As a practicing consultant and former assessor, I see a lot of organisations who utilise some sort of external assistance with the document elements of implementing management system standards.
My conclusion is that used correctly a documentation toolkit can be a valuable weapon in an organisation’s approach to adopting a management system standard. However, used badly it can result in a management system full of overly beauacratic documentation that bears no relevance to the business.
So what would be considered a right approach to using a documentation toolkit?
Documentation toolkits provide the organisation with a potential solution to the documentation part of a standard’s requirements, and will provide the organisation with an example document set that maps to the requirements of the standard in question. They save weeks of work and are a great tool if resource is scarce or time is of an issue.
This in itself then can be as simple as filling in each document, and you have a compliant management system?
Wrong. The idea of the documentation toolkit is to provide comprehensive templates and guidance for meeting the requirements of the management standard – it doesn’t reflect the nature of the organisation that purchases it.
Organisations are unique. They can be large or small, with differing business, legal, regulatory and contractual requirements. Different organisations have specific processes, procedures and practices or industry requirements.
A documentation toolkit requires alteration to fit the organisation concerned, customisation and re-writing to make it relevant to the situation where is applied.
A documentation toolkit available for retail purchase will obviously be generic, and therefore it can never be the case of “fill in the gaps” for compliance. Smaller organisations may need to cut something down from what is sold, and larger organisations will have to break it down and develop it further. Equally whilst the standard will dictate a certain amount of mandatory procedures and policies, the organisation will have to develop more for its practical processes and ensure they are consistent. For example, an ISMS is only part of a wider organisational management system, not a closed system in itself, and therefore it makes little sense for the organisation to have consistent ISMS documentation, and then different formats and processes elsewhere.
As an assessor it would greatly sadden me when I assessed an organisation and realised that it wasn’t their management system at all – but a consultancies – and that I had seen a carbon copy repeated in multiple organisations.
Organisations sometimes forget that management standards are not simply about writing as many documents as you can, but are about more than this, changing culture, training, management commitment, resources, generating records and so on – management systems are about more than writing documents.
Finally, a documentation toolkit isn’t a “silver bullet”, but it is a valuable tool for those organisations who need to find a structure and approach that they can use to move forwards quickly, without having to invent procedures from scratch.
Indeed, many organisations find and take a great benefit from using documentation toolkits as a backbone for their management system and will be able – with customisation – to create a bespoke management system that works for them.
Documentation toolkits, used correctly, can be a great part of an organisation’s quest to gain certification to a management system. But, you have to remember – it isn’t the tools you buy, it’s what you do with them that counts.
IT Governance’s management systems documentation toolkits have been developed by real expert and practitioners and come with a 12-month support. A demo version is available from www.itgovernance.co.uk/free_trial.aspx.