Many organisations recognise the same challenges. Important knowledge often resides with individual people, responsibilities can be unclear, working methods vary, and leadership lacks full visibility. These are frequently signs that the organisation lacks clear process orientation.

Process orientation is not about producing more documentation. It is about creating better flow in the work, clarifying responsibilities and laying the groundwork for continual improvement.

When organisations work in a more process-oriented way, they typically become less vulnerable, more efficient and better equipped for growth and long-term organisational development.

Process orientation is about viewing the organisation as a whole made up of work processes that create value for the customer. Work is governed by how tasks flow through the organisation, not simply by departments, roles or systems.

When an organisation works in a process-oriented way, responsibility follows the process from start to finish. Working methods become standardised, processes are kept alive and developed continuously, and improvement becomes a natural part of the culture.

This is an important distinction. Many believe process orientation is a project carried out once, when in reality it is about long-term process management. In practice, it is a management model and a way of working that must be sustained over time.

A lack of process orientation can have significant consequences, both operationally and strategically. There are several typical situations that commonly arise when processes are not clearly defined.

When important knowledge exists only in one person’s head, the organisation becomes vulnerable. When that person leaves, much of the understanding of how the work is actually carried out goes with them. The consequence is often considerable lost time, inefficient onboarding and a high risk of errors.

When responsibilities are unclear, tasks are left unattended. Customers wait, internal clarifications take time and follow-up does not happen. This can cause frustration both internally and externally. In the worst case, customers may be lost.

Different working methods produce different levels of quality. This can work in the short term, but it makes the organisation unpredictable and difficult to improve. Standardisation is essential for ensuring quality.

Without visible processes, it becomes difficult to understand how work is actually carried out. Decisions are made on gut feeling rather than facts. This makes the organisation less robust.

A clear example of how critical good processes are can be found in healthcare.

In the period 2016–2017, 3,557 medication errors were reported in Norwegian hospitals, and 62 per cent of these resulted in harm to patients. Some cases had serious consequences, including fatalities.

The cause is linked to unclear, inconsistent or inadequate processes. The point here is important. Errors do not necessarily occur because people are careless. They often occur due to a lack of process orientation.

This applies not only to healthcare. In every industry, poor processes can cost money, quality, trust and in the worst case — lives.

One of the most well-known examples of successful process orientation is Toyota.

When Toyota took over a former General Motors factory in the 1980s, they used many of the same employees, in the same facilities, but with a completely different working methodology.

The results were dramatic. Absenteeism fell from around 20 per cent to 2 per cent. Quality improved significantly, and lead times were drastically reduced.

The difference did not lie in new technology or more staff. It lay in standardised processes, clear responsibilities and a culture of continual improvement.

This is the essence of process orientation.

Many organisations have extensive documentation but still lack good processes.

Documents and processes serve different purposes. Documents are static. They must be read, interpreted and understood. Processes are visual and give a faster overview of who does what, when and how.

This is particularly important in onboarding, training and cross-functional collaboration, where clarity and accessibility are essential.

Documents still play an important role, particularly in quality management, but they should support processes, not replace them.

In short, it is about letting the process come first, with documents serving as support where needed.

Organisations that succeed with process orientation often experience several concrete benefits.

They become less vulnerable to absence and staff turnover. They reduce errors and non-conformities. They create more consistent quality. They gain a better foundation for process improvement and can work more systematically to optimise workflow. And they become more scalable as the organisation grows.

For management, this means a better basis for decision-making and less time spent on non-conformities and fire-fighting.

For employees, it means less uncertainty, clearer responsibilities and a simpler working day.

For customers, it means better quality and more predictable delivery.

Process orientation requires more than drawing up a process map.

To succeed, four fundamental building blocks must be in place: management commitment, clear process ownership, sound process mapping that makes processes visible, and continual improvement.

These four elements must work together.

Perhaps most important of all is culture. To succeed, processes must be actively used, owned by the organisation and improved over time.

This is not a one-off project. It is a long-term journey of change that often takes several years.

The most important thing is to begin.

A good first step is to identify one critical process in the organisation and ask a few straightforward questions. Is responsibility clear? Is the workflow visible? Does everyone work in the same way? Do we know where the bottlenecks are?

The answers often provide an honest picture of how mature the organisation is, and where the greatest potential for improvement lies.

Process orientation is not about changing everything at once. It is about creating clarity, building good working habits and laying the foundation for continual improvement.

The earlier you start, the sooner the organisation can reduce vulnerability, strengthen quality and build a more robust and efficient operation.

