The ISO Show

Blackmores UK

4.0 (2)
Management
Updated Weekly

Blackmores is a pioneering consultancy firm with a distinctive approach to working with our clients to achieve and sustain high standards in Quality, Risk and Environmental Management. We'll be posting podcasts discussing ISO standards here very soon!

6d ago

#260 What is ISO 9004? Guidance For Quality Management Systems

Putting work into Quality Management doesn't stop once you achieve ISO 9001. Continual Improvement is at the heart of every ISO Standard, but sometimes it's hard to know what good looks like beyond certification. This is where Guidance Standards can lend a hand. ISO 9004 provides guidance for Quality Management Systems, and though its current iteration was published in 2018, its advice is more aligned with the 2026 version of ISO 9001 than the previous 2015 edition. In this episode, Ian Battersby dives into the purpose of ISO 9004, its applicability to the new 2026 version of ISO 9001 and explores the clauses and differences between ISO 9001 and ISO 9004. You'll learn · What is ISO 9004? · What's the main difference between ISO 9001 and ISO 9004? · Is ISO 9004 due an update? · Where do ISO 9001 and ISO 9004 connect? · What are the other differences between ISO 9001 and ISO 9004 · Breaking down ISO 9004 by clause Resources · ISO 9004 · Isologyhub In this episode, we talk about: [02:30] Episode Summary – Ian Battersby dives into the guidance Standard for Quality Management, ISO 9004, looking at the key connections and differences between it and ISO 9001. [02:45] What is ISO 9004? ISO 9004 is a Guidance Standard designed to support ISO 9001. Its latest iteration was published in 2018, which was 3 years on from ISO 9001's previous iteration, meaning much of its guidance aligns with the newer 2026 version of ISO 9001. [03:35] What's the main difference between ISO 9001 and ISO 9004? There is a core distinction between the two: ISO 9001 is a management system standard — it specifies requirements. An organisation can be audited and certified against it. Its job is to give confidence that an organisation can consistently deliver products and services that meet customer and applicable statutory/regulatory requirements. ISO 9004 is guidance, not requirements — you can't be certified to it. It addresses the "quality of an organization" itself: the degree to which its inherent characteristics fulfil the needs and expectations of all relevant interested parties (not just customers), with the aim of sustained success over the long term, in a changing environment. ISO 9001 gives confidence in what you produce or deliver and ISO 9004 gives confidence in what you are as an organisation. In short, the two complement each other. Something worth noting: The 2018 edition of ISO 9004 deliberately repositioned itself as independent of ISO 9001 rather than an "add-on"; a change from earlier editions, which were more explicitly paired as a "consistent pair" with 9001. [06:00] Is ISO 9004 due an update? ISO 9001 has been updated as of 2026, so should we expect ISO 9004 to follow suit? The answer is no, there is no planned revision date currently, so the most current edition is still 2018. [08:45] Where do ISO 9001 and ISO 9004 connect? There are a number of features of each Standard that connect. Both sit under the same quality management principles from ISO 9000, so they share a common vocabulary and philosophical base, so there's no contradiction, just different altitude. ISO 9001:2026 has an Annex which is very helpful in explaining requirements, but ISO 9004 can be read as picking up where 9001 stops. ISO 9001's clauses (context, leadership, planning, support, operation, evaluation, improvement, all clarified in the new ISO 9001 Annex) reappear in 9004 but are expanded and extended into strategic territory, eg, 9001's "leadership" clause vs 9004's full treatment of policy, strategy, and organisational identity. An organisation that's already certified to 9001 has the infrastructure that 9004 assumes and builds on, so 9004 may be used as a maturity roadmap after certification, not before it. Remember: ISO 9001 is the ground, 9004 is the sky you're reaching toward. [10:50] What are the other differences between ISO 9001 and ISO 9004 – Other key differences include: · Certifiable vs non-certifiable (single biggest practical difference for clients: no third-party audit, no certificate, so no external pressure to adopt it). · Compliance / conformity mindset (ISO 9001) vs performance / excellence mindset (ISO 9004). · Narrower interested-party scope (customer focus, mainly) vs broader (all relevant interested parties). · Operational / tactical (ISO 9001) vs strategic / cultural (ISO 9004) — identity, values, culture literally appear as a clause heading in 9004 and have no equivalent requirement in 9001. [12:20] Why this matters for organisations right now, with 9001:2026 just out – ISO 9001:2026 has actually pulled a bit closer to ISO 9004's territory. The new 2026 version of ISO 9001 adds "quality culture and ethical behaviour" language and stronger strategic framing, which was already present in the 2018 version of ISO 9004. This narrows the conceptual gap slightly, even without ISO 9004 itself being revised. [13:05] Breaking down ISO 9004's Clauses 1-4 – 1–3: Scope, normative references, terms and definitions: standard preliminaries. Clause 4 - Quality of an organization and sustained success: defines the core concept: quality of an organization is the degree to which its inherent characteristics fulfil the needs and expectations of customers and other relevant interested parties, and sets out what "managing for sustained success" means. It's distinct from 9001, which focuses on quality of products / services. It introduces broader concepts than ISO 9001 in relation to IPs, relationship management, and the varied expressions of needs and expectations. [14:50] Breaking down ISO 9004's Clauses 5 & 6 – Clause 5 - Context of an organization: identifying relevant interested parties and the external/internal issues affecting the organisation (it corresponds to but receives broader treatment than ISO 9001's equivalent clause). It builds upon ISO 9001 clause regarding internal and external issues and proposes external factors such as globalisation, innovation & natural environment. It expands on internal factors to bring in strategy, complexity and maturity. It invites top management to consider these issues and to determine which could result in risks to sustained success or opportunities to enhance sustained success Clause 6 - Identity of an organization: This is the clause with no real ISO 9001 equivalent: it's where 9004 moves into genuinely strategic / organisational territory. An organization is defined by its identity and context. The identity of an organization is determined by its characteristics, based on its mission, vision, values and culture. These are all too vague in many organisations, but here it lays out what they should really mean: · Mission: the organization's purpose for existing; · Vision: aspiration of what an organization would like to become; · Values: principles and/or thinking patterns intended to play a role in shaping the organization's culture and to determine what is important to the organization, in support of the mission and vision; · Culture: beliefs, history, ethics, observed behaviour and attitudes that are interrelated with the identity of the organization Note the word 'ethics', ISO 9004 is way ahead of ISO 9001 in addressing ethical behaviour. [18:15] Breaking down ISO 9004's Clause 7 Leadership – Policy, strategy, objectives, and communication, all framed around driving sustained success rather than just QMS conformity. It refers back to leaders promoting the mission, vision etc. It talks about them creating the environment in which people are engaged and committed to objectives. It also describes unity of purpose and direction (established by top management). In 7.2 we have policy AND strategy. ISO 9001 does require alignment to strategic direction, but here it guides us to develop strategy, either by a recognised model or one bespoke to the organisation. It even proposes that top management should make strategic decisions regarding competitive factors and provides a model for doing that, it then goes on to discuss the alignment of objectives. It takes objectives way beyond ISO 9001 and considers framing them in terms of the organisation's positive impact on society and the environment, and it's people's engagement in society beyond merely business-related activities. Again, we see the ethical slant in ISO 9004 well before its inclusion in ISO 9001. [18:15] Breaking down ISO 9004's Clauses 8 & 9 – Clause 8 - Process management: Determining processes, assigning responsibility and authority, and managing processes. This clause contains fuller treatment than ISO 9001's process-approach requirements, but also one which discusses processes as means to fulfilling objectives. Clause 9 - Resource management: Beginning with people (engagement, empowerment, competence), organizational knowledge. Competent, engaged, empowered and motivated people are a key resource. Engagement of people enhances the organization's ability to create and deliver value for interested parties. Empowerment enhances the motivation of people to take responsibility for their work and its results. 9.3 covers organisational knowledge, which receives very scant treatment in ISO 9001, but is expanded upon greatly here. Here it's described as: 'An intellectual asset which top management should manage as an essential element of the organization's sustained success.' The rest of clause 9 gives very broad guidance on technology, infrastructure and work environment, externally provided resources. All much more detailed than the ISO 9001 equivalents. In one part it discusses: 'Creative work methods and opportunities for greater involvement, to realize the potential of people in the organiza
Oct 8

