How to maintain ISO compliance between audits 

What does maintaining ISO compliance mean? 

Maintaining ISO compliance means continuing to implement, maintain and improve your management system. In practice, that means keeping these four things aligned:  

• The requirements of your ISO or BS standard 
• Your processes and documented information 
• Applicable legal, regulatory, customer and contractual requirements 
• What your people do in practice  

As always, the aim isn’t to create paperwork for every task. It’s to retain enough reliable evidence to show that your key controls work, results are reviewed and problems lead to action.  

Create a year-round compliance schedule 

Create one compliance calendar instead of working backwards from your next audit. For each activity, record the owner, frequency or trigger, required evidence and escalation route. 

Include activities that happen:  

• When triggered, such as recording a complaint, incident, data breach, supplier failure or nonconformity 
• Regularly, such as reviewing objectives, performance measures, risks, legal requirements, supplier performance and expiring qualifications
• At planned points, such as internal audits, emergency exercises, management reviews and document reviews  

Set the frequency according to risk, change, past results and any stated requirement. A stable, low-risk process may not need reviewing as often as one that’s recently changed or caused repeated complaints. 

Set aside a few minutes each month to review overdue tasks, recent changes and any results that aren’t meeting their targets. Check that any agreed actions are moving forward and raise anything that needs a decision or extra support.  

Keep your management system aligned with change 

Treat significant changes to people, premises, equipment, software, suppliers, services or requirements as prompts to review your management system. 

Before making a significant change, identify which risks, processes, responsibilities and controls it will affect. Update the relevant documents, communicate the changes and provide any necessary training. 

Once the new arrangement is in place, check that it works as you intended. Capture evidence through the process instead of trying to recreate it before an audit. For example, changing a supplier should produce an approval record, while training records should show how you checked competence, not just who attended. 

Make current documents easy to find and remove obsolete versions from points of use. If you need to retain an old version, identify it clearly and store it away from current documents for the required retention period. As a quick test, ask a process owner to locate the latest instructions and a recent record. If they can’t, address the gap now rather than waiting for the next audit.  

Use internal audits to check compliance 

Internal audits aren’t rehearsals for the external audit. They help you confirm that your management system is being followed and working as intended, while there’s still time to address any gaps. 

During each audit, follow a recent activity from start to finish. You might trace an order from enquiry to delivery, a new employee from induction through to a competence check or a complaint from receipt to resolution. Compare what the process requires with what people do, what the records show and whether the intended result was achieved. 

Choose auditors who understand the process, can assess evidence objectively and, where possible, aren’t auditing their own work. 

Record each nonconformity against the relevant requirement and supporting evidence, then track the resulting action. Before closing it, confirm that you’ve addressed the cause and that the solution works. 

Keep management reviews focused on action 

Management review gives your leadership team an opportunity to confirm that the management system still supports the organisation and achieves its intended results. 

You don’t have to hold one long annual meeting unless your own process requires it. ISO auditing guidance confirms that you can incorporate management review into regular leadership meetings. The important thing is to cover the required inputs at planned intervals and retain evidence of the decisions made. 

Use a concise agenda or dashboard to review performance against objectives, customer feedback, audit findings, nonconformities, significant changes, emerging risks and resource needs. Focus the discussion on underperformance, unresolved issues and decisions that require leadership involvement. 

Finish each review by recording what was decided, who’ll take action, when it’s due and what resources they’ll need. Begin the next review by checking whether those actions were completed and achieved the intended result. 

Maintaining compliance shouldn’t require a rescue operation before every audit. If your audit programme has stalled or your management system no longer reflects the business, our team at ISO QSL can provide ongoing ISO consultancy and internal auditor training. We’ll help you keep your system current, useful and ready for scrutiny throughout the year.