AVEN
Who does this approach fit?
Choose a starting point by scale, activity and current friction; specialist controls need qualified validation.
Who it fits
Choose a starting point by scale and current friction
Industry names only guide discovery questions. Applicable standards, legal duties and technical controls require confirmation against products, sites and qualified specialists. The examples below are illustrative scenarios, not client cases.
An organisation may begin with a focused review, build one operating flow, maintain an existing system or expand to another standard. There is no reason to commit to an entire programme before knowing what is actually missing.
01
Scale shapes coordination
A 10–50 person team at one site usually needs one internal coordinator with real time to gather sources, involve owners and pilot a flow. A narrow scope exposes handoffs among sales, delivery and checking before expansion. A current-state review followed by a lean foundation often fits; timing follows operations, not document count.
A 50–200 person organisation with several functions needs clearer accountability and version approval. The number of procedures is often less important than each team using a different form or not knowing which version applies. Implementation or maintenance can assign owners, clean up the register and track actions through a management cadence.
Multiple locations, contractors or shifts create genuine variation. The project must decide which controls are shared, which are local and how differences are reported. We usually suggest a one-site pilot, record exceptions and only then expand. Duration, sessions and fees follow scoped discovery.
02
Manufacturing and construction
Illustrative scenario — a factory checks final output, but each shift handles nonconforming items differently. First ask who quarantines, who decides disposition and which record links the batch to customer feedback. ISO 9001 may be a quality starting point; ISO 14001 or 45001 should be considered only after environmental or safety scope and duties are specialist-validated.
Illustrative scenario — a contractor operates several sites with subcontractors and scattered records. The team needs to separate site controls from common processes and define evidence of handover, incidents and worker consultation. Technical safety content needs a specialist; office forms do not replace workplace hazard assessment.
- Suggested start: review the quality flow or multi-site controls before adding standards.
03
Services, software and information
Illustrative scenario — a service team commits to deadlines while changes stay in personal email. Intake, scope approval, change, handover and complaints need one accountable history. A narrow ISO 9001 flow can make that work visible before adding policy documents.
Illustrative scenario — a software company receives an ISO 27001 request. Before selecting controls, the team must define systems, data, interested parties, information risks and risk acceptance. Existing quality work may support document control, audit and action tracking; information security still needs its own assessment, Statement of Applicability and control evidence.
- Suggested start: implement a service flow or map reusable controls for expansion.
04
Food operations and multi-site chains
Illustrative scenario — a central kitchen supplies several outlets. Traceability, supplier control, prerequisite programmes, menu changes and nonconforming product cannot be inferred from a generic form. A food-safety specialist must validate ISO 22000 or FSSC scope before technical controls enter the process.
For multi-site chains, pilot a representative location to expose exceptions and compare other sites. One common policy may work, but operating logs and shift ownership belong to each site. Reports should count missing records and overdue actions by source, not compress them into a single “compliance” percentage.
05
Signals to start now
Start when managers cannot identify the current document version, a deviation recurs without effectiveness verification, or customer evidence requests require a search across many channels. A standard-edition transition or new site is also a useful moment to set scope and ownership before records scatter further.
Initial discovery needs only activities, locations, standards of interest, a coordinator and the three main pain points. Do not send sensitive records through the public form. After discovery, we suggest an order: work to check now, work suitable for a small pilot and work requiring specialist confirmation.
Next step
Start with a scope that can be checked
Self-check first, or send an outline of your scope so we can agree outputs, sessions and specialist needs. Do not send sensitive records through the public form.
We provide consulting and training; certification decisions are made independently by certification bodies.