Many organisations associate the management review primarily with a requirement in the ISO standards. But organisations that derive the greatest value from the process see it as far more than a mandatory activity before an audit. When the management review is used correctly, it becomes a strategic tool that helps leadership evaluate the organisation’s direction, identify risks and ensure continual improvement.

Here we take a closer look at what a management review is, why it matters, and how organisations can carry out the process effectively with the help of a digital management system such as Certain QMS.

A management review (also referred to as a management evaluation) is a structured and planned activity in which the organisation’s top management assesses whether the management system remains suitable, adequate and effective.

This is a central requirement in ISO standards such as ISO 9001, ISO 14001, ISO 45001 and ISO 27001. The purpose is to ensure that the management system supports the organisation’s strategy and contributes to achieving its objectives.

When the standards refer to suitability, this concerns whether the way the organisation operates continues to align with its strategy and needs. Adequacy concerns whether the organisation has the resources, structures and competence required to succeed. Effectiveness concerns the results — whether actions, decisions and processes are actually delivering the desired effect.

Many organisations carry out the management review once a year, but it is also possible to split the process into quarterly or half-yearly reviews. What matters most is that the process is carried out regularly and that it is actively used by management.

A common misconception is that the management review is simply an extended status meeting.

In reality, the review should lift the gaze above day-to-day operations and provide a holistic picture of the organisation. The purpose is not to discuss individual incidents or isolated challenges, but to assess how the organisation is functioning as a whole.

Management should be able to answer questions such as:

• Are we moving in the right direction?
• Does the management system support our strategy?
• Are there risks we cannot accept?
• Is there a need to adjust course?
• Are the actions we are implementing delivering the desired effect?

The review should therefore serve as a strategic checkpoint at which management assesses the organisation’s overall development.

When the ISO standards require the organisation to review its management system, this encompasses far more than documentation and procedures.

A management system does indeed consist of processes, roles, responsibilities and digital tools. But it also concerns how the organisation actually functions in practice.

How are decisions made? How is risk managed? How are non-conformities followed up? How does learning and improvement happen? And how does the organisation behave when placed under pressure?

Through the data gathered in the management system, leadership gains a picture of the organisation’s actual behaviour over time. The management review therefore also becomes an assessment of the organisational culture.

It is not only about what the organisation says it does, but about what it actually does.

Many will be familiar with the expression “culture eats strategy for breakfast”.

Even the best strategy will have limited impact if the organisational culture pulls the business in a different direction. The management review is therefore an important arena for examining whether culture, behaviour and decisions support the direction the organisation wants to take.

If employees make decisions day to day that gradually move the organisation away from its strategy, culture will over time exert greater influence than management’s plans.

Although the ISO standards rarely use the word “culture”, clear expectations regarding this are embedded in the assessment of the management system’s suitability and effectiveness. The management review therefore gives leadership a unique opportunity to uncover gaps between strategy and actual practice.

When the process is used correctly, it becomes an important leadership tool for steering the development of the organisation.

The ISO standards set out requirements for which inputs should be considered in the management review. At the same time, it is important to remember that the goal is not to gather as much data as possible.

The value lies in the analysis of the data.

Management should focus on patterns, trends and signals that say something about how the organisation is developing.

Typical areas considered include:

• Status of actions from previous management reviews
• Results from audits
• Non-conformities and corrective actions
• Risks and opportunities
• Changes in internal and external factors
• Objective achievement and performance
• Resources and competence
• Customer and stakeholder feedback
• Compliance with legal and other requirements

For organisations certified to multiple standards, certain requirements will be specific to the standard in question. For example, ISO 9001 places greater emphasis on customer satisfaction, whilst ISO 14001 focuses on environmental performance and ISO 27001 on information security.

The real value of the management review does not arise when data is presented, but when management discusses what the data means.

If the review consists only of reporting without reflection and decisions, the organisation misses the most important part of the process.

Management must ask questions such as:

• Why are we not achieving our objectives?
• Which challenges keep recurring?
• Which risks should be prioritised?
• What are the trends telling us about the future?
• Which actions do we need to initiate?

A growing number of non-conformities, for example, is not necessarily the problem in itself. What is interesting is what the trend tells us about the organisation. Does the organisation lack competence? Is capacity too low? Have priorities been wrong?

The answers to these questions form the basis for decisions that can influence the organisation’s further development.

A good discussion has little value if it does not result in concrete actions.

