Consulting Process

Inside Our First Consulting Meeting

Every project starts with a conversation, not a proposal. Before we talk timelines or pricing, we need to understand something a template can never tell us: how your company actually works.

We’re Not There to Pitch

The first meeting isn’t a sales call in disguise. We ask about your structure, your industry pressures, what’s already documented and what only lives in someone’s head. Half the value of that first hour is us listening, not talking.

The Question That Changes Everything

At some point we ask: “Who would actually notice if this system stopped working tomorrow?” The answer tells us more about scope and priority than any org chart. It’s usually not who people expect.

What You Walk Away With

Not a generic quote. A realistic sense of what the project actually involves for a company your size, in your industry ‚Äî and whether it’s a six-week job or a six-month one. If it’s not a fit, we’ll tell you that too.

Let’s Have That First Conversation

No commitment, no generic pitch — just a real look at what certification would take for your business.

Documentation

How We Turn a Blank Page Into a Procedure You’ll Actually Use

Most procedures end up in a folder nobody opens. Ours don’t, because nobody writes them alone ‚Äî least of all us.

The First Draft Is Never the Real Answer

We write a first version based on what we’ve seen work elsewhere and what the standard requires ‚Äî then we hand it straight back to the people who’ll actually follow it. Their reaction tells us more than our first draft ever could.

“We Don’t Actually Do It Like That”

That’s the sentence we’re hoping to hear. It means the feedback round is doing its job ‚Äî catching the gap between the process on paper and the process in practice, before an auditor catches it instead.

Two or Three Rounds, Not Twenty

Endless revision is its own failure mode. We aim for a handful of focused feedback loops, then lock it in ‚Äî because a procedure that’s still being tweaked six months later was never really adopted in the first place.

Tired of Documentation Nobody Reads?

We build procedures your team actually follows, not paperwork built for a shelf.

Gap Analysis

What a Gap Analysis Really Tells You

A gap analysis sounds like a score. It’s really a map ‚Äî and the destination matters a lot more than the number.

It’s Not Pass or Fail

Nobody starts a certification project already compliant ‚Äî that’s the whole point of the project. We’re not there to grade you against the standard; we’re there to find out exactly how far the distance is, and where.

The Gaps That Don’t Show Up on Paper

Some gaps are obvious ‚Äî a missing policy, a control nobody’s implemented. The ones that matter most are usually quieter: a process that exists but that only one person understands, or a control that’s documented differently than it’s actually run.

What Comes Out the Other End

Not a scary list of failures ‚Äî a prioritized plan. Some gaps are quick fixes, some need real work, and some aren’t gaps at all once we understand your context. That’s what turns an analysis into a roadmap.

Want to Know Exactly Where You Stand?

A clear, honest gap analysis is where every one of our projects begins.

ISO 27001

The Statement of Applicability, Demystified

If there’s one document that intimidates people starting ISO 27001, it’s this one. It’s also one of the most misunderstood.

A List, Not an Essay

At its core, the Statement of Applicability is a decision record: for every control in the standard’s reference list, whether it applies to you, and why. It’s meant to be precise, not long.

“Not Applicable” Is a Real Answer

Companies often assume every control must be implemented. It doesn’t. A control that doesn’t fit your risk profile can be marked not applicable ‚Äî as long as the reasoning holds up, which is exactly what we help you build.

The Document Auditors Come Back To

It’s referenced constantly during certification ‚Äî every other document gets checked against it. Getting it right early saves you from rewriting half your system later.

Building Your SoA Shouldn’t Be Guesswork

We’ve built these for companies of every size and sector ‚Äî let’s build yours right the first time.

GDP — Good Distribution Practice

Keeping Medicines Safe in Transit

A medicine can meet every quality standard in the factory and still be compromised before it reaches a patient. GDP exists for everything that happens in between.

Temperature Is Just the Start

Everyone thinks of cold chain first, and it matters — but GDP compliance covers far more: who handled the shipment, how it was stored between vehicles, what happens if a delivery is delayed overnight.

The Paper Trail Behind Every Delivery

Every step needs to be traceable — not because of bureaucracy, but because a break in the chain of custody is exactly what an inspector is trained to find. We help transporters build that trail without slowing operations down.

What We Focus On

We work specifically with companies transporting medicines under the EU Directive — closing the gap between daily operations and what an authorization inspection expects to see.

Ready for Your GDP Authorization?

We help medicine transporters build the documentation and procedures inspectors expect to see.

ISO 22000 / HACCP

Inside a HACCP Audit

Food safety audits have a reputation for being about paperwork. The ones that matter are actually about a handful of specific, physical points in your process.

Finding the Points That Actually Matter

Not every step in a food process is a critical control point, and treating them all as equally important dilutes attention from the ones that genuinely are. Identifying the real ones is most of the work.

Why We Spend More Time on the Floor Than in the Office

A HACCP plan looks solid on paper until you watch how a shift actually runs. Timing gaps, temperature logs filled in late, a step that skips a check when the line is busy ‚Äî that’s where the real risk lives.

Closing the Gap Before It’s a Recall

Every finding gets ranked by actual food safety risk, not by how easy it is to fix. That’s the difference between an audit that protects your certificate and one that protects your customers.

