Compliance belongs in the daily work, not on a shelf

Summary

Many organisations treat ISO 9001 and business continuity as documents to show an auditor. The controls that protect an organisation are the ones built into the daily work: a supplier that has not passed its checks cannot receive a purchase order, however urgent the request.

The problem

Organisations invest real time and money in business impact analyses, risk registers and continuity plans. The documents are written, approved and filed. Then the daily work carries on around them.

A purchase is approved in a WhatsApp group to save time. A supplier is paid before its documents have been checked. A policy changes, and the people who apply it hear about it weeks later, if at all. None of this shows in the documents, which still describe the process as it was designed.

The cost appears in three places. Audits become projects, with weeks spent collecting evidence by hand before each visit. Exceptions go unnoticed until they become losses, penalties or audit findings. And the board believes the controls are working because they exist on paper, when nobody can show that they operate.

Compliance treated as a department produces documents. Compliance built into the work produces evidence.

What was done

We start with the processes where a failed control costs most, usually purchasing, payments and supplier onboarding, and follow the Praxis Method.

1. Compare the policy with the practice. For each process we set the written procedure next to what really happens, step by step, and list every place where the two differ.

2. Turn each control into a rule the system can check. Who may approve, and up to what amount. Which documents and checks a supplier needs before it can be paid, including identity and anti-money-laundering checks. What happens when a site, a system or a key supplier is unavailable, and who decides.

3. Build the rules into the work. A purchase order cannot be raised for a supplier whose checks are incomplete. Approvals above a limit go to a second person. An exception is possible only with a recorded reason, and every change is logged. The continuity plan lives in the same system, with its contact lists and fallback steps kept current.

4. Keep the evidence as you go. Audit evidence becomes a report the system produces, not a project. We train the teams who apply the controls, review the exceptions with management each month during the first cycles, then hand over.

The result

Audit evidence comes from the system’s own records, exceptions are visible when they happen, and the board can see which controls operate instead of assuming that they do.