Resources
Case studies
Four certifications in detail, including the findings that were uncomfortable. A case study where nothing went wrong is a case study that has been edited.
About these case studies
Client names are withheld and the studies below are presented as samples pending written consent from the organisations concerned. The technical detail, findings and outcomes describe the kind of work these engagements involve. Named studies with verified figures will replace them as consent is confirmed.
Automotive · IATF 16949 + ISO 14001
From OEM audit failure to IATF certification in nine months
A precision machining supplier lost a supplier scorecard rating after two customer escapes. IATF certification was made a condition of continued nomination.
The challenge
Two field escapes in twelve months had triggered a customer-imposed containment regime and a supplier scorecard downgrade. The organisation held ISO 9001 but its FMEAs had not been revised since initial part approval, control plans did not reflect current process settings, and MSA had never been performed on the CMM used for the critical characteristics.
What we did
- Stage 1 identified that the FMEA-to-control-plan linkage was the root of both escapes
- The organisation revised all process FMEAs with cross-functional teams including operators
- Control plans were rebuilt from the revised FMEAs with reaction plans defined for each characteristic
- MSA studies were completed across all gauges in the control plan, two of which failed and were replaced
- SPC was implemented on the four critical characteristics with capability studies establishing a baseline
- Contingency plans were developed for power interruption and single-source supplier failure
Results
- 0customer escapes since certification
- 1.67Cpk on critical characteristics, from 1.02
- 9 monthsfrom Stage 1 to certificate
- RestoredOEM supplier scorecard rating
The MSA finding was uncomfortable. Two of our gauges could not measure what we were using them to accept, and we had been shipping on that data for two years. We would rather have found it in an audit than in a warranty claim.
IT & ITES · ISO 27001:2022 + ISO 27701
Enterprise security review cut from eleven weeks to four days
A growing SaaS company was losing enterprise deals at the procurement stage, not the technical one. Security questionnaires were consuming senior engineering time.
The challenge
Each enterprise prospect issued a bespoke security questionnaire of 200 to 400 questions, answered by the CTO and two senior engineers. Average time from questionnaire receipt to security sign-off was eleven weeks, and two deals had been lost to competitors who held certification.
What we did
- Scope defined narrowly around the production platform and supporting functions, deliberately excluding the corporate IT estate in year one
- Risk assessment conducted against the 2022 Annex A structure from the outset
- Asset inventory surfaced fourteen unmanaged cloud accounts and access still active for eleven former staff
- Joiner-mover-leaver process rebuilt with quarterly access review
- ISO 27701 added concurrently to answer the data processing agreement questions the same customers were asking
- Incident response plan exercised twice before the Stage 2 audit
Results
- 4 daysaverage security review, from 11 weeks
- 14unmanaged cloud accounts identified and closed
- 2standards certified in a single audit programme
- 3enterprise deals closed in the following quarter
We expected to buy a certificate that unblocked sales. What we did not expect was finding eleven ex-employees with live production access. That alone justified the exercise.
Food & Beverage · FSSC 22000
GFSI recognition achieved in time for a national retail listing
A regional food manufacturer secured a national retail listing conditional on GFSI-recognised certification within seven months.
The challenge
The organisation held HACCP certification, which the retailer would not accept — the listing required GFSI recognition, meaning FSSC 22000. The existing hazard analysis had been prepared by a consultant and the process flow diagram did not match the plant as built. Allergen changeover cleaning had never been validated.
What we did
- Process flow diagrams reverified on site, revealing two rework loops absent from the documented flow
- Hazard analysis rebuilt with the food safety team, correctly separating OPRPs from CCPs
- Prerequisite programmes upgraded to ISO/TS 22002-1 requirements
- Allergen changeover cleaning validated by swab testing at defined points
- Mock recall exercised twice, with mass-balance reconciliation completed within four hours
- Environmental monitoring programme established with trend analysis
Results
- 7 monthsfrom gap assessment to certificate
- 4 hoursmock recall mass-balance reconciliation
- Securednational retail listing
- 2undocumented rework loops identified and controlled
The flow diagram verification found two rework loops nobody had documented. Both were plausible allergen carry-over routes. That is exactly the kind of thing you cannot find from a desk.
Construction · ISO 45001 + ISO 9001 + ISO 14001
Integrated certification across eleven active sites
An EPC contractor needed all three standards to qualify for PSU tenders, across sites that were opening and closing continuously.
The challenge
Eleven active project sites across four states, a workforce that was 80% contracted, and a certification scope that changed every quarter as projects completed. Head office had a functioning system; sites had a copy of it in a folder.
What we did
- Multi-site sampling scheme agreed with a defined site-rotation plan across the certification cycle
- Site-level system reduced to a working set of documents that could realistically travel with a project
- Contractor selection, induction and permit-to-work rebuilt as the primary safety control
- Site safety representatives appointed with a genuine worker consultation mechanism
- Integrated internal audit programme covering all three standards in one site visit
- Stage 2 conducted across a sampled subset of sites during active work
Results
- 3 standardscertified in one integrated audit programme
- 11 sitescovered under a multi-site sampling scheme
- 41%reduction in reportable incidents over 18 months
- Qualifiedfor PSU tenders requiring all three certifications
The auditor spent the first morning on site with the permit-to-work system and the contractor gate register, not in the site office. We had never been audited that way before.
Next step
What would yours look like?
Tell us your sector, your scope and the pressure driving certification. We will tell you honestly what the work involves and how long it takes.