​When future history books are written, the pandemic of 2020 may well go down as the time when the way we live and work changed fundamentally.

The workplace of the future could look markedly different from the ones we were using in 2019, from flexible working spaces to plasma ventilation systems, body temperature sensors, desk screens, and the many other things which may become commonplace.

Undoubtedly many things will change because they will have to, in order to remain relevant and useful to our current plight. And ISO standards will be no different.

There are current elements of ISO standards which have already become more prominent and important to the organisations that use them. Hopefully this will also spur others to see the value they can bring in a Covid and (hopefully, and soon) post-Covid world.

Our first example will be ISO 9001, which is the standard that deals with the management of quality systems, and its focus on disaster recovery and business continuity.

With this standard you have to look at your risks and document them, along with the controls you’ll use to minimise any adverse affects this would have. Typical risks have traditionally been identified as extreme weather events affecting property, transport and power supplies (which can also have an impact on global supply chains); cyber-attacks and disruption to IT systems; changes to regulations and the political landscape; an loss of customer confidence due to negative publicity.

The idea is that you’ll manage disruption and limit the effects of these events to ensure business gets back to normal as quickly as possible.

Now, we’ve seen many a Business Continuity Plan that has also listed ‘pandemic’ as a scenario, but one that has probably never been envisaged as coming to pass. However, this is without doubt going to change, and how a business weathers a ‘virus event’ will become a hot topic for discussion across management teams up and down the country for years to come.

Another big area of significance will be attached to ISO 45001 - the standard addressing health & safety - and how assessing the risk of Covid in the workplace will become a primary concern.

In the UK, this falls under general management of health and safety in the workplace regulations, and all employers have to take reasonable steps to protect workers and others from the virus. A Covid-19 risk assessment is seen as a key part of this.

Guidance from the Health and Safety Executive, itself using guidance from Public Health England, drew up a series of issues an employers need to take into account when undertaking this assessment, such as identifying what work activity or situations might cause transmission of the virus; who could be at risk; how likely it was that someone could be exposed; and how they would act to remove the activity or situation, or if this wasn’t possible, control the risk.

In addition, some groups of people could be at more risk of being infected and/or an adverse outcome if infected, and this also need to be considered in the risk assessment.

So having a properly set up health & safety management system with a defined way of carrying out risk assessment using all of the available guidance definitely made life easier for organisations that had the ISO 45001 standard, and will continue to do so.

And finally, a nod to the importance of the ISO 27001 information security standard - organisations that had an information security management system in place found it so much easier to handle setting up staff working from home.

​Organisations with the standard already had a suite of policies for working from home, along with risk assessments already completed, controls in place to combat unauthorised remote access, logging access to networks traced in the event of an incident, along with processes in place to close down any incidents as quickly as possible.

So as we change our ways of working, many elements of the most popular ISO standards are there to make it as easy as possible.

​And the reason? Because they are all ‘risk-based’ standards. This means that they help you to focus your resources toward things that present a higher risk to you and your customers and clients. And these days, that means a lot.

The world has only until 2030 to stem catastrophic climate change - but can companies be part of the solution? And, if so, how?

A report published by the UN Intergovernmental Panel on Climate Change said that “rapid, far-reaching and unprecedented changes in all aspects of society” are needed to avoid disastrous levels of global warming.

Whilst often seen as culprits, businesses can actually set a positive example.

What is ISO 14001:2015?

ISO 14001 enables companies to put in place an effective environmental management system, and is designed to address the balance between a company’s environmental impacts while maintaining profitability.

Environmental issues are growing in prominence; energy efficiency, environmental compliance, environmental impact, and carbon footprint are widely discussed. In implementing an environmental management system, companies can effectively control these issues, and ensure that they are fully compliant with environmental legislation.

They also join in the fight against climate change. Being ISO 14001 certified proves to stakeholders, customers, suppliers etc. that you are environmentally credible.

So what’s the link between ISO 14001 and climate change?

