From paper system to dual ISO certification, in eight weeks.
A UK technology services SME on its third attempt at a quality management system. Two prior internal rewrites had stalled. Auditor due in two months. Information security control evidence scattered across three platforms. The team had no path that didn't involve "another year of consultancy".
What we did
- 01Wrote the integrated 9001 + 27001 management system from scratch — a single document set, not a folder of templates.
- 02Built the evidence library — control register, training matrix, supplier DD packs — keyed to the clauses that needed them.
- 03Ran two internal audit cycles inside the eight-week window.
- 04Sat on the client side of the table for the certification audit.
The audit took two days. The nonconformity list ran to four observations, all minor. We had the certificates within a fortnight.