#259 AmcoGiffen – The Road Towards ISO 27001 Certification

The need for Information Security has only increased as we become more dependent on technology to keep things running smoothly. Even in industries such as construction, which many may have assumed were largely exempt. While not common, there are a few within the construction space that have taken the initiative to implement best practice information security Standards, such as todays' guest, AmcoGiffen. In this episode, Ian Battersby is joined by James Butler, IT Director at AmcoGiffen, to dive into why they chose to implement ISO 27001, what they learned during the process and the benefits felt following certification. You'll learn · Who is James Butler? · Who are AmcoGiffen? · What was the main driver for ISO 27001 Implementation? · What was the biggest gap identified during the Gap Anaylsis? · What did AmcoGiffen learn from the Implementation journey? · What are the main benefits of ISO 27001 Implementation? · James' Top Tip Resources · AmcoGiffen · ISO 27001 · Isologyhub In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by James Butler from AmcoGiffen to discuss their journey towards ISO 27001 certification, including the challenges faced and resulting benefits following certification. [03:00] Who is James Butler? James Butler is the IT Director at AmcoGiffen. One thing many may not know about him is that he's recently started taking swimming lessons aside his kids. Growing up, there weren't many opportunities to learn, so he's taking the time now to both set a good example for his children and to ensure he can keep them safe when in bodies of water in the future. [05:40] Who are AmcoGiffen?: AmcoGiffen are a national contractor for construction and engineering throughout the UK. They are owned by the group company Renew Holdings. Their projects range from rail, infrastructure, highways, environmental sectors to aviation. [07:10] What was the main driver behind ISO 27001 Implementation? They had a couple of reasons: 1) They wanted to ensure that clients, stakeholders and shareholders had confidence in their ability to secure their data and information along with their employees data. 2) When you work in the public sector, ISO 27001 is becoming a necessary certification to have. James expects that within the next 5 years, it will be just as mandated as Cyber Essentials currently is. AmcoGiffen already proudly hold Cyber Essentials Plus, and saw ISO 27001 certification as the next natural step to provide that extra level of assurance. [08:35] How long did it take to achieve ISO 27001? It was discussed for a while before committing, but the whole process took around 12 months from start to certification. At first, they did want to challenge themselves with a shorter timeframe, but after starting the process they realised that a shorter time restraint was adding unnecessary pressure and wouldn't have resulted in a good Management System that could be used. So, they took a step back and allowed more time for the system to be properly integrated into the business, which was that part that took the longest, as documentation is the easier part to deal with. [10:55] What was the biggest gap identified during the Gap Analysis? – For AmcoGiffen, the biggest gap was documentation. They already had a lot in place where controls were concerned thanks to their existing Cyber Essentials Plus certification, but the actual documentation of processes, objectives and risks were lacking. ISO 27001 allowed them to put the structure in place to manage this. Their key message throughout the implementation process was: 'we need documentation for the right purpose'. [09:55] What did AmcoGiffen learn from the Implementation journey? ISO 27001 helped to create a priority list, while also allowing them reflect and realise they should be documenting a lot more, not just to meet Standard requirements but because it's the right and responsible thing to do. One such example is making sure that there's enough information to allow someone to pick up a task if it's passed to them. They went to great pains to ensure the whole implementation wasn't forced, and as a result they passed both their Stage 1 and Stage 2 Assessments with no non-conformities or observations! AmcoGiffen also had the benefit of strong leadership commitment and involvement throughout the Implementation. James stresses the need to have Leadership buy-in from day one, otherwise you have to fight an uphill battle of making cases for the changes that you need to make as a result of implementing a Management System. He also make a point of ensuring you understand your stakeholders requirements, as ISO 27001 is not just an IT Standard, it touches on aspects like HR and physical security, aspects they may actively be involved with. If possible, it's best to bring them in and involve them in the initial planning so you're all on the same page of why you want to achieve Certification. [15:20] When did AmcoGiffen achieve Certification? – They completed they Stage 2 Assessment in July of 2026 and received the certificate in September of 2026. [15:50] What are the benefits of ISO 27001 Certification? – James states that the benefits started from day 1 of the implementation process. The initial Gap Analysis allowed them to really look at how they currently operated, what were their strengths and weaknesses, where potential opportunities were. It gave them the chance to gather people from all corner of the business to come together and discuss their current processes, get feedback on how they could be improved, and ensure the updated processes would fit in with how they actually worked. James states that IT professionals can have a tendency to over complicate things, so he ensured that the system remained something that could be easily understood and integrated into the business. One other thing they implemented early was a mature Risk Register, this was so they could be driven by the actual risks facing the business and not just by who was shouting the loudest. Ultimately, ISO 27001 has provided a lot more organisational structure and more direction on priorities. [18:55] James' Top Tips – Do it for the right reason, don't do it as just a tick box exercise. If you're simply doing it for a badge on the website, then it's unlikely it will be providing any real benefit as it requires effort to keep the momentum of continual improvement going. Secondly, get Leadership buy-in before committing to certification. The process will be difficult without that endorsement from the top down. Lastly, challenge yourself to remove friction. The system has to work for the business, not just the auditors of the system. The key is to make the right information available to the right people at the right time. Don't just bog them down with endless processes and manuals, keep it simple and easy to understand as that's how a system gets integrated successfully. [21:50] James' book recommendation – The subtle art of not giving a f*ck – Mark Manson [23:45] James' favourite quote – 'Keep it simple' If you'd like to learn more about AmcoGiffen, check out their website. If you'd like help with ISO 27001 Implementation or on-going support, feel free to reach out to us, we'd be happy to help. We'd love to hear your views and comments about the ISO Show, here's how: ● Share the ISO Show on Twitter or Linkedin ● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List
Sep 16