One of the major challenges that face us all is that of mitigating and adapting to climate change. Internationally, work has progressed from the formation of United Nations Convention on Climate Change (UNFCCC) to the Paris Agreement which came into force on 4 November 2016.

Under the Paris Agreement countries agree to hold the global temperature increase due to increase in greenhouse gas (GHG) emissions, to below 2 °C, aiming at 1.5 °C. This commitment is realised through a commitment at national level to reduce national GHG emissions. Additionally, countries agreed to support action to adapt to the consequences of climate change.

For users of ISO 14001 the question is 'How does ISO 14001 help organisation to mitigate and adapt to climate change?' The diagram below shows the link between key clauses in ISO 14001:2015 and climate change mitigation and adaption. It shows that users of ISO 14001 CAN address climate change challenges through their management system:

​As isolation is eased and people return to work, governments across the UK are requiring organisations to complete risk assessments as part of the permission to resume normal service.

Health and safety law requires employers, who continue to operate under current circumstances, to do ‘what is reasonably practicable’ to protect their staff and members of the public.

As an employer, you’re required by law to protect your employees, and others, from harm. Under the Management of Health and Safety at Work Regulations 1999, the minimum you must do is:

• identify what could cause injury or illness in your business (hazards)
• decide how likely it is that someone could be harmed and how seriously (the risk)
• take action to eliminate the hazard, or if this isn’t possible, control the risk
• Assessing risk is just one part of the overall process used to control risks in your workplace.

To fulfil this duty in addressing the risk from COVID-19 all companies must review their risk assessments and put in place measures to ensure the guidance available from their respective governments (in England, Northern Ireland, Scotland and Wales) is implemented.

Risk assessment covering exposure to Covid-19 will be different from one organisation to another. Healthcare workers, retail cashiers, home delivery drivers, utility engineers and construction workers have different exposure to this risk. 

A risk assessment should recognise the virus as a hazard. It should also reflect that the virus is spread in minute water droplets that are expelled from the body through sneezing, coughing, talking and breathing. 

The virus can be transferred to the hands and from there to surfaces. It can survive on surfaces for a period after transfer (depending on such things as the surface type, its moisture content and temperature). The risk assessment should conclude that if it is passed from one person to another, while many survive infection, some may die from the disease. It should be regarded as a high hazard.

The safety hierarchy of control can serve you well in considering what can be done. Any mitigation controls devised and implemented must reduce exposure of employees and anyone else who could be infected by your employees. 

Control considerations must include identification of those who may have the disease, preventative measures and what to do if you find if an employee has contracted the disease. In other words, there may be elements of management systems design to think about. Decisions about what may be done must be realistic and reasonably practicable: achievable given the resources available.

Elimination is the best form of control. Can we eliminate the virus? Only through vaccination, so there is little that can be done by organisations. They are reliant on government response. Organisations should monitor vaccine availability and the priority of their workforce in any future vaccination programme so that arrangements can be made promptly. Social distancing and staying at home are not forms of elimination, but an administrative control. 

Next in descending order is substitution: replacing the virus for something less harmful is not possible. Engineering controls place a physical barrier between the person and the hazard, or provide mechanical reduction of the hazard. Placing screens between people (e.g. cashier points in shops) will interrupt the flow of air from one person to another and therefore provide protection. 

Providing ventilation is also an option. Recent research has shown that downward ventilation onto a patient’s bed considerably reduces the exposure of healthcare workers to infected droplets suspended in the air. Care must be taken if ventilation is to be considered. The fundamental question is where the potentially infected water droplets are ventilated to. It’s no good if they are blown onto other people or surfaces and increase exposure elsewhere. But as a principle it is worthy of some consideration e.g. ask whether the job must be done in a workshop, or can be done outside. 

But then also consider exposure to ultraviolet radiation and other risk. Ventilation is a good control if it takes infected air away from people and transfers it to somewhere where the virus will not do harm. 

Administrative controls provide the best options for most organisations. The risk assessment must consider how you will keep the workplace and equipment clean, adjust your working practices and ensure people are safe.