The decisions from the management review must therefore be documented and followed up systematically. These may include:

• Corrective actions linked to non-conformities
• Improvement proposals
• New objectives or priorities
• Resource decisions
• Changes to processes or working methods

All actions should have clearly assigned responsible parties, expected outcomes and planned deadlines.

Follow-up is essential to ensure that actions actually deliver the desired effect. If an action is not working as planned, the organisation must evaluate why and adjust course accordingly.

Continual improvement does not happen because a problem is recorded. It happens because the problem is followed up until it is resolved.

In many organisations, the information needed for the management review is spread across different systems, documents and spreadsheets. This makes the process both time-consuming and vulnerable.

In Certain QMS, the management review can be structured through the use of annual planners, tasks, risk, non-conformities, audits, document control and reporting.

An annual planner makes it possible to plan activities, assign responsibilities and ensure that the review is carried out at regular intervals. At the same time, the organisation can draw on insights from relevant modules such as:

• Non-conformities and improvements
• Risk assessments
• Audits
• Checklists and controls
• Document control
• Register for legal requirements and compliance assessments
• Dashboards and reports

By consolidating information in one place, management gains a better foundation for identifying trends, following up on decisions and documenting that the requirements of the ISO standards have been met.

The most mature organisations do not view the management review as an annual ISO exercise. They use it as an active management tool to ensure that strategy, culture and operations all pull in the same direction.

When the process is well planned, built on relevant data and leads to concrete decisions, the management review becomes an important part of the organisation’s leadership and continual improvement work. At that point it is no longer about satisfying a requirement in a standard — but about achieving better results.

ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence (AI).

As artificial intelligence becomes an increasingly important part of organisations’ work processes, requirements for control, documentation and responsible use are also growing. At the same time, the EU is introducing new regulations through the AI Act. This is driving growing interest in establishing an AI management system based on ISO 42001.

In this article, we explain what ISO 42001 is, which organisations it is relevant for, what requirements it sets out, how it relates to the AI Act and how organisations can work towards certification.

ISO/IEC 42001:2023 is the world’s first international standard for artificial intelligence management systems. The standard has been developed by ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) and describes the requirements for an Artificial Intelligence Management System (AIMS).

In the same way that ISO 9001 provides a framework for quality management and ISO 27001 provides a framework for information security, ISO 42001 provides a framework for the governance of artificial intelligence.

The goal is to help organisations use AI in a responsible, documented and controlled manner. The standard covers the development, procurement, implementation and use of AI systems.

ISO 42001 can be used by organisations in all industries and of all sizes, whether they develop their own AI solutions or use AI technology supplied by others.

AI creates significant opportunities for efficiency, innovation and better decision support. At the same time, the technology introduces new types of risk that traditional management systems do not fully address.

Organisations must, amongst other things, address questions such as:

• How do we ensure that AI models produce reliable results?

• How do we detect bias or discrimination in AI systems?

• How do we document decisions that have been influenced by AI?

• How do we safeguard data protection and information security?

• Who is accountable if AI provides incorrect recommendations or decision support?

• How do we monitor AI systems that evolve over time?

ISO 42001 was developed to give organisations a structured method for addressing these challenges through established management principles, risk management and continual improvement.

Many assume that ISO 42001 is only relevant for technology companies that develop their own AI models. In practice, the target audience is far broader. The standard is relevant for all organisations that develop, supply or use AI in their products, services or work processes.

Organisations that use tools such as Microsoft Copilot, ChatGPT or other AI features in their day-to-day work processes.

Organisations that use AI for analysis, decision support or automation of work processes.

Companies that use AI for predictive maintenance, quality control or production optimisation.

Organisations that use AI for risk assessments, fraud detection or automated decision-making.

Organisations that develop AI-based products or build AI functionality into existing solutions.

Organisations that assist clients with AI advisory services, implementation or development.

Many organisations think of AI as advanced language models or purpose-built solutions. The reality is that many organisations are already using AI today without being consciously aware of it.

AI is becoming an integrated part of:

• Microsoft 365

• CRM systems

• ERP solutions

• Analytics and reporting tools

• Marketing platforms

• Customer service systems

• Recruitment tools

This means the need for AI governance applies not only to organisations that develop AI, but also to organisations that use AI as part of their work processes.

An AI management system — also referred to as an artificial intelligence management system — is the totality of processes, roles, guidelines, controls and documentation that ensures responsible use of AI within the organisation.

The goal is not to control the technology alone. The goal is to control how the organisation uses the technology.

