ISO Consultant for a Multi-Site Integrated System: Case Study

What is the starting point of this case study?

A manufacturer certified on a single site, whose customer now asks for three standards across several sites. This is a composite case study: it brings together situations we encounter in the integrated system projects we support. The company, its customer and the figures are fictitious and given for illustration.

The company makes metal structures, cabinets and boilermaking parts for industry. It employs around three hundred people across three sites in Morocco.

When its contract comes up for renewal, a European customer, an equipment manufacturer, adds ISO 14001 and ISO 45001 to its supplier requirements, for the sites that produce for it. At the same time, management records two lost-time accidents in the Tangier paint shop. It decides to launch an integrated management system project and to approach consultancies.

The pattern is familiar well beyond Morocco: a supplier in Africa or the Middle East, or the local subsidiary of a foreign group, receives a new requirement from a key customer and must extend its system to sites that have never been certified.

Which choices were made before going to tender?

Four decisions, taken by the management committee before a single line of the request for proposal was written. They set what the consultancies had to price.

• One integrated system, with a central function at the Kenitra head office: a shared process map, document control system, internal audit programme and management review, with local requirements per site. The method is described on our integrated QHSE management system page.
• The versions in force. For quality, the transition to ISO 9001:2026 and the extension to the two other sites. For the environment, a first certification directly to ISO 14001:2026: according to the transition document of Global ACI, the body that took over the work of the International Accreditation Forum (IAF), no initial certification to the 2015 version is possible after 31 October 2027. For health and safety, ISO 45001:2018, with a review planned after the revision that the ISO/TC 283 committee expects in 2027 at the earliest.
• All sites in scope. Since the three sites do not have very similar activities, the certification body would not be able to audit a sample: according to Global ACI-TECH-3-001, that is the condition for sampling. Each site therefore had to be prepared, and the consultancy had to be able to be present on each one.
• A combined audit. According to Global ACI-TECH-3-008, the time reduction for integration is capped at 20%, and the body must be accredited for each standard. The expected gain was mainly organisational: one audit, one team, one report.

The Kenitra quality manager was appointed project manager, with time reserved every week, and a contact person was named on each of the two other sites.

How was the tender run?

On a single request for proposal, sent to four consultancies, with a scoring grid agreed before the offers were opened. The request followed the template in our article on the ISO consultancy request for proposal: scope by site, headcount and shift teams, starting point, deliverables, training, safety constraints, and a response format with a price by phase.

Each consultancy could visit the Kenitra and Tangier sites before responding. The grid gave 30% to method, 25% to the team, 15% to references, 10% to the schedule and 20% to price, with four elimination criteria: a declaration of independence, a named consultant, no guarantee of certification, no promised CSF amount.

Offer A raised the clearest problem. Accreditation rules forbid a certification body to provide management system consultancy, and to imply that certification would be simpler or faster with a specified consultancy, as the SADCAS assessment checklist for ISO/IEC 17021-1 recalls (clauses 5.2.5 and 5.2.9). SADCAS is the accreditation body of the Southern African Development Community. A certificate obtained this way would have been fragile in front of the European customer.

What made the difference between the offers?

Proof of competence on each standard and on each site, more than price. Offer D was not the cheapest: offer C cost less, but because it counted fewer on-site days and left the drafting to the company. Brought back to the consultant day and to the content of each phase, the two offers were close.

Three tests separated C and D:

• The interview with the lead consultant. Each was asked to explain how they would run the gap analysis of the Tangier paint shop. D’s lead consultant talked about hazardous waste, chemical storage, fire and exposure risks, worker consultation and Moroccan Labour Code obligations; C’s talked mostly about procedures.
• The reference calls. One of C’s references said that the consultant announced had been replaced during the assignment. D’s two references, industrial sites of comparable size, confirmed that the system held after the consultancy left.
• The schedule. D placed the mock audit after a full cycle of internal audits on all three sites; C placed it just after drafting ended.

How was the assignment framed after the choice?

Through a contract that takes over the request for proposal, then a first quarter devoted to the gap analysis and the schedule. The criteria that guided this choice are set out in our guide on how to choose an ISO consultant in Morocco.

The contract includes: the list of deliverables as an annex, a price by phase paid on delivery of each deliverable, the names of the lead consultant, the two experts and a deputy, the consultancy’s declaration of independence, a confidentiality undertaking and ownership of the documents produced. The factors that set the number of days are those described in our article on ISO consultancy fees and duration.

Steering rests on a monthly committee: the managing director, the project manager, the site contacts and the lead consultant. Progress is measured in gaps closed, documents approved and people trained, not in days consumed.

The training was written into the training plan before it took place: process owners, internal auditors working across sites, staff awareness in Arabic and French. In Morocco, that allows it to fall under the special training contracts (contrats spéciaux de formation, CSF) of OFPPT, the national vocational training office, under the rules of the CSF procedures manual (May 2006, amended by Amendment No. 2 of 2 June 2014); a simulation was run, with no promised amount. The detail is on our CSF and GIAC funding page.

Finally, the company itself approached certification bodies accredited for all three standards, asking for their transition timetable to ISO 9001:2026 and ISO 14001:2026, their combined audit time calculation and the make-up of the audit team. The consultancy helped read the offers, without recommending any of them.

What are the lessons for a multi-site manufacturer?

That choosing the consultant needs as much preparation as the audit. The points that mattered in this case, to check in yours:

• Decisions on scope, versions and integration are taken before the tender.
  
• The request for proposal describes each site, its activities, its headcount and its risks.
  
• Elimination criteria are set before the offers are opened.
  
• Any offer that links consulting and the certificate is rejected.
  
• Each standard is covered by named expertise, environment and health and safety included.
  
• The lead consultant is heard on a concrete case from your site.
  
• References are called, with the question of consultant replacement.
  
• Prices are compared by phase and by day, not as a total.
  
• The schedule places the mock audit after a full cycle of internal audits.
  
• The certification body is chosen by the company, separately from the consultancy.