#258 What is BS 99001? Quality Management For The Built Environment

Many of you will be familiar with ISO 9001, the leading Quality Management Standard, which provides a solid foundation for managing any business. However, for certain industries, ISO 9001 alone is not enough. The built environment is one such sector, as it requires more rigorous controls to keep projects on track, ensuring safety of all involved and processes that enable documented accountability for each and every step until project delivery. BS 99001 was introduced in 2022, not to replace ISO 9001 but rather to add to existing quality management systems for those in the built environment sector. In this episode, Ian Battersby is joined by Darren Morrow, Senior Consultant at Blackmores, to explain what BS 99001 is, how it addresses challenges unique to the built environment sector and explore the clauses and how they differ from ISO 9001. You'll learn · What is the built environment sector? · Why was BS 99001 created? · What is BS 99001's relationship with ISO 9001? · How does BS 99001 differ from ISO 9001? · Exploring the clauses of BS 99001 · Where is BS 99001 going in the industry? Resources · Isologyhub · BS 99001 In this episode, we talk about: [02:35] Episode Summary – Ian Battersby is joined by Darren Morrow to explore BS 99001, Quality Management for the Built Environment. Join them as they discuss the reason for the Standards creation, it's relation to ISO 9001 and an overview of it's main clauses. [03:30] What do we mean by the Built Environment Sector? The sector covers the whole human-made environment: · buildings (homes, workplaces, hospitals, schools, entertainment), · infrastructure (roads, rail, bridges, utilities), · public space (parks, squares, streets etc) On top of that, you could also add the urban environment on a large scale, the way cities and towns are planned, developed over time, connected Any profession involved could apply this standard: · Design and planning (town planners, architects, interior designers, landscape architects) · Engineering (civils, structural, M&E, transport, environmental (planning our waste, water etc) · Construction (delivery, PMs, QSs, SMs, trades, contractors) · Management (of estates/facilities, property developers, agents, surveyors, valuers) · Policy, regulation, compliance (local authorities, planning officials, building control, regulatory authorities, enforcement agencies) [05:00] Why was BS 99001 created?: Despite the widespread adoption of 9001 across the industry (and it being a prerequisite in many circumstances), there has continued to be a series of significant incidents, numerous reports and national enquiries. These all point to an issue with quality that a generic standard appears to have failed to address. When this is the case, it's a sign that something more sector specific is necessary to avoid repeating the same mistakes. The UK Building Safety Act is now being enforced, which has added more implications and requirements on contractors. BS 99001 can help to support compliance with this due to its focus on responsibilities, competency and accountabilities. [09:45] What is BS 99001's relationship with ISO 9001?: BS 99001 doesn't modify or replace ISO 9001, it builds on it for the built environment sector. ISO 9001 creates a solid foundation for any business, but because of this it is deliberately vague in it's requirements. BS 99001 in comparison is very prescriptive with what it what's businesses to do, record and evidence. [10:30] How does BS 99001 differ from ISO 9001? BS 99001 is very much aware of the project based nature of its targeted sector, so the requirements are written with this in mind. Its requirements are written to ensure all parties involved in construction projects are included, accountability is its foundation, and it looks to help facilitate a lessons learned environment for compliant businesses. [11:30] BS 99001 Clauses: 4 Context - We're all used to this clause, but there's a note to consider the nature of the interested parties, as it's a lot more prescriptive and includes: · Members of the public are suggested first (users of stations, tenants in social housing) · Owners and operators of assets (ie, the built end product) · Project funders/investors · Project owners/sponsors · Project teams It also requires context documents specifically taking into account commitments to social, economic and environmental sustainability. So ESG is being embedded from the start. These interested parties encourage open forums between not only all those involved in the actual construction, but those that will be affected by the project and end product. This commitment to social, economic and environmental sustainability is a theme that continues throughout the whole Standard. Some businesses that already hold certification to Standards such as ISO 14001 and ISO 45001 think they may already have all of this covered, and in many ways they would be correct, however those typically apply to the business as a whole whereas BS 99001 incorporates everything in and around the project rather than treating projects as a separate entity – which is how other ISO Standards act in this sector. [15:40] BS 99001 Clauses: 5 Leadership – The specific requirement states: 'Top management shall ensure that a competent person is appointed as the management representative with oversight of quality for projects the organization is involved in or plans to be involved in' This may seem like an old-fashioned approach, however the need for competency in this sector is paramount. Organisational roles, responsibilities and authorities for Quality Management roles with clear competence and impartiality / independence criteria are explicitly stated. What was once a role that may have not held the power to stop a project like Health & Safety roles, now has that ability. If something is raised as a quality concern, then there is a strong argument for that becoming a safety risk down the line. It's better to fix something early on than to have it become a bigger problem, therefore, significance to the roles that point out these issues have been given the power they deserve in the project management process. [20:00] BS 99001 Clauses: 6 Planning – Risk management is an essential part of BS 99001, Clause 6 is where the requirements for risks and opportunities is explicitly stated, however, these are references multiple times throughout the Standard. There are specific Risk requirements to take account of are: · Projects it is involved in or plans to be involved in; · The process of construction and the subsequent use of the asset; · The organization as a whole; and · Society the economy and the environment. Many construction companies will be tendering for multiple jobs, so it's a good opportunity to build a robust risk register that gets added to with each project. Learning from one project should be used to help you to bid for the next one. Keeping track of these should also be done so you can inform your interested parties of the risks involved, and any subsequent lessons learnt should also be of value to your supply chain. One key group that often gets overlooked is the Funders, they'll have a particular interest in the risks and to have all the knowledge available about what they're funding. Having records to answer their questions will keep them happy or at least informed. Objective requirements include: · Quality objectives for each project, to reflect contractual and other requirements · Evidence of the following considerations in objectives: · Defined scope, time, cost and project lifecycle · Social, economic and environmental commitments · Collaboration with interested parties In ISO 9001, the objectives are set from the business level, but in BS 99001 these are aimed at the project level. [24:10] BS 99001 Clauses: 7 Support – As mentioned, people and competence is a big focus for BS 99001. Evidence for competence arrangements include: · Project / contract specific roles and responsibilities - formally assigned · Formal process(es) for determining competence · Competence arrangements relating to all people working on the organisation's behalf There are also verification processes for all external providers, including the need for: · Authorities for approval of operations, processes, design, production, inspection and tests · Competence arrangements for management representative(s) specifically regarding quality · Evidence that competence arrangements take into account requirements of interested parties It's up to the business to make sure they can prove people are competent for the roles they are assigned, which is why there is a lot of detail in this area. Documented information is also key, as this provides a traceable and auditable path of accountability. Again, BS 99001 is a lot more prescriptive on this clause when compared to ISO 9001. BS 99001 requires documentation of: · Process(es) to ensure awareness of statutory / regulatory requirements specifically relating to documented information (eg, building information, product safety, structure, maintenance, retention timeframes) · Approval methods and authorities for the different types of documented information · Communication / availability / control of changes to documented information to interested parties Now this doesn't mean you have to drown yourself in paperwork! These can all be stored as ele
Aug 19

