RKMS

30/10/2026

We've spent October looking at risks and opportunities.

Next month, we're moving onto what the organisation is actually trying to achieve.

ISO 9001 Clause 6.2 – Quality Objectives and Planning to Achieve Them.

And there's one thing we'll definitely be talking about:

Objectives that exist purely because someone thought ISO required three of them.

“Improve customer satisfaction.”

“Reduce complaints.”

“Improve quality.”

They sound good.

But what does success actually look like?

How will you measure it?

Who's responsible?

What resources are needed?

And what happens when the objective isn't being achieved?

That's where we're heading next.

29/10/2026

A risk register full of green boxes doesn't necessarily mean you've got low risk.

Sometimes it means nobody has challenged the scoring for a while.

That's something worth thinking about.

A risk starts as high.

Controls are introduced.

The score comes down.

Six months later the circumstances change, the business grows, a key employee leaves or a supplier starts struggling.

But the spreadsheet still says green.

Risk management only works if the information behind it reflects what's actually happening in the business.

The colour of the box isn't the important bit.

The conversation behind it is.

27/10/2026

Here's a scenario we see in growing businesses quite regularly.

A company wins a big new customer.

Great news.

Sales increase.

Turnover increases.

The order book looks healthier.

It's an obvious opportunity.

But the same opportunity can introduce risk.

Can production cope?

Do you have enough competent people?

Can suppliers support the increased demand?

Will lead times change?

Does one customer now represent too much of your turnover?

Will quality suffer if capacity gets stretched?

That's why risks and opportunities shouldn't always be treated as two completely separate things.

The same decision can create both.

Good planning means understanding both sides before growth creates problems you weren't expecting.

24/10/2026

What's the biggest risk in your Quality Management System?

It might not be the one with the highest score.

It might be the one nobody talks about because:

“It's always been fine.”

“We've never had a problem.”

“That's just how we do it.”

“They've worked here for years.”

“That customer would never leave.”

“That supplier always delivers.”

“We'll sort it if it happens.”

Past performance is useful evidence.

But it isn't a guarantee of what happens next.

Sometimes the risks worth discussing are the ones the business has become too comfortable with.

23/10/2026

Something businesses don't always realise when choosing an ISO consultant:

We're not the Certification Body.

And that's actually important.

The consultant's role is to help you develop, implement and maintain a system that works for your organisation and meets the requirements of the standard.

The Certification Body independently assesses it.

Those roles need to remain separate.

It also means that when something comes up during certification, your consultant can help you understand the requirement, review the evidence and, where appropriate, challenge an interpretation professionally.

After more than 30 years in this industry, we've worked with a wide range of Certification Bodies.

Good professional relationships matter.

But so does knowing when to ask:

“Can you show us how you've reached that interpretation?”

22/10/2026

An auditor asking a question isn't automatically telling you that something is wrong.

That's worth remembering during certification audits.

“Have you considered…?”

“How do you manage…?”

“What happens if…?”

Those questions are often exactly that:

Questions.

You should be able to explain your approach, show your evidence and, where appropriate, explain why you've decided a particular risk doesn't require further action.

ISO doesn't mean agreeing with every hypothetical scenario somebody puts in front of you.

And an auditor isn't there to design the solution for you either.

A good audit should test whether your approach meets the requirement and is effective.

That's why understanding your own system matters.

Evidence and reasoning beat panic every time.

21/10/2026

Risk assessment doesn't need to begin with a complicated scoring matrix.

Sometimes five questions will get you surprisingly far:

What could actually happen?

What would the impact be?

What are we already doing to prevent or control it?

Do we know whether those controls are working?

Do we need to do anything else?

Then decide how much structure the answer needs.

The mistake is starting with the spreadsheet and trying to make the business fit it.

Start with the conversation.

Use the tool to record and support the thinking afterwards.

19/10/2026

A business can have excellent procedures and still have a fairly significant risk sitting in plain sight:

“Only Dave knows how to do that.”

Every business seems to have a Dave.

It might actually be Sarah, Mohammed or Steve, but you know the person.

They've been there forever.

They know the customer.

They know the machine.

They know the workaround.

They know which spreadsheet does what.

And because they're brilliant at their job, nobody worries too much about it.

Until they're on holiday.

Or off sick.

Or leave.

Competence isn't only about whether someone knows how to do something.

Sometimes the risk is whether anyone else does.

Worth thinking about.

18/10/2026

UKAS-accredited and non-accredited ISO certification are often discussed as though one is automatically “real” and the other isn't.

That's not a particularly helpful way to look at it.

The better question is:

What does your organisation actually need the certification to achieve?

For some businesses, a reputable non-accredited route can support internal structure and demonstrate commitment to a management system.

For others, particularly where customer, tender or procurement requirements specify accredited certification, UKAS accreditation may be essential to achieving the commercial objective.

We've broken down the difference - and why transparency matters - on the RKMS blog.

👉 https://www.rkmsuk.co.uk/blog/accredited-certification-and-iso/

Confused by ISO options? Discover how accredited certification and reputable non-accredited ISO build trust, support SME compliance and strengthen your supply chain.

17/10/2026

Now that ISO 9001:2026 is here, we're interested in how businesses are approaching the transition.

Are you already looking at the changes?

Or is it firmly a job for later?

Where are you with ISO 9001:2026?

Already reviewing changes
Waiting for CB guidance
Haven't looked yet
Not currently certified

No wrong answer.

We'll be covering the changes and transition practically over the coming months — without turning every minor wording change into a crisis.