The ISO Show

AI usage has skyrocketed in the past 2 years, with many commonplace apps and software now featuring an AI integration in some form.  With the rapid development and possibilities unlocked with this powerful technology, it can be tempting to go full steam ahead with implementing AI use into your day-to-day business activities. However, new technologies come with new risks that need to be understood and mitigated before any potential incidents. In this episode Mark Philip, Information Security Manager at Cloud Direct, joins Ian to discuss emerging AI risks and how you can build AI resilience into your existing practices. You’ll learn ·      Who is Mark? ·      Who is Cloud Direct? ·      How can you assess your current level of AI resilience? ·      What are some of the key threats that AI systems currently face, and how can you mitigate these? ·      How can you utilise AI to enhance your security? ·      What is best practice when responding to an AI related security incident?   Resources ·      Cloud Direct ·      Isologyhub    In this episode, we talk about: [02:05] Episode Summary – We invite Cloud Direct’s Information Security Manager, Mark Philip, onto the show to discuss AI risks and how to build in AI resilience into your existing security practices.   [03:25] Who is Mark Philip?: While his primary role is as an Information Security Manager at Cloud Direct, a little known fact about him is that he is an amateur triathlete! At London earlier in 2024, he was lucky enough to bump into Alistair Brownlee, who is the UK’s two time gold olympic medalist in triathlon. [05:10] Who are Cloud Direct? – Founded in 2003, Cloud Direct are a Microsoft Azure expert MSP that is the top of Microsoft accreditation that any partner can hold, putting them in the top 5% of Microsoft partners globally. They offer consultancy and professional managed services, specialising in Microsoft Cloud, which is all underpinned with security across the whole Microsoft stack. They also assist with digital transformation and modernisation. [06:30] Assessing the current AI risk landscape: Ian points out that a recent report from the Capgemini Research Institute found that 97% or organisations are using generative AI. With this increase in AI use, there is a correlation with an increase in security incidents related to AI. Mark adds that this technology is so new, with a lot of larger software companies such as Microsoft pushing AI elements into their tools. So there is a learning curve involved with utilising the technology. There is also a lack of Risk Assessment being done in relation to AI, not a lot of though is going into the use of AI on a day-to-day basis. If you’re using an AI platform, you need to ask yourself: What is this platform actually doing with the data I’m inputting? There is also the fact that shady individuals are already leveraging this technology with the likes of deep fakes, bad bots and more sophisticated phishing schemes – and the harsh truth is that they’re going to get better at it over time. [08:20] What is AI resilience and why is it so important? – AI resilience is about equipping businesses with the processes that control the use and deployment of AI usage, so that they can anticipate and mitigate any AI risks effectively. Similar to ISO Standards, this would involve a risk-based approach. However, this will look very different depending on your business and how you are using AI. For example, the risks of someone using AI to generate a transcript of meeting notes will be much lower in comparison to a healthcare company using complex sets of data with AI to synthesize new medicines. So, if you are using AI you need to consider what the inherent risks could be, and that would be dependent on the data you’re processing i.e. is it sensitive data? And then factor in if the software is publicly available (such as ChatGPT), or it is a closed model under your control? Asking these types of questions will give you a more realistic outlook on the risk landscape you face. [10:35] How can a business assess their current level of AI resilience? AI is here to stay, so you won’t be able to avoid if forever. So first, you need to embrace and understand it, and that includes creating a clear picture of your use cases. Mark states they did this exercise internally at Cloud Direct when they were starting to use Microsoft’s Co-Pilot. They asked themselves: ·      What sort of data is the software interacting with? ·      What data are we putting into it? ·      How do Microsoft manage the program and related security? ·      Are Mircrosoft storing any of that data? It’s not just about the security either, you need to understand why your using AI and if it will actually be to your benefit. A lot of people are using it because it’s new and shiny, but if it’s not actively helping you achieve your business goals, then it’s more of a distraction than anything else. For those looking for additional guidance on AI policies, risks and resilience, there’s a lot of guidance provided by both ISO and the NCSC. ISO 42001 in particular is useful for both people using AI and developers creating AI. If you’re stuck on where to start, a Gap Analysis is a fantastic tool to see where you are currently and what gaps you need to bridge in your security to cover any AI usage, and to see how well you are complying with current legal requirements (the EU AI Act is now in effect!). Another tool is a Risk Assessment. You may not process what many would consider sensitive data, such as healthcare information, but even if you store and hold customer data, then you need to ensure that any AI you use doesn’t pose a risk to it. [14:30] How can AI improve security and resilience? – Sticking with Microsoft as an example, as they are releasing a lot of AI driven tools, they can be used to fill gaps that humans may not have the time to do. Once example of this is monitoring and sending security alerts, previously a system may have just sent this to a human member of staff to resolve, but now AI security tools can act on those alerts on your behalf. So, if you have limited IT resources, this could be a fantastic addition to your security set-up. It also eliminates the lag of human response, and AI can look at things in a way a human wouldn’t think to.   [17:55] How do people stay ahead of the curve in the evolving AI landscape? – You should be using the myriad of resources available to learn about AI, as there are webinars, social media feeds, blogs and videos released constantly. Microsoft in particular are offering a comprehensive feed of information relating to AI, the risks and new technologies in development. The key is to understand AI before integrating it into your business. Don’t just jump at the new shiny toys being advertised to you, go to reputable sources such as the ICO, NCSC, Cyber Essentials and regulatory bodies to learn about the technology, the benefits it can bring in addition to the risks you need to mitigate against. Mark can vouch for Microsoft’s though leadership in this field, as they keep all of their customers up-to-date with all of their AI related developments. Cloud Direct themselves are also putting out some great content, so don’t forget to check out their resources. If you are already utilising Microsoft’s tools, the Cloud Direct can help explain how their new tools can apply to your business. If you’re looking for assistance with ISO 42001, then Blackmores can help you with implementing a robust AI Management System. [21:40] What is best practice when responding to an AI related incident? – To be honest, there’s no reason to not treat it like any other security incident. We’ve already adapted to more sophisticated security risks as a result of the move towards home and hybrid working over the pandemic. This simply another stage along in this ever changing security landscape. You should treat it like assessing any new step, and you likely have all the processes in place for analysing risk already in place, simply apply them to the usage of AI and put in place the necessary governance based on your findings. Standards such as ISO 20000 IT Service Management and ISO 22301 Business Continuity are fantastic tools of you’re new to this sort of incident response planning. If you’ve already been certified to these standards, then you likely have the following in place already: ·      Risk Assessments ·      Business Impact Assessments ·      Business Continuity Plans ·      Recovery Plans Simply add AI as an additional risk factor into your existing management system and update the necessary documentation to include actions and considerations for its use. If you update your Business Continuity and recovery plans, then make sure to test them! Don’t just assume that they will work, put them to the test and adjust until you’re comfortable that in a real incident, everyone in the business knows how to react, what to communicate and how to get back up and running. [24:00] What are Mark’s predictions for the field of AI resilience? – People need to look at the opportunities in utilising AI, a lot of people are using it without really understanding it so there’s a lot of learning still to do. So, he expects to see a lot of businesses fully grasping how they can use AI to their advantage in the coming years. With that comes the challenge of ensuring it’s integrated safely, with the right governance embedded to ensure its safe and ethical usage across entire organisations. Another big challenge is the handling data privacy within AI. Scams are only going to get more complex as AI develops, and you need to ensure your business can protect against that as much as possible. Also businesses should carefully consider what AI platforms they choose to use. Ensure you understand what data is being input and stored, and the level of control you have over it. All of this to say, there are a lot of massive benefits of using AI and you should shy away from it. But, you need to ensure you are using it safely and ethically. [27:30] What is Mark’s book recommendation? – The hunt for Red October by Tom Clancy [28:45] What is Mark’s favorite quote? – “I have a bad feeling about this…” – Star Wars Want to learn more about Cloud Direct? Check out their website. We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The uptick in greenwashing cases, and subsequent outing of these claims only serves to make stakeholders and consumers dubious of any businesses sustainability pledges. One key way to combat this is to have the information to back up your claims, something that is becoming a mandatory requirement for some depending on  sector, location or company size. In this episode, Mel dives into the use of ISO 14064 and how verification to this internationally recognised Standard can help companies build trust and ensure their climate action claims are genuine and impactful. You’ll learn ·      What is Greenmasking? ·      Why there is a need for transparency in green claims ·      What is Greenhouse Gas Statement Verification? ·      What is ISO 14064? ·      How can ISO 14064 Verification combat greenmasking?   