#257 How to meet legislative and ISO requirements in leasehold properties

Many businesses do not own the property they operate in, this can lead to complex questions over who has ownership over certain property and facility related legal obligations. Managing areas such as waste transfer, electrical, gas and aircon servicing etc could feasibly be managed by both landlords and those leasing the property, and it's important to establish who manages what to ensure all legal requirements are met. In this episode, Ian Battersby discusses the complexities of leasehold compliance, including how to establish key responsibilities, examples of what legal and ISO related requirements need to be met and what evidence you need to be keeping a record of. You'll learn · What is leasehold compliance? · What areas do you need to consider within leasehold compliance? · Establishing responsibility · What subject areas relate to ISO compliance? · How to plan for leasehold compliance and gathering evidence Resources · Isologyhub · PAS 79 · BS 5839 In this episode, we talk about: [02:35] Episode Summary – Ian Battersby discusses leasehold compliance, including establishing responsibilities and gathering evidence to ensure your legal and related ISO requirements are being met. [02:45] What is leasehold compliance? Many organisations don't actually own the property where they operate, it's very common for businesses to lease property. A landlord will lease the property to a client and often appoint a building manager, managing agent to run it on their behalf and act as the interface with all the leaseholders. Sometimes, the building manager will be part of a large organisation which also provide facilities management services. Often they'll only offer the most basic of services and will contract another party to provide further facilities management. Whichever party provides general facility management services will almost certainly need to contract another layer of providers responsible for specialist services such as waste transfer, electrical / gas / aircon servicing. Sometimes, the leaseholder will directly contract a third party for a service (air con, electrical, PAT, cleaning).So all in all, it can be quite a complex picture of responsibility! [05:10] The complexities of leasehold compliance: It can be tricky navigating through this and demonstrating that you've fulfilled all your own legal obligations as well as gaining assurance that other parties have done what they need to do to protect you and your employees. Often, those charged with liaising with the building manager are not experts in Health & Safety, Environment, Facilities Management and compliance. It might be the office manager who picks up this role. In some cases, you have an absolute duty, even where the landlord has complete control over the service which is provided to you (e.g. waste management). [06:45] Establishing Responsibility: Establish who owns what, who is responsible for things such as building fabric, installed services, the contracting of support services. But, regardless of actual ownership and the direct responsibility for a particular aspect of a building, there is always an interrelationship, a dependence between building, infrastructure elements. For instance, you may use a whole floor which has been fitted out for your own purposes, you own the electrical installation from the walls inwards, but that links into the electrics beyond your own shell. You may have certain responsibilities in your own area for firefighting equipment, fire doors etc, but fire safety also depends on things like: · The escape routes · The building's fire alarm · Emergency lighting · Protection of the common areas such as the lobby If the building isn't safe beyond your own demise, your own demise isn't safe. While you may not have direct control over these aspects and your legal responsibilities, leases may leave the burden on you to seek evidence. Although there should be demonstration of various compliance obligations throughout the pre-let enquiries process. You may even be lucky enough to have a lease clause which requires landlord to complete or contribute towards compliance reporting. [08:30] What subject areas relate to ISO compliance?: Standards where leasehold compliance is particularly relevant include ISO 14001 environmental management and ISO 45001 Health & Safety management. For both of these, there may be a need for you to provide your own evidence or seek assurance from a third party. The examples we're providing here apply to office locations and for more complex, more industrial, more heavily commercial premises. Considerations / requirements for either one of both of these Standards include: Energy performance certificates: Legally required documentation. They rate the energy efficiency of a property from A to G, and they have to be provided prior to leasing and on leasing. These can apply to a whole building or just a wing or floor of a building. These can be verified online via a .gov portal. As of the 1st of April 2023, any commercial property in England or Wales must have a minimum energy performance certificate rating of E. However, this is set to change after consultation, so from April 2031 you won't be able to let property unless it's in the A or B band. Recommendations Report: This supplements the previously discussed energy rating. This report, as the name suggests, provides recommendations for improving efficiency. If you're already rated an A or A+, then there may not be too many recommendations. But C and below will have some that will improve your building over time. It's important to note that there is no mandatory obligation to action these recommendations, and some provided can be quite generic and not at all applicable. However, you should seek through the landlord and ask if they're following through on any of the recommendations to improve energy performance, particularly if you will be looking to renew leases around the time that the law changes. Air Conditioning: If your building is relatively new, less than five years, you will really need to see the installation and commissioning information associated with air conditioning. There should be records of building control, electrical installation, commissioning certificates, and also a test which is called a TN 44. This test is legally required once on installation and then again after every 5 years. It needs to be carried out by an accredited energy assessor, who can be verified via the same Government portal as the Energy performance certificates. This applies to any system with an effective rated output of more than 12 kilowatts, which quite simply, is nearly all commercial offices. The TN 44 test will also provide a report which includes recommendations on how to use the equipment, the management regime for its setting points for temperatures and other such advice to keep it working as efficiently as possible. The person responsible for air conditioning is responsible for this certificate. If you own the aircon in your demise, it's yours, if the landlord owns the aircon, it's theirs. F Gases: Any system which contains fluorinated greenhouse gases, so what we call F gases, needs to be inspected regularly to ensure that none of the gas leaks and to ensure that they're operating at optimum efficiency. This can includes things such as air conditioning, heat pumps, Fire Protection (aerosols and foams) and is often used in various parts of Industrial Manufacturing. If there are any leaks, they need to be logged, replacements need to be made, recharge needs to be done, and all this needs recording in a logbook. When it comes to servicing of anything that uses F Gases, you need to check the competence of those individuals. Refcom has a register of accredited / approved companies that provide these services. Fire Risk Assessments: Fire Risk Assessments are legally required documentation which needs to be carried out by a competent person. There isn't a prescribed frequency on fire risk assessments, but you should really be reviewing them at least annually and doing a full reassessment on a three-year period – or when there has been a significant change to the layout / occupation of the building. There is a mandatory way of completing a fire risk assessment, PAS 79, which is a publicly available specification. So you need to check that yours are being done in alignment with this Standard as this provides proper risk evaluation and an action plan which is prioritized according to the level of risk. It may also be worth checking with your insurance organization or any local authorities whether they have a prescribed frequency for your fire risk assessments. Fire Alarms: You will no doubt have a fire alarm within your building, this may be the landlords own fire alarm system or it may be one you as the leasehold business own. As a starting point, you need to understand who has ownership of this. On installation and commissioning, you must comply with certain standards. For the UK this is BS 5839, which requires building control, a commissioning certificate, handover certification, the correct drawings, a manual, a logbook, specific training to the owners and users of the system. Every six months you should have a competent person complete maintenance, servicing and inspection to ensure that the way the fire alarm was installed is the way it remains in compliance with BS 5839. As well as a six-monthly inspection, there is also a competent person test and inspection over elements over and above that, which requires certificate issuing annually. There's also a full test and inspection of the wiring underpinning the fire alarm system. This isn't prescribed, but it's commonly c
Aug 5

#256 BedX – Supporting Businesses Looking To Tender For Universal Bedfordshire and Beyond

