• You have a better understanding of what your business is about and what your business is trying to achieve.
• You have processes in place to find things that aren’t working and improve on them.
• You have systems in place to identify risks and either reduce the likelihood of them occurring or reduce the consequence when they do occur.

• You have an outwardly visible tick of approval from an independent body that certifies that you have achieved the standard.
• Customers and suppliers have a higher level of trust in your business processes and business management.
• You have independent, impartial, expert auditors that know your organisation and can identify relevant opportunities for improvement as your organisational maturity grows.

• You have confidence that when you supply goods/services to your client organisation you know that they will be effectively managed.
• It may mean that you get paid quicker and paid correctly (especially if their certification covers their accounts payable process).

• You have confidence that the services/products being delivered are being managed effectively.
• Depending on the standard implemented, it may give you the benefit of greater assurance that the company supplying the service is going to be around next year.
• You receive the benefit that your private information is being protected.

This is a common driver for organisations to be certified. With this driver your organisation is required to comply with certain legislation or regulation to be able to operate in the sector or deliver certain services.

Sometimes the regulations are quite prescriptive, such as the requirements for some service providers to the Australian Government to achieve certification in ISO/IEC 27001. In this particular case, the regulations also require application of certain information security controls from the Australian Government Information Security Manual.

A more familiar example is health and safety. Mining and minerals companies in Australia are familiar with OHS obligations under the Safe Work Australia Model Work Health and Safety Laws, which are given effect through legislation in each state and territory. While the exact phrasing differs, these all require that organisations operate effective occupational health and safety management systems.

For mining companies, these are often supplemented by state/territory specific regulations. For example, Western Australia’s Work Health and Safety (Mines) Regulations 2022 require that mines must operate a mine safety management system that includes performance standards for measuring mine safety, and ‘a system for auditing the effectiveness of the mine safety management system against the performance standards, including the methods, frequency and results of the audit process’.

In Western Australia – and in other states and territories – OHS authorities and the legal system understand that accredited certification to ISO 45001 is a strong indicator of a mining organisation’s overall commitment to meeting these requirements.

This is another common driver. Organisations choose to obtain certification when they see that their competitors have certification or when they perceive that certification gives them a competitive edge over the competition.

This occurred in Asia in the late 1990’s and early 2000’s when many companies sought to achieve ISO 9001 – the quality standard to demonstrate that the products that they produced were built within a quality environment.

Some clients will demand that service providers have certain management standards in place. This is a way that the client obtains assurance that the service provider is protecting the assets or processes of the client.

Clients may use the demonstration of certification as a key method to select or not select certain providers in the marketplace.

• Should our business be aware of the standards?
• Should our business purchase the standards and choose which bits we like and then implement just those sections?
• Should our business purchase the standards and then adopt the good practices of the standard?
• Should our business implement the standard as a once-off activity?
• Should our business implement the standard with the support of an advisor and then obtain an internal assessment that we essentially conform with the requirements of the standard?
• Should our business fully embrace the standards, achieve conformance with the requirements and be certified by a conformance assessment body so that we can outwardly demonstrate that we are certified in the relevant standard?

This is not an easy decision. Each of the options above have different costs and benefits.

• Can the business afford to go all the way?
• Can the business afford to not go all the way?
• Does the business have the financial support to achieve certification?
• Does the business have the risk appetite to achieve certification?
• Does the business have readily available expertise to help the business progress through to certification?
• What are our regulatory requirements?
• What do our stakeholders expect?
• What does our board want?

Once you answer these questions, you’re ready to proceed on your journey.

At the very worst, you may read the standards and find that your organisation is already implementing equivalent or superior technical solutions to the challenges of asset management, information security or business continuity. If so, this in itself will be valuable: you will be able to explain honestly to internal or external stakeholders that your organisation is operating world best-practice management techniques for these challenges.