Resources ·      Carbonology ·      7 Shades of Greenwashing Guide   In this episode, we talk about: [02:05] Episode Summary – In this episode, Mel delves into the world of ISO 14064 and explores how verification under this international standard can help companies build trust and ensure their climate action claims are genuine. Catch-up with the previous episodes in the series here: The Rise of Greenwashing The 7 Shades of Greenwashing [03:05] What is greenmasking?: Greenmasking (a term coined by Carbonology®) is used to describe the practice where organisations self-certify their environmental impact without independent verification. This means they claim their green credentials are accurate while avoiding transparency about their methodology and data. Essentially, they are "marking their own homework," which can lead to misleading claims about their sustainability efforts. This could be compared to someone completing their own MOT and signing it off themselves, instead of taking it to a qualified mechanic. Obviously, that MOT certificate wouldn’t be valid in that case, and would have no credibility when it came to selling the car. [04:45] The need for transparency – For carbon reporting to succeed globally, enforcement will need to be standardised across all nations. With transparency around ESG initiatives increasingly important, you need to be able to objectively and accurately measure and report on your carbon footprint. Some to keep an eye on include the Green Claims Directive and the Anti-Greenwashing Charter. Stakeholders are now looking for independent Verification of the accuracy of your emissions data and your calculated carbon footprint through Standards such as ISO 14064-3. [07:05] What is Greenhouse Gas (GHG) Statement Verification? - GHG Verification is the engagement of an independent third-party by an organisation to provide Verification of their GHG statements using standards such as ISO 14064-3. Carbon footprint Verification involves, collecting data and reporting on your emissions from your company’s activities, and then independently verifying its accuracy to provide assurance to stakeholders that your claims are transparent and true. If you’d like to learn more about the differences between the Greenhouse Gas Protocol and ISO 14064, check out a previous episode. [08:10] What is ISO 14064-1 and ISO 14064-3? – This is the specification for Greenhouse Gas emissions reporting and part 3 is the specification for verifying that, covering more elements than the Greenhouse Gas protocol. The reporting requires you to collect data from various sources across your scope 1, 2 and 3 emissions, collating it into a report and then have that report independently checked against the requirements of ISO 14064. [09:45] How can Greenhouse Gas Verification combat greenmasking? – ·      Highlights integrity - Verification against ISO 14064-1 highlights the veracity of your systems and processes to prove your GHG inventory, assertions and reports conform to the ISO 14064 standard; and are free from errors, omissions or misstatements, demonstrating the highest integrity of your GHG reporting. ·      Validation of Net Zero goals - Verification against ISO 14064-1, establishes the integrity of your claims towards Net Zero. ·      Verify success - Verification against ISO 14064-1 provides assurance of your carbon footprint declarations which will give confidence in achieving the projected emission reductions ·      Stakeholder assurance - Stakeholders are increasingly looking for independent Verification of GHG Data to prove reduction are achieved year on year Download a copy of The 7 Shades of Greenwashing from Carbonology’s website here. If you would like some assistance with carbon Standards and reporting, simply get in touch with the team over at Carbonology.   We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The rampant rise of greenwashing threatens to undermine genuine sustainability efforts and mislead consumers, with over 900 businesses in Europe being accused of the practice in 2024.  Greenwashing can come in many different forms, and the tactics used aren’t always easy to spot. In this episode, Mel dives into the 7 shades of greenwashing and explains the common greenwashing tactics you should be on the lookout for. You’ll learn ·      What is Greencrowding? ·      What is Greenlighting? ·      What is Greenshifting? ·      What is Greenlabelling? ·      What is Greenrinsing? ·      What is Greenhushing? ·      What is Greenmasking?   Resources ·      Carbonology ·      7 Shades of Greenwashing Guide   In this episode, we talk about: [02:05] Episode Summary – In the 2nd part of this 3-part series on greenwashing, we dive into the various methods and tactics used by businesses to avoid their sustainability obligations. [03:05] What is greencrowding?: This tactic relies on safety in numbers and occurs when different groups (like governments, organisations and companies) join forces to create the impression of making significant environmental changes. For example, 8 of the world’s biggest 20 plastic polluters including companies such as Royal Dutch Shell, Coca-Cola, and BP are part of the Alliance to End Plastic Waste, however the group moves at the speed of the slowest member and sets low environmental targets to stall action as it is often costly and involves a lot of the companies resources and time [03:55] What is greenlighting? – This is when companies spotlight a particularly ‘green’ product or operation which helps to draw attention away from tis otherwise environmentally damaging activities. Commonly seen in the car industry, recent BMW campaigning highlights the company’s electric vehicles, despite being heavily invested in combustion engine vehicles therefore not addressing their major source of emissions. Another example is Exxonmobil, who heavily advertised its “advanced biofuels” made from algae, however didn’t mention the fact that the biofuels made up a miniscule part of production. Since coming under scrutiny Exxonmobil have rescinded this project altogether and haven’t looked to practical alternatives. [05:15] What is greenshifting? - This is where the blame gets shifted onto consumers. BP’s “Know your carbon footprint” campaign is a key example, it invited customers to share pledges for reducing their individual emissions yet BP’s core business continue to partake and scheme hugely polluting oil and gas projects. Another example include H&M who urged consumers to recycle their old clothes yet, the company continues to be a prime culprit in fast-fashion and have a significant part to plat in over-consumerism leading to environmental degradation. [06:10] The growing need for comprehensive carbon reporting – This occurs when companies use words like ‘eco’, ‘sustainable’ or related wording or symbols conveying green messaging with no evidence to support it. Kohl’s and Walmart were sued for labelling toxic rayon textiles as eco-friendly bamboo. Another more recent example is McDonald's Paper Straws where In 2019 a paper straws to introduced to replace plastic ones, claiming it was an eco-friendly move. However, it was later revealed that these paper straws were not recyclable, leading to criticism that the company was misleading consumers about the environmental benefits. [07:15] What is greenrinsing? - This is where companies change their sustainability commitments or targets before actually achieving them. Repeatedly, Coca-cola has missed and moved its recycling targets. Between 2020 – 2022, the company dropped its targets for using recycled packaging from 50% by 2030 to 25% proving these targets were not sufficiently made. BP and ExxonMobil are two more examples of being criticized for frequently updating their climate targets without substantial progress. Various ambitious goals were announced over the years, but critics argue that these targets are often revised or postponed making it hard to assess real achievements and also trust between consumers, investors and legal frameworks are lost. So the takeaway here is, make sure you’re targets are realistic! [08:45] What is greenhushing? – This occurs when companies deliberately underreport or hide green credentials to evade scrutiny, which is a rising practice found in larger firms who struggle to successfully hit their targets/ aims. Commonly found with firms that make distant net zero targets but do not report on progress. It allows them to hide the fact that they are not taking meaningful steps. Companies often avoid reporting positive environmental measures they may be taking to prevent greenwashing accusations which can be argued as counter-productive in the efforts to help drive systemic and industrial change in the most polluting industries. H&M and ExxonMobil are key examples of greenhushing and no-longer actively promote their sustainability practices as they have faced criticism over false / limited actions in the past.  