I have managed to steer a 270 seat ICT department through the certification process for ISO9001 (the International Standard for Quality Management Systems) and ISO27001 (for Information Security Management Systems). After a 4 day audit which followed months of preparation, the result saw a clean assessment with only a few opportunities for improvement identified.
It’s very satisfying to get over the line, and has helped the department improve its processes and it’s own self-reflection by way of the internal audit process. The external auditor was friendly yet thorough, and we were able to strike up an excellent working relationship. This enabled some frank honest discussion but also made the whole experience enjoyable – more workshop or healthcheck than interrogation.
I have learnt a great deal from the process. My top 5 tips are:
- Have everything written down. It’s so important to be able to point to evidence… you may be the best organisation in the world but if you can’t produce an internal audit report you’re going to be in trouble.
- Bring everything together. Use the manual and Statement of Applicability as the ‘contents’ to your system and signpost. Even if your processes are distributed across SharePoint, the web, your Wiki… make them easy for you to show and tell
- Say what you do and do what you say. Make sure you can point to engagement with your customers, and make sure you can show how supportive senior management are.
- If you’re an ICT department, a framework like COBIT5 really helps to structure your processes. Again you don’t need to rip everything out and start again – use the COBIT5 process as a ‘summary’ and put your own processes and procedures in as detail.
- Use a good assessor and treat them as someone of value rather than someone whose sole purpose is to catch you out. Remember they want to pass you nearly as much as you want to pass yourself.
I’m happy to talk to organisations who would like some help on their journey towards certification. Once you’ve got there it’s (i)so satisfying!