The implementation of a management system moves between two extremes. At one, the organisation designs around its context, processes and risks. At the other, it adopts borrowed documentation and adapts it only as much as necessary to present it. ISO 9001 defines general requirements, not a single way of operating; the test therefore lies not in the format of the procedure, but in its alignment with actual work and intended results.
The off-the-shelf system · what it is and why it proliferates
An off-the-shelf system is an implementation built on documentation, processes and records conceived for another organisation: commercial templates, downloaded files or documents transferred between subsidiaries without sufficient adaptation. It may pass a review focused on documentary consistency. That does not demonstrate that the procedure governs operations or that the records originate from the process they claim to represent.
A template reduces drafting work and can shorten the start of the project. The saving has a limit: someone must understand the context, define processes, assign responsibilities and verify results. When that task is omitted, the cost reappears in exceptions, rework and records prepared outside the operational rhythm. This report does not establish timelines or market percentages; it describes signals observable in practice and requires them to be corroborated in each organisation.
The tailored system · what it is and why it costs more
A tailored system grows out of context. Before drafting procedures, the team identifies how the organisation operates: who decides, what evidence each process produces, which exceptions are frequent and which decisions need formal support. The process approach published by ISO connects that design with inputs, outputs, interactions, controls and intended results.
Only then does it design the system. The documentation distils the way the organisation actually operates, formalised using the vocabulary of the standard. Procedures are the written version of practices that the organisation already carries out with varying degrees of consistency. That is why the cost comes upfront: the expensive hours are those spent observing operations, not drafting.
The operational comparison
| Dimension | Tailored system | Off-the-shelf system |
|---|---|---|
| Origin of the design | Prior mapping of actual operations · decisions, records, historical incidents | Templates from another organisation, transferred without significant adaptation |
| Design sequence | Context and processes before documents | Documents before understanding operations |
| Effort | Concentrated on understanding and design | Shifted to exceptions, rework and subsequent corrections |
| Initial audit | The evidence allows the process to be traced from decision to result | May appear consistent if the sample is limited to prepared documents |
| First operational incident | The procedure reflects actual practice and the team follows it | The team chooses between disrupting operations and breaking traceability |
| Evidence it generates | Operational · records at the pace of operations | Documentary · records in batches before the audit |
The first operational incident · when the difference becomes apparent
The difference usually becomes apparent when an exception arises: a complaint, a supplier failure, a process deviation or a decision that requires escalation. In a system designed around operations, the procedure provides guidance and the record allows what happened to be traced. Traceability does not generate itself; it arises from responsibilities and controls that the team uses before the auditor arrives.
In an off-the-shelf system, the procedure describes how another organisation handles that conflict — generally a larger one, with more resources or in another industry. The team cannot follow it without distorting its operations. Faced with that impossibility, it chooses · either it follows the procedure and disrupts operations, or it follows operations and generates traceability inconsistent with the documented system. Either breakdown is recorded; the only thing that changes is where.
Signals that warrant a deeper review
No signal proves on its own that the system is off-the-shelf. Their concurrence warrants expanding the sample, interviewing those who carry out the process and cross-checking record dates against operational events.
The documentation does not age
The procedures are written using vocabulary alien to the organisation’s culture, and their latest changes are cosmetic — logos, version number, minor adjustments. A living system matures with operations. Frozen documentation admits that operations take place elsewhere.
The same people are responsible for everything
A mature organisation distributes specific responsibilities according to actual competence. In off-the-shelf systems, the same two or three people are listed as nominally responsible for processes that bear no resemblance to one another. The assignment was made at a desk, far from actual operations.
Records are concentrated before the audit
Records arising from operations tend to be distributed according to process events. An anomalous concentration before the audit does not prove fabrication, but it requires a review of metadata, sources and alignment with operational facts. Criterion 14 treats that provenance as part of evidence integrity.
The alignment test
Select critical procedures and ask each person actually responsible to reconstruct a recent execution using their records. Compare the actual sequence with the documented procedure. Classify the differences: an operational change not incorporated, a document unrelated to the context, a control that exists only on paper or a valid practice not yet formalised. The diagnosis emerges from that classification, not from a prior label.
The conclusion is operational: the system needs to match the organisation it seeks to govern. When the document, the decision and the record tell different stories, the problem has already been located.