This one is rather damaging, especially to those who are taking meaningful sustainable action, but may not be keeping up with their targets. This is why it’s so crucial to make those targets obtainable. If this practice continues, then there is less pressure overall for businesses to do their part for sustainability. It’s important to celebrate the victories, no matter how small, as it all adds up to the bigger picture. [10:55] What is greenmasking? - Greenmasking (a term coined by Carbonology®) is used to describe the practice where organisations self-certify their environmental impact without independent verification. This means they claim their green credentials are accurate while avoiding transparency about their methodology and data. Essentially, they are "marking their own homework," which can lead to misleading claims about their sustainability efforts. Some companies offer ISO 14064 consulting and verification services that may not always adhere to the rigorous standards required for genuine verification. This can result in poor practices and undermine the credibility of the certification. For example, some consulting firms might offer ISO 14064 verification as part of their services but fail to conduct thorough and independent audits. Instead, they may ‘verify’ the data is correct in-house. This can lead to situations where companies are able to self-label their environmental impact as compliant with ISO 14064 without truly meeting the standard's requirements. This results in a vast amount of unreliable and untrustworthy data that is purportedly verified. Furthermore, with some consultancy companies asserting that offering both consultancy and verification within the same firm is a viable option, it paves the way for poor reporting standards to be accepted, only worsening the problem in the long run. Greenmasking can have significant implications for stakeholders, including investors, customers, and regulators, who rely on accurate and transparent environmental reporting. To combat greenmasking, it is crucial for organisations to seek independent and accredited verification of their GHG emissions ensuring that their sustainability claims are credible and based upon the rigorous standards stated in ISO14064-3. Download a copy of The 7 Shades of Greenwashing from Carbonology’s website here. If you would like some assistance with carbon Standards and reporting, simply get in touch with the team over at Carbonology.   We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

In a world increasingly concerned about environmental impact, companies are under immense pressure to demonstrate their sustainability credentials. But how can businesses truly differentiate themselves from those simply paying lip service to green practices? Greenwashing is a term that you will likely be familiar with, as it’s one that’s been on the rise as consumer preference steers towards those who are seen to be doing the right thing. Alarmingly, high-severity cases, which involve companies that took a purposeful and systematic approach to concealing ESG violations, rise by more than 32% year on year. In our upcoming 3-part series we’ll be exploring the impact of greenwashing on business, the different types of greenwashing and the role verification can play in building genuine evidence based sustainability strategies. In this episode, Mel dives into the first of this 3-part series to explain what greenwashing is, the common tactics used in greenwashing and how businesses can build genuine sustainability. You’ll learn ·      Who is greenwashing? ·      Where did the term originate from? ·      The rise of greenwashing ·      What are some of the common greenwashing tactics used? ·      The danger of greenwashing ·      How can businesses build genuine sustainability strategies?   Resources ·      Carbonology     In this episode, we talk about: [02:05] Episode Summary – We kick off our 3-part greenwashing series with an exploration of what greenwashing really is, the common greenwashing tactics businesses employ and how you can avoid those pitfalls to build genuine sustainability within your business. [05:25] What is greenwashing?: Greenwashing, in essence, is the deceptive use of environmental claims to mislead consumers into believing a company's products or services are more environmentally friendly than they actually are. [05:45] Where did the term ‘greenwashing’ originate from? – The term "greenwashing" was coined in 1986 by Jay Westerveld, an American environmentalist.   Westerveld first used the term in an essay describing his experience at a hotel in Fiji. The hotel encouraged guests to reuse towels to "save the environment," but Westerveld observed that the hotel was simultaneously expanding its operations, significantly impacting the local environment. This contradiction highlighted the hotel's primary intent to cut costs rather than genuinely conserve resources.   Westerveld's observation exemplified how businesses could deceptively use environmental claims to mislead consumers into believing their products or services are more environmentally friendly than they actually are.  [06:35] The rise of greenwashing: Many businesses over a wide range of industries have made a pledge to reduce their carbon impact by 2050, driven by both an increase in regulation and consumer perception. However, the Economist highlighted some troubling research, citing that while many businesses will puff out their claims of sustainable practices, many don’t have the evidence to back them up. Many should have the resource, say an Asset Manager, that could provide tangible reports on their carbon consumption each year, and yet they choose not to publicly disclose any such reports. So, a lot of talking the talk, but not walking the walk! [07:40] The growing need for comprehensive carbon reporting – There are a number of sustainability and ESG regulations now in effect, with more to come in 2025 (such as the Green Claims Directive that is due to come into affect on the 27th March 2025) that require businesses of different sizes and sectors to report on their carbon consumption and reduction. If you’d like to learn more about a few of these, check out our previous episodes on: ·      SECR ·      ISBB S2 ·      CSRD ·      CSDDD [08:15] What are the common tactics used in greenwashing? These can include:- ·      Vague and Ambiguous Claims: Phrases like "eco-friendly" or "sustainable" are often used without specific, quantifiable data.  However, the EU Green Claims Directive, in theory help address this, although this only applied in Europe. ·      Focus on Single Issues: Highlighting one minor environmental benefit while ignoring significant negative impacts across the supply chain. ·      False Labels and Certifications: Creating misleading labels or misrepresenting genuine certifications.  There are numerous ‘Green certifications’ out there that charge for a badge, without providing any evidence, of for those that do provide information it could just be a document that isn’t evidence based i.e. a Policy statement or ‘pledge’ or ‘commitment’ ·      "Greenwashing by Association": Implying a connection to environmental causes through sponsorships or marketing campaigns. [10:15] The danger of greenwashing – The danger with greenwashing is the negative impact it has through an Erosion of Consumer Trust. People are becoming increasingly skeptical of environmental claims, making it harder for truly sustainable companies to gain credibility. Greenwashing can also lead to Distorted Market Signals: creating a false impression of progress, hindering genuine innovation and investment in sustainable solutions. [11:30] How can businesses build genuine sustainability strategies? ·      Transparency and Accountability: Disclose environmental data openly and transparently. Seek independent third-party verification of sustainability claims.   Focus on Life-Cycle Assessment: Evaluate environmental impacts across the entire product or service lifecycle, from raw material extraction to end-of-life disposal.   Continuous Improvement: Set ambitious, measurable, and time-bound environmental targets. Regularly review and refine sustainability strategies based on performance data.   Engage with Stakeholders: Collaborate with suppliers, customers, and other stakeholders to identify and address environmental challenges. If you would like some assistance with carbon Standards and reporting, simply get in touch with the team over at Carbonology.   We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

The end of another year has rolled around in the blink of an eye! We’ve managed to publish a whopping 42 episodes this year, pushing us over the 200 episode mark.  We want to thank all our listeners, both old and new, for allowing us to continue to share both ISO tips and success stories from our wonderful clients. We hope you’ll follow along as we continue our podcasting journey in 2025. To close out the year, Ian Battersby and Steve Mason share some of their stories of misadventures during audits, from common mistakes, to broom battles and forklift mishaps, they really have seen it all! Listen, laugh and learn what not to do during an audit. You’ll learn ·      What not to do in an audit   Resources ·      Isologyhub   In this episode, we talk about: [02:05] Episode Summary – Ian and Steve share some of their experiences from their time as auditors. From common mistakes to outlandish situations that you’d have to see to believe, listen and learn what shouldn’t happen during an audit.  [03:40] Lazy Copycats: Steve recounts a time where a company had copy and pasted their Management Review for years, which rightfully earned them a non-conformity. Ian shares a similar story where a construction company submitting a tender had copy pasted the content and included the wrong company name! The copying doesn’t stop there, as Steve remembers a company Quality Manual that managed to include multiple company names. It was found that they’d simply copy and pasted example pages they’d found online that looked good, but didn’t bother to update any of the content to be relevant to them. [06:30] Training Troubles – Ian recounts a time where he was auditing a subcontractor for a construction company that required a record of training. The induction was very important and obviously needed to be documented. When he checked the documents, though all the forms had different names, all the signatures suspiciously had the exact same handwriting! Turns out the Director was signing them all off, which is obviously in breach of a number of health and safety related regulations. [08:00] IT Security slip-ups – Steve recounts a time where a Finance Director had good intentions, but poorly implemented his idea. The Finance Director didn’t trust their IT system back-up and instead backed-up all his information on a memory stick. Steve had pointed out the flaws with this, such as losing the memory stick, data getting corrupted ect. It just simply isn’t a safe or reliable way to store such important information. [09:05] Disconnected Leadership – Ian shares a time where an auditor caught the lack of leadership commitment to their management system. Despite it being a very nice looking management system by all accounts, the cracks