As an ISO consultancy obviously there is a big focus on taking a risk-based approach and the assessment of risk, evaluating effectiveness of control measures, complying with regulations, legislation, etc.

As businesses start to mobilise they’ll have the twin issue of new, immediate significant risks which will have arisen due to the pandemic alongside dealing with budget constraints and limited compliance resources.

We’ve been helping businesses in these scenarios, assessing their risk and conducting a review with the aim of identifying core compliance requirements. Much of this has been driven by their own clients requiring supply chains to undertake a proper Risk Assessment of current working arrangements. 

Significantly, the crisis may have caused companies to find new suppliers that have not been fully vetted due to time pressures. Likewise, the pandemic may have caused substantial risks to employee safety associated with reopening businesses, such as effective social distancing. This emerging risk will likely call for the development of new policies and procedures that will require close oversight by senior management.

Our review will usually entail a historic review of internal procedures and controls to identify past activities or other problems to determine where the biggest risks reside. At this point we undertake a detailed COVID-19 Risk Assessment. External industry risks such as enforcement actions are considered as well.

But for those businesses who simply want to undertake their own detailed assessment, we are giving away the template we use for free. You can simply download it here.

There is no catch, we won’t ask you to sign up for anything, simply download, conduct the Risk Assessment and get back to work!

Millions of people around the world have lost their jobs amid the current Covid-19 crisis - it is a crisis within a crisis. The long-term economic impact is yet unknown but will surely be deep.

What is not in doubt is that the economic strain on companies of all sizes across the UK and the rest of the world will be here for the foreseeable future. Manufacturers have closed plants, stores are shut, and consumer demand has collapsed in many sectors.

Research by the Institute for Social and Economic Research at the University of Essex has found that more than 6.5 million jobs could be lost due to the economic fallout from the UK’s coronavirus lockdown, about a quarter of the UK’s total jobs.

A simply staggering number of companies have plunged into administration, from stalwart high street brands to major travel agents, as well as a whole raft of businesses in sectors such as construction. The true toll is only just beginning to be understood.

So it’s no surprise that companies which are still managing to keep their heads above water will be starting to look at deep cost-cutting measures in the short- and medium-term. With profit centres being hit like never before, cost centres such as ISO compliance will undoubtedly have fewer resources until the economy turns around.

What does this mean for the ISO compliance functions of companies that are struggling?

In practical terms, they will have to make risk-based decisions about how to allocate the limited resources that they have. And one important thing to think about is how you can use the expertise of companies such as The Ideas Distillery to outsource your compliance tasks cost-effectively with little overhead.

Certification Bodies have recognised, for the moment at least, that the world has changed significantly. Just about all have turned to ‘remote auditing’ as a way to still service clients while still respecting the lockdown. There has also been the option of postponing for up to six months in many circumstances, although this option is now starting to wind down.

Any company’s priority will simply be to put themselves in a position to survive the crisis. So when dealing with budget constraints and limited compliance resources, flexibility and creativity will be key.

For our part, when we are helping businesses in these scenarios, we always assess risk and conduct a review with the aim of identifying core ISO compliance requirements. This often entails a historic review of internal procedures and controls to identify past activities or other problems to determine where the biggest risks reside.

​External industry risks such as enforcement actions brought against competitors should be considered as well, along with identifying low-risk areas where there have been few incidents or problems.

But more significantly, we help companies to determine if new, immediate significant risks have arisen due to the pandemic. Another emerging risk may exist in a company’s sales department, for example, perhaps due to the pressures of bringing in new business. This may be an area that leads to an increase in customer complaints as things are missed.

The crisis may have caused companies to find new suppliers that have not been fully vetted due to time pressures. Likewise, the pandemic may have caused substantial risks to employee safety associated with reopening businesses. This emerging risk will likely call for the development of new policies and procedures that will require close oversight by senior management.

For more information - and to see how we can help - just get in touch with us in any number of ways using on our Contact page.