PAS 99 and IMS

1. Introduction
2. Overview
3. Global adoption
4. Benefits
5. Auditing
6. Choosing a registrar
7. Route to registration
8. Costs
9. Contributing editor

There has been concern for many years that management system standards were being written and used in a silo manner, without recognition that the best way of operating is by encompassing the arrangements within an integrated business management system. PAS 99:2006 “Specification of common management system requirements as a framework for integration” was produced to help organizations with multiple systems that wished to align or integrate their common arrangements. It recognizes that there is redundancy when operating multiple systems as the requirements for some elements in management system standards are practically the same or very similar. PAS 99 provides a clause by clause framework which covers the common requirements and enables an organization to have one common system for the core elements of all management system standards (MSS). The specific areas unique to the discipline still have to be dealt with and therefore do not dilute the thrust to manage quality, information security, environment etc.

The international standards body ISO has also long recognized this deficiency and is in the process of developing a common framework (called the high level structure document, HLSD) for all management systems. When agreement has been achieved, the HLSD will be used for all new MSS and introduced to existing ones as they are revised. It is anticipated that all standards will be in this format within 3 to 4 years which will facilitate integration and alignment in the longer term.

Using the PAS 99 common arrangements, helps organizations reduce the burden of internal auditing of multiple systems and when mature reduces the need for duplicated effort by external certification bodies on reviewing the core components and should facilitate migration of standards written in the HLSD framework.

The standard can be used for certification/registration although this was not its prime intention when first written.

PAS 99 is based on ISO Guide 72 for standards writers, which includes a framework for the common requirements that are found in management system standards. The main requirements are categorized into the following subjects:

• Policy;
• Planning;
• Implementation and operation;
• Performance assessment;
• Improvement;
• Management review

The key standards that should be used in conjunction with PAS 99 are those that the organization wishes to integrate and align with for operational purposes.
Guidance on implementation can be found in books published by BSI and ISO:

• IMS: Principles of Integrated Management Systems
• IMS: Implementing and Operating
• Integrated Use of Management System Standards (IUMSS) – ISO Handbook

Is PAS 99 relevant to your organization?

PAS 99 is suitable for all organizations looking for effective and efficient ways of working with multiple management systems that are currently operating in separate silos.

It is not known how many organizations have formally or informally adopted PAS 99 into their organization but it is known that it has been adopted in many countries and that a large number have gained certification against this specification.

The PAS was produced “to help organizations to achieve benefits from consolidating the common requirements in all management system standards/specifications” The benefits include:

• improved business focus;
• a more holistic approach to managing business risks;
• less conflict between systems;
• reduced duplication and bureaucracy;
• more effective and efficient audits both internally and externally.

Those organizations adopting PAS 99 will find it provides a basis for integrated internal auditing. Those components that are common such as documentation, records, training, audit process, review process, corrective and preventive action etc. do not need to be audited for each system but just once should suffice. This enables the opportunity for a greater focus on operational control issues and a reduction in audit time both internally and externally.

There are over 1000 certification bodies globally. It is important to select an approved certification body and to ensure they comply with the following criteria:

• Ensure the company is accredited to ISO/IEC 17021:2006, and the certification body accreditation is issued by a recognised competent body.
• Receive quotations from several certification bodies.
• Do not select the cheapest as their auditing or service may be below standard,
• Ensure the certification body is recognised by your customers and they relevant sector experience for your industry sector

There are various phases to registration:

1. Pre-audit Assessment
   • Check documentation with Lead Assessor
     Together, you and your Lead Assessor will review your documentation. This will ensure that all documented procedures cover the requirements of PAS 99 and IMS.
   • Determine date of assessment
     Together with your Lead Assessor you will determine the best timetable for your registration and agree on a date for initial assessment. Many organizations benefit from our pre-assessment "dry run" of the formal assessment.
2. Initial Assessment conducted
   • An initial assessment will be conducted by your auditor. You will be informed of his recommendation at the closing meeting.
3. Registration Confirmation
   Following your auditors recommendation, your registration will be confirmed by the technical reviewers.
   • Certificate Issued
     Your certificate of registration will arrive soon after your registration has been confirmed.
4. Continued Assessment
   After registration your nominated auditor will visit your organization every 6 months or annually to ensure that your management system continues to meet the requirements of PAS 99 and IMS.
5. Reassessment
   Your registrar is required to perform a reassessment of your management system every 3 years. This is normally 2/3 of the initial assessment duration at the end of the closing meeting your auditor will confirm the outcome of the reassessment.

The answer depends on a number of factors. There are costs to both implement and to maintain your certification.

Implementation Costs

In terms of costs to implement, if you choose a full do-it-yourself approach, the only real costs will be the time for resources dedicated to the implementation process and in time spent writing documents and training your staff. If you have little experience with ISO 9000, or have limited internal resources, you might choose to get some outside professional help through a management system consultant. There are advantages in recruiting a consultant as you are able to guarantee your registration within a given period.

Certification Costs

Costs of registration are dependent on the size of your organization. Most registrars charge a certain rate per day to be on-site at your facility. This day rate will vary depending on your country, the typical day rate in the United Kingdom will vary between £300 and £800 per auditor day depending on the registrar. Small companies with less than 20 staff could expect one auditor on site for 1-3 days; Large companies can expect several auditors on site for up to up to 10-15 days.

Other fees include application fees, certificate fees or annual licence fees. To maintain your certification, the Registrar must return annually to audit a portion of your system. These costs will be less than the original visit, since the time spent will be shorter. Once every three years, the Registrar returns to audit your entire system.

David A Smith

David A Smith is a Director of IMS Risk Solutions Ltd which provides consultancy, training and audit services to organizations all over the world. David has authored or co-authored a number of books including a series on integrated management systems published by BSI. He was the Technical Author of PAS 99 and is Chair of the BS Committee Management Systems Expert Group as well as Chair of HS/1 Occupational health and safety management systems.