showed enough for an outsider to spot the flaws. Steve adds that sometimes, you can over engineer a management system to a point past useful. It needs to work for your business, otherwise people will work around it to get what they need done. Steve had a rather obvious example if this when he required a chat with a member of leadership, who refused on the day initially, despite it being scheduled for 6 months. The person relented a few minutes over lunch where he posed his complete commitment to BS 5750 – A standard that existed 20 years ago and had since been replaced by ISO 9001. Very telling for his level of ‘commitment’. As we have covered in a previous episode – Leadership commitment is imperative to a successful management system. [11:40] Skip Diving for Secrets – Steve shares his experience of conducting a skip diving exercise, which is following a document waste trail. At a certain company, they ended up looking in an actual skip only to find what looked like a lot of confidential documents, when questioned someone had said that they looked like they belonged in the CEO’s filing cabinet. When questioned, the CEO remarked ‘I didn’t want you to catch me with anything that I shouldn’t have, so I threw it all out last night’. This warranted a non-conformity as anyone could have gone past and fished out that confidential information just as Steve had. Ian also adds a time where he worked in the NHS and a local hospital had an accident where a lot of confidential medical files ended up scattered across the floor. These were documents that should have been disposed of securely. [14:05] PPE? You’ve got to be kidding me! – Ian recounts a time working for a manufacturing company that was part of a large international firm. Their UK operation had to abide by strict PPE requirements, proper shoes, eye protection ect. It was something that everyone on the premises had to adhere to. One day, a Director walked in with none of the PPE which was clearly labelled on many of the signs decorating the shop floor. He had incorrectly assumed that because of his position, he could walk around with no PPE whatsoever. Fortunately the shop floor supervisor set him right and sent him to get properly suited up. [15:35] Data Centre security says no – Steve recalls a time when a member of top management went to visit one of their own data centre’s, on getting to the gate the security had told him ‘I don’t care who you are, your name isn’t on the list so you’re not getting in.’ That person hadn’t gone through the process of being approved for entry. Yet, predictably, they sent complaints everywhere, but the head of the UK branch had quite rightly praised the security personnel for simply following protocol. [16:55] Private bank details? Don’t mind if I do! – While Steve was auditing physcial security for an office, a printer ended up printing the payroll of every employee at the business. This wasn’t in a private room, this was in the middle of the office, so anybody could walk up and see bank account details and salaries! When questioned, it turned out their Finance Director was working from home, and hadn’t bothered to contacts anyone to retrieve the documents. So unsurprisingly, they received a non-conformity. [19:55] Do not goad the auditor -  A bit of advice from Steve “Never say ‘this is our most secure room’ to an auditor” – that is essentially a challenge, and one that you’ll likely lose if you don’t follow your own processes. Steve put this to the test when someone had claimed only 3 people had access to a certain room. Out of curiosity, Steve used his visitor badge to gain entry, and asked if he was included in that 3. Obviously he wasn’t, and this was simply down to access control being a bit muddled at that particular company. [21:25] Mistaken Identity: Steve recalls a time when he was given a visitors badge with a completely different person as the photograph. It had no effect on the correct access rights, but amusing all the same. He shares another story where he shared a waiting room with another Steve. When they called only the first name, the other Steve was taken into that business and questioned on ISO, to which the poor man had to inform them that he had no idea what they were talking about! Shortly after, the correct Steve was collected. But it goes to show how important it is to ensure you’re giving access to the right people. [24:20] Battle of the Broomsticks: Ian recalls another time when working in construction, when he had the opportunity to work at a horse racecourse. They were looking to achieve what was OHSAS 18001 at the time (now known as ISO 45001), and it was going so well until a few new hires came running across the stable yard wielding 2 brooms, battling like gladiators in view of their auditor. Thankfully they weren’t really harming each other, but it was enough for the auditor to raise a few questions about subcontractor controls. You really couldn’t write the timing any better (or worse, I suppose!). [26:15] Clearly a certified forklift driver:  While Steve was working at a warehouse, the manager there stressed how well trained all of their forklift drivers were, how sensible they all were. Though, Steve could see a person dancing, speeding and popping wheelies with his forklift over the managers shoulder. After he’d been alerted to the wannbe stunt driver, the manager went to have a word with them. [27:30] Accidents don’t happen after 5pm: Ian was working at a company that highly valued the use of PPE on-site, everyone did a good job of abiding by that, until it came to the end of the day. One person leaves across the shop floor in just a normal t-shirt and jeans, waving them all off happily as he leaves for the day. He still had to cross the shop floor, and being off the clock doesn’t make you invincible. [29:10] Fire Door Dramas: Steve recalls a time during an ISO 9001 audit where he spotted a fire door had been blocked by pallets in a warehouse. Another time he saw a fire door that was actually chained and padlocked! On another occasion, a local council had put their rubbish bins outside the fire door for the building, and during a fire drill, they couldn’t get out.   Ian states how many times he’s seen signs ignored by drivers who park in front of fire exits. All this to say that a little awareness goes a long way. [31:10] Emergency Plans for the avid reader: During an incident at an NHS hospital where they’d suffered a long term major power outage, Ian and the staff had found that the emergency plans were 144 pages long! With Senior responsibilities hidden away in an Appendix on the last few pages. Well thought out plans are necessary, but the actual procedure needs to be something that can be followed in the event of an emergency. A little common sense should be applied when deciding what needs to be communicated. [34:00] Risk Assessment disaster: While working with a team in a manufacturing plant, Ian helped them to streamline their risk assessment process as their previous one needed too many signatures to actually go anywhere. This bottleneck was resolved with months of hard work, or so they thought… When it came to being audited, the auditor asked the team manager what happened to all of the risk assessments, he’d then pointed towards the Health & Safety Management and claimed they had them all, who had to admit that he didn’t. Later that evening a director called the administration and asked to hide all of the documentation, to which she rightly refused to do. This also linked back to when the auditor had asked about how the apprentices were trained, and it happened that the apprentice supervisor was on holiday and so they were just let onto the shop floor. Suffice to say, this didn’t reflect well on the resulting audit results. [36:30] Against the wire: Ian states that manufacturing companies are not famous for admin. He had one experience while trying to get a recertification booked in, which went up against the wire for their current certification running out. The CB obliged and sent a very qualified Health & Safety assessor there, who took them to pieces. It didn’t take long for him to point out that they had a really nice management system with no commitment from managers to use it. A word to the wise – don’t leave your recertification up until the last minute! If a CB tried to move your recertification past that expiry date, you can and should push back.   [39:00] Password palavers: Steve shares an experience when he interviewed a very organised PA who managed 7 Directors. At the end of the audit he pointed out a folder on her computer called ‘passwords’, to which she obliged to show him the contents. Predictably it contained all the usernames and passwords for various accounts the Directors owned. She knew about the secure passwords policy, but no one could realistically remember that many! When Steve questioned the technical team, they states only selected people needed one, and she wasn’t one of them. Steve pointed out that she did, and had done the best she could with the tools available, and gifted them a non-conformity as a result as they hadn’t done a good job of ascertaining who should get additional security tools. By the end of that day, the PA had their own password vault. [41:30] A fire extinguisher as useless as a chocolate teapot: In another company Steve had noted that they still had a black fire extinguisher. When asked, the staff replied that they were all up-to-date as of 2007. On checking, it was revealed that it had last been serviced in August 1997 – so no, it was not in fact ‘up-to-date’. It may be innocuous to some, but when it comes to safety equipment, that could be the difference between life and death in an emergency. [42:40] Technophobes in a modern age: Ian recounts a past quality audit he did for an engineering company. They require a lot of specific ISO Standards for that industry, and so the company paid a subscription service to ensure they had digital copies of all these Standards to refer back to. One such standard was on verification, and on asking a particular quality engineer about how he verifies a specific product, he pulls out a printed hard copy of a standard from 1993. Ian was interviewing him in 2017, there had been at least 2 updated versions of the Standard out by that point. When probed about why he wasn’t using the online standards library paid for by the company, he simply stated ‘I don’t like computers’. [45:00] The case