Steph Churchman, Author at Blackmores

The Energy Savings Opportunity Scheme (ESOS) is a legal requirement for organisations of a certain size or value. The scheme is designed to make companies look at how they use energy with a view to improving performance. If your organisation qualifies for ESOS, you have until December 5^th to comply or complete your phase 3 reporting.

Over the last few episodes we’ve explored two routes to compliance: Energy Audits and ISO 50001. As we explained, ISO 50001 goes above and beyond ESOS requirements and ensures you don’t have to gather an evidence pack every four years to prove compliance.

However, there are many more benefits to ISO 50001 than just it’s compliance with ESOS requirements. Join Mel this week as she dives into the other benefits ISO 50001, including real world examples from some global brand names.

You’ll learn

Why Implement ISO 50001?
What are the benefits of ISO 50001?
Who has found success with ISO 50001?

Resources

In this episode, we talk about:

[00:35] Watch our previous episodes to learn more about Energy Audits and ISO 50001

[01:41] Benefit #1: Cost savings – By Improving your energy efficiency and reducing energy consumption, you can save a startling amount. ISO 50001 helps you to put a system in place that will allow optimisation of your energy usage.

[02:20] Benefit #2: Compliance – ISO 50001 can help you comply with the likes of ESOS and SECR. Carbon reporting and legal requirements in relation to it are global, any countries lagging behind on these requirements will soon adopt or create their own in response to the limited time we have left to reduce the effects of the climate crisis.

[02:45] Benefit #3: Reduce your environmental Impact – By reducing energy usage and switching to more energy efficient means, you will reduce your carbon emissions. ISO 50001 also acts as a complementary tool to ISO 14001 (Environmental Management) that many already have in place.

[03:10] Benefit #4: A coordinated approach – Companies, especially large ones, may have multiple systems in place to manage energy. ISO 50001 helps to create a universal framework that can be applied to a whole business.

[03:25] Benefit #5: External Incentives – There may be external benefits that can be gained by proving that you are taking steps to reduce your environmental impact. This could include tax benefits, insurance ect

[04:25] Benefit #6 Informed funding – There is a lot of funding out there to help companies with new green technology. Having ISO 50001 in place will give you a consistent overview of your energy usage, so you’ll be able to make informed funding choices based on where more savings can be made in terms of emissions and general costs.

[04:55] Benefit #7 Track Objectives – ISO 50001 can help you set Objectives and then set policies and procedures to help make those a reality. Those familiar with ISO Standards will know that it’s all about continual Improvement, so you’ll always be making progress.

[05:30] Benefit #8 Credibility – ISO 50001 is an internationally recognised Standard, and is a mark of your credibility. This can be used in marketing materials, displayed on your website, used in Case Studies ect.

[06:35] You don’t have to be a large brand or organisation to Implement ISO 50001. It can be implemented for a business of any size where energy is a significant environmental Impact.

[07:05] Hilton’s success with ISO 50001: One of the world’s largest hotel chains, Hilton was the first global hospitality company to achieve portfolio-wide certification to ISO 50001. The savings have been significant, reducing Hilton’s energy intensity by 20.6% and its carbon intensity by 30.0% from a 2008 baseline.

[07:55] Bentley’s success with ISO 50001: Reduced energy usage by two-thirds for each car produced and by 14% overall for the entire plant, delivering savings of 230 GWh of energy – enough to power 11,500 houses for a year!

[09:37] Hitachi’s success with ISO 50001: Following the Japanese earthquake disaster in 2011, Hitachi decided to introduce “the smart next-generation factory plan”. Following implementation of ISO 50001, the plant reduced 23 % of the contract electricity, 15 % of CO2 emissions and 5 million yen/month of electricity costs.

[10:12] Toyota’s success with ISO 50001: Implementation of ISO 50001 resulted in a reduction in electricity usage which has translated into cost-savings of more than R4.8 million (Over £210,000!) over a two-year period. The company also generated energy savings of GWh 8.15 across its 14 plants, and reduced its GHG emissions by 7,804 tons.

[10:50] Schneider Electric’s success with ISO 50001: The company adopted ISO 50001 certification in order to maximise energy performance. Following the certification, the business’ energy performance increased by 10.5%, with savings totaling £26,500 over 3 years.

[12:15] Want more info on ISO 50001? – Head on over to the isologyhub to get access to a wealth of ISO 50001, and energy management tools

For those interested in ISO 50001, we’re offering a free copy of the Standard to anyone who signs up for Implementation with us before the 16^th June.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Last week Mel explained the Energy Audits route to compliance, which is a process that must be repeated every 4 years. Companies that want to avoid the inevitable rush to get reports submitted before the deadline may want to consider a more long-term commitment to ensure continued compliance, that being the Implementation of ISO 50001.

ISO 50001 is the standard for Energy Management, and it goes above and beyond what is required of ESOS. Companies certified to this standard are already considered compliant to ESOS with out the need to complete any additional reporting outside of what is already monitored and measured by the standard.

Join Mel this week as she explains what ISO 50001 is, how it complies with ESOS requirements and the key differences between other environmental standards such as ISO 14001.

You’ll learn

What is ISO 50001?
How ISO 50001 complies with ESOS?
What is the difference between ISO 50001 and ISO 14001?

Resources

In this episode, we talk about:

[00:50] Watch our previous episode to learn more about Energy Audits

[01:00] Reminder: Companies certified to ISO 50001 do not have to carry our Energy Audits.

[01:14] What is ISO 50001? This is the Energy Management Standard, a globally recognised best practice framework designed to help manage a companies energy performance, optimise their energy efficiency and reduce their overall impact.

[01:50] Why have a Standard for Energy Management? This standard is most appliable for businesses who are looking to put measures in place to reduce their overall environmental impact, specifically in relation to energy management. Businesses who operate data centers or large healthcare facilities will use a lot of energy, many Implement ISO 50001 to help reduce their costs for energy.

[02:48] Why Implement ISO 50001 if you already have ISO 14001? – ISO 50001 is specifically aimed at the energy aspect of environmental impact. It helps businesses to take a deeper look at their operations and how their managing energy performance. If you already have ISO 14001, you’re already half-way there, and ISO 50001 could easily be integrated as an enhancement to your Management System.

[03:25] If you want to claim ESOS compliance, it’s important to ensure that your ISO 50001 certification is valid for the compliance date.

[03:50] If you want to go down the ISO 50001 route, the time to act in now (April / May 2023) – You will need to factor in a minimum of 6 months to Implement ISO 50001. Need help with this? Contact us!

[04:40] There has been an increase in uptake of ISO 50001, which has put a lot of UK certification Bodies under pressure to get Assessments booked in before the ESOS deadline. So get in touch with a few UKAS accredited Certification Bodies ASAP to find out if they can accommodate you in an appropriate time frame. We offer a quote request service for free, simply contact us for more info.

[05:50] More about ISO 50001 – It’s based on the Plan-Do-Act-Check cycle, which is a familiar structure to a lot of ISO’s. Many aspects of ISO 50001 Implementation will be similar to the likes of ISO 9001, i.e. having policies and procedures in place and conducting Internal Audits ect.

[06:34] How does ISO 50001 differ from ISO 14001? – The main difference is the requirement for an Energy Review. This is all about understanding how you’re using energy as an organisation, then using that information to recommend controls to reduce energy use.

[07:43] You will be able to determine your Energy Performance Indicators following on from an Energy Review. These help to establish a clear roadmap and energy controls for reducing energy usage. For example, you could put controls in place for certain equipment, LED light replacements, cycle to work or car share schemes ect.

[08:45] What is the benefit of ISO 50001 over Energy Audits?: ISO 50001 puts a whole system in place to continually Improve your energy performance through controls and procedures. Energy Audits will only tell you about your current energy use and provide recommendations for Improvement with no clear roadmap or further incentive to Implement those changes.

[09:00] What else is involved with ISO 50001?: Another key aspect of ISO 50001 is the continued monitoring and measurement of energy performance. This can then be reported back to the board so they can see the progress being made.

[10:00] What are the key clauses in ISO 50001? ISO 50001 went under a revision in 2018 to align itself with Annex SL, which is common across a lot of other ISO’s. The 10 clauses are as follows:

Clauses 1,2,3 – Explanatory clauses. You won’t Implement these, they simply provide context and help with key terms and definitions.
Clause 4 – Context of the Organisation
Clause 5 – Leadership
Clause 6 – Planning
Clause 7 – Support
Clause 8 – Operations
Clause 9 – Performance Evaluation
Clause 10 – Improvement

[11:00] Want more info on ISO 50001? – Head on over to the isologyhub to get access to a wealth of ISO 50001, and energy management tools

For those interested in ISO 50001, we’re offering a free copy of the Standard to anyone who signs up for Implementation with us before the 16^th June.

Tune in next week where we explore the many benefits of Implementing ISO 50001.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s

Over the next few weeks, we will focus on how you can comply with ESOS, starting with Energy Audits. These audits are required by ESOS in order to understand where and how energy is used within the organisations premises and operations. Every audit will recommend cost-effective measures that will save the organisation energy and money, which is the ultimate intention of the legislation.

Join Mel this week as she explains what Energy Audits are, what data you need to report on and what final sign-off is required before a report is submitted.

You’ll learn

Who needs to comply with ESOS?
How can you comply with ESOS?
What are Energy Audits?
What data do you need to gather?
Who needs to sign-off the ESOS report before submission?

Resources

In this episode, we talk about:

[00:44] The deadline for Phase 3 ESOS reporting is the 5^th December. Remember that ISO 50001 is considered a route to compliance if you don’t want to go ahead with conducting Energy Audits.

[01:32] What is ESOS? ESOS stands for the Energy Savings Opportunity Scheme. It was launched by the department of energy and climate change, Deck, back in July 2013. It was established to comply with Article 8 – an EU directive that was created in 2014. Despite Brexit, any qualifying businesses must still comply. ESOS in simple terms is an energy assessment that must be carried out by its definition of large enterprises.

[02:50] Who qualifies for ESOS? Large enterprises as defined by ESOS are businesses that have more than 250 employees and / or an annual turnover exceeding 50 million euro or a balance sheet exceeding 43 million euro. This only applies to the private sector – the public sector is exempt.

[03:33] When does ESOS reporting occur? Every 4 years – The first phase staring in 2014, Phase 2 was in 2019 and Phase 3 will have it’s deadline this year.

[04:08] Why is ESOS important? – No matter where you are in the world, energy reduction is crucial. Businesses should also be well aware of their own energy use and impact, not only to reduce but hopefully offset as part of ongoing sustainability efforts.

[04:35] It’s estimated that there will be a net benefit of £1.6 billion as a result of ESOS to the UK alone.

[04:55] What do you need to do to comply with ESOS? An ESOS assessment requires you to do 3 things:

Measure your total energy consumption
Conduct Energy Audits – to identify cost effective energy reduction recommendations
To report compliance back to the Environment Agency (For the UK, other European countries will have their own authority)

[05:42] How can you comply with ESOS? – There are 2 routes to compliance:

Conduct Energy / ESOS Audits
Implement ISO 50001 – Companies certified to this standard are already complying with ESOS, as it goes above and beyond ESOS’s requirements.