Let’s Look at Your Critical Control Points

From gap analysis to certification, we know what a HACCP auditor is really looking for.

ISO 42001

Building an AI Management System That Isn’t Just a Policy Binder

ISO 42001 is new enough that most companies building an AIMS are figuring it out in real time. We’re building alongside them, not from a rulebook that’s been tested for twenty years.

Governance for Something That Keeps Changing

Most management systems govern something stable. AI systems get retrained, updated, and repurposed constantly — so the governance framework has to account for change as the normal state, not the exception.

Where Companies Get Stuck

Usually not on the technical side ‚Äî on ownership. Who’s accountable when an AI system behaves unexpectedly often hasn’t been decided anywhere, on paper or otherwise. That question gets answered early in our process, not left until an incident forces it.

What Makes It Actually Work

A framework the team responsible for AI systems can actually use day to day — not just a document that satisfies an auditor once a year and gets ignored the other 364 days.

Get Ahead of AI Governance

ISO 42001 is still new territory ‚Äî let’s build your AIMS with a partner who’s building it too.

Risk Assessment

Risk Assessment: The Step Everyone Underestimates

Ask ten companies what their biggest risk is, and eight will name the same one or two things — usually not the ones that end up mattering most.

Not Every Risk Deserves the Same Attention

A long list of risks with no ranking is just anxiety on paper. The value of a real risk assessment is deciding, with evidence, what actually deserves resources first ‚Äî and what genuinely doesn’t.

The Bias We Watch For

People inside a company tend to overestimate risks they’ve personally experienced and underestimate the ones they haven’t. An outside review catches that blind spot ‚Äî which is half the reason this step shouldn’t be done alone.

From a List to a Plan

The output isn’t a spreadsheet that gets filed away ‚Äî it directly shapes what gets built next: which controls, which procedures, which training. Everything downstream depends on getting this part right.

Know What Actually Deserves Your Attention

A properly run risk assessment is the foundation of every system we build.

ISO 14001

What We Actually Look At During an Environmental Review

Ask a company about its environmental impact and most point straight to emissions or waste. Those matter ‚Äî but they’re rarely the whole picture.

Beyond the Obvious

Water use, packaging choices, supplier logistics, even how equipment is maintained ‚Äî all of it counts toward your environmental footprint under ISO 14001, whether or not it’s ever been written down anywhere.

Where Smaller Companies Get Surprised

Larger manufacturers usually already track emissions closely. Smaller companies are often surprised to learn their most significant impact is something ordinary ‚Äî packaging waste, or a delivery pattern that’s never been questioned.

Turning Impacts Into Priorities

The review isn’t about listing everything that touches the environment ‚Äî it’s about identifying which impacts are significant enough to actively manage, and building the system around those.

Know Your Real Environmental Priorities

Let’s find out what actually matters for your operation, not just what’s easy to measure.

ISO 45001

Where Workplace Risk Really Hides

Ask about workplace hazards and people picture machinery, chemicals, heights. Most of what shows up in our assessments is quieter than that.

The Hazards Nobody Reports

A near-miss that didn’t hurt anyone rarely gets written up ‚Äî which means it never enters the official record, even though it’s exactly the kind of event a good safety system should be learning from.

Why We Talk to Workers, Not Just Managers

Management sees the safety policy. Workers see the shortcut someone takes when the supervisor isn’t around. Both perspectives matter, but only one of them usually gets asked.

From Hazard to Actual Control

Identifying a hazard is the easy part. The system only works if it leads to a control someone actually follows — not a sign nobody reads or a rule nobody enforces.

Find the Risks Your Reports Don’t Show

A proper workplace risk assessment looks past the obvious hazards to the ones that actually cause incidents.

Internal Audit

What a Day of Internal Audit Actually Looks Like

Most people picture an audit as someone with a clipboard hunting for what you did wrong. After hundreds of internal audits, we can tell you it’s a very different experience in practice — and knowing what to expect changes how a team shows up on the day.

Before We Walk In

A good audit starts days before anyone sets foot on site. We agree the scope with you — which departments, which processes, which locations — and we ask for the records we’ll want to see. No surprises on the day, for you or for us. The goal isn’t to catch anyone off guard; it’s to see the system as it actually runs.

Walking the Floor

This is where most of the real information shows up — not in the documents, but in the conversations. We talk to the people actually doing the work, not just the manager who signs off on it. A procedure can read perfectly on paper and still not match what happens at 7am on a Tuesday. That gap is exactly what we’re there to find.

What We’re Really Listening For

After enough audits, you stop looking for missing signatures and start listening for hesitation — the moment someone pauses before answering a simple question about their own process. That pause is usually worth more than any checklist. It tells us where the system is memorized versus where it’s genuinely understood.

The Part Nobody Expects

Almost every company assumes the biggest risk is in the department under the most pressure — production, or whichever team is growing the fastest. More often than not, it’s somewhere quieter: a process nobody’s touched or questioned in years, simply because it’s never caused a visible problem yet. Finding that before a certification auditor does is the entire point.

Want a Clear Picture of Where You Stand?

We run internal audits for companies we’ve certified and for companies certified by someone else. Either way, you’ll know exactly what will and won’t hold up.