An AI management system contributes, amongst other things, to:

• Clear roles and responsibilities

• Systematic risk management

• Control over data and models

• Documentation of decisions

• Monitoring of AI systems

• Non-conformity handling

• Continual improvement

In the same way as other ISO-based management systems, the AI management system should be an integrated part of the organisation’s leadership and operations.

ISO 42001 follows the same harmonised structure used in modern ISO standards. This makes it easier to integrate the standard with existing management systems such as ISO 9001 and ISO 27001.

The requirements are organised into the following main clauses.

The organisation must understand how AI affects stakeholders, business objectives and its environment.

Management must establish policy, responsibilities and objectives for the AI management system.

The organisation must identify risks, opportunities and necessary actions.

Requirements for competence, resources, communication and documentation.

Management of AI-related activities and processes.

Monitoring, measurement, internal audit and management review.

Handling of non-conformities and continual improvement of the management system.

Although the standard contains many detailed requirements, there are a number of central themes that recur throughout.

The organisation must establish clear governance mechanisms for the use of artificial intelligence. This includes, amongst other things, roles, responsibilities, decision-making processes and reporting.

AI-related risks must be identified, assessed and managed systematically. The risks may be technical, legal, ethical or commercial in nature.

The standard places significant emphasis on understanding the consequences AI systems may have for individuals, the organisation and society.

AI systems must be governed throughout their entire lifecycle:

• Planning
• Development
• Testing
• Implementation
• Operations
• Monitoring
• Decommissioning

The organisation must maintain control over the quality, provenance and use of data employed in AI systems.

Stakeholders must receive the necessary information about how AI is used and what consequences its use may have.

The AI management system must be evaluated and improved over time in the same way as other management systems.

Get in touch to find out how we can help your organisation!

There is no definitive answer, but certain organisations will have greater need than others.

An AI management system is particularly relevant if the organisation:

• Develops its own AI solutions
• Delivers AI-based services to customers
• Uses AI in decision-making processes
• Processes personal data through AI
• Operates in regulated industries
• Anticipates requirements from customers or authorities relating to AI

Many organisations are already finding that customers are asking questions about how AI is used, which data is employed and which controls are in place.

ISO 9001 is about quality management.

ISO 42001 is about the governance of artificial intelligence.

Both standards are built on risk-based thinking, management commitment and continual improvement. ISO 42001, however, introduces requirements that are specific to AI.

These include, amongst others:

• AI risk assessments
• Data governance
• Transparency
• Human oversight
• Impact assessments
• AI-specific governance

For organisations already certified to ISO 9001, much of the structure will be familiar.

ISO 27001 focuses on information security.

ISO 42001 focuses on the governance of artificial intelligence.

There is significant overlap between the standards, particularly in:

• Risk management
• Supplier management
• Documentation
• Internal audit
• Management review
• Continual improvement

Many organisations will therefore be able to integrate ISO 42001 with existing management systems based on ISO 27001.

AI governance describes the discipline or field concerned with the management of artificial intelligence.

ISO 42001 is a concrete standard that describes how organisations can establish a management system for AI governance.

One way to put it is:

• AI governance is the goal.
• ISO 42001 is the framework.

In the same way that information security is the field, whilst ISO 27001 is the standard that describes how the work can be organised.

The AI Act is the EU’s regulatory framework for artificial intelligence.

ISO 42001 is an international standard for AI management systems.

These are two different things, but they share many common themes.

The AI Act sets legal requirements for certain types of AI systems. ISO 42001 provides a governance framework that can help organisations establish the processes, responsibilities and documentation that support compliance with these requirements.

Both focus, amongst other things, on:

• Risk management
• Documentation
• Transparency
• Accountability
• Monitoring
• Human oversight

Yes. ISO 42001 is an international standard and can be certified through accredited certification bodies in the same way as ISO 9001 and ISO 27001.

Interest in ISO 42001 is still at an early stage, but many expect demand to increase significantly as the AI Act gains greater relevance and AI is adopted by a growing number of organisations.

The path to certification will vary between organisations, but typically involves the following steps:

Identify which AI systems are in use within the organisation.

Compare current practice against the requirements of ISO 42001.

Define roles, responsibilities, processes and the necessary documentation.

Carry out actions relating to risk management, data governance and governance.

Verify that the management system is functioning as planned.

Management must evaluate the system’s effectiveness and maturity.

An accredited certification body carries out an audit and assesses whether the requirements have been met.

For many organisations, the most important first step is to gain an overview.

Start by mapping:

• Which AI tools are in use within the organisation
• Who is using them
• Which data is being processed
• Which risks exist
• Which requirements customers or authorities are setting

The organisation can then establish a management system that builds on existing processes for quality, information security, data protection and risk management.

ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a structured framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence.

As AI becomes an increasingly important part of how organisations work, make decisions and deliver services, the need for AI governance and documented management will grow.

For organisations wishing to establish an AI management system, prepare for the AI Act or document maturity in the responsible use of artificial intelligence, ISO 42001 is likely to become one of the most important standards in the years ahead.

ISO 42001 is the world’s first international standard for AI management systems. The standard gives organisations a structured framework for managing risk, accountability, transparency and continual improvement in connection with the use of artificial intelligence.

As AI becomes an increasingly important part of how organisations work, make decisions and deliver services, the need for AI governance and documented management will grow.

For organisations wishing to establish an AI management system, prepare for the AI Act or document maturity in the responsible use of artificial intelligence, ISO 42001 is likely to become one of the most important standards in the years ahead.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!

When the General Data Protection Regulation (GDPR) was introduced, virtually every organisation was affected. Many leaders are therefore asking whether the AI Act will have similar consequences. The answer is more nuanced.

The AI Act is built around a risk-based approach, where the requirements depend on how artificial intelligence is used and what consequences it may have for individuals and society. Two organisations can therefore use AI every day whilst facing entirely different regulatory requirements.

For most organisations, it is not the industry alone that determines how significantly they are affected by the AI Act. What matters is which AI systems are in use, which data they process, and whether they feed into decisions that affect individuals.

The AI Act distinguishes between different risk levels. Whilst certain types of AI are prohibited, the most stringent requirements will apply to what are known as high-risk systems.

This means that many organisations will be able to use generative AI tools without extensive new obligations, whilst others must establish documented processes for risk assessment, control and follow-up.

It is therefore misleading to ask whether an organisation is “covered by the AI Act”. Every organisation that uses AI will be affected to a greater or lesser degree. The key question is how significant the regulation will be for each individual organisation.

For many organisations, AI is used primarily as a tool that supports employees in their day-to-day work.

Examples include:

• Generating text drafts and content
• Summarising meetings and documents
• Coding assistance for developers
• Language support and translation
• Analysis of large volumes of information

In such cases, it is humans who make the decisions, whilst AI functions as a productivity tool.

Although these organisations should still maintain an overview of which AI solutions are in use, they will not normally face the most extensive requirements under the AI Act.

A different picture emerges when AI becomes an integrated part of operational processes.

In industry, energy, transport and offshore, artificial intelligence is increasingly used for analysis, optimisation and predictive maintenance. AI can help identify anomalies, predict failures or recommend actions based on large volumes of data.

In such cases, the primary challenge is not necessarily human rights or discrimination. Rather, the need for control over data quality, traceability and an understanding of how AI models influence the basis for decisions becomes more pressing.

Many organisations in these sectors will therefore find that the AI Act creates a need for better documentation and governance, even if the solutions are not necessarily classified as high-risk systems.

The most extensive requirements under the AI Act are linked to AI systems that can affect individuals’ rights, opportunities or access to essential services. This applies, amongst others, to solutions used in the following areas.

AI used to rank candidates, filter applications or make recommendations in recruitment processes may fall within the high-risk categories of the regulation.

AI solutions that affect the assessment of students or decisions about educational pathways may trigger stricter requirements.

AI used for diagnostics or clinical decision support is among the areas subject to significant regulation.

Municipalities, directorates and other public bodies must be particularly attentive if AI is involved in case processing or decisions that affect citizens.

In such cases, the AI Act sets requirements for, amongst other things, risk management, documentation, human oversight and ongoing follow-up.

For leaders, it is therefore more relevant to map the organisation’s AI portfolio than to attempt to determine whether the organisation “is covered by the AI Act”.

Two organisations in the same industry can have very different risk profiles.

A university using AI for administrative tasks faces different requirements from one using AI to assess students. In the same way, a municipality using generative AI for content production will have a different risk profile from one using AI in case processing or decision-making.

The first step towards AI Act readiness is therefore to establish an overview of which AI systems are in use within the organisation, which processes they form part of, and what the consequences could be if they produce incorrect results.

For many organisations, the AI Act will not entail extensive new requirements in the near term. Nevertheless, the regulation helps to make visible a need that already exists: the need for control over how artificial intelligence is used within the organisation.

Organisations that establish an early overview of their AI portfolio will be better placed to handle both regulatory requirements and the rapid development of artificial intelligence.

We help organisations with advisory services, establishment and further development of AI management systems. Get in touch to find out how we can help you!