What you hold at the end
Every document an engagement produces, laid out before you sign anything.
- Documents
- Eight, one per step of the cycle
- Yours to keep
- Each one, at the end of its step
- Gap report
- Within a week of the site visit
- Live records
- Written by your team, not by us
- Readiness pack
- Indexed the way an assessor reads it
A readiness engagement produces a gap report, an implementation plan, the documented system, live records, an internal audit report, a closed corrective action log, management review minutes and a readiness pack. The documented system is opened below as a specimen, one level per page, with its real structure and no client data.
Page 1 of 7: The manual.
01 / 07
The manual
- What it is
- The front of the documented system. It states the scope, shows how the processes connect and points each clause to the document that meets it. It has not been a requirement since the 2015 edition, so it stays short.
- Who owns it
- Approved by top management. Its revision sits on the master list with every other document.
- Cycle step
- 4 · Build
02 / 07
Policy and objectives
- What it is
- Short statements the standard requires you to hold as documented information, with your objectives beside them.
- Who owns it
- Signed by top management. Each objective carries an owner and a date.
- Cycle step
- 4 · Build
03 / 07
Procedures
- What it is
- Written where a process would go wrong without one. ISO 9001 itself asks for very few.
- Who owns it
- A named owner who helped write it and can walk an auditor through it without reading from the page.
- Cycle step
- 4 · Build
04 / 07
Work instructions
- What it is
- Kept at the point of work, for the tasks where a missed step causes a defect, a spill or an injury.
- Who owns it
- The supervisor who runs the job decides it exists. It is written in the language the line reads.
- Cycle step
- 4 · Build
05 / 07
Forms and registers
- What it is
- The blanks that become records, designed to be filled in at the point of work in seconds. Registers hold the running lists, such as risks, training and calibration.
- Who owns it
- Designed around the job, numbered and revision-marked, and tried on the floor before they are issued.
- Cycle step
- 4 · Build
06 / 07
Records, the evidence
- What it is
- Your own records, produced by your team as the work happens. An assessor samples them to see that the system has run, and records cannot be backdated.
- Who owns it
- Written by your team, not by us. We design the forms and check the entries as they build.
- Cycle step
- 5 · Embed
07 / 07
From a record back to the clause
- What it is
- The route an assessor follows from one record up to the requirement it proves. Each document names the one above it, so the route is a chain, not a search.
- Who owns it
- Held on the master list: every controlled document with its number, revision and owner. It is the first thing an auditor asks for.
- Cycle step
- 6 · Internal audit
- ClauseThe requirement in the standard, where the assessor starts.
- ManualIts clause table names the procedure that meets it.
- ProcedureIts records section names the form.
- FormIts number and revision are printed on every copy.
- RecordThe entry, dated and signed by your team.
Why you should see these before signing
Most proposals list deliverables by name. A name tells you nothing about what the document contains, and that is where engagements disappoint.
A gap report can be two pages of opinion or a clause-by-clause register with the evidence found against each row. Both carry the same title on a proposal. Only one of them lets your team start work the next morning.
So the structure comes first. The documented system above is drawn with its real sections and columns and nothing from a client. If any document in the set would not be useful to you, say so before the engagement starts and it changes.
One of the eight is not ours to write. Live records are produced by your people, doing the work. We design the forms and check the entries as they build. A consultant who offers to produce the records for you is offering to backdate your system.
The documents, one per step
Each step of the readiness cycle ends with a document you keep, whether or not you continue.
| Document | What it contains | Step |
|---|---|---|
| Gap report | Every clause, its status, the evidence found and the effort to close | 2 · Gap analysis |
| Implementation plan | Phases, owners on both sides, dates | 3 · Plan |
| Documented system | Policies, procedures, registers, forms and the master list | 4 · Build |
| Live records | Your own records, produced by your team as the work happens | 5 · Embed |
| Internal audit report | Findings written in three parts, requirement, evidence and gap, with identifiers | 6 · Internal audit |
| Corrective action log | Each finding, its cause, the action taken and the evidence it is closed | 7 · Close out |
| Management review minutes | Inputs, decisions and actions with owners and dates | 8 · Review |
| Readiness pack | Everything above, indexed the way an assessor reads it | 9 · Handover |
What each one lets you do next
Decide with the gap report
Each clause is marked evidenced, in place but unwritten, or missing. The size of the rest of the work follows from those three counts, and the report is useful to anybody, including a different consultant.
Run parts yourself with the plan
Owners on your side are named against each phase. A team with its own quality lead can run the build from the plan and bring us back for the internal audit.
Fix findings with the audit report
A finding in three parts tells your team what the standard asks, what was seen and what is missing. It can be closed without a meeting to explain it.
Show the system corrects itself
The corrective action log is where an assessor looks to see that problems are traced to a cause and closed with evidence, not just fixed on the day.
Book your audit with the readiness pack
Scope, sites, process list, document index and the evidence an assessor asks for, in the order they ask for it. It goes with you to your own certification body.
The documents in one engagement
A logistics company in Riyadh is asked for ISO 9001 in a tender and wants to know what it will be holding before it commits.
It stops after the gap analysis to decide. The gap report shows warehouse operations controlled but unwritten, while supplier evaluation and internal audit do not exist yet.
It continues. The implementation plan names the operations manager and a warehouse supervisor as owners on its side, with dates. The documented system is built with them: the master list, the procedures, and the registers and forms used at the dock.
Its own team fills in those forms. The internal audit samples the records and raises findings in three parts. The team closes them, with the cause and the evidence logged against each, and holds its management review.
At handover it holds the readiness pack, the whole set indexed in the order an assessor reads it, and books its own certification audit.
Questions about the documents
Do we keep the documents if we stop partway?
Yes. Each document is complete at the end of its step and it is yours. A gap report or an implementation plan is useful to anybody, including a different consultant.
Who owns the documented system?
You do. It sits inside your own document control, approved by your own people, from the first issue. We draft with your process owners, and they sign it off.
Why do the live records have to come from our team?
Because an assessor samples records to see that the system has run, and records cannot be backdated. We design the forms so they take seconds at the point of work, and we check them as they build up. The entries themselves are yours.
Are the documents in English or Arabic?
Either, or both. The language is decided per document by the people who use it: a form filled in on a warehouse floor may need Arabic, a procedure a multinational customer reads may need English.
What is in the readiness pack?
The scope, sites, process list, document index and the evidence an assessor asks for, assembled in the order they ask for it. It is what you take with you when you book your certification audit.
Where these come from
Our method
The nine steps that produce these documents, and who does the work at each one.
Read moreServiceGap analysis
The first document in the set, and the one that decides the rest.
Read moreServiceDocumentation and implementation
How the documented system is written with the people who do the work.
Read moreServiceInternal audit
How findings are written in three parts, with identifiers.
Read morePart of one system
Every division keeps records to the same standard, so the second one you need works the way the first one did.
Start with the first document
The gap report is the first document in the set and the one that decides the rest. Book the gap analysis and you keep the report whatever you decide.