There has been a lot of buzz around the upcoming Universal Project currently in development in Bedfordshire. It's estimated to generate around £50 billion in economic benefit, along with the creation of 20,000 jobs during its construction, and a further 8,000 jobs once it's operational. It's undoubtedly brought a lot of eyes towards the smallest county in the UK, and with it a lot of opportunity for local businesses to get involved with not only the main theme park itself, but the surrounding projects that aim to make Bedford and beyond a thriving tourist destination. For those wondering how to get involved, there is a dedicated group looking to share knowledge and tools to get you tender ready. In this episode, we are joined by Lorna Leonard, Managing Director of LBS, and Kirsty Maynard, Commercial Director of THSP, who are instrumental in running BedX, a group dedicated to sharing knowledge and tools to help businesses get tender ready for Universal and beyond. Listen to our roundtable discussion as we dive into why BedX was created, its main drivers, how it can support local businesses and how you can get involved. You'll learn · Who are Kirsty and Lorna? · What is BedX? · What were the main drivers behind the creation of BedX? · What are the group's main aims? · What are Kirsty and Lorna's roles within the group? · How can businesses get involved with and benefit from BedX? · What can businesses be doing now to get tender ready for Universal? Resources · Bedfordshire Chamber of Commerce - BedX · BedX Webinars · Tender Diagnostic · Kirsty Maynard LinkedIn · Lorna Leonard LinkedIn In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman and Carly Mowbray are joined by Lorna Leonard (LBSv) and Kirsty Maynard (THSP) to discuss the creation of BedX, and how it aims to support businesses with tender preparation ahead of the Universal and related projects currently underway in Bedfordshire. [01:25] Who are Kirsty and Lorna?: Kirsty is the commercial director at THSP. THSP work with businesses across health and safety, HR and compliance, helping organizations make sure they've got the right systems, processes and people in place to operate safely, professionally and compliantly. THSP have been in operation since 1992 and support any type of organisation, from construction to food brands, global luxury retailers, major transport organizations, and complex international businesses operating in highly controlled environments. Lorna is the managing director of LBS. LBS is a business solutions company supporting sophisticated start-ups and growing corporations with outsourced finance department services, direction and solutions. She set-up the business 14 years ago, and has worked with organisations of all sizes, from blue chip companies to micro businesses of only 1 or 2 people. Regular listeners may recall Lorna from a previous episode, she also shares many insightful posts on LinkedIn and is certainly worth a follow! [07:05] What is BedX? It's A business-led working group powered by the Bedfordshire Chamber of Commerce. It was created to help Bedfordshire businesses understand, prepare for and win work from the major investments coming into the region, in particular, the universal destinations and experiences, the Luton Airport expansion and other on-going linked projects. BedX's role is to connect, inform and prepare, but they don't lobby, they don't represent the developers and they don't do politics. They are simply there to help local businesses get ready. [07:45] What were the main drivers behind the creation of BedX? The Universal park is certainly the banner piece for the group. It's what all the big numbers are attached to, including 5 billion pounds worth of inward economic investment, 20,000 jobs created and the five years' worth of construction. However, that is just one part of the upcoming development going on in Bedfordshire. The big project is seeing more funding going into the area to support transport networks and other venues as investors seek to make Bedfordshire a place worth staying for more than just the Universal Park. Other projects include the expansion of the Wixams Train Station, construction at the Luton Hoo, the new Luton Town Football Club and a new Data Centre at Quest Pit. BedX was created in response to all of these projects, not just Universal. It's to help local businesses navigate these opportunities, as this small county has rarely seen such a seismic shift in the amount of investment going into the area. Even though the deadline for Universal Park is 5 years away, supply chains are looking for support now, which is why it's better to start preparing sooner rather than later. [10:20] Making Bedfordshire a play to stay: It's also not just about the venues, to prepare for the influx of tourists there will be more investment in housing and transport and related routes such as the work currently going on at the Black Cat roundabout. Kirsty states that the Bedford County Council have a scrutiny committee, which is currently labelled as the Universal Scrutiny Committee, and are in discussion about a viable tourist strategy for Bedfordshire. So, there is no doubt that there will be many more small projects going ahead within a very short timeframe to get the area ready. [12:00] How LBS's expertise is instrumental within BedX: Businesses that want to get involved may not know how to get working capital or access potential available funding, which is where Lorna's and LBS's expertise comes in to support BedX's aims. With tenders as highly valued as this, it can throw businesses through a loop if they're not prepared. Lorna shares a story where she explains that she used to work for a company that made point of purchase display equipment, this company had a US subsidiary called Anshauser-Busch, who own Budweiser. That subsidiary put through an order directly through to their factory, requesting a huge order be manufactured and delivered within 180 days. The cost of which was upwards of $2.7 million, which was due to suppliers 150 days prior to Lorna's company at the time being paid. It was their first time working with that subsidiary, so there was no guarantee on payment. The lessons they learned ended up shaping how the company operated going forward. All this to say, if you're bidding for high value contracts, you need to think about the opportunity from every perspective. [14:40] Be realistic about what you bid for: Kirsty states she is really passionate about ensuring businesses are trying to grow responsibly, so that they understand those terms in the bid and that they're realistic about the size of contract that they should be bidding for. If you're looking for more guidance in this area, Katie from Bids and Tender Support provided a webinar on this topic for BedX. It's available to view on-demand on BedX's website. [16:25] Lorna's role within BedX: Lorna reminds us that a lot of the Tier 1 contractors started out as 1 or 2 person businesses. She states that, honestly, 90% of the companies that BedX help will not be in direct contact with one of those Tier 1 contractors. However, supply chains are just that, a chain, there are many opportunities to get involved further down the line. Lorna feels as if that's a large part of her role, keeping businesses focused on the opportunities they can access within that supply chain. She is also keen to help all the local businesses understand how this is going to affect them, because whether they get involved in the various projects being built or not, the whole area is going to be affected regardless. She points out an example where they needed to source a large number of electricians, and it turns out that Bedfordshire simply doesn't have enough! So BedX is helping to make the wider community aware of training opportunities like this that can open doors for local businesses. [18:45] Other considerations for businesses operating in Bedfordshire: Lorna points out a few other concerns that people had about the on-going development in the area, including the possibility of local contractors putting prices up due to all the other projects. Timeframes may also be affected by both on-going work and the fact that more businesses will be getting involved in the area's development. [19:15] What are the group's main aims?: BedX's main aim is to be an opportunity exchange, they sit in the middle as a conduit between the opportunities and the Bedfordshire businesses and help to inform, educate and prepare to be a part of it. They are there to support preparation local businesses are able to access emerging supply chains as that waterfall flows down into tier 2 and 3 and even into 4 and 5 over the course of the project. If you're not sure which of those tiers you'd likely sit in, BedX have a helpful household checklist to find out. [20:20] Getting ISO Ready for Universal: Kirsty mentions that she's seen a lot of recent Pre-Qualification Questionnaires (PQQ's) request that bidding companies are certified to ISO 27001 Information Security. Many will be familiar with the requests for ISO 9001 (Quality Management), ISO 14001 (Environmental Management) and ISO 45001 (Occupational Health & Safety), but ISO 27001 seems to be a more recent pre-requisite. This is particularly the case for any Government contracts, with them stating either Cyber Essentials or ISO 27001 must be in place for any bidding businesses. Carly points out that ISO 27001 in many cases is just the first step, as you can strengthen this with supporting Standards such as ISO 27701 (Privacy Information Management) and ISO 27017 & ISO 27018 (Cloud Security), which can give you an advantage over your competitors. If y
Jul 22