[07:20] What’s involved in an ESOS Energy Audit? – You will be required to collect 12 months of energy data, provide cost effective energy reduction recommendations for the areas audited in scope, and findings need to be reviewed by an ESOS Lead Assessor.

[08:00] What do you need to consider when collecting data and looking at where reductions can be made? – Facilities – i.e. heating, lighting, ventilation ect. There are a number of energy efficiency initiatives to help reduce costs involved with elements of facility management. It can be something simple like replacing old boilers, using energy efficient Led lighting, reducing working hours in the office, reviewing time settings for lighting, ventilation and heating ect. Many businesses leave unnecessary functions and devices on overnight, start looking at how much energy you’re using and where, and you’ll be able to identify where energy use and costs can be cut.

[10:20] Other things to consider are additional warehouses or transportation within your business i.e. fuel consumption, vehicle maintenance ect.

[10:53] To truly make a difference, you need to spread awareness within your business about any changes you’re making as a result of these energy audits. Including any reminders to them i.e. turning off lights when they leave a premises.

[11:05] What do you need to do to carry out an ESOS Energy Audit?:

You need to plan the audit – including establishing the scope
Conduct the audit
Collect data for analysis and identify the opportunities for improvement
Pull together all the documentation in an ESOS evidence pack which will be reviewed and signed off by top management and an ESOS Lead Assessor
Finally, you can submit that evidence pack to the Environment Agency

If you need help with any of this – Blackmores can help 😉

[11:45] What are the different data sources you should look at? Meter reading records, delivery notes, automatic meter readings ect. We find that the financial team and facility managers are instrumental in gathering the necessary data. Don’t forget to gather any travel information from your drivers or vehicle fleet managers!

[12:31] Establishing the scope and documentation – You will need to set the scope and boundaries of the audit, document the methodology for your data collection and recommendations for improvement, document your data sources and identify any gaps.

[13:00] Final sign-off: Once everything has been documented in an evidence pack, you need to get this signed off by a director or member of top management and by an ESOS energy assessor. Once done, you can submit this to the Environment Agency

Tune in next week where we explore the ISO 50001 route to ESOS compliance.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Sustainability should be a top priority for any business going into 2023. The last few years’ worth of extreme weather have proven that action needs to be taken now to protect our future. But where do you start?

While there are a lot of great ideas out there, it’s becoming increasingly clear that a standardised approach is needed to keep everything on track. Which is where ISO Standards come into play – having been promoted heavily at the last few COP conferences, there are a whole range of environmental Standards to help businesses manage and reduce their impact.

One of the most popular being ISO 14001 (Environmental Management), which was adopted by the subject of today’s interview – dotdigital.

dotdigital is an online marketing company who specialise in email and SMS marketing automation, tailoring customer experience and providing solid data analysis tools.

Mel is joined by Steve Shaw, Chief Product & Technology Officer at dotdigitial, to talk about the positive impacts following on from their successful ISO 14001 implementation, and to explain some of their fantastic sustainable initiatives introduced over the past few years.

You’ll learn

Who are dotdigital?
How do dotdigital manage their Environmental Management System?
What are dotdigital’s sustainable initiatives?
What have they learned through the implementation of ISO 14001?

Resources

In this episode, we talk about:

[01:07] Listen to our previous interview with dotdigital – where we discussed their ISO 27001 (Information Security) certification.

[01:32] An introduction to Steve Shaw – He is the Chief Product & Technology Officer at dotdigtal, who oversees a lot of their innovators (which comprises of software engineers and those involved with product development and support). He also manages the various acquisitions for the group.

[03:15] Who are dotdigital? Dotdigital have been around since 1999, they have evolved and adapted to join the growing SaaS market. They provide a range of automated marketing solutions in addition to a customer experience and data platform. They recently celebrated reaching 400 employees and have become AIM listed.

[03:52] What can dotdigital’s platform do? Data collection and analysis to build a profile for single or groups of users. This data can then be used in combination with AI and machine learning to create a tailored digital journey with a brand.

[05:15] How do dotdigital manage their current ISO 14001 certified system? – Their Management System is an integrated Management System, which provides the business with a central hub to work from. They have an established team who are tasked with the management of their ISO system (this is not a dedicated role for anyone in that team). Part of their role involves looking at the businesses aspects and impacts to see where the biggest consumption of energy is happening, measuring this consumption and setting objectives to help reduce this where possible.

[06:51] dotdigital was the worlds first carbon neutral marketing automation platform that was ISO 14001 certified. They also aim to be net zero by 2030!

[07:10] They have a relatively small footprint as a primarily digital based company, only really having to consider the running of computers, air conditioning and standard office facilities. So it can be a challenge to reduce!

[08:30] What led to the success of dotgreen? – dotdigital launched a group called dotgreen, which has since thrived into a community of likeminded individuals all working together to improve and reduce dotdigital’s impact. They were fortunate to have an Executive group sponsor who can take ideas and suggestions to other leadership for consideration. This grassroots group encourages suggestions from everyone – no idea is a bad idea. Over time, the group evolved and helped to develop a sustainability programme for the business.

[10:30] What was one of the initiatives implemented from dotgreen? – They identified that existing data centers used by the business weren’t always utilising renewable energy. So, over the course of 2 years, they worked with Microsoft to build on their Azure platform to enable dotdigital to make the switch. Azure runs on renewable energy sources, and any remaining emissions can be offset through carbon credits.

[12:00] A green option for their customers – As a result of their cloud platform now being run through green partners, they can extend the environmental benefit to their customers.

[14:00] A sustainable culture shift – The introduction of dotgreen, it’s initiatives and the success of certification to ISO 14001 fostered a shift in the businesses culture. It spread to all aspects of the business – even resulting in their marketing team making the decision to not send out Christmas gifts and instead used the money to buy credits for tree planting.

[15:25] What is dotvoice? – Another pillar in the internal mechanisms of dotdigital. This voluntary group look at how they can promote awareness of different issues. One such example was organising interviews to celebrate the women in tech at dotdigital for International Women’s Day.

[17:10] Adapting – Like many businesses, they had to adapt over Covid to allow for home working. Following on from feedback, they have kept up with hybrid working. This means that meeting in-person usually becomes a big event! They ensure that all employees are taken care of, even creating another pillar called dotwellbeing to offer mental health support.

[21:53] Through the use of dotgreen and dotvoice, they promote voluntary days to assist with local initiatives and charities (many of which are their clients – such as the Woodland Trust).

[23:20] What have dotdigital learned over the years of maintaining an ISO 14001 certified system?

Don’t rush for certification if it can be helped, take the time to put the right people and resources in place to start the process.
It can be beneficial to enlist the help of a third party to guide you through your first Implementation.
ISO 14001 helped to put tools in place to measure aspects and impacts – which in turn assisted with their SECR requirements
Manage your system centrally. ISO Standards should be embedded into the business

[23:20] Steve’s top tips: Get leadership support, look for passionate individuals to get involved, let the Standard guide you and don’t be afraid to set lofty goals.

[23:20] Steve’s book recommendation: Creativity Inc – by Ed Catmull

[23:20] Steve’s favorite quote: “The only constant in life is change” / “Some people want it to happen, some wish it could happen and others make it happen”

You can find out more about dotdigital via their website.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s

With the pandemic being the driving force behind more remote working than ever before, health and safety professionals are becoming increasingly tech-savvy. All evidence points to them increasing their reliance on Software as a Service (SaaS) solutions to keep on top of H&S compliance and the ever-changing risks that are presenting themselves to businesses the world over.

Companies such as Riskex offer many software solutions to make Health and Safety Professionals’ lives easier, by streamlining compliance processes, gathering better safety data and providing total visibility on the performance of risk management. As a result, they keep a keen eye on new technology being adopted by the H&S sector.

Mel is joined by James Sharp, Chief Technical Officer at Riskex, to explain the top 10 emerging Software as a Solution trends in Health and Safety.

You’ll learn

Who are Riskex?
Why are people leaning towards SaaS?
What are the top 10 emerging SaaS trends in health and safety?
What solutions do Riskex provide?

Resources

In this episode, we talk about:

[01:40] An introduction to Riskex and James Sharp’s role as Chief Technical Officer there.

[02:51] What is AssessNET? AssessNET is an online Health and Safety / Risk Management System designed to help streamline compliance processes and make gathering data much easier.

[04:00] Riskex have been certified to a number of ISO Standards, including ISO 18001 (Prior Health and Safety Standard, now certifying to the latest version, ISO 45001), ISO 27001 (Information Security) and ISO 9001 (Quality Management)

[06:20] Software as a Service became very popular during Covid, as business became very fragmented and were looking for solutions that could be rolled out across multiple sites. Riskex also created their own track and trace system based on established software they were already offering – helping businesses manage Covid safely.

[08:40] Trend #1 – Artificial Intelligence – Artificial learning is all around us and with vast volumes of data being collected by safety management platforms. AI allows decision engines to predict and provide guidance based on key trends or established KPI’s. For example, if accident rates were to increase but at the same time risk levels have been reducing, it could soon highlight this trend and look at other surrounding data or previous trends to establish a pattern. This will lead to a more pro-active approach to reporting and subsequent decision-making.

[10:35] Trend #2 – API Connectivity – Providing an open API platform will allow businesses to integrate internal systems and external services to digest data. As more organisations adopt Cloud solutions, connectivity between platforms has become increasingly important. With a robust API offering, multiple business services can interact with ease and become part of the safety management space, without incurring significant cost or time.

[11:50] Trend #3 – Low-Code Optimisation – Developing generic components within software to allow for quicker builds, implementations and tailoring requests. As stand-alone and generic component development increases, solutions can offer more flexibility and self-serve options to the end user to assist them with aligning platforms with their specific processes.

[13:30] Trend #4 – Mobile Optimisation – More and more end-users are accessing health and safety software via their mobiles but for various reasons, are not always able to use native apps (installed on the device). Therefore, health and safety software platforms need to adapt use on multiple devices, without the loss of features.

[14:45] Trend #5 – Vertical SaaS – Configuring EHS Software to align with the specific risks, terminology and processes that are pertinent to a given sector. As systems continue to grow in terms of sophistication and the ability to customise, so does the need to ensure that they remain User-friendly. A key factor to consider is that each industry has its own set of industry codes of practice, regulations, hazards and risks – and EHS systems need to be designed with these in mind.

[15:50] Trend #6 – White Labelling – Integrating 3rd party EHS platforms into a client’s corporate brand identity. When it comes to optimising User engagement and embedding technology effectively into business operations, it is important that the look and feel of the system interface is aligned with an organisations branding, company values and mission to create a more cohesive User experience. Riskex have embraced this by offering ‘FreshNet’ to clients, which can be tailored and aligned with clients existing branding.

[17:10] Trend #7 – Centralised Analytics (BI) – Robust Health and Safety management systems rely on an abundance of performance data arising from core processes – Risk Assessments, Audits, Contractor Governance, Incident Management and so on. The sheer volume of information generated by these processes can provide a wealth of positive opportunities to improve safety outcomes, if analysed correctly – which is where BI platforms come in to help provide an overall picture of risk performance management.