of the mysterious ghost file: Steve once had an audit with a relatively nervous member of staff, after explaining that all he has to do is explin how he works, the interview went rather smoothly. At one point he photocopied a bit of paper, hole punched it and filed it away on a shelf in the corner. Steve initially thought ‘good admin, he’s clearly following a process’, so when he returned Steve asked why he filed that particular bit of information away, to which the staff member said ‘I don’t know, I’ve just been told to do it’. Steve then questioned the Quality Manager there about that document and they replied with the same. He then questioned the warehouse personnel to get the same answer. So, you have this document being photocopied over and over, filed away each time and no one knows why! Steve politely pointed out that it might be a good idea to rethink that pointless process. [47:50] Useless numbering systems: Ian had a similar experience with a numbering system that nobody knew the origins of. The staff involved simply shrugged it off and stated it was simply just what they used. Ian decided to put something to the test, by getting rid of it. He removed an entire archive system from a company’s network folder, as back then file space was a big cost and concern. He kept the files and waited to see if anyone actually needed them. After months, he only had 2 requests for documents. It’s important to ask both what is and isn’t working well. Getting input from all levels of staff can be eye opening, and empower those employees who can help shape up company processes to work more efficiently. [49:50] Allergic to Audits: Ian shares a secondhand story where a trainer for the HSE was conducting a site visit, where he needed to question the shop supervisor on a few things. He asked him for something he couldn’t see, and the guy agreed to go get it, and just never came back. Apparently he was so scared of the auditing process that he just went home!   [54:00] Shady police and stolen cars: One of Steve’s previous clients had an experience where what they thought was a policeman asked about a hire car the company owned, stating it had been involved in a crime. They didn’t think much of letting him take it for his ‘investigation’. Later when the hire company asked about getting their car back, the staff let them know what happened, rightly confused this led to a lot of discussion. As you can probably tell, the man was not a policeman and had made off with a nice shiny BMW simply by asking for it. If something like this happens to you, always ask for documentation from the police. [55:00] The Great Computer Caper: Ian recalls a training centre incident where a lot of computer equipment is stored in one suite. One day a few  guys came in and started lifting stuff out, people were holding doors open for them, not at all thinking them to be thieves. Low and behold, they were and took everything. Steve recounts a very similar experience where the thieves posed as a computer service company, stripping the entire office on a Friday afternoon. It wasn’t until Monday when everything was still gone that people thought to question who those people really were. Thank you all for a great 2024, we look forward to bringing you more ISO tips and success stories in 2025. We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Join Graeme Richardson-Locke, Head of Associations & Technical Lead at FESPA, as he shares insights from the print industry's journey toward sustainable practices. He discusses the significant carbon footprint of international events and the challenges of implementing ISO 20121. Discover how FESPA tackled gap analysis, the benefits gained from sustainability certification, and their innovative strategies, including reducing carbon footprints with fiberboard use at trade fairs. Graeme emphasizes the importance of personal responsibility in environmental conservation.

AI has been integrated into almost every aspect of our lives, from everyday software we use at work, to the algorithms that determine what content is recommended to us at home. While extraordinary in its capabilities, it isn’t infallible and will open up everyone to new and emerging risks. Legislation and regulations are finally catching up to the rapid adoption of this technology, such as the EU AI Act and new Best Practice Standards such as ISO 42001. For those looking to integrate AI in a safe and ethical manner, ISO 42001 may be the answer. Today Rachel Churchman, Technical Director at Blackmores, explains what ISO 42001 is, why you should conduct an ISO 42001 Gap analysis and what’s involved with taking the first step towards ISO 42001 Implementation.   You’ll learn ·      What is ISO 42001? ·      What are the key principles of ISO 42001? ·      Why is ISO 42001 Important for companies either using or developing AI? ·      Why conduct an ISO 42001 Gap Analysis? ·      What should you be looking at in an ISO 42001 Gap Analysis?   Resources ·      Register for our ISO 42001 Workshop ·      Isologyhub     In this episode, we talk about: [00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo. [02:05] Episode summary: Rachel Churchman joins Steph to discuss what ISO 42001 is, it’s key principles and the importance of implementing ISO 42001 regardless of if you’re developing AI or simply just utilising it. Rachel will also explain the first step towards implementation – an ISO 42001 Gap Analysis. [02:45] Upcoming ISO 42001 Workshop– We have an upcoming ISO 42001 workshop where you can learn how to complete an AI System Impact Assessment, which is a key tool to help you effectively assess the potential risks and benefits of utilising AI. Rachel Churchman, our Technical Director, will be hosting that workshop on the 5th December at 2pm GMT, but places are limited so make sure you register your place sooner rather than later! [03:20] The impact of AI – AI is everywhere, and has largely outpaced any sort of regulation or legislation up until very recently. These are both needed as AI is like any other technology, and will bring it’s own risks, which is why a best practice Standard for AI Management has been created. If you’d like a more in-depth breakdown of ISO 42001, check out our previous episodes: 166 & 173 [04:30] A brief summary of ISO 42001 – ISO 42001 is an Internationally recognised Standard for developing an Artificial Intelligence Management System.  It provides a comprehensive framework for organisations to establish, implement, maintain, and continually improve how they implement and develop or consume AI in their business. It aims to ensure that AI risks are understood and mitigated and that AI systems are developed or deployed in an ethical, secure, and transparent manner, taking a fully risk-based approach to responsible use of AI. Much like other ISO Standards, it follows the High-Level Structure and therefore can be integrated with existing ISO Management systems as many of the core requirements are very similar in nature.  [05:45] Why is ISO 42001 important for companies both developing and using AI? – AI is now becoming commonplace in our world, and has been for some time.  A good example is the use or Alexa or Siri - both of these are Large Language AI Models that we all use routinely in our lives.  But AI is now being introduced in many technologies that we consume in our working lives - all designed to help make us more efficient and effective.  Some examples being: ·      Microsoft 365 Copilot ·      GitHub Copilot ·      Google Workspace ·      Adobe Photoshop ·      Search Engines i.e. Google Organisations need to be aware of where they're consuming AI in their business as it may have crept in without them being fully aware.  Awareness and governance of AI is crucial for several reasons:  For companies using AI they need to ensure they have assessed the potential risks of the AI such as unintended consequences and negative societal impacts, or potential commercial data leakage.  They also need to ensure that if they are using AI to support decision making, that they have ensured that decisions made or supported by AI systems are fair and unbiased.   It's not all about risk - organisations can also use AI to streamlining processes helping to become more efficient and effective, or it could support innovation in ways previously not considered. For companies developing AI, the standard promotes the ethical development and deployment of AI systems, ensuring they are fair, transparent, and accountable.  It provides a structured approach to risk assessment and governance associated with AI, such as bias, data privacy breaches, and security vulnerabilities. And for all, using ISO 42001 as the best practice framework, organisations can ensure that their AI initiatives are aligned with ethical principles, legal requirements, and industry best practices. This will ultimately lead to more trustworthy, reliable, and beneficial AI systems for all. [10:00] Clause 7.4 Communication – The organisation shall determine the internal and external communications relevant to the system, and that includes what should be communicated when and to who. [09:00] What are the key principles outlined in ISO 42001? – ·      Fairness and Non-Discrimination - ensuring AI systems treat all individuals and groups fairly and without bias. ·      Transparency and Explainability - Making AI systems understandable and accountable by providing clear explanations of their decision-making processes. ·      Privacy and Security - Protecting personal data and privacy while ensuring the security of AI systems. ·      Safety and Security - Prioritising the safety and well-being of individuals and the environment by mitigating potential risks associated with AI systems. ·      Environmental & Social - Considering the impact of AI on the environment and society, promoting sustainable and responsible practices. ·      Accountability and Human Oversight - Maintaining human control and responsibility for AI systems, ensuring they operate within ethical and legal boundaries.  You'll often hear the term 'Human in the loop'.  This is vital to ensure that AI is sanity checked by a human to ensure it hasn't hallucinated or result ‘drifted’ in any way. [11:10] Why conduct an ISO 42001 Gap Analysis? What is the main aim? – Any gap analysis is a strategic planning activity to help you understand where you are, where you want to be and how you’re going to get there.  