#255 AI Due Diligence - Information Security Checks Before You Integrate AI

AI can be fantastic for relieving a lot of administrative burdens, allowing individuals to focus on more complex tasks that need a human touch. However, many are all too quick to install and integrate, which can lead to crucial vetting processes being skipped. So many applications have also integrated various AI features, and while you may have vetted the software before these were available, those new AI features still need scrutiny before widespread use within the business. In this episode, we dive into why there is a need for a more cautious approach to implementing AI and share some tips on basic Information Security checks you can do to ensure an AI application or integration is safe to use. You'll learn · The link between AI and increasing data breaches · Recent incidents as a result of AI misuse or error · Key considerations for the implementation of AI technology · 11 Information Security checks for AI tools Resources · Isologyhub · ISO 42001 Webinar · IAF Accreditation Check In this episode, we talk about: [02:25] Episode Summary – Stephanie Churchman explains the need for caution when exploring the implementation of AI tools, and provides guidance on some information security checks you can perform to ensure your data stays safe. [02:45] The link between AI and increasing data breaches: Data breaches tripled since the wide adoption of AI in early 2024 and studies are saying there is a clear link between these two events. Here in the UK alone, 32% of businesses experienced a cyber-attack or data breach in 2023, compared to 43% of businesses in 2025, with us already steadily on track to surpass that in 2026. Does this mean people shouldn't use AI at all? No, of course not, but we do need far more caution before you simply start using a tool. [03:35] Recent incidents as a result of AI misuse or error: ChatGPT copycat – There was a ChatGPT clone available as a web extension that was downloaded by some 1.5 million users. It functioned just like ChatGPT, answered queries and provided links to legit sources. But, in the background, it was scrapping passwords and gathering information that was to be sold off without users knowledge. Sage Copilot - The popular accounting software had to temporarily suspend Sage Copilot after a data-isolation flaw occurred. This incident caused an issue where users who prompted the AI to list recent invoices ended up with incorrectly surfaced financial records belonging to unrelated businesses. This was a major security issue, especially for an application thousands of businesses rely on to track their financial records. Google Gemini – Google Gemini was found to have been abused by bad actors for data reconnaissance. One particular group were building profiles on major cybersecurity and defense companies and were looking to gather specific technical job roles and salary information. Google's threat intelligence team characterized this activity as a blurring of boundaries between professional research and malicious reconnaissance. Their soft touch approach allowed the bad actors to craft tailored phishing personas and to further identify potential soft targets to compromise. [06:30] Key considerations for the implementation of AI technology: Any software or technology you plan on introducing into the business that will interact with your and your customers data should be subject to clear vetting procedures, with clear rules for use to follow. Before integrating an AI tool, ask yourself, is the tool you want to use: a) Relevant b) Safe c) Ethical Ethical may sound strange, and will depend on what you're using an AI for. Take CV sorting for example, many studies have shown that AI's can have an inherited bias based on their training data. This has also now evolved into AI based recruitment tools preferring AI generated CV's over human written ones. From a safety standpoint, think about the data you are feeding into those recruitment tools, that's personally identifiable information, full names, phone numbers, emails and possibly even addresses. A full profile for an individual. Is that system your using closed, do you know if you consented to having any input data used for further training? Don't just assume that inputted data won't be used beyond your control. If that recruitment AI tool gets hacked, who do you think is liable for the breach? Is it the AI tool developer or the business that input the data? You think the answer would be clear, but the legality of all this is still being debated. [09:10] 11 Information Security checks for AI tools: #1: Have an AI Policy and AI Integration approval process in place - Many businesses will already have an AI policy in place, most are very generic, so we recommend looking at the guidance provided by ISO 42001 to see what good looks like for an AI policy. You should also create a clear approval process that any AI tools must pass BEFORE people start using them. This should be clearly communicated to the wider team, and there should be a method to manage these checks such as a ticketing system to kick off the process. #2: Understand where your data actually goes - Find out whether inputs are used to train the vendor's models. These inputs can include prompts, uploaded files or even customer data depending on what the tool is. You also need to find out how long that data is retained, and whether it's stored in a specific jurisdiction. You can look for answers to these in a DPA (Data Processing Agreement), don't rely on the basic marketing blurb they state on the website. If those answers aren't provided, contact the tools support or basic enquiries to find out. #3: Check for a SOC 2, ISO 27001, or equivalent certification – This is an easy check for vendor's security posture. Absence of certification shouldn't automatically disqualify a vendor or tool, but it should prompt more due diligence, not less. Even with a certification in place, you also need to double check that it's valid. ISO 27001 for example will need to be certified by a UKAS accredited certification body for those in the UK. For overseas, you will have your own ISO accreditation bodies, which can be verified on the IAF website. #4: Map out third-party and subprocessor risk - Most AI tools sit on top of other infrastructure like cloud hosting, underlying foundation models and additional analytics tools. You should ask for a subprocessor list to fully understand who else touches the data. #5: Test for prompt injection and data leakage - If the tool interacts with external content such as emails, documents or web pages, it can potentially be manipulated by malicious instructions hidden in that content. Businesses should ask vendors how they mitigate this and ideally test it themselves. #6: Clarify access controls and permission scoping - This is especially the case for AI agents or tools with system integrations. You need to establish if the tool operates with the same permissions as the user, or whether it has broader access. Overprivileged AI agents may operate independently with no human oversight. 'Human in the loop' has become a common phrase within cyber security for a reason, you always need a point of human oversight to ensure the AI is doing what it's supposed be doing and is doing so safely. #7: Ask about model update and versioning transparency - You need to ensure that the vendor won't just silently swap out the underlying model for its AI tools, as this can introduce sudden behaviour changes in the tool itself. Transparency is a key component of emerging AI security frameworks and regulations such as ISO 42001 and the EU AI Act. If a vendor isn't willing to tell you when they're making major changes to their tools, then it's not a vendor you want to entertain. #8: Evaluate the output reliability and hallucination risk in context - For security-adjacent or compliance-adjacent AI tools, factually wrong outputs are a risk. AI can have a tendency to 'hallucinate' data or outcomes and then present them as fact. So, ask the vendor what guardrails exist and whether their tools' outputs are auditable / traceable. They should know what data was used to train their models, or where their models are pulling data from. If they don't or can't control what data is being used, then it's not a tool you can 100% trust. #9: Review incident response and breach notification commitments - If the vendor is breached, do you how quickly you would be notified, and what their recovery process looks like? If you hold ISO 27001 and ISO 22301, or simply have a business continuity plan in place then you will already have similar procedures in place for peace of mind for your own customers, so why should you settle for any less? And just like your clients would expect, breach notifications and expected recovery times should be contractually defined, not just assumed. #10: Consider the supply-chain risk of the vendor itself - This tech is still relatively new, and so newer AI vendors may have smaller security teams and less mature processes than what you may be used to with more established providers. However, startup pace doesn't mean you have to tolerate the start-up risk. Consider all of the previously mentioned steps, if they don't have a lot of that in place, then they may not be mature enough yet for you to go ahead with. This doesn't mean you have to automatically disqualify them, if they have a clear plan of action for growth, which shows a clear focus on increased security and transparency within a reasonable timeframe, then it's still worth considering. #11: AI tool monitoring and Kill switch – In addition to this initial vetting procedure, you should also have a process in place to continuously monitor these AI tools too. Many AI tools aren't static, th
Jul 1

