISO 19600 in a seamless way that integrates these management systems together. This is the most effective way to reap the benefits of these world-class standards, with training and best practices that position your organisation to mitigate risk and create actionable systems for increased success.
What are the ISO certification & Training benefits?
When your organisation makes the decision to become certified in ISO 37001, ISO 31000, and ISO 19600, there are numerous benefits that come with implementing these management standards.
- Get government tenders: ISO certification is now required in a majority of government tenders.
- Build credibility internationally: ISO certification helps your organisation gain credibility to build overseas business.
- Better customer satisfaction: ISO standards are designed to enable an organisation to serve their customers better, and hence increase customer satisfaction. ISO certification enhances customer satisfaction by meeting customer requirements.
- Improve product quality: Since product quality matches the international level, this can reduce the risk order rejections which can occur due to the flaw in the product.
- Improve business efficiency: ISO certification implementation enhances functional efficiency of an organisation. ISO certification helps you develop SOPs and work Instructions for all your processes. ISO implementations help you manage your resources effectively, as you become able to use all your resources to their maximum extent.
- Improve marketability: ISO certification helps to improve the credibility of business with current and new clients, which leads to creating a niche market for your business.
> Our ISO solutions (certification and training) are offered through our ABAC® Center of Excellence. Powered by CRI Group, ABAC® educates, equips and supports the world’s leading business organisations with the latest best-in-practice risk assessments, performance assessments, systems improvement and standards certification. Find out how ABAC® can help your business!
Address bribery and corruption in all its forms with ISO 37001 Anti-Bribery Management System
To help combat the threat of bribery and corruption, ISO issued the ISO 37001:2016 Anti-Bribery Management System (ABMS) standard to help businesses, nonprofits and governmental agencies reduce their risk of bribery and corruption by establishing, implementing, maintaining and improving an anti-bribery management system. This is critically important, as bribery and corruption can lead to criminal punishments, fines, regulatory action, lowered employee morale and damage to reputation.
When an organisation makes the decision to move forward with ISO 37001 Anti-Bribery Management System training and certification, the benefits are immediate. That’s because ISO 37001 puts methods in place that do the following:
- Ensure that your organisation is implementing a viable anti-bribery management system using widely accepted controls and systems.
- Give your company the tools it needs to prevent bribery and mitigate related risks
- Provide assurance to management, investors, business associates, personnel and other stakeholders that the organisation is actively pursuing internationally recognised and accepted processes to prevent bribery and corruption.
- Help your company create new and better business partnerships with entities that recognise your certified status, including supply chain manufacturing, joint ventures, pending acquisitions and co-marketing alliances
- Potentially reduce corporate insurance premiums
- Provide your customers, stakeholders, employees and partners with confidence in your business operations and ethics
- Provide a competitive edge over non-certified organisations in your industry or niche
- Provide acceptable evidence to prosecutors or courts that the organisation has taken reasonable steps to prevent bribery and corruption
ISO 37001 certifies that your organisation has implemented reasonable and proportionate measures which prevent, detect and respond to bribery and comply with anti-bribery laws, internally and externally (i.e. agents, consultants, suppliers, distributors and other third-parties). These measures involve top-level leadership, training, bribery risk assessment, due diligence adequacy, financial and commercial controls, reporting, audit and investigation. Learn more about ISO 37001 standard today.
Leverage ISO 31000:2018 to improve your business continuity management program
ISO developed the 31000:2018 Risk Management Standard to help organisations address operational continuity, and provide confidence and reassurance in your organisation’s economic resilience, professional reputation and environmental and safety outcomes. Like most ISO management standards, ISO 31000 can be tailored to your organisation to help achieve the best results. ISO 31000 Risk Management provides principles, framework and a process for managing risk. Public, private and community enterprises can all benefit from ISO 31000 because it covers most business activities, including research, planning, management and communications. Implementing ISO 31000 can help organisations increase the likelihood of achieving objectives, improve the identification of opportunities and threats and effectively allocate and use resources for risk treatment.
Being ISO 31000 certified means that you are protecting your organisation from potential risks that could endanger the operational efficiency, governance, and stakeholders’ confidence. It will help strengthen and achieve the strategic objectives of your organisation by establishing a risk-based system of values, enabling your organisation to:
- Enhanced risk management will support achieving goals & objectives
- Reduce costs through proper risk management
- Respond to change effectively & find viable solutions
- Create and protect value
- Create a consistent basis for decision making & planning
- Increase the likelihood of achieving objectives
- Productively identify the opportunities and threats
- Identify and mitigate the risk throughout the organisation
- Gain stakeholder confidence and trust
ISO 37301 standard provides a clear and comprehensive description of what the compliance function should be responsible for
ISO 37301:2021 provides guidance for establishing, developing, implementing, evaluating, maintaining and improving an organisation’s compliance management program. It covers all compliance-related issues including anti-trust, fraud, misconduct, export control, anti-money laundering, and other unexpected risks which might aﬀect your business.
The standard acts as a global benchmark for eﬀective and responsive compliance management program, based on the good governance and transparency principles. The guidelines set forth by the standard are applicable to all types and sizes of organisations and aren’t restricted by industry, risk exposure or geographic reach. The guidelines set forth in the internationally accepted ISO 37301 Compliance Management Systems represent the first step in developing a framework that protects the organisation from falling victim to the many risks associated with corporate bribery and/or corruption. ISO 37301 standard provides a clear and comprehensive description of what the compliance function should be responsible for:
- Identifying compliance obligations and translating those obligations into actionable policies and procedures
- Integrating compliance obligations into existing practices and procedures
- Analysing performance to identify the need for corrective actions
- Providing or organising ongoing training and support for employees on a regular basis
- Establishing compliance performance indicators, monitoring and measuring compliance performance
- Providing objective advice to the organisation on compliance-related matters
- Putting in place a compliance reporting & documenting system
- Ensuring the compliance management system is reviewed on a regular basis
- Developing & implementing processes for managing information (i.e. hotlines, whistleblowing reporting systems & other mechanisms)
- Providing employees with access to resources on compliance procedures & references
- Ensuring there is access to appropriate professional advice in the establishment, implementation and maintaining of the management system
- Promoting the inclusion of compliance responsibilities into position descriptions & employee performance-management processes
- Identifying compliance related risks & managing resulting compliance obligations relating to third parties (i.e. suppliers, agents, distributors, consultants & contractors)
Who is CRI Group?
Based in London, CRI Group works with companies across the Americas, Europe, Africa, Middle East and Asia-Pacific as a one-stop international Risk Management, Employee Background Screening, Business Intelligence, Due Diligence, Compliance Solutions and other professional Investigative Research solutions provider. We have the largest proprietary network of background screening analysts and investigators across the Middle East and Asia. Our global presence ensures that no matter how international your operations are, we have the network needed to provide you with all you need, wherever you happen to be. CRI Group also holds BS 102000:2013 and BS 7858:2012 Certifications, is an HRO certified provider and partner with Oracle.
In 2016, CRI Group launched the Anti-Bribery Anti-Corruption (ABAC®) Center of Excellence – an independent certification body established for ISO 37001:2016 Anti-Bribery Management Systems, ISO 37301:2021 Compliance Management Systems and ISO 31000:2018 Risk Management, providing training and certification. ABAC® operates through its global network of certified ethics and compliance professionals, qualified auditors and other certified professionals. As a result, CRI Group’s global team of certified fraud examiners work as a discreet white-labelled supplier to some of the world’s largest organisations. Contact ABAC® for more on ISO Certification and training.