The ISO 42001 gap analysis will identify gaps and pinpoint areas where your AI practices need to meet the ISO 42001 requirements.  It aims to conduct a systematic review of how your organisation uses or develops AI to then assess your current AI management practices against the requirements of the ISO 42001 standard. This analysis will then help you to identify any "gaps" where your current practices do not fully meet the standard's requirements.  It also helps organisations to understand 'what good looks like' in terms of responsible use of AI.   It will help you to prioritise improvement areas that may require immediate attention, and those that can be addressed in a phased approach. It will help you to understand and mitigate the risks associated with AI.  It will also help you to develop a roadmap for compliance to include plans with clear actions identified that can then be project managed through to completion, and as with all ISO standards it will support and enhance AI Governance. [13:15] Does an ISO 42001 gap analysis differ from gap analysis for other standards? – Ultimately, no. The ISO 42001 gap analysis doesn't differ massively from other ISO standard gap analysis, so anyone who already has an ISO Standard and has been through the gap analysis process will be familiar with it. In terms of likeness, ISO 42001 is similar in nature to ISO 27001 in as much as there is a supporting 'Annex' of controls and objectives that need to be considered by the organisation.  Therefore the questions being asked will extend beyond the standard High Level Structure format. Now is probably a good time to note that the Standard itself is very informative and includes additional annex guidance information to include ·      implementation guidance for the specific AI controls, ·      an Annex for potential AI-related organisational objectives and risk sources, ·      and an Annex that provides guidance on use of the AI management system across domains and sectors and integration with other management system standards.  [14:55] What should people be looking at in an ISO 42001 gap analysis? – The Gap Analysis will include areas such as looking at the 'Context' of your organisation to better understand what it is that you do, or the issues you are facing internally and externally in relation to AI - both now and in the reasonably foreseeable future, and also how you currently engage with AI in your business.  This will help to identify your role in terms of AI.  It will also look at all the main areas typically captured within any ISO standard to include leadership and governance, policy, roles and responsibilities, AI Risks and your approach to risk assessment and treatment and AI system impact assessments.  It also looks at AI objectives, the support resources you have in place to manage requirements, awareness within your business for AI best practice and use, through to KPI's, internal audit, management review and how you manage and track issues through to completion in your business. The AI specific controls look more in-depth at Policies related to AI, your internal organisation in relation to key roles & responsibilities and reporting of concerns, The resources for AI Systems, how you assess the impacts of AI Systems, The AI system lifecycle (AI Development), Data for AI Systems, Information provided to interested parties of AI Systems, and the use of AI Systems and 3rd party and customer relationships. [18:10] Who should be involved in an ISO 42001 Gap analysis? – An ISO 42001 gap analysis looks at AI from a number of different angles to include organisational governance that includes strategic plans, policies and risk management, through to training and awareness of AI for all staff, through to technical knowledge of how and where AI is either used or potentially developed within the organisation.  This means that it is likely that there will need to be multiple roles involved over the duration of a gap Analysis. At Blackmores we always provide a Gap Analysis 'Agenda' that clearly defines what will be covered over the duration of the gap analysis, and who typically could be involved in the different sessions.  We find this is the best way to help organisations plan the support needed to answer all the questions required.  It's also important to treat the gap analysis as a 'drains up' review, to help get the  most benefit out of the gap analysis.  This will ensure that all gaps are identified so that a plan can then be devised to support the organisation to bridge these gaps, putting them on the path to AI best practice for their business. If you’d find out more about ISO 42001 implementation, register for our upcoming Workshop on the 5th December 2024. If you’d like to book a demo for the isologyhub, simply contact us and we’d be happy to give you a tour. We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

One of the biggest contributors to a stagnating ISO Management System is a failure to communicate. This has certainly been true in our experience with implementing ISO Standards for over 18 years, and as a result, we make sure to highlight awareness and communication as an integral step of the Implementation process. It’s a wasted effort only to have your management system gathering dust in a rarely visited folder on your server. If you want to reap the benefits of ISO implementation, it’s in your best interest to make everyone aware of their role in relation to your management system and its continual improvement. Today Ian Battersby explains what ISO Standards mean by awareness and communication, why they are so integral to a successful management system and how you can effectively communicate your management system.   You’ll learn ·      What does awareness and communication mean in relation to ISO Standards? ·      Why should you communicate your management system? ·      The benefits of management system awareness ·      How can you effectively communicate your ISO management system?   Resources ·      Isologyhub   In this episode, we talk about: [00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo. [02:05] Episode summary: Ian Battersby will be explaining what ISO Standards mean by awareness and communication, and why they are so integral to a successful Management System. [02:30] What is awareness and communication so important?– The success and failure of a management system depends on it’s existence being known and understood within an organisation. Staff have a key part to play, and they need to know their part in the Management System and how it aligns with the organisations direction. [03:20] Extra guidance available for awareness and communication – There is a Standard that accompanies ISO 9001, called ISO 9004:2018 – Quality of an Organisation: Guidance to achieve sustained success. This is a great companion to any Standard, as it provides general guidance on how to properly embed a management system within your business. It talks at length about people and the need to ensure that they are competent, engaged, empowered and motivated. These are crucial as: Engagement of people enhances the organisations ability to create value for interested parties. Empowerment motivates people to take responsibility for their work and the results of their work. These can be achieved by providing people with necessary information with authority and the freedom to make decisions related to their own work. People should understand the significance and importance of their role, specifically in creating that value to meet and exceed customer expectations. [05:30] What should be communicating according to ISO Standards? – Taking ISO 9001 as the example, because it is the basis for most ISO Standards, it has a specifies the following: 5.2.2 Quality Policy - The policy should be available and maintained as documented information, so must be issued somewhere so that people can see it. But it also, quite importantly, must be communicated, understood and deployed within the organisation. It also needs to be made available to other relevant and trusted parties. 5.3 Organisational roles, responsibilities and authorities - Top management have a responsibility here. They must ensure that responsibilities and authorities for relevant rules are assigned, communicated and understood within the organisation. There’s a lot to consider here as this will also take into account for ensuring processes are delivering expected outputs, the reporting of system performance and improvement and the promotion of customer focus throughout the organisation. 6.2 Objectives - The organisation should establish objectives. These will be targeted at relevant functions, levels and processes and should be communicated to the relevant people affected by those objectives. 7.3 Awareness – Includes the specification that anyone working under the organisations control, so this could include indirect workers, must be aware of your quality policy. Also included is the awareness of objectives and staff’s contribution to the effectiveness of the management system. People aslo have to be aware of the implications of not conforming to the requirements of the management system or standard. [09:30] The implications of not following requirements – You need to consider what happens if someone doesn’t follow a process. For Standards such as ISO 45001 Health & Safety management, following processes could be a matter of someone getting hurt or breaking the law. [10:00] Clause 7.4 Communication – The organisation shall determine the internal and external communications relevant to the system, and that includes what should be communicated when and to who. [10:30] When should you deliver ISO Management System awareness and communication training? – If you’re just starting out on your ISO Implementation journey, it’s crucial to communicate at the outset the importance of the process of achieving certification. The level of awareness will vary depending on people’s roles, i.e: Top Management: Top management must understand the role of the management system in relation to the strategic direction of the organisation as part of context, they must understand what the management system contributes to the overall business outcomes. While top management don't need to know standards inside out, they must be aware and must have understanding of the overall purpose of the standard and the benefits that standard will bring to the organisation. To gauge the level of awareness