#254 Driving ISO Implementation – Meet the Consultant: Emma Coxhill

The path towards becoming an ISO consultant is often a meandering one. It's not often a career that many aspire to, yet despite that, there are still thousands of ISO professionals worldwide. We're continuing with our mini-series where we introduce members of our team, to explore how they fell into the world of ISO and discuss the common challenges they face while helping clients achieve ISO certification. In this episode we introduce Emma Coxhill, an isologist® at Blackmores, to share their recent journey into the world of ISO consultancy and how they've found their first year working with other organisations to help them achieve ISO certification. You'll learn · What is Emma's role at Blackmores? · What does Emma enjoy outside of consultancy? · What did Emma do before becoming an ISO consultant? · How has Emma found her first year as an ISO consultant? · What Standards has Emma worked with so far? · Has there been any unexpected elements to her role? · What is the biggest challenge Emma has had during a project so far and how did she overcome it? · What is Emma's biggest achievement? Resources · Isologyhub · TISAX Webinar In this episode, we talk about: [00:30] Episode Summary – We introduce Emma Coxhill, an Isologist® here at Blackmores, to discuss her recent entry into the world of ISO consultancy, including how she's found working on the other side to help other organisations achieve ISO certification. [03:30] What is Emma's role at Blackmores? Her role primarily involves supporting clients in two key areas: maintaining and continually improving their existing ISO management systems and helping them establish and implement new standards. Emma specialises in information security management systems (ISMS), but is branching out to other Standards as she takes on more clients. [04:30] What does Emma do in her free time? Emma is a big fan of the outdoors, enjoying long walks and exploring in general. It makes sense then that she also enjoys gardening. While it is a lot of work, she finds the result rewarding. Emma is also a big fan of movies, excluding horror films! She enjoys making the trip to see films on the big screen when she has the chance. Lastly, Emma is also a qualified life coach. This involves guiding people to get where they want to be in life, with the crucial distinction that it's not about telling people what to do, but rather providing the right questions and tools to help them achieve their goals quicker. These skills have evidently translated well into her role as an ISO consultant, as auditing is very similar in the fact that it's about giving people a different perspective. [06:55] What was Emma's previous role? Emma previously worked in admi and retail roles, with her last job being a sales admin at a company for 13 years. She first started at that company as a sales admin, moved onto business systems and around 2019 the request for them to earn ISO 27001 certification came in. Back then ISO 27001 was a 'nice to have' and not a 'need to have' like it is today. Emma jumped at the chance to join the team working on the ISO 27001 Implementation, taking part in the research, training and implementation tasks. The company managed to navigate their certification, even through the turbulence of COVID, and Emma was the one maintaining that ISMS for the following years. During that time she also implemented TISAX, an Information Security Standard specific to the automotive industry, which you can learn more about on one of our previous webinars hosted by Emma. Sadly, Emma was made redundant in 2025, but was fortunate to join the Blackmores team shortly after. [10:10] How has Emma found her first year as an ISO consultant? It's been challenging for Emma to adjust to being on the other side of the fence, helping others to achieve certification rather than being the one to implement a system firsthand. Thankfully there was plenty of opportunity to learn during her first year with Blackmores, including expanding her repertoire of Standards and being able to learn from other experienced consultants in the team. She's really enjoying working with a variety of clients, getting to learn about different industries and how different each company is in their operations. Emma is aware that she's just scratching the surface within her first year, and is eager to learn more. [12:20] What Standards has Emma worked with so far? ISO 27001 is the main one as it's the one that Emma learned to implement from scratch at her pervious job. Since joining the Blackmores Team she's also gained experience working with ISO 9001 (Quality Management), ISO 27701 (PII Management), ISO 17100 (Translation), ISO 42001 (AI Management) and TISAX. ISO 27001 remains her favourite out of all of them, and she's keen to learn more from Blackmores own Information Security guru, Steve Mason. [14:15] Has there been any unexpected elements to her role? One of the more unexpected aspects has been helping clients navigate various acquisitions. When she joined, Blackmores had an unusual amount of clients currently in the middle of this process. Dealing with ISO management in these situations can get tricky as you're having to marry up different styles of management as two companies merge. Emma's role was in helping them to navigate that transition. She was surprised as she expected to be dealing with companies that were business as usual for years, but ISO Management is at the heart of managing these types of changes. So, it was interesting to learn how involved an ISO consultant can get into the inner workings of a business to help ease the burden for all parties involved. [17:20] What is the biggest challenge Emma has had during a project so far and how did she overcome it? Emma is still relatively fresh to implementation projects, but has found the process to be quite straight forward with the both the Blackmores 7 step methodology and support from other team members. What has been a challenge was the promotion she was tasked with for TISAX. It was a new service offering for Blackmores due to her expertise, and she was involved in recording a podcast and hosting a webinar. Both activities she'd not had any prior experience with. She doesn't think of herself as a big presenter, so it seemed like a dauting task. Emma did a lot of practice and went our of her comfort zone to do the webinar, which was positively received by the audience. The experience certainly boosted her confidence in that area, and though it was a bit stressful at the time due to nerves, she felt like it was a good learning opportunity. [19:45] What is Emma's biggest achievement? Emma has various moments throughout her life, with an early one being the fact that she passed her driving test first time at the age of 17. Later in 2005, she went solo travelling for 5 months around Australia, New Zealand and Fiji. She did end up having to work for a bit of that trip to make up some additional funds, but that was a necessary evil. Other than that, she was amazed at all the different people she met during her travels and was so pleased that she was able to complete the trip. Lastly, she's proud to have joined the Blackmores team in 2025. She's recently helped her first client achieve certification from scratch, which felt like a reward in of itself to know they'd passed their ISO assessment. If you'd like any assistance with implementing ISO standards, get in touch with us, we'd be happy to help! We'd love to hear your views and comments about the ISO Show, here's how: ● Share the ISO Show on Twitter or Linkedin ● Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one. Subscribe to keep up-to-date with our latest episodes: Stitcher | Spotify | YouTube |iTunes | Soundcloud | Mailing List
Jun 24