[19:40] Trend #8 – Micro-SaaS – Deploying discreet elements of a SaaS platform to work as standalone entities to fit a specific customer requirement. Modular-based solutions or smaller SaaS platforms can meet the needs of those organisations that may only require a specific feature, not necessarily a holistic service.

[20:30] Trend #9 – Machine Learning – This is a subset of AI, machine learning learns as it goes, picking up trends and offering insights for consideration.

[21:27] Trend #10 – Customer Experience – Customer Experience, in terms of both usability and service will outshine complex offerings. As SaaS becoming commonplace from both consumer and commercial perspectives, User’s expectations regarding Customer Experience are growing sharply when they are looking to make technology purchase decisions. Successful EHS SaaS vendors put significant focus and investment in optimising the Customer Experience, both in terms of interface and functionality, to reduce the barriers to adoption by focusing on how Users interact with their solutions.

[28:00] Businesses usually have a very limited Health and Safety resource. SaaS solutions enables informed decisions to be made despite a lack of human resources available.

You can find out more about Riskex via their website. Don’t forget to check out their Health and Safety Management software – AssessNET

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

To keep global warming to no more than 1.5°C, as called for in the Paris Agreement – emissions need to be reduced by 45% by 2030 and reach net zero by 2050.

Many businesses are already making great strides to reduce their Impact, and while you can reduce, achieving true carbon neutrality will involve offsetting a certain amount of emissions.

Treeconomy are one of the few companies in the UK that offer credible carbon credits. Backed by principles of PAS 2060 (Carbon Neutrality), they seek to break the greenwashing cycle.

Mel is joined by Harry Grocott, CEO and Co-founder of Treeconomy, to discuss their credible carbon offsetting schemes and the innovative technology they use to help quantify the value of nature.

You’ll learn

Who are Treeconomy?
What is the difference between services offered for landowners and Offset buyers?
Can you quantify the value of nature?
How can people be sure that they don’t fall prey to Greenwashing?
How can someone go about buying and monitoring offsetting credits?
Are Treeconomy’s carbon offsetting schemes verified?

Resources

In this episode, we talk about:

[00:30] Catch up our episodes covering the Sustainable Development Goals (Part 1 / Part 2), ISO 14064 and PAS 2060.

[01:00] Treeconomy are a company that offer credible carbon offsetting schemes – they are one of the few companies who are recognised by PAS 2060 (the Standard for Carbon Neutrality)

[02:05] Harry Grocott (CEO) introduces Treeconomy – A nature based, carbon removal and restoration company that operate in the UK and Internationally. They offer schemes that work towards afforestation, peatland restoration, rewilding ect. They are also keen to enable evidencing the impact, developing a software platform, remote sensing, and AI technology to do so.

[03:41] They are part of the Centre for climate change innovation which is an initiative of Imperial College London and the Royal Institution to catalyse innovation of all forms that address the causes and effects of climate change.

[04:22] What is the difference in services for Landowners and Offset Buyers? For landowners, Treeconomy can help you change land use from one to another. I.e changing land used for sheep grazing into something more carbon intensive. Treeconomy will ensure that any project started with them is a verified Carbon Scheme – in-line with the woodland carbon code. Once your project set up has been completed and verified, Treeconomy will assist in the sale of credible carbon credits.

[07:22] For offset buyers: Treeconomy offer a wide range of projects and varyingly priced carbon credits.

[07:45] Can we quantify the value of nature? Short answer right now is no, but there is a lot of nuance. Nature offers ecosystem services i.e. farms offer a calorific benefit, we can put a price on the value that offers. The same principle applies to resources such as wood or oil. Now we are gaining the ability to quantify CO2 removal, which is undeniably valuable to humanity.

[09:18] Other more recent services such as biodiversity projects are a bit harder to quantify – as they vary so much depending on the country. However, we are starting to assign value to these.

[12:15] How can people be sure that they don’t fall prey to Greenwashing? There are 2 main issues to consider: 1) Are your carbon credits credible? 2) what claims are top management making?

[12:44] Tackling claims made by leadership: ISO standards are starting to solve this issue. There are clear requirements and certifications that need to be in place to back those claims.

[13:00] Tackling carbon credits: The carbon offsetting market is heavily unregulated currently. Essentially it’s a lot of people trading in invisible gas. There are a number of carbon standards (Not quite at the same level as ISO Standards), such as the Woodland Carbon Code and the Peatland Code, and Internationally there are standards such as Verra VSC – unfortunately, a lot of these standards aren’t very robust and aren’t enforced.

[15:30] Many companies will often look to buy the cheapest offsets available, which are likely to be non-credible and will provide no evidence of actual offsetting occurring. But, there are a lot of new companies emerging that provide tangible evidence of offsetting (such as Treeconomy 😊)

[18:30] How can someone go about buying and monitoring offsetting credits? If you don’t want to use a company like Treeconomy, you would need to directly contact and purchase credits from a company who is developing a project.

[19:23] Treeconomy have created a platform called Sherwood – this displays all the projects they are helping to develop, which also tells you who the landowners are and the carbon inventory attached to each project. It can also help you evidence credits purchased, whether they are historic or future carbon removal.

[21:30] Not many companies offer comprehensive reporting and evidencing of carbon credits in practice. Treeconomy use a range of methods such as drones, satellites and AI programs to report back, and aim to make getting this information as easy as possible for credit purchasers.

[23:20] How did Harry get into this business? Starting off studying geography and Science – he later went onto work in finance for 3 years and qualified as a finance adviser. While working he realised that the amount of money available is rarely the issue, rather the use of it. He saw that there was a large gap in funding for climate change mitigation and adaptation – but not enough money was going towards it. He began wondering why more couldn’t be invested and so decided to study climate change management and finance (partly though Covid), where he met his co-founder. After getting some Government grant funding, investors and landowner partners, they have flourished over the last 3 years.

[27:00] Are Treeconomy’s offsetting schemes verified? Yes – they work under the UK woodland carbon code (and soon the peatland carbon code). They are also working to create a new protocol to tackle rewilding, including how the value and progress can be tracked. Internationally they will be working under Verra.

[29:05] Treeconomy can help to provide detailed evidence of carbon offsetting thanks to their reporting capabilities, this can be passed onto 3^rd party auditors to verify in-line with any carbon Standard.

[30:00] You can find Treeconomy via their website, LinkedIn, Twitter and Instagram 😊

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Anyone with a current ISO 27001:2013 certificate will be required to update and add certain elements in their existing Information Security Management System to ensure compliance to ISO 27001:2022 ahead of the October 2025 deadline.

Over the past few weeks, our mini-series has covered the fundamental changes to the Standard, along with tips on how to plan and Implement the required updates.

Join Mel this week as she explains the final few stages of an ISO 27001 transition, including the Internal Auditing and final preparation ahead of a Certification Body visit.

You’ll learn

What needs to be audited?
What do I need to do to prepare for the Certification Body visit?
How can you get a free copy of ISO 27001:2022?

Resources

In this episode, we talk about:

[00:44] Catch up on the last two episodes before listening to this one: What you need to know to transition to ISO 27001:2022 / What changes need to be Implemented to transition to ISO 27001:2022

[01:00] The last stages are all about gathering evidence of compliance against new and updated clauses and controls

[01:28] Make sure you plan your transition visit well in advance – If you leave it too late you may incur additional fees for more days or possibly even for a full certification if you miss the deadline.

[02:15] This process for transition is fairly consistent among Certification Bodies. It typically includes a Readiness Review and a transition visit where they will review evidence of compliance against the new controls.

[02:45] You can get a free copy if you sign up to our Transition Programme by April 1^st 2023)

[02:55] The last stage ahead of the transition visit is Internal Auditing. For those still planning their 2023 Internal Audits, you may wish to Implement the changes earlier in the year with a view to audit the changes in the later half of 2023. Ensure that you allow time to build evidence of compliance ahead of a transition visit.

[03:45] If you need a bit of extra help, we include Internal Auditing within our transition programme – this will typically take 1 day.

[04:30] We can also support you during your transition visit – this could be on-line or on-site, which would depend on your Certification Bodies preference.

[05:20] Currently many Certification Bodies are suggesting a half day for the Readiness Review and another day for the transition. Some may choose to include this transition as a part of their annual Surveillance visit to help save on costs. If you have a Surveillance coming up, it’s worth getting in contact with them to see what they would recommend regarding your transition.

[05:43] We advise that you also ask your Certification Body, when they will be UKAS accredited for ISO 27001:2022 – they may not be ready complete a transition visit until the later half of 2023.

[06:35] For our global listeners, your Certification Body will have an Accreditation Body that needs to verify their ability to conduct transition visits. For the UK this is UKAS, but it may differ for other countries.

[07:15] Don’t leave this until last minute! Based on previous experience with transitions, we’ve found companies that leave it until a few months before the deadline often can’t transition in time, and end up having to pay up for a full Stage 1 and 2 Assessment in order to keep their certification.

Grab a copy of our ISO 27001:2022 Guideline to the changes here:

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

The updated ISO 27001:2022 has had several changes, including the addition of 11 completely new controls and the merging of 56 other controls into 24 newly titled controls.

These changes mean that anyone with a current ISO 27001:2013 certificate will be required to update and add certain elements in their existing Information Security Management System to ensure compliance to ISO 27001:2022 ahead of the October 2025 deadline.

Join Mel this week as she explains the changes that need to be made, including what key documentation requires updating to align with ISO 27001:2022.

You’ll learn

What changes need to be made to your existing Information Security Management System?
What key documents need to be updated?
How can you get a free copy of ISO 27001:2022?

Resources

In this episode, we talk about:

[00:44] In the last episode we covered the planning stages for your transition – catch up here

[01:02] We have a free ‘Guide to the ISO 27001 Changes’ available – simply fill out the form at the end of the Show Notes to download your copy

[01:29] You should have a copy of ISO 27001:2022 ahead of Implementing the changes (you can get a free copy if you sign up to our Transition Programme by April 1^st 2023)

[01:35] Before you move onto Implementation, ensure that you have: planned back from your transition date, have an understanding of the new controls and had a Discovery session / Gap Analysis to see where the gaps in your current system are

[02:11] This is also a good opportunity to revamp your Management System! We have a few older episodes to help you with this: #102, #103, #104

[02:50] What needs updating? This will include:

Your Statement of Applicability
Risk Assessment
Objectives
Action Plans
Monitoring and measurement (reviewing what you are monitoring / measuring and how it’s recorded)
Internal Audit Schedule / Programme – To include the new controls

[03:45] At this stage you need to look at what controls you have in place – there may be some you can now merge together to reduce any paperwork involved.

[04:25] We have some tools available to tackle the new controls (i.e Threat Intelligence, data masking, physical security monitoring ect) if you need some extra help

[04:50] It’s not just about updating documentation, you will need to fully implement and communication these new controls to the wider business. You may find that you already have some controls covered, but not yet formalised.

[05:30] The main aspect of the Implementation phase is to address the gaps found during the Gap Analysis. For example, new controls such as data masking, threat intelligence and web filtering, which you may not have considered seriously before, now need to put formal documented measures in place to address it.

[06:26] Communication and evidence should be at the forefront of your mind when updating your Info Sec Management System.

