Case Study 1: Integration of OH&S and Environmental Requirements into Design

1. Background

NovaLight Manufacturing Co. is a medium-sized manufacturer of lighting fixtures operating in a competitive and highly regulated market. The organization decided to implement an Integrated Management System (IMS) aligned with ISO 14001 and ISO 45001 to improve safety performance, environmental sustainability, and regulatory compliance.

Product design is a critical process, as decisions made at this stage directly influence worker safety during production, environmental impacts throughout the product life cycle, and compliance with legal requirements. Historically, NovaLight focused design efforts on technical performance, aesthetics, and cost efficiency. Occupational health & safety (OH&S) and environmental considerations were assumed to be adequately controlled during later operational stages.

2. Problem Description

During the Stage 1 audit, it was identified that risk and hazard analyses related to OH&S were not systematically integrated into the design inputs. Environmental aspects such as energy consumption, material selection, waste generation, and emissions were also not considered during the design phase. Additionally, design verification records lacked formal approval from the Safety Manager.

3. Root Cause Analysis

The root causes included functional silos between the Engineering and HSE departments, the absence of an integrated design procedure, and the misunderstanding that ISO 14001 and ISO 45001 apply mainly to production activities rather than to design. There was also no formal cross-functional design review mechanism.

4. Risks and Impacts

Potential risks included the introduction of unsafe products, increased environmental footprint, regulatory non-compliance, and a high risk of certification failure. These issues could also lead to reputational damage and increased operational costs.

5. Corrective Actions

The organization updated the design procedure to mandate risk and hazard analysis, integrated environmental aspects into design-stage evaluations, required formal Safety Manager approval during design verification, and provided IMS integration training to design engineers.

6. Lessons Learned

Design is a high-risk and high-impact process. IMS requirements must be embedded early, and cross-functional governance is essential to ensure effective risk control and compliance.

Case Study 2: Contractor Management and Control of Outsourced Risks

1. Background

NovaLight Manufacturing Co. is a mid-sized industrial organization operating under an Integrated Management System aligned with ISO 9001, ISO 14001, and ISO 45001.

The organization extensively uses contractors for maintenance, logistics, waste handling, equipment calibration, cleaning services, and specialized technical activities. Contractors routinely work on-site in high-risk areas, including production floors, near energized equipment, confined spaces, and hazardous chemicals. Historically, contractor selection and management were decentralized, cost-driven, and handled independently by departments without IMS oversight.

2. Problem Description

The Stage 1 audit identified major deficiencies in contractor management and outsourced process control. There was no documented contractor management procedure, no contractor risk assessments, and no defined HSE or environmental selection criteria. Contractor onboarding was inconsistent, and there was no evidence of training, induction, monitoring, or performance evaluation.

3. Root Cause Analysis

Management incorrectly assumed that risks and legal responsibilities were transferred to contractors. There was limited awareness of the ISO 45001 and ISO 14001 requirements for outsourced processes. No clear ownership or accountability for contractor management existed within the IMS structure.

4. Risks and Impacts

Risks included serious injuries or fatalities involving contractors, environmental spills, and regulatory violations. Additional impacts included loss of operational control, reputational damage, and major certification nonconformities.

5. Corrective Actions

• The organization developed and approved a Contractor Management Procedure.
• Contractor pre-qualification criteria were introduced, including HSE performance, legal compliance, and competence.
• Mandatory contractor induction, training, permits, and RAMS were implemented.
• Ongoing contractor audits, KPIs, and performance monitoring were established.

6. Lessons Learned

• Outsourcing does not remove accountability.
• Contractor activities must be planned, controlled, monitored, and reviewed as part of the IMS.

Case Study 3: ISMS Governance and Business Continuity Weaknesses

1. Background

NovaLight Manufacturing Co. implemented an Information Security Management System aligned with ISO 27001:2022. The initial ISMS implementation focused primarily on technical IT controls, with limited involvement from leadership and governance. Business continuity and succession planning were treated as documentation exercises rather than operational capabilities.

2. Problem Description

The Stage 1 audit identified missing ISMS approval records and unclear leadership commitment. There was no IT succession planning, incomplete physical and environmental security controls, and untested business continuity plans. Employee awareness and training related to ISMS and continuity were insufficient.

3. Root Cause Analysis

• The ISMS was incorrectly viewed as an IT-only responsibility.
• Governance structures were immature, and oversight by leadership was limited.
• The organization relied heavily on tools rather than people, processes, and preparedness.

4. Risks and Impacts

Risks included loss of data access, ineffective incident response, and breaches of confidentiality, integrity, or availability. Noncompliance with ISO 27001 requirements posed serious risks to certification and reputation.

5. Corrective Actions

• Formal ISMS governance mechanisms were established and approved by top management.
• A Deputy IT Manager was appointed and trained to address succession risks.
• Security, physical protection, and business continuity policies were updated and tested.
• Organization-wide ISMS training and awareness programs were implemented.

6. Lessons Learned

Succession planning and awareness are critical security controls.

ISMS effectiveness depends on governance, leadership, people, and preparedness.

QMS Effectiveness and Process Control Failures (ISO 9001)

1. Background

NovaLight Manufacturing Co. operates a Quality Management System aligned with ISO 9001:2015 to support consistent product quality, customer satisfaction, and operational efficiency. Due to rapid growth, increased product variety, and delivery pressure, several process changes were implemented informally. Quality responsibilities were largely centralized within the Quality department, with limited ownership at the process level.

2. Problem Description

The Stage 1 audit identified weaknesses in process control and overall QMS effectiveness. Process interactions were not clearly defined, and process owners were not formally assigned. KPIs were inconsistently monitored, and documented procedures were not consistently followed. Corrective actions from previous internal audits lacked evidence of effectiveness evaluation.

3. Root Cause Analysis

• Quality was viewed mainly as the responsibility of the Quality department.
• There was limited understanding of process-based and risk-based thinking.
• Accountability for process performance and improvement was unclear.
• Decision-making was not consistently supported by performance data.

4. Risks and Impacts

• Increased nonconforming products and customer complaints.
• Higher rework costs and delayed deliveries.
• Reduced customer satisfaction and certification risks.

5. Corrective Actions

• Core and support processes were formally identified and mapped.
• Process owners were assigned with defined responsibilities.
• KPIs were established and reviewed through management review.
• Internal audit and corrective action processes were strengthened.
• Risk-based thinking was integrated into operational planning.

6. Lessons Learned

• A QMS is effective only when process ownership is clearly defined.
• Documentation alone does not ensure conformity.
• Risk-based and process-based thinking drive continual improvement.