ISO, EXPLAINED SIMPLY

5 signs your ISO exists only on paper

Aug 17, 2026 · Management systems

The value of a management system that conforms to ISO standard requirements is not measured by the volume of documented information. It is measured by how consistently everyday work runs, and by how much performance information is actually used for decision-making and improvement.

Here, “on paper” does not mean printed documents only. It also covers the electronic files, procedures, forms and records that are never used in daily work.

The five signs below are not audit criteria, and they are not a judgement about certification. Finding one of them does not by itself prove that a requirement is unmet. Each is a signal to test your management system against how work is actually done.

The five signs — 30-second video

Start with the five signs in one short video. The video is in Mongolian; the article below carries the full explanation in English.

Watch the 30-second YouTube Short →

1. The system starts “working” only when an audit approaches

In some organizations, procedures, indicators and responsibilities are discussed — and staff are briefly reminded of them — only in the weeks before an audit. If that activity fades again the moment the audit ends, the system may not be fully integrated into daily operations.

An audit is not a reason to run the system temporarily. It is one way of evaluating whether the system is implemented as planned and remains effective.

Example

Before an internal audit, process indicators, responsibilities and implementation are all hurriedly reviewed at once. Between audits, they are not reviewed regularly or used in decisions.

Check question

With no audit approaching, what system work has actually been done regularly over the past three months?

First step

Choose three activities that run regularly regardless of audits — for example, monitoring process indicators, evaluating nonconformities, and reporting results to management — and set a clear frequency and owner for each.

2. The procedure says one thing. The actual work is done another way

When the documented information is in place but people work differently, there are two common causes: the procedure has fallen behind the real work, or the process has changed without control.

Either way, a gap between the procedure and actual practice increases the risk of errors, lost information and blurred accountability.

Example

The procedure says every order is recorded in the shared system, yet staff actually handle orders through chat, phone calls and personal notes.

Check question

Pick one process at random. Does the actual sequence a