[06:39] Don’t just implement controls for the sake of it – considering how they are going to reduce risk and how they’re going to make a difference to improve your Risk Register and Statement of Applicability.

[07:00] The Implementation phase of our Transition Programme is 1-3 days depending on your level of required support

[07:54] You should also consider creating a Communication Plan to share knowledge of these changes to the wider business. Make sure you also compile any evidence of training on new elements of your Management System too. We will have Coffee Break Training available on the isologyhub which could help with this.

Grab a copy of our ISO 27001:2022 Guideline to the changes here:

Keep an eye out for next weeks episode where we explain how to complete your ISO 27001:2022 transition.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

ISO 27001 2022 is here, which means it’s time to start thinking about starting the transition process. While the deadline is set at December 2025, it’s never too early to start!

If this is all news to you, check out our previous three episodes, where we reviewed all the major changes to ISO 27001, including clause updates and the 11 completely new controls added.

Join Mel this week as she explains what you need to know before embarking on your ISO 27001 transition journey, in addition to a summary of our transition programme.

You’ll learn

How to plan for your ISO 27001 transition
How can Blackmores help you?
How can you get a free copy of ISO 27001:2022?

Resources

In this episode, we talk about:

[00:44] Businesses have until October 2025 to transition to the updated version of ISO 27001:2022 – but don’t wait until the last minute! Certification Bodies get really booked up in the last year, and you could risk losing your certification and paying for another Stage 1 and 2 Assessment.

[01:30] We recommend that you start thinking about your transition in 2023 so you have everything in place to start the process in 2024.

[02:28] As a recap – the major changes to ISO 27001:2022 are: 56 controls have been merged into 24 newly titled controls, the addition of 11 completely new controls and controls are now categorised into just 4 groups instead of the 14 from the previous version.

[03:00] ISO 27001:2022 Guide to the changes available – Simply fill out the form available at the end of the show notes to grab a copy!

[04:25] Over the next few episodes, Mel will talk through the process of planning, implementing and preparation for the Certification Body transition visit.

[05:51] All steps of the transition process are laid out in our Transition Programme, which includes: an awareness video, a transition action plan, Implementation of changes, Internal auditing of the changes and some optional support during the Certification Body visit.

[08:45] The Planning Phase: We recommend trying to combine your transition visit with your next Surveillance visit – you can have a chat with your CB to see if that’s possible. This may not be possible if your Surveillance is coming up very soon, as you need time to implement the changes needed. Those that have it in say 6 or more months’ time would be in a good position to make the request.

[09:30] Certification Bodies are recommending an extra half day for transition – some may require a desktop review ahead of the actual visit. Combining this visit with your Surveillance is a good way to reduce costs.

[10:30] When planning out your timescales for transition, don’t forget to inform Leadership and key personnel involved in the running of the Management System about the expected changes to come – and plan in time for them to help with the implementation.

[11:10] Understanding the changes: We gave a high-level overview of the 11 new controls in our last episode. We will also have 11 Coffee Break Training courses covering the controls in more detail, available from March 31^st 2023 on the isologyhub.

[12:11] Offer: We’re including a free copy of ISO 27001:2022 for those that sign up to our Transition Programme before April 1^st 2023.

[12:34] You may get asked for a copy of the Standard at your transition visit – as having a copy can come under ‘other’ legal requirements.

[13:10] Discovery Phase: We have a transition checklist which can help you identify where the gaps are in terms of compliance with the new controls. You may already have some of it in place!

Grab a copy of our ISO 27001:2022 Guide to the changes here:

Keep an eye out for next weeks episode where we dive into how to Implement the changes…

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

ISO 27001, The Information Security Standard, was updated in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards.

Over the last two episodes, we’ve gone over the key changes and explored the specific clause updates in more detail. As mentioned in the first episode of this mini-series, there have been 11 new controls added to ISO 27001:2022.

Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the 11 new controls added to ISO 27001:2022 and their purpose.

You’ll learn

What are the 11 new controls in ISO 27001:2022?
Why have these been added?
What is their purpose?

Resources

In this episode, we talk about:

[01:00] A quick overview of the key changes – 56 Controls combined into 24 newly titled controls, 11 new controls added and 58 existing controls remained unchanged.

[02:30] We have been over a few of the new controls in ISO 27002:2022 in more detail in a few previous episodes: #111, #112, #113, #114

[02:50] These new controls are nothing to worry about – they are simply aligning the Standard with more modern security considerations. You may already be complying with them!

[03:32] Control A.5.7 Threat intelligence – ‘To provide awareness of the organization’s threat environment so that the appropriate mitigation actions can be taken.’ – This can come from many different sources, such as the NCSC or local police websites. There are also additional tools you can add to detect possible phishing attacks. This also includes consideration to external threats – Information Security is about much more than just protecting data! It also includes physical security.

[05:33] Control A.5.23 Information security for use of cloud services – “To specify and manage information security for the use of cloud services.” – More and more businesses reply on cloud-based computing. It’s important to verify the security of your service provider to ensure it’s adequate. You can check to see if they have any valid Information Security related credentials such as CSA Star, Cyber Essentials, SOC. You could also adopt principles of ISO 27017 (certification for cloud security), ISO 27018 (Protection of PII in the public cloud) and ISO 27701 (PII security Standard).

[08:30] Control A.5.30 ICT readiness for business continuity –‘ To ensure the availability of the organization’s information and other associated assets during disruption’ – There a few standards that could assist with this, including ISO 27031 (ICT readiness for Business Continuity). Those that have ISO 22301 may want to look at how ISO 27001 elements can be integrated and improved in any disaster recovery plans. ISO 27001 needs to be an integral part of any business continuity plans – not just a bolt on. Small business may not want to conduct a full business impact analysis, but should carry out a risk assessment around business continuity at the very least.

[11:30] Control A.5.30 ICT readiness for business continuity – further considerations: A key focus of this part of the Standard is Recovery Time Objectives and Recovery Point Objectives. Overall, the whole business continuity aspect of the updated ISO 27001:2022 may take a bit of work to implement, but you will ultimately be much better off in the event of a disaster or security incident. For further guidance, you may want to check out an older non-certifiable standard, BS 25777 (ICT continuity).

[13:20] Control A.7.4 Physical security monitoring –‘ To detect and deter unauthorized physical access.’ – This can include things like CCTV, access control, swipe cards ect. This also includes the ability and regular practice of monitoring these access methods, for the purpose of detecting any anomalies.

[18:56] Control A.8.9 Configuration management – ‘To ensure hardware, software, services and networks function correctly with required security settings, and configuration is not altered by unauthorized or incorrect changes’ – Configuration for things like a firewall, software, any hardware devices, passwords ect should be documented, explained and monitored on a regular basis to ensure nothing has been changed without notifying the relevant people. ISO 20000 includes a helpful section around configuration if you require further guidance.

[21:41] Control A.8.10 Information deletion – ‘To prevent unnecessary exposure of sensitive information and to comply with legal, statutory, regulatory and contractual requirements for information deletion.’ – This already existed in the Standard, it has simply been clarified further. You will now need to prove that data has been deleted as required, if you use a 3^rd party for this, they will need to provide the relevant certificates.

[22:05] Control A.8.11 Data Masking – ‘To limit the exposure of sensitive data including PII, and to comply with legal, statutory, regulatory and contractual requirements.’ – You have 3 options for data masking: Obfuscation, pseudonymisation and annoymisation. This also helps to comply with GDPR requirements.

[24:10] Control A.8.12 Data leakage prevention – ‘To detect and prevent the unauthorized disclosure and extraction of information by individuals or systems.’ – This control has made a return from the 2005 version of ISO 27001. Businesses should have systems in place to monitor any particularly large data downloads – or even possibly large print batches. You should also ensure that you have a secure email system in place as well as VPN’s and regular security training to sure up your security to prevent any potential leaks.

[27:00] Control A.8.16 Monitoring Activities – ‘To detect anomalous behaviour and potential information security incidents.’ – Appropriate monitoring should be in place to detect any potentially dangerous or malicious behavior.

[28:00] Control A.8.23 Web Filtering – ‘To protect systems from being compromised by malware and to prevent access to unauthorized web resources.’ – Your systems should be set up in a way to prevent people from accessing unsecure or unsavory sites. This could include Social Media sites – but be mindful that there may have to be exceptions for marketing or communications personnel for those particular sites.

[28:00] Control A.8.28 Secure Coding – ‘To ensure software is written securely thereby reducing the number of potential information security vulnerabilities in the software.’ – If you have created your own secure coding, be sure to evaluate it against industry professional standards such as OWASP and NIST.

As a reminder, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version.

Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022…

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

As many of you are aware, an updated version of ISO 27001 was published in October 2022. While there is a 2-year grace period for transition, we would urge everyone to make a start on implementing the changes to ensure you are compliant with latest best practice standards. But where do you start?

In the last episode, Mel and Steve gave an overview of the updated ISO 27001:2022, including a high-level look at some of the key changes.

In addition to the control changes, there have been several changes made to specific clauses within the Standard.

Mel is once again joined by Steve Mason, Managing Consultant here at Blackmores, to discuss the ISO 27001:2022 clause updates and their purpose.

You’ll learn

What clauses have been updated from the 2013 version of ISO 27001?
Why have these clauses been updated?

Resources

In this episode, we talk about:

[01:06] The changes to these clauses appear to align your Management System with the business more so than in the previous iteration of ISO 27001 – a key focus is integration.

[01:20] First change: Clause 4.2 Understanding the needs and expectations of Interested parties – ‘c) which of these requirements will be addressed through the information security management system.’ – This seeks to align the Management System with interested parties and identify where it may or may not be able to meet their needs and expectations.

[03:30] Clause 4.4 Information Security Management System – ‘The organization shall establish, implement, maintain and continually improve an information security management system, including the processes needed and their interactions, in accordance with the requirements of this document.’ – There will be more focus on process flows and not Policies and Procedures. This can be further used to align the Management System with your business, by clearly identifying where it fits in with your business activities.

[06:14] Clause 5.1. Leadership – ‘Reference to “business” in this document can be interpreted broadly to mean those activities that are core to the purposes of the organization’s existence.’ – This acts more as a reminder to top management to ensure they include the Management System as part of the business and not just a bolt-on. It should be a part of the strategy and part of the business (part of the ship, part of the crew)

[07:42] Clause 6.1.3 Information Security Risk Treatment –‘ Note 2 in sub-clause ‘c’ now states ‘Annex A contains a list of possible information security controls.’ (it had previously read Annex A contains a comprehensive list of control objectives and controls.) – This simply means that you can add references to other controls outside of the list provided within Annex A i.e. NIST or Cyber Essentials. Though, do be careful to avoid doing this at minutia level, as that just increases Management System maintenance.

[09:15] Clause 6.2 Information security objectives and planning to achieve them –‘ A couple of extra points have been added to this clause: d) be monitored g) be available as documented information’ – The monitoring was previously a given, but not really specified. So now, you’ll have to demonstrate how you’re monitoring objective planning and achievements.

