A system that works after the auditor leaves.
We build management systems that are used by the people they're designed for — not filed away after certification. This is how we do it.
Three things we believe about management systems.
The system should reflect how you actually work.
We start by understanding your existing processes, not by installing a template. Documentation that describes real operations gets used. Documentation that describes an idealised version of operations gets ignored. We interview your team, not just your management.
Integration is available when it helps — never assumed.
Many ISO management system standards, including ISO 9001, 27001, and 42001, share Annex SL — a common high-level structure. Where a client needs more than one standard, we can write policies, management reviews, internal audits, and risk methodology once and apply them across all of them, with a clear scope for each certificate. Where a client needs just one, we build exactly that — standalone, with nothing carried over that doesn't need to be there.
Ownership transfers to your team — support stays available if you want it.
We structure every engagement so your team ends up owning the system: they know why each element exists, how to maintain it, and what's coming next. If you'd rather keep us on call for surveillance audits, recertification, or general queries along the way, an ongoing retainer is available — that's your choice to make, not something we assume you need.
The four phases in detail.
Gap analysis
We map your current state against the clause requirements of each management system standard in scope — reviewing existing policies, controls, and records against what the standard actually asks for.
Output: a gap register with each gap rated by severity and effort, a recommended scope statement, and a project plan you can act on. You receive this whether or not you proceed with us.
System build
We draft the management system documentation with your team over a structured series of working sessions. The sequence is deliberate: we start with context and scope (what the system covers and who it affects), then work through risk, then controls, then documented information.
Sessions are short and frequent, involving the people who own each process area. We draft between sessions; you review and approve. Nothing is finalised without sign-off from someone accountable in your organisation. We also build the staff training and awareness materials the system needs, and can deliver the sessions directly.
All documentation is written in plain English, organised for the people who will use it, and structured to satisfy auditor expectations without being incomprehensible to everyone else.
Internal audit
We conduct the internal audit required by each standard, checking whether what you've documented reflects what you're actually doing, and whether all standard requirements are addressed.
Timing depends on your situation — sometimes it makes sense to run the internal audit before Stage 1, sometimes it's better placed between Stage 1 and Stage 2, and sometimes another point in the project fits best. We agree the right timing with you rather than applying one fixed sequence. Nonconformities are raised formally, with root cause analysis and corrective action plans, and we work with your team to close them before the certification body sees anything outstanding.
Certification
Stage 1 is a documentation review. The certification body confirms your management system documentation is complete and books Stage 2. We attend Stage 1, handle documentation queries, and agree any pre-Stage 2 actions.
Stage 2 is a live system audit — auditors interview your staff, examine records, and test whether the system operates as documented. We attend as technical support, not to answer questions on your behalf. The certificate is issued once any minor nonconformities from Stage 2 are closed.
What we don't do.
Being clear about scope avoids surprises. The following are outside a standard Aivantis engagement:
- IT infrastructure work, penetration testing, or technical security implementation — we advise on controls and specifications; your IT team or a specialist implements them.
- Legal advice on GDPR, NIS2, or other regulatory obligations — we note where our work is relevant to these, but we are not lawyers and do not provide legal opinions.
- Certification body fees — you engage and pay the certification body directly. We help you select one appropriate to your sector and size.
Start with a gap analysis.
A clear gap register. A project plan you can use with or without us.