#253 Building The Case For Health & Safety Regulations & Standards

Everyone who goes to work should have the right to go home after work. This is a sentiment that wasn't necessarily formally recognised until the 1970's here in the UK. Health & Safety often gets mocked for overly cautious or seemingly onerous tasks to meet certain regulations and Standards today, however these are in place for a reason. They save lives, plain and simple. In this episode, Ian Battersby makes the case for Health & Safety regulations, including why they were introduced, events that sparked the conversation for workplace safety and the impact regulations have had since their introduction. You'll learn · The decline in ISO 45001 adoption · The Health and Safety at Work Act · How much difference has this Act made since its introduction? · How do the US and UK differ in their approach to safety regulations? · What events led to the creation of safety regulations in the UK? · Addressing broader health and safety risks – illness and long-term damage as a result of work · How to make health & safety manageable Resources · HSE · ISO 45001 Support · Isologyhub In this episode, we talk about: [02:05] Episode Summary – Ian Battersby makes the case for modern Health & Safety regulations, sharing why they were introduced, how they've impacted workplace safety statistics and how you can make health & safety more manageable. [03:30] The decline in ISO 45001 adoption – From our standpoint as consultants, there has been less adoption of ISO 45001 when compared to other Standard such as ISO 9001 or ISO 27001. In years previous, it was a common Standard to implement either with or straight after ISO 9001. There are a number of reasons for this, including: · The appetite for ISO 45001 has reduced in favour of newer Standards · Supply chains not proposing it as a requirement · Our particular client base feel they are low risk in their respective industries To be fair, health and safety does get a bad reputation for being overbearing. It's been subject to many attacks from various media and lobbying groups, however, it's necessary to ensure we all stay safe at work. Let's look at some history… [05:00] The Health & Safety At Work Act: This act received Royal Assent in the UK on 31 July 1974, and came into force on 1 April 1975. To an extent it replaced and improved upon previous laws covering separate industries and activities: Factories, Mines & Quarries, Agriculture, etc It was enacted in response to a recognition that, although conditions for workers had improved over the century, there was still completely unnecessary harm being caused to many in the country's workforce. This is also the point when the Health and Safety Executive was formally established to enforce the law. It also provides a wealth of guidance to businesses, so we highly recommend checking out their website. They also have the legal duty to collect consolidated data on workplace injuries for the UK, and have provided an annual report since it's inception in 1975. [07:45] How much difference has this Act made since its introduction? In the year to 31/03/1975 when consolidated data was first recorded there were 651 deaths at work. The equates to more than 2.5 deaths in a single year per 100,000 workers. Comparatively, in 2024/25 124 people died in work, and while that's 124 too many, it's a big improvement. The rate per 100,000 workers is now 0.37, and you have to bear in mind that the workforce has grown, but overall that's a reduction of over 85%. [09:10] How do the US and UK differ in their approach to safety regulations? The Occupational Safety and Health Administration (OSHA) serves similar purpose in USA as HSE, but they have important differences in approach and independence. The HSE is independent of government to an extent and has no ministerial control, whereas OSHA sits within the Dept of Labor. It can also be argued that the OSHA approach is prescriptive in setting rules whereas HSE follows the more outcome-based principles of HASAWA: to reduce risk "so far as is reasonably practicable", which some argue is more sophisticated and produces better results. OSHA has also seen its powers to intervene, investigate and enforce curtailed at times due to certain political interests. Looking at the numbers, the US Bureau of Labor Statistics published fatality rates for 2024: Census of Fatal Occupational Injuries: There were 5,070 fatal work injuries recorded in the United States in 2024, down 4.0% from 5,283 in 2023. The fatal work injury rate was 3.3 fatalities per 100,000 full-time equivalent workers in 2024, a decrease from 3.5 in 2023. That rate is notably higher than Great Britain's — 3.3 per 100,000 versus 0.37 — though the two figures aren't directly comparable. The BLS uses full-time equivalent workers as the denominator and covers a broader range of incident types, while the HSE's RIDDOR series uses a headcount of all workers and has specific exclusions (road traffic accidents, air and sea travel, etc.). The methodological differences mean a like-for-like comparison requires some care. [13:35] What events led to the creation of safety regulations in the UK? In the days of Victorian Britain, it's difficult to view the common working man, woman AND child as anything other than a commodity. Thousands died every year in industrial accidents during this era, and large-scale accidents in many industries weren't uncommon. Mining was particularly tragic, a few events include: · The Oaks Colliery explosion of 1866 killed around 360 men and boys. · Hartley Colliery in 1862 trapped and killed 204 miners when the single shaft collapsed (but individual deaths from falls, gas explosions, and equipment failures happened constantly and attracted no particular attention) · The Abercarn Colliery explosion in Monmouthshire (1878) killed 268 men. · The Albion Colliery explosion at Cilfynydd in Wales (1894) killed 290. These were not exceptional events, they were part of a continuous toll. In the 1860s alone, over 1,000 miners died annually in Britain. Textile mills, ironworks, shipyards, and construction sites all had very high casualty rates. Factory machinery had no guards. Children routinely worked in spaces too small for adults, climbing inside machinery to clean it while it was still running, or crawling under looms. Mill workers lost fingers, hands, and arms with regularity. The end of the Victorian era saw attempts at regulation, but without true enforcement. The Factories Act didn't appear until 1933 and it was bitterly opposed by many owners of mines and mills. Modern regulations exist today to prevent the tragedies of the past from happening again, they were hard fought for by workers and lobbyists, and in some ways we're still fighting to include the broader impacts work can have on an individual. [16:45] Addressing broader health and safety risks – This is in relation to harm accumulated over a lifetime of work with long-term and often fatal consequences. The suffering caused to workers exposed to hazardous conditions is immeasurable. For example, let's look at asbestos. The dangers of working with asbestos were recognised remarkably early, as far back as 1890s in France, and Asbestosis was formally recognised in 1930. This led to regulation in 1931, but only applying to the asbestos textile industry, excluding all the industries where its use was widespread such as construction, shipbuilding, anyone working in insulation etc Worse still, it wasn't even enforced! Then take mesothelioma, the distinctive and almost invariably fatal cancer of the lining of the lungs and abdomen. The connection between asbestos and mesothelioma was established in SA in 1960 when mining blue asbestos. Further research in the UK firmly established the link in the 60s. From the mid-60s, headlines were being made nationally when shipyard workers from the war era stared dying in large numbers. Unions began lobbying for protections and media coverage continued for years as cases multiplied across several areas and industries. Nevertheless, its manufacture and use continued. The Asbestos (Licensing) Regulations 1983 introduced licensing for the most hazardous asbestos removal work. Blue asbestos (crocidolite) was banned in 1985, followed by brown asbestos (amosite) in 1986, though white asbestos (chrysotile) remained legal until 1999. In the interim and since then thousands of people died and multiple legal cases have ensued. 2218 people died of mesothelioma alone in 2023. Altogether it's estimated that workplace-related lung disease and cancers kill as many 13000 per year in the UK. Several thousand more are known to die of non-lung-related occupational diseases each year, but these aren't recorded as workplace deaths on certificates, so these people aren't included in HSE annual reporting. It doesn't stop at deaths either, there is an argument for the detriment that certain work can have on quality of life. Incidents and conditions such as: · accidents causing amputation and fracture · eye conditions from welding and other light sources · Deafness and hearing difficulties · HAVS, vibration white finger · Skin conditions from exposure · Musculoskeletal in low risk environments None of these are terminal and so often go unreported. [23:25] How to make Health & Safety manageable – Some consider modern health and safety regulations to be over the top, but overarching law in the UK has the principle 'As Far As Is Reasonably Practicable'. One common area is in risk assessment, The Management of Health and Safety at Work Regulations states: "Every

4

out of 5

2 Ratings

Blackmores is a pioneering consultancy firm with a distinctive approach to working with our clients to achieve and sustain high standards in Quality, Risk and Environmental Management. We'll be posting podcasts discussing ISO standards here very soon!

Creator

Blackmores UK
Years Active

2019 - 2026
Episodes

200
Rating

Clean
Copyright

© All rights reserved
Show Website

The ISO Show

Politics

Politics

Updated Semiweekly