top management need, ask yourself, would you be happy to let them be interviewed in private by a third-party assessor in regards to all of their responsibilities in relation to the management system? [13:20] General awareness for the workforce– While leadership require a greater level of awareness, there is still a need for general staff to have a certain level of management system awareness. For those on their first implementation journey, you should bring people in from the very beginning, this includes all staff and those working indirectly under your organisation. You will want to make them aware of the following: What is a quality management system? – Define what it is and what it means What’s important about the Standard? – People don’t need to know the intricacies of standard subclauses, so just select important aspects such as the Plan Do Check Act (PDCA) cycle If you’re integrating Standards, what are some common requirements? – If you’re integrating a new standard, what requirements specific to that new standard need to communicated? [15:15] Join the isologyhub and get access to limitless ISO resources – From as little as £99 a month, you can have unlimited access to hundreds of online training courses and achieve certification for completion of courses along the way, which will take you from learner to practitioner to leader in no time. Simply head on over to the isologyhub to sign-up or book a demo. [17:20] General awareness for the workforce continued – You will also need to make sure people are aware of: What do they need to know in relation to certification? – This can include the date you’re working towards, what might be expected of them during an ISO assessment, what does the certification actually mean for the business? Accessing the Management system – How can people find your management system? What documents does it hold? How do you use it? And how does this impact on staff’s day to day activities? Staff’s role in relation to the Management system – How do staff contribute to the management system on a daily basis? How do they contribute to business objectives? How does the management system benefit them? – Your management system will include tools and guidance on how to carry out certain activities. It explains how improvements can be suggested and made and how audits work. Ultimately it provides a structured approach to ensure everyone is singing from the same song sheet. The importance of complying with policies, processes and procedures – including the consequences of not complying with them. Raising issues relating to non-conformity, the effectiveness of the management system and any potential improvements – You can’t have eyes everywhere, and the people working in alignment with your processes can better highlight where something may not be working. This also increases engagement as people will have a real impact on how your business operates.   [20:15] Specific standard considerations for communication – The focus of elements of your communication will be tied to the specific ISO Standard you’re implementing. I.e. A Health & Safety management system will include communication of key risks and hazards, how to report safety issues and abiding by Health & Safety law Environmental management systems may include awareness of the need to protect the world we live in, how each person can help lessen their impact on an individual scale ect.   [21:00] Other key roles and related communication – There are other key roles within the organisation which will have specific communication requirements. These will be people like operational functional managers with key roles in processes they may be involved in, i.e. sales, design, purchasing, calibration ect. If they've got specific functions in the organisation with respect to the management system, they need to understand them as much as top management needs to know theirs and the general workforce need to know theirs. [21:50] Communicating key changes to the Management system – You need to continually communicate to the workforce when changes occur to the management system. That communication doesn’t stop as soon as you’re certified! For first time implementation, you’ll want to communicate when you’ve achieved certification.   [22:30] The importance of communication within a Management System – If people are aware of their role and importance to a management system, they will be more engaged with its operation. This can include reporting on objectives progress during team briefs, raising potential issues and non-conformities or opportunities for improvement, highlighting customer complaints, monitoring number of incidents at work ect All of these contribute to the success of the business and need to be reported on continually. These can turn into lessons learned, which could lead to major system changes where documentation or processes need to be updated and communicated. [24:30] What’s the best way to communicate your ISO management system? – Not all organisations are the same, so there is no right or wrong way to do so. A few suggestions include: ·      SharePoint ·      Teams Channel ·      E-mail / internal newsletters ·      Bulletins ·      In-person training ·      Videos For any of the above you may need to consider how to record who has completed set awareness training. [25:30] A final thought  – If an auditor stops and asks a worker about your quality policy, what will that person say to that auditor? We understand that the quality policy must be communicated, but how does each person understand it? Your awareness raising needs to capture methods of ensuring that that happens, which is a tricky task! They do not need to know a Standard verbatim, but they should know the importance of complying with it, what a non-conformity within that system means, and what are the consequences are if they don’t follow the rules. If you’d like to book a demo for the isologyhub, simply contact us and we’d be happy to give you a tour. We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

A crucial part of Implementing any ISO Standard is addressing your risks and opportunities.  This is a key part of Clause 4 Context of the organisation, which expresses and explicit need to review and assess what internal and external factors could help and hinder in achieving your business goals. While ISO Standards don’t define a definitive method of doing so, many have adopted the practice of carrying out a SWOT and PESTLE analysis.   Today Ian Battersby explains what a SWOT and PESTLE analysis is, the key questions you should be asking and the importance of continually reviewing and updating the results as your management system matures.    You’ll learn ·      What is a SWOT analysis? ·      What is a PESTLE analysis? ·      Examples of questions you should be asking during a SWOT and PESTLE ·      How often should a SWOT and PESTLE be conducted? ·      Examples of SWOT and PESTLE in practice   Resources ·      Isologyhub   In this episode, we talk about: [00:30] Join the isologyhub – To get access to a suite of ISO related tools, training and templates. Simply head on over to isologyhub.com to either sign-up or book a demo. [02:05] Episode summary: Ian Battersby will be explaining what a SWOT and PESTLE exercise is, it’s role in fufilling key requirements in Clause 4 of any ISO Standard, and the key questions you should be asking during the exercise.   [02:30] What is a SWOT and PESTLE analysis? – This is one is the tools you can use to look at various factors that affect your organisation. SWOT standards for: ·      Strengths ·      Weaknesses ·      Opportunities ·      Threats PESTLE standards for: ·      Political ·      Economical ·      Social ·      Technological ·      Legal ·      Environmental And in recent years, people have added ethical into PESTLE too. Whether that’s on its own or integrated within the other elements is up to the organisation and how they want to run the exercise. Both analysis are fundamental in helping organisations understand the benefits and pitfalls of a project, management system implementation included. [05:05] Where in the Standard is there a need for a SWOT and PESTLE? – Clause 4 in all ISO Standards is known as ‘Context of the organisation’, which you need to establish early on in order to set the foundations for building your management system. Context is the world in which an organisation works, it is the considerations of the internal and external factors that affect what you do. SWOT and PESTLE, while not specifically referenced in the Standard, is a highly recommended tool as it directly assesses multiple internal and external factors and can fulfil the requirements of any ISO Standard. [06:20] Addressing Context of the Organisation – Clause 4, Context of the organisation states: “The organisation shall determine external and internal issues that are relevant to its purpose and its strategic direction, and that affects its ability to achieve the intended results of its management system. The organisation shall monitor and review information about these external issues.” There are also 3 additional notes: #1: Issues can include positive and negative factors or conditions #2: Understanding the external context can be facilitated by considering issues arriving from legal, technological, competitive, market, cultural, ect 3#: Understanding the internal context can be facilitated by considering Issues related to values, culture, knowledge and performance of the organisation.   So, there’s a lot to consider! [08:10] How SWOT and PESTLE address Context of the Organisation – Taking a look at SWOT, strengths and weaknesses would refer to factors internal to your organisation, while the opportunities and threats would be external. Depending on the focus of your management system, you may also want to complete this exercise through a certain lens. That could be information security, health & safety or environmental. The Standard requires you to align your management system with the strategic direction of the organisation, so even if you are viewing this exercise through a certain lens, don’t do so in complete isolation. [09:55] How to conduct a SWOT and PESTLE – The people involved in completing this exercise are important, not just the questions you ask. Senior management should be included as they will have key insight to the strategic direction of the business. You should also include operational managers or other functional managers as they will have more context for how things actually work in practice. The point of a SWOT and PESTLE is to ascertain where you stand in terms of your risks and opportunities, and issues relating to resources, people, information, process, technology, equipment, laws, markets, environment, finance, economy ect from both an internal and external lens. This will give you a solid foundation to build your management system on, which will ultimately help you achieve your intended outcomes and lead to a cycle of continual improvement. [11:55] Considerations for Strengths – Strengths is an internal factor. Questions you could ask include: ·      What do we control through good processes? ·      What are we known for? ·      What does our marketplace and competitors say about us? ·      What are we good at? ·      What assets do we have? ·      What resources and knowledge do we have readily available? ·      What's the strength in our products and in the processes for delivering those products and the people that run those processes and deliver those products, their skills, their knowledge, their strengths, their weaknesses and their expertise? ·      What areas in our organisation are already at a high standard and don't necessarily need improvement?   ·      Do we have objectives and targets that we measure against, i.e. KPIs, metrics, success factors and service level agreements, that demonstrate we're good? [13:10] Considerations for Weaknesses – Weakness is another internal factor, one that you have to be brutally honest conducting. Questions you could ask include: ·      What could you improve? ·      Where is money being spent poorly, or being lost? ·      What do your competitors do better than you? ·      What resources / knowledge / people / expertise do you lack? ·      What processes do you lack? ·      Where can your products or services be improved? ·      What are the constraints on your ability to meet changes in market need or demand? ·      What does your customer feedback look like? ·      Do your suppliers meet your requirements or the requirements of your clients? [14:45] Considerations for Opportunities – Opportunities are considered an external factor. Questions you could ask include: ·      What new opportunities are available in your market? ·      What data do you have available on market trends, and how can you leverage that? ·      How changes in compliance requirements in your specific industry or your locality might provide you with opportunity to gain an edge? ·      What are past identified opportunities that we’ve not acted on? ·      What is the competition not taking advantage of that you could? ·      How can you increase customer satisfaction based on both positive and negative feedback received? [16:00] Considerations for Threats – Threats are also considered an external factor, they are obstacles for you achieving your goals. Questions you could ask include: ·      What new environmental effects may affect you? Note: there is a new climate change amendment added to many commonly adopted ISO Standards, so this is something you will need to address. ·      What competitors are a threat to you? ·      Are other competitors taking advantage of markets that you have not accessed? ·      Why might competitors be getting ahead? ·      Are the habits of customers changing, and if so, how? ·      Are there other interested parties other than customers who present obstacles to you? ·      Are there any foreseeable resource issues? i.e. loss of experienced staff, lack of relevant talent in the pool of available people ect ·      Are you adapting to changes in the world? [16:00] PESTLE: Addressing political factors – When you’re looking at political factors affecting your intended outcomes, consider the following: ·      What is happening politically in your environment? - That could be international or local on scale ·      What is the impact of policy or tax? ·      What is the impacts of employment trends / trade restrictions / tariffs? ·      What is the impact of unemployment rates on your organisation? ·      What is the impact of workforce shortages that may affect you? ·      Is there any form of Government intervention in your specific market? ·      Would this government intervention be considered an opportunity or threat? i.e. offering grants [19:20] Join the isologyhub and get access to limitless ISO resources – From as little as £99 a month, you can have unlimited access to hundreds of online training courses and achieve certification for completion of courses along the way, which will take you from learner to practitioner to leader in no time. Simply head on over to the isologyhub to sign-up or book a demo. [21:25] PESTLE: Addressing economic factors – When you’re looking at economic factors affecting your intended outcomes, consider the following: ·      What is the impact of interest rates / exchange rates / inflation? ·      What is economic policy doing to you and your industry and your clients? ·      What are the impacts on wage rates / minimum wage changes /affordable living cost of living? [21:50] PESTLE: Addressing social factors – When you’re looking at social factors affecting your intended outcomes, consider the following: ·      What's the impact of changes in the cultural landscape? ·      What’s the impact of the expectation of people? ·      What’s the impact on working people’s lives and what their expectations are for working life in general? i.e. working hours and career aspirations ·      What is the and the emphasis on ethics, safety, Environmental Protection and data privacy for your clients / workforce / suppliers?   [22:50] PESTLE: Addressing technology factors – When you’re looking at technological factors affecting your intended outcomes, consider the following: ·      What is happening technology wise which impacts on what you do? ·      How does this affect the equipment you use? i.e. automation, the age of your equipment ect ·      What's the impact of emerging technology? ·      How you decide on the costs and benefits of investing in new technology? ·      How do you use your website / blogs / social media to interact with your marketplace? ·      Have you got intellectual property you need to protect? i.e copyright pins that need consideration. [23:40] PESTLE: Addressing legal factors – When you’re looking at legal factors affecting your intended outcomes, consider the following: ·      How does the law affect how you do business? i.e company law, health & safety law, HR law, trade law? ·      What changes in legislation have occurred recently that you need to have considered? ·      How do you horizon scan for changes in legislation that affect you in your market? ·      What's the impact on employment on imports, exports, labour departments? ·      Have you considered other compliance obligations, such as certification to certain standards? [24:50] PESTLE: Addressing environmental factors – When you’re looking at environmental factors affecting your intended outcomes, consider the following: ·      How do environmental aspects impact you, and how does the way you operate affect the environment? This includes consideration for air, water, land, natural resources, flora, fauna. ·      How do changes in the energy and utilities markets affect you? ·      How does your organisation fit in with any carbon reduction targets that your Government may have in place? ·      Are you required to create a carbon reduction plan? ·      Do you need to comply with certain environmental reporting requirements? i.e. here in the UK we have schemes like ESOS and SECR [24:50] PESTLE: Addressing ethical factors – This one is optional, but many are choosing to include it as part of their PESTLE now. When you’re looking at ethical factors affecting your intended outcomes, consider the following: ·      How do you stay on the right side of the law with respect to the use of money? ·      Have you considered human rights / labour / children in the workforce / slavery / health & safety and well-being of local populations? ·      What charitable contributions do you make as an organisation? [27:15] Assigning significance  – The next part of a SWOT and PESTLE requires you to assign significance to the various factors affecting your organisation. So, make sure you document every factor and how those factors affect your ability to achieve what you intend. Ensure that this all remains in alignment with the strategic direction of the business, as ultimately, you want your Management System to help drive those goals forward. [30:25] Frequency of a SWOT and PESTLE: This isn’t just a one-off exercise. You should be continually monitoring these internal and external factors, and only updating the exercise during a management review meeting will do you a disservice. This is an ever-changing world, it’s the one in which you operate, and you need to ensure you’re keeping up with it. You could look at various factors in monthly or even weekly meeting with the appropriate parties, and see if circumstances have changed. [31:25] Examples of why you should continually update your SWOT and PESTLE: Ian recounts an experience he had with a client where they had failed to disclose where they had switched to a digital system for competence related documentation, but it had not met their needs and so they needed to return to manual documentation. This switch made finding the required documentation for internal audits difficult. None of this was recorded in their SWOT and PESTLE. If you’d like to book a demo for the isologyhub, simply contact us and we’d be happy to give you a tour. We’d love to hear your views and comments about the ISO Show, here’s how: ●     Share the ISO Show on Twitter or Linkedin ●     Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List

Chris Truss, Global Sustainability Director at Reed & Mackay, leads the charge on sustainable business travel. He discusses the pressing need to reduce greenhouse gas emissions in this sector, highlighting the journey towards ISO 14064 carbon verification. Truss shares insights on the challenges and benefits of achieving this certification, the company's commitment to sustainability, and how transparency in carbon reporting can improve accountability. Listeners will also hear about innovative strategies in sustainable travel policies and the importance of engaging stakeholders in environmental efforts.