[10:24] Clause 6.3 Planning of Changes – ‘When the organization determines the need for changes to the information security management system, the changes shall be carried out in a planned manner.’ – This has now been aligned more with ISO 9001’s approach to changes. All changes should be planned before implementation, and this now includes information security consideration. Fun fact – they forgot to include this clause in the Standard table of contents! (as of January 2023, this will probably be added later!)

[11:55] Clause 9.3.2 Management Review Inputs –‘ c) changes in needs and expectations of interested parties that are relevant to the information security management system’ – This just ensures that the needs and expectations of your Interested Parties are reviewed and not just left stagnant.

[13:20] To help you revamp your Management Review, check out episodes #99 and #100

As a reminder, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version.

Keep an eye out for next weeks episode where we dive into the clause clarifications and control changes of ISO 27001:2022…

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

The long-awaited update of ISO 27001 arrived in October 2022, having gone 9 years since its previous 2013 iteration. Needless to say, it was much overdue.

The new 2022 version of the Standard includes 11 new controls and sees around 56 other controls combined into 24 newly titled controls.

In order to cover every aspect of the new Standard, we’ll be running a mini-series through January and February on the updated ISO 27001:2022 in addition to how you can transition to the new version.

Starting off the series strong, Mel is joined once again by Steve Mason, our very own Information Security guru, to broadly discuss the changes to ISO 27001:2022.

You’ll learn

Who is ISO 27001:2022 applicable to?
An overview of the changes to ISO 27001:2022
What is Steve’s favorite change to ISO 27001:2022?
What are the challenges involved with updating to the 2022 version?

Resources

In this episode, we talk about:

[01:50] Steve Gives an overview of what’s new in ISO 27001:2022 – The updated version of ISO 27001 was released on the 26^th Oct 2022. The new version included 24 changes and clarifications within the main clauses.

[02:50] The controls for the new standard are now categorised into 4 groups: Organisation, People, Physical and Technology

[05:50] We covered some of the new controls in more detail in previous episodes: #109, #110, #111, #112, #113 and #114

[06:17] The 24 changes and clarifications to Clauses include older existing clauses which have been tidied up to be more transparent. We recommend reviewing to ensure that you are complying in a way that aligns with the Standard.

[06:35] There are 11 new Controls. 56 controls from the 2013 version have been reduced to 24 with 58 remaining unchanged. So, in short, Annex A has been simplified with less duplication of controls.

[07:44] Steve highlights section A.9 for Access Control as one of the much-improved controls – due to the lack of repetition and simplified requirements for compliance.

[08:35] Steve’s favourite update to the Standard: The whole Standard now collectively encourages incorporation into your business. Your ISMS should not feel like a bolt on, it should be a part of your businesses DNA.

[10:36] Steve’s favourite update to the Standard #2: It’s not a static Standard, it encourages development and continual improvement.

[13:45] For those completely new to ISO 27001 – check out our 3-part Steps to Success series which explains the Implementation process from start to finish.

[14:38] Listen to some of our client interviews to hear the challenges others faced when Implementing ISO 27001 in addition to the benefits gained as a result of adopting the Standard:

[14:50] Why would the business continuity elements of ISO 27001:2022 pose a challenge? There used to be a clause in the 2005 version of the standard which documented the need for a business impact analysis – this was removed in the 2013 version. The new ‘ICT readiness for business continuity’ control will require at the very least, a risk assessment.

[16:48] Steve recommends checking out the Plan, Do, Act, Check diagram in ISO 27031 (Guidelines for information and communication technology readiness for business continuity). It also includes some great guidance on business impact analysis.

[18:40] The ICT readiness control is not designed to be an all encompassing business continuity strategy – it’s designed to work in tandem with as existing one (you may already be certified to ISO 22301 Business Continuity Management).

[19:50] It’s highly recommended that if you don’t have a Business Continuity Plan or strategy – at least have a framework in place. Disasters by their nature are unpredictable, as is the resulting damage to an extent. You will not know the full extent until you’ve lived it – so don’t write an exhaustive 80+ page manual that no-one will read, document the what, who and how of getting yourself back up and running again.

[21:11] There has also been an update to ISO 27005 (Risk assessment in relation to info sec). It includes a new set of threat categories: physical threats, natural threats, infrastructure failures, technical failures, human actions, compromised services or functions and organisational threats. These may help you when putting a business continuity framework in place.

[22:05] Above all else – ISO 27001:2022 has modernised and aligned itself more with the likes of cyber essentials and NIST.

Keep an eye out for next weeks episode where we dive into the clause updates…

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Happy New Year! We at Blackmores hope you all managed to have a break over the holiday season and are gearing up for many challenges and successes in 2023.

As a reminder, we signed off last year by highlighting the top 5 podcasts as dictated by you, the listeners.

Before we dive into a brand-new year full of top tips, expert advice with industry leaders and client interviews, we’d like to take a step back and let the host share her reflections on 2022.

Join Mel as she shares her personal top 5 ISO Show episodes from last year.

You’ll learn

What are Mel’s top 5 episodes of 2022?

Resources

In this episode, we talk about:

[00:30] A reminder to listen to our last podcast, covering the top 5 podcasts as dictated by the listeners.

[01:21] #1 Episode 102 – What’s in a name? This episode features our Senior Isologist, Sarah Ball, as she explains the importance of giving a meaningful name to your Management System.

[03:40] What’s in a Name snippet – Full episode available in the ISO Show Archive

[08:01] #2 Episode 94 – The 7 Steps of Carbonology_ Reduce – Part 4 of the 7 Steps of Carbonology series, featuring our Carbonologist, David Algar. This episode delves into the creation and communication of a carbon reduction plan, and the benefits of reducing your footprint rather then relying on offsetting alone.

[10:14] The 7 Steps of Carbonology – Reduce snippet – Full episode available in the ISO Show Archive

[16:48] #3: Episode 117 PMC’s journey and ongoing success with ISO 27001– This is an interview with Philip Bailey, the Managed Services Director at PMC Retail, talking about their ISO 27001 journey. Philip shares his lessons learned and gives some top tips for anyone considering implementing the Information Security Standard

[17:58] PMC’s journey and ongoing success with ISO 27001 snippet – Full episode available in the ISO Show Archive

[24:00] #4: Episode 100 How to get the most out of your Management Review – Featuring Rachel Churchman, Managing Consultant here at Blackmores, this episode explores how added value can be gained from doing a Management Review. Mel and Rachel discuss various ways you can conduct a Management Review and what should be your key inputs and outputs.

[26:14] How to get the most out of your Management Review snippet – Full episode available in the ISO Show Archive

[30:41] #5: Episode 108 How to align your Management System with the Sustainable Development Goals– Following on from the Sustainable Development Goals summary episodes, Mel shares how you can align your Management System right now without the need for any ISO certification.

[32:37] How to align your Management System with the Sustainable Development Goals snippet – Full episode available in the ISO Show Archive

We look forward to bringing you even more amazing content in 2023, so stay tuned! 😊

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s

Stitcher | Spotify | YouTube | iTunes | Soundcloud

It’s been a busy year here at Blackmores! Somehow, we managed to fit in the time to publish 37 new ISO Show episodes.

It’s been a mix of knowledge sharing, top tips, advise and stories from our very own consultants and clients – and we’re looking forward to sharing even more with you next year!

We thought it’d be good to end this year on a look back at 2022 and highlight 5 of the most listened to episodes of the ISO Show across its many platforms.

Join Mel as she shares some snippets from our top 5 most popular episodes this year.

You’ll learn

What are the most listened to episodes of the ISO Show for 2022?

Resources

In this episode, we talk about:

[00:30] The top 5 episodes of 2022 have been selected based on which episodes have been listened to the most.

[01:00] #1: 98 What is a Management Review? This is an episode that appeals to a more general audience as Management Review is a requirement of many ISO’s. This was the 1^st of a 3-part series and explains the basics of what a Management Review is and what it typically includes.

[02:47] What is a Management Review snippet – Full episode available in the ISO Show Archive

[05:40] #2: 100 How to get the most out of your Management Review – Part of the Management Review series – this episode includes Rachel Churchman, a Managing Consultant here at Blackmores. The episode explored various ways in which you can make your Management Review both more engaging and successful in achieving tangible outcomes.

[06:55] How to get the most out of your Management Review snippet – Full episode available in the ISO Show Archive

[13:20] #3: 106 What are the Sustainable Development Goals – This is a 2-part series which explores the 17 SDG’S and how ISO Standards can meet certain goals. In both episodes, Mel gives specific examples of the many ISO’s that align with the SDG’s.

[15:08] What are the Sustainable Development Goals snippet – Full episodes available in the ISO Show Archive – Part 1 / Part 2

[22:08] #4 and #5: 109 What’s new with ISO 27002:2022? / 110 What are the 11 new controls in ISO 27002? – Both of these episodes shortly followed the release of ISO 27002 – A guidance document for ISO 27001. While not certifiable, it did give us an insight to the changes in ISO 27001 that were published later in the year. Episode 109 summarises how ISO 27002 works in relation to ISO 27001, along with a very brief summary of the changes. Episode 110 goes into more detail on each of the 11 new controls – and features our very own Managing Consultant, Steve Mason.

[24:38] What are the 11 new controls in ISO 27002 snippet – Full episode available in the ISO Show Archive

That’s it from us for 2022! We hope you all have a wonderful Christmas and New year – See you on the other side in 2023 😊

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Currently, there are around 1,077,884 valid ISO 9001 certificates globally – which beats the second runner, ISO 14001, by over 600,000!

There is no doubt that the Quality Management Standard, ISO 9001, is still the most widely adopted ISO Standard – and for good reason!

ISO 9001 is basically a model for running a successful and profitable business. It provides a common framework for things that all businesses should have in place, including defining your companies unique ‘way of working’.

In addition to being a blueprint for a business’s operation, there are many other benefits to be gained from implementing ISO 9001. Today, Mel explains a few of these benefits in greater detail.

You’ll learn

What is ISO 9001?
Why Implement ISO 9001?
The benefits of ISO 9001

Resources

In this episode, we talk about:

[00:30] Why talk about ISO 9001 benefits? Often times, Mel gets asked for benefits of ISO 9001 so a business case can be put forward.

[01:00] What is ISO 9001? For a detailed break down of the Standard, go back and watch ‘Episode 36 – What is ISO 9001?’

[01:45] For those that have Implemented ISO 9001, what are the benefits? We’d love to hear from you! If you have some stories to share – feel free to leave a comment on which ever media player you’re listening on – or email us. We’d love to share some of your experiences in a future episode.

[02:09] Benefit #1: Win new business – From a sales and marketing perspective, ISO 9001 is essentially a passport to trade. It demonstrates credibility to Stakeholders as it’s a mark of quality.

[02:55] Benefit #2: A framework that can fit any business – This can be for any industry sector and business size. It helps businesses figure out what is working well and what’s not working so well.

[03:10] Benefit #3: Identify opportunities for Improvement – It helps businesses figure out what is working well and what’s not working so well. It can help identify issues such as: Bottlenecks in processes, resourcing and external factors.

[04:05] ISO 9001 helps you to look at your business – warts and all. It does no one any good to bury their head in the sand and ignore issues, especially as Stakeholders and clients will see through this.

[04:40] Benefit #4: Put quality controls in place to mitigate risk and raise your standards – If you have complaints or need to do a product recall – you need processes in place to handle this. ISO 9001 gives you the tools to do so, creating an effective framework everyone can follow.

[05:40] Benefit #5: Improve efficiency – ISO 9001 helps you identify the best way of working and pushes you to optimise that. That could include eliminating aspects of you business that waste time, or create burdens.

[06:05] Benefit #6: Creating a unique Blueprint – ISO 9001 isn’t an out of the box solution – it can be tailored to your way of working. It helps to establish relevant Policies and Procedures that improve your business operations.

[06:24] Benefit #7: Enhancing customer satisfaction and employee retention – Good quality business practices will inevitably help you to keep ahold of good clients – and good employees too! This can be achieved by having clear roles and responsibilities in addition to vision and goals for the business.

[07:20] Benefit #8: Increase profitability – Businesses often look at the cost of poor quality – where is your business leaking money? Addressing those issues is a direct cost saving.

[08:21] Businesses who have grown through acquisition often find ISO 9001 a great tool to help standardise their way of working, so they can easily integrate other businesses and services.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Data breaches have risen by 70% globally in Q3 of 2022, reinforcing the requirement for many to seek out Information Security solutions, especially those within the tech space.

Today we speak to Triaster, who have been in operation since 1994, providing businesses with process mapping and execution software to help drive business improvement.

Triaster’s Business Operations Manager, Jane Duncan, explains why they sought to implement ISO 27001, what challenges they faced and what they learned during their certification journey.

You’ll learn

Who are Triaster?
Why Triaster Implemented ISO 27001
What did they learn from their experience?
What benefits have they seen as a result of Implementing ISO 27001?

Resources

In this episode, we talk about:

[00:54] Get to know Jane Duncan – Triaster’s Business Operations Manager who has recently started fostering dogs for a local charity.

[01:41] Who are Triaster? In short, they build software solutions that drive business improvement. They are a thought leader in their field and strive to create new software to meet business needs.

[02:25] What was the main driver for achieving ISO 27001? In 2020, they had certified to the Quality Standard, ISO 9001, and saw the many benefits that come with ISO certification. They saw ISO 27001 as both an opportunity and a necessity due to their work within the IT industry. ISO 27001 is seen as a mark of trust and provides a central framework to improve data security.

[04:28] How long did It take to implement ISO 27001? They started looking at certification bodies and consultants to help with implementation in March 2021. The project overall lasted six months, with their assessments taking place in September and October of the same year. They also chose to recertify to ISO 9001 at the same time – this aligned both Standards under one Integrated Management System.

[06:35] If you are considering implementing multiple ISO’s, it’s recommended to integrate them into a single Management System. This reduces the costs of implementation and is overall easier to maintain.

[07:17] What was the biggest gap identified in Triaster’s initial Gap Analysis? They had a lack of security policies in place in addition to a lack of processes that would have mitigated potential data security risks.

[08:00] What was the biggest difference ISO 27001 made? They now do regular annual SWOT and PESTLE’s that are evaluated at Management Reviews. Risks identified during those reviews are added to a risk register and are used to develop the necessary objectives and controls needed to mitigate future risk.

[08:38] Other differences include the ability to track non-conformities, security risks and opportunities for improvement. They also have the confidence to prove their data security credentials to clients and have the required documentation to back it up. Tendering processes are also made easier by having ISO 27001 as it is often a requirement that can now be ticked off.

[09:25] Triaster use Infrastructure partner (who are also ISO 27001 certified) and can now hold them accountable for the services they provide.

[09:50] Jane states that they are now a much better business following the Implementation of both ISO 9001 and ISO 27001 – continually improving their processes and scrutinising working practices.

[10:54] All of the same security practices can be done by those who are homeworking at Triaster

[11:05] What has been the main lesson learned? The process if certification is a journey – it’s about continually improving and truly adopting the ethos of Information Security into every aspect of the business.

[11:52] What are the main benefits? They hope their clients can see their efforts and have confidence in Triaster’s ability to keep their data secure. They also now have the processes in place that drive continual Improvement.

[12:33] Jane’s top tip: Document what you do as a business and look for gaps. Also, certification is a journey, and you shouldn’t stop striving to improve once you achieve certification.

[13:00] What book would you recommend and why? Internal Auditing in plain English: A simple guide to super effective ISO Audits by Craig Cochran

[14:15] Jane’s favorite quote: “No one is you, and that is your superpower”

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

All companies have a legal obligation to comply with existing legislation – it’s the law!

Failure to comply to legal requirements can be costly in terms of fines and reputational damage if an incident occurs. So, it’s in your best interest to ensure you can identify all applicable compliance requirements.

Most ISO’s specify a requirement to identify legal compliance requirements, and in our experience, the most effective way to do so is through the creation of a Legal Register.

Mel is joined by Sarah Ball, A QHSE Consultant here at Blackmores, to discuss how you can create your own Legal Register and keep up-to-date with changes in legislation.

You’ll learn

The importance of Legal Compliance
How to identify what legislation is applicable to you
What is a Legal Register?
How can you create a legal Register?
How can you keep up with changes in Legislation?

Resources

In this episode, we talk about:

[01:06] Why do you need to comply with Legislation – quite simply, it is the law! It can be very costly for you in both a financial and reputational respect.

[01:25] There is a requirement for identifying legal compliance requirements in most ISO’s i.e. ISO 45001 (Health and Safety) and ISO 14001 (Environmental)

[02:33] A Legal Register is not a requirement of any ISO – but we find it is the most effective way of documenting and keeping track of changes in applicable legislation.

[03:05] Why is it so important to manage legal compliance? Besides the financial and reputational cost of not complying with the law – it’s a way to protect your business. The law is there for a reason and it is often times to protect individuals or communities.

[04:35] You will need to take a proactive approach to find out what legislation is applicable to you.

[05:40] How can you identify your legal obligations? Firstly, do some basic research, start by visiting reputable industry authorities as they will likely have some guidance available i.e. The HSE Website or the Legislation.gov website. There are also subscription services available that give you an overview of what may be applicable to you and notify you of any updates. Finally, you can look to a specialist consultancy to help you.

[09:05] We do have a module on Legal Compliance available in the isologyhub!

[10:05] Why is it important to have a legal register? You will have to keep track of a lot of legislation! By documenting it, you have full visibility and can identify any gaps. You can also assign accountability against each piece of legislation, so the responsibility can be shared and managed.

[11:40] Your brain is for thinking and processing, not remembering. By documenting information, you create a ‘second brain’ to free up your brain for more important tasks – We recommend checking out the ‘Productivity Ninja’ series of books for more helpful organisation and prioritisation tips!

[12:28] What does a Legal Register look like? It’s typically a table of information – we use spreadsheets but any format is fine. Key columns we use identify the name of the legislation or contractual obligation, a link to the legislation, the requirements and purpose (what does this legislation mean to you?), A link to any further guidance and description of what good looks like to you i.e an example of evidence of compliance. You could include a column for accountability.

[16:00] How do you create a Legal Register? First, set up your table, next go out and find your applicable legislation, confirm and document your requirements in regard to the legislation, then assign accountability within the organisation. You may want to consult stakeholders to complete the obligations and figure out what good looks like. It is also good practice to do a legal compliance audit to ensure you are meeting obligations and identify any gaps.

[17:50] You can document other requirements in the Legal Register – this can include Service Level Agreements or even any ISO standards you’re certified to. It is advised to add any contractual requirements with customers or possibly landlords or suppliers. If you are a trade body that has a code of conduct, we recommend you include that too.

[21:00] Sarah’s top tip: When creating new processes or updating existing ones, it’s always good to look back at the Legal Register and check that any changes you’re making aren’t going to affect anything in terms of compliance.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

We have over 17 years experience of implementing various ISO’s – and we’d like to share some insight into our proven methodology.

Our regular listeners may be familiar with the term ‘isology’ from previous episodes where we’ve highlighted our online platform – the isologyhub. But what is isology exactly?

Put simply, isology is our 7-step method for implementing any ISO Standard. Join Mel this week as she breaks down each of the 7 steps, including the planning, creation and review of an ISO Management System.

You’ll learn

Our experience implementing ISO’s
The origin of isology
What is isology?
The seven steps of isology

Resources

In this episode, we talk about:

[00:31] An overview of isology – a methodology for implementing any ISO. Find out more over on the isologyhub

[01:08] How the isology methodology was created – 17 years in the making with the help of our consultants.

[01:33] A brief overview of the 7 Steps of isology

[03:05] 1^st Step – Plan: Get a copy of the Standard, determine your scope, timescales, leadership commitment, resources and selecting a Certification Body. Some choose to implement the system but leave out the badge. There are ISO’s that aren’t certifiable but good to have i.e. ISO 20400 Sustainable Procurement.

[05:38] 2^nd Step – Discover: Time to understand what you have in place already and what you’re missing – this is done through a Gap Analysis.

[06:35] 3^rd Step – Expose: This is where we look at risks and opportunities related to your desired Standard (both internally and externally). This is typically done through a SWOT and PESTLE. A Risk Register may be created to capture the findings to be addressed later. Companies are also encouraged to create a Legal Register to keep track of all their statutory, regulatory and contractual requirements.

[08:41] 4^th Step – Create: Time to review the requirements of the Standard in terms of documentation – and create what’s needed. This includes capturing your way of working with documented Procedures – make sure you have the relevant staff involved in their creation.

[10:05] 5^th Step – Launch: Once the Management System has found it’s home (usually an intranet or SharePoint) – you need to communicate it. Consider the type of launch you want and who will be involved. Make sure you encourage engagement with the Management System.

[11:18] 6^th Step – Engage: There’s little point in having a Management System if people don’t know about it or have little interest in it. You should train your staff on the Management system, so that they are aware of your policies and procedures and where to find key documents. You must verify compliance through Internal Audits – this is a requirement of any ISO Standard.

[13:09] 7^th Step – Review: Time to take a step back and look at what’s been achieved and what’s been highlighted as areas for improvement through your Internal Audits. There’s a set list of criteria in each ISO Standard to help you plan an agenda for the Review.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. While this Standard’s focus is on the manufacture of cosmetics specifically, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination.

This Standard sets out clear guidance to help you ensure you align with Good Manufacturing Practices (GMP), but how do you go about implementing it?

In our last episode of the ISO 22716 series, we bring back Derek Hall once again to share his experience with implementing ISO 22716 and offer some top tips to get you started.

You’ll learn

What considerations do you need for every aspect of the manufacturing process?
How you can apply ISO 22716’s principles to your own processes
Derek’s experience with his clients

Resources

In this episode, we talk about:

[01:10] If you want a recap on the Standard – Watch our first episode in the ISO 22716 series

[01:50] Key considerations for Personnel: Establish an Organisational Chart (with clear references for the responsibility and authority of quality issues), use a Skills matrix to help determine where training gaps are, develop procedures and processes to control what people can and can’t do in certain locations.

[08:33] Key considerations for Premises: Manufacturers should consider how the building is designed and laid out, ensure that there is a good flow for materials, have effective filling and packaging areas, introduce efficient sanitation programs, what can you do to minimise mix-ups?

[10:45] Key considerations for Premises: Manufacturing areas should only be accessed by authorised personnel, you should have effective measures in place to prevent pests – this includes the exterior as well as the interior of your buildings! You might want to consider external contractors for pest control.

[13:05] Key considerations for Equipment: Ensure all equipment is fit for purpose, efficient and has the ability to be cleaned thoroughly, make sure any calibrations are assessed and documented, equipment should be laid out in a way to ensure a flow of materials, make sure there is a clear segregation of manufacturing and storage areas.

[16:45] Key considerations for Raw Materials and Packaging Materials: – Raw materials should be well stored and clearly labelled, source your materials from trusted and accredited suppliers, have a controlled and quality approved list of suppliers and vendors (Do these suppliers provide proof of quality? Set out your minimum requirements for quality and ensure suppliers fulfill these)

[19:15] Key considerations for Production: All raw materials and manufacturing batches should be identified by a unique code for control and traceability, regular quality control inspections should take place, determine what methods are used to ensure that products meet customer expectations, samples should be taken during set stages of manufacturing to check for quality.

[21:20] Key considerations for Finished Products: Finished products should not be stored on the floor (use pallets), do what you can to minimise contamination during storage, ensure all staff know how to store products correctly and what to do if there is contamination, have defined acceptance criteria for products, have clear labelling, any faulty products should be labelled as ‘quarantined’ or ‘rejected’ and moved to a designated area.

[24:48] Key considerations for Quality Control: Ensure all raw materials, components, bulk product and packed products pass established quality tests, obtain Certificates of Analysis, have acceptance criteria forms – fill these out at all relevant stages.

[26:30] Any products out of specification should be investigated by authorised personnel, only those responsible for product quality can decide to destroy or reprocess products.

[27:25] Key considerations for Wastes: Identifiy different types of waste, ensure these wastes are disposed of in a timely and sanitary manner, have processes in place for collection, transportation, storage and disposal of waste.

[28:48] Key considerations for Wastes: Where necessary, allocate a code in line with the European Waste Catalogue, ensure that correct waste carriers licenses are received and maintained.

[29:19] Key considerations for Subcontracting: You can subcontract a lot of aspects i.e. cleaning, pest control, packaging ect. Ensure that any subcontractors are reviewed and approved, have clearly defined written agreements in place that outline roles and responsibilities (this can be a contract or just strictly in writing)

[32:10] Key considerations for Deviations: Deviations can happen anywhere, have a regime in place to investigate complaints, in the case of serious deviations that could affect health and safety – ensure you have an effective recall process in place.

[33:25] Key considerations for Complaints and Recalls: All complaints should be communicated to the plant, all complaints should be investigated and followed-up, if a recall needs to happen – ensure that appropriate steps are taken to recall and then take corrective action.

[12:05] Key considerations for Change Control: Have a change management system in place to document any changes (and define if they are fixes, enhancements or major revisions), you need to establish who can: request, approve, develop, test and implement these changes.

[36:35] Key considerations for Internal Audits: Internal audits need to be carried out in regular intervals, a minimum of 1 a year (but we recommend more!), track findings and document any corrective actions taken in a Continual Improvement Log.

[38:17] Key considerations for Documentation: Documents are used through the whole process – ensure all documents used are approved, signed and dated by authorised personnel, key documents should be version controlled.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

As discussed in last weeks’ episode, having ISO 22716 is essential if you are manufacturing or distributing within the EU. Besides being a legal requirement for certain regions, what other benefits can ISO 22716 offer?

Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to explain some of the key internal and external benefits of ISO 22716 and how it can work in tandem with other ISO Standards.

You’ll learn

The internal benefits of ISO 22716
The external benefits of ISO 22716
How can ISO 22716 work with other ISO Standards?

Resources

In this episode, we talk about:

[00:50] Adoption of standards such as ISO 22716 are often key requirements of Stakeholders

[01:15] One general benefit of implementing ISO 22716 is the ability to win new business by virtue of displaying compliance to EU regulations.

[01:40] What are the internal benefits? Firstly, it ensures you’re legally compliant

[02:10] ISO 22716 put controls in place that can reduce risk and hazards with product manufacture, storage and distribution.

[02:35] There can be tangible cost savings – Derek highlights a few clients who have taken a step back to correct and improve their internal processes, which in turn resulted in cost savings. Compliance can also help to avoid any fines

[03:29] It can help to avoid products being wrongfully distributed – which can be a very costly mistake, both in time, money and reputation.

[04:20] ISO 22716 can integrate seamlessly with other ISO Standards such as ISO 9001 (Quality Management), ISO 14001 (Environmental Management) and ISO 45001 (Health and Safety Management). They are all based on a similar framework and are designed to work together

[06:15] ISO Standards can act as a roadmap for managing a business – especially for micro businesses

[08:05] ISO Standards are all scalable and can apply to any size of business. So, if you were to acquire more sites, you can simply roll out your management system across the expanding business

[08:43] ISO 22716 is very clearly laid out and easy to follow

[09:30] What are the external benefits? It’s an internationally recognised Standard, and can be used for various marketing and tendering opportunities

[10:47] ISO 22716 is a mark of quality and displays a brands commitment to delivering quality products

[11:10] It promotes ethical behavior through your supply chain

[11:50] It promotes regulatory credibility – Ensures your products meet regulatory requirements

[12:05] It gives assurance that your product ingredients also meet legal requirements

[12:40] Some ISO Standards can reduce insurance costs – This is something we’ll explore in future episodes!

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

On the surface, ISO 22716 may be considered a niche Standard, so why it is still so widely adopted?

Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to discuss the key drivers behind ISO 22716, including legal EU requirements and other related regulations.

You’ll learn

Why is ISO 22716 used as an industry Standard?
What is ISO 22716’s relation to the Cosmetic Regulation (EC) No. 1223/2009?
Who are these regulations applicable to?
Other regulations and Standards applicable to cosmetics manaufacturing

Resources

In this episode, we talk about:

[00:42] A brief summary of ISO 22716 – watch the last episode for a full summary

[01:25] Do you still need to comply with EU directives? Short answer – Yes, especially if you sub-contract parts of your manufacturing process / packaging or export product within the EU.

[02:00] Why was the Cosmetic Regulation (EC) No 1223 created? To streamline and modernize current legislation across Europe for Cosmetics (though this can also include hygiene products i.e. soaps, toothpaste, deodorants ect)

[03:30] What is the Cosmetic Regulation (EC) No 1223? This regulation establishes rules to be complied with by any cosmetic product made available on the market – to ensure a high-level of protection of human health

[04:21] ISO 22716 is the central pillar of the Cosmetic Regulation (EC) No 1223

[05:02] A bit of background to the EU adoption of ISO 22716 – On April 21^st 2011 – ISO 22716 officially became the Good Manufacturing Practices Standard for cosmetic product across Europe. This created a harmonised approach that ensured cosmetic products are safely manufactured, stored and shipped.

[05:58] The whole regulation came into effect in July 2013. The laws for each nation had to follow this regulation – which included any relevant Standards or guidance affecting the cosmetic industry. This requirement also applies to any cosmetic manufacturers outside the EU that want to import into the EU.

[07:36] Who are the regulations applicable to? Anyone involved in the cosmetic products chain (European and non-European). This includes raw materials producers, product assembly, distributors, exporters ect

[08:05] ISO 22716 provides guidance for most parts involved in cosmetic production i.e. production, control, storage and shipment. However, it does not cover: safety for personnel (this may fall more under ISO 45001), protection for the environment, is not appliable to research & development and not appliable to the distribution of finished product

[09:55] ISO 22716 is almost 20 years old – so environmental considerations weren’t as much at the forefront of product manufacturing as they are today. Any manufacturers should be doing what they can about their impact regardless of current regulations (new versions may add guidance around this, so keep up-to-date with regulatory changes)

[11:45] Other applicable standards include: The two part ISO 16128 Standard:

ISO 16128-1: Guidelines on technical definitions and criteria for natural and organic cosmetic ingredients and products

ISO 16128-2: Describes approaches to calculate natural, natural origin, organic and organic origin indexes that apply to the ingredient categories

[13:58] COSMOS (standard Cosmetics Organic and Natural Standard) was created by many different International parties including BDIH (Germany), COSMEBIO & ECOCERT (France), ICEA (Italy), AISBL (Belgium) and Soil Association (UK). Its purpose is to define common requirements and definitions for organic and / or natural cosmetics.

[15:25] Standards are created collaboratively by technical committees made up of global experts of their respective fields – they take years to develop to establish best practice

[16:09] ISO 22716 has been approved by many regulatory bodies around the world, including the ICCR (The International Cooperation on Cosmetic Regulation), FDA (Food and Drug Administration), JCIA (The Japan Chemical Industry Association) and ASEAN Consultative Committee for Standards

[17:10] Through current regulations, there is increased responsibility in regards to: Ingredients toxicity, product labelling, more comprehensive product file and compulsory notification of new products introduced to the EU

[21:00] The current regulations have specific requirements for ingredient toxicity and product labelling

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

ISO 22716 sets out the framework for a quality management system for anyone involved in the manufacture of cosmetics and other healthcare related products. This is not only limited to production but also the control, storage, and transportation of products, including the purchase of raw materials, components and packaging material.

While this Standard’s focus is on the manufacture of cosmetics, many of the requirements can apply to any manufacturing process, especially those that involve a risk of contamination.

Today, Mel is joined by Derek Hall, a Senior Consultant here at Blackmores, to talk through the main structure of the Standard and how it can be applied.

You’ll learn

What is ISO 22716?
Who does ISO 22716 apply to?
How is ISO 22716 structured?
How ISO 22716 can be applied

Resources

In this episode, we talk about:

[00:35] A description of ISO 22716 Good Manufacturing Practices – A supporting Standard for the manufacture of cosmetics

[01:20] Why are we talking about such a niche standard? It’s one of our most popular standards via website enquiry, so we’d like to share our knowledge 😊

[02:20] There is an EU directive pushing for the adoption of this Standard where applicable

[03:00] A more in-depth summary of ISO 22716 – Why it’s so important and why it was made

[04:01] What does ISO 22716 cover? Guidelines and practical advice on the management of the human, technical and administrative factors affecting product quality.

[04:58] A summary of the 17 clauses within ISO 22716

[07:55] What are the core elements of ISO 22716? Personnel, Premises and Equipment, Operations and Material Management, Quality Control and Cosmetics Quality Management System

[08:50] Personnel – Key considerations include: Restricted areas free from food and drink, visitor supervision, personnel authorisation, personnel uniforms (removal of rings, hair restraints, safety glasses, gloves ect)

[11:25] Premises and Equipment: The layout of buildings and equipment placement need to be controlled, controls for sanitisation and cleaning, guidance for storage, proper access to materials and equipment.

[13:27] Premises: Pest control – should be very controlled to prevent contamination. This can be controlled via the building layout and cleaning controls. A pest control program should be created and followed. This extends to the exterior of your building too!

[15:45] Equipment: Automated systems should be controlled in-line with ISO 22716. Equipment should be suitable for purpose and capable of regular cleaning and maintenance to avoid contamination.

[17:02] Materials Management and Operation: How well do you control your materials? What controls do you have in place for manufacturing and packaging? How good is your storage? What is your delivery process? Do you keep documentation of all your purchasing and quality checks?

[18:15] Materials Management and Operation: Stock – Consider how you manage and store stock, include regular checks to ensure it’s all well within date. The Operations area in particular aligns with ISO 9001 – Quality Management.

[19:40] Materials Management: You need to set the criteria for quality during different stages of manufacturing i.e. specifications for raw materials, components and packaging material. This should also include release parameters.

[21:00] Materials Management criteria can be set out in a checklist. Mel mentions ‘The Checklist Manifesto’ as a recommended read

[24:15] Materials Management: Make sure you store in a way that avoids any contamination or mix-ups. Ensure all containers are stored off the floor. Use clear labelling to show if they are accepted, rejected or quarantined

[25:37] Operations: Should be carried out according to manufacturing documentation i.e. suitable equipment, product formula, details of the product process ect.

[27:15] Quality Control: Consists of sampling, specification testing, out of spec investigations and release. You may subcontract out quality control – in which case, you must ensure you get proof that they are conducting adequate tests.

[29:13] For subcontractors – Ensure you have a written contract OR agreement in place. If your subcontractor is subcontracting along the work, you need to ensure that process is controlled

[31:32] Deviations: These can happen at any point in operation and can be both internal and external in origin

[32:09] Complaints and Recall: You need to have processes in place to log and deal with complaints and recall. You should also regularly test your product recall process

[33:20] Change Control: Making sure you have effective processes and documentation to control any changes to existing operation. I.e. if you get different machinery that changes mixing times

[34:50] Internal Audits: You need to have an internal audit program in place and have competent independent personnel that can carry those audits out. This could be sub-contracted out

[36:10] Documentation: You will be documenting all throughout the manufacturing process, it’s integral. Ensure all staff know the importance of it and how to complete it correctly.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episodes:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Today we’re joined by Philip Bailey, Managed Services Director at PMC Retail, to talk about PMC’s experience with ISO 27001, from implementation to on-going maintenance.

PMC is a leading retail IT services and solutions provider, who recognised the growing need for formal Information Security certification. They succeeded in achieving certification to ISO 27001 in 2021, now almost a year down the line, we catch up with Phil to find out what they’ve learned, benefits of certification and some tips for those looking to implement ISO 27001.

You’ll learn

Who are PMC retail?
How do PMC currently manage their ISO 27001 certification?
How has the ISO Support Plan helped?
What have they learned from implementing the standard?
What are the benefits of implementing ISO 27001?
ISO 27001 Top tips from Phil

Resources

In this episode, we talk about:

[01:03] An interesting fact about Phil – He started in electronic engineering and was involved the build of a system designed to measure the mirrors used in a telescope that was carried on the Discovery shuttle!

[01:44] Who are PMC Retail?

[03:49] An example of one of PMC’s projects – Pulling together legacy systems, updating them to newer technologies while maintaining the legacy data.

[04:40] Learn about Phil’s role at PMC

[05:45] PMC now certified to ISO 27001 – One of the most popular ISO’s globally in recent years. It’s becoming something of a mandatory requirement in the tech space when bidding for contracts

[06:31] How do PMC manage their ISO 27001 certification – Created a small team dedicated to the task of achieving certification – along with some help from us 😊 Following certification they onboarded a Compliance Governance Manager to keep up with Internal Audits and other ISO maintenance.

[08:25] How has the ISO Support plan helped? – Blackmores helped to implement the standard, and were very familiar with their system and way of working. Great to have a wealth of knowledge to tap into.

[09:00] PMC managed to implement the standard in just 6 months!

[10:25] What did PMC learn from their experience? It wasn’t an easy task! Getting leadership commitment from the start made a huge difference.

[11:50] The benefits PMC have experienced by implementing and maintaining ISO 27001: Being able to identify risks and put actions in place to mitigate them. Certification demonstrates a robust security infrastructure to third parties. Establishes more credibility to customers and partners. They are able to see a pathway for business growth, utilising the certification.

[14:30] ISO 27001 has helped to collate and bolster their existing Information Security structure – Having a library of resources, unified policies and procedures, company wide Objectives, and better understanding of measuring & managing risks.

[16:15] PMC ensure that staff complete annual training – as required by the Standard.

[17:10] Phil stresses that you can’t just stay still with Information Security is concerned, you need to be aware of new risks and make sure those in your business are also aware and know how to react.

[18:00] Top tips from Phil: Get Leadership commitment early on. Build yourself a Management Team. Get help from an experienced external party. It’s not a walk in the park, and needs focus to achieve in a reasonable amount of time.

[19:42] Phil’s book recommendation: The magic of thinking big by David J. Schwartz.

[21:42] Phil’s favorite quote: “You’re never too old to set a new goal, or too old dream another dream”

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

The work doesn’t stop once you get ISO certified, there is a requirement to complete an annual surveillance audit to ensure your Management System continues to meet the requirements of the standard(s).

Last week Mel covered some basic preparation you can do ahead of a surveillance audit, but what should you expect on the actual audit day?

Today, Mel shares 10 top tips to help you prepare and ensure your next surveillance audit runs as smoothly as possible.

You’ll learn

What is a surveillance audit?
What to expect during the surveillance audit
Considerations for remote vs on-site audits
What evidence do you need to have prepared?

Resources

In this episode, we talk about:

[00:36] A description of a surveillance audit

[02:00] A summary of the 10 top tips

[02:40] There is no right or wrong way to prepare for a surveillance audit – but the following tips will be applicable regardless of the standard your certified to

[03:30] Tip 1: Be Prepared – A summary of what Mel covered in the previous episode

[05:40] Tip 2 – The opening Meeting – Be sure to have all people involved in the audit present at the meeting. It’s advised to have a member of the leadership team present. Here the Auditor will explain the different types of audit findings.

[08:00] Tip 3 – Audit questions – Similar to your Stage 1 and 2 Assessment, you will be asked a lot of questions. Try to be specific with your answers, and don’t be afraid to ask for clarification. Don’t worry if you don’t know the answers to certain questions outside of your area of expertise, simply direct them to the correct individual who can answer. You are within your rights to seek clarification on findings – Do not argue with the auditor, simply ask for justification on findings if you’re confused as to why they’re being raised.

[13:05] Tip 4: Keep on track – It’s in everyone’s best interest to stick to the Agenda.

[13:35] Tip 5: On-site Surveillance audits – Do a floor walk before the auditor arrives to check that you’re following your procedures. Make sure reception knows that the Auditor is arriving, and follows any of your standard visitor procedures. Try to book a room to base the audit in to avoid them overhearing any unnecessary chatter and to allow the auditor and auditees some privacy.

[16:05] Tip 6: Remote Surveillance Audits – Ensure that you follow any company remote working procedures. Ensure you have a good wi-fi connection, all attendees should be visible on camera but be muted when not speaking. Make sure everyone has access to the necessary documents while off-site.

[17:15] Tip 7: The Auditor – They are human, and they are here to support you to ensure you are doing what you say you’re doing. They are experts on their Standards and it’s advised to foster a friendly relationship with them. But please be aware that they shouldn’t be sending you reports from personal email addresses, be left unattended on-site and shouldn’t be taking any information off-site – show evidence on screen / in-person during the audit.

[20:20] Tip 8: The closing Meeting – Held at the end of the day. Listen to the feedback and findings from the auditor – they are there to help you improve. Feel free to ask for further clarification if needed. It’s advised to have everyone at the opening meeting present at the closing meeting.

[22:38] Tip 9: Evidence needed – You will typically need access to your audit schedule, audit reports and Management Review Minutes. You may also need various policies and procedures. Ensure that all documents are version controlled and any applicable branding is consistent.

[24:10] Tip 10: Enjoy it! – If you’re doing everything you say you’re doing, then you should enjoy showing off your Management System. The resulting report should be seen as an opportunity to continually improve – the auditor only wants the best for your business.

We’d love to hear your views and comments about the ISO Show, here’s how:

Share the ISO Show on Twitter or Linkedin
Leave an honest review on iTunes or Soundcloud. Your ratings and reviews really help and we read each one.

Subscribe to keep up-to-date with our latest episode’s:

Stitcher | Spotify | YouTube | iTunes | Soundcloud

Consultancy service

Let us do it for you

Online membership

DIY with our isology Hub

Beyond certification, we take great pride in delivering ISO support solutions which help our clients improve their productivity and profitability in a risk-controlled way.

We are your dedicated support team for all ISO compliance matters from internal audits to updating Health, Safety and Environmental Legal compliance.

About Blackmores

Our 7 Steps to Success

The Blackmores ISO Roadmap is a proven path to go from idea to launching your ISO Management System.

Whether you choose to work with one of our isologist consultants or work your own way through the process on our isology Hub, we’re certain you’ll achieve certification in no time!

LEARN MORE

What our clients have to say

The support and advise I get from our assigned auditors is immense. Forward planning for the following year is great and they are flexible and always willing to help.

Kalil Vandi

“Blackmores have assisted us almost since the start of our adoption of the ISO 9001 quality standard. Their input has improved our processes since the start, and enabled our goal of continuous improvement to be achieved. The people are also extremely easy to get on with, and they really understand our business, giving us a great deal of confidence in their advice.”

David Gibson

Photon Lines Ltd

“Blackmores are the perfect bridge between working on your ISO as an individual or company, to being audited each year. We find that any queries we have are covered and we feel sure that we have everything as needs be before going into an external audit.”

Mandy Welsby

Jaama Ltd

“We have been extremely impressed with the service and support provided by Blackmores. There knowledge and assistance through out our ISO journey has been amazing!”

Philip Hannabuss

Dome Consulting

“Blackmores have really kept us on our toes with the broad scope and level of detail they apply to our internal audit schedule. They always stay abreast of ISO standard changes and help us to adapt our processes and documents to embrace these changes accordingly. Having Blackmores shadow our external audits provides invaluable confidence and peace of mind – would highly recommend their services!”

Phil Geens

Kingsley Napley

“Our ISO 27001 certification project has gone so well, that there was no doubt in who we were going to ask to help us with our aspirations of becoming ISO 14001 certified. It’s been an absolute pleasure working with Blackmores, and we are really looking forward to working with them for the foreseeable future.”

dotdigital

Trusted by leading organisations across all sectors, we support companies of all sizes in any location.

Are you ready to start your ISO journey?

Listen to our Podcast

Welcome to the ISO Show podcast, dispelling myths and sharing tips for success to improve your business with ISO Standards. Join us to hear interviews with successful business leaders as they share their ISO journey with you.

Get top tips via audio master classes “ISO Steps to Success” on the most popular ISO Standards.

Ready to go carbon neutral... And achieve ISO Standards?

Welcome to Carbonology®

The proven method for achieving your carbon goals, aligned with ISO 14064 (carbon verification) and PAS 2060 (carbon neutrality)

The creators of isology®

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

You’ll learn

Resources

In this episode, we talk about:

Let us do it for you

DIY with our isology Hub

About Blackmores

Our 7 Steps to Success

What our clients have to say

Kalil Vandi

David Gibson

Mandy Welsby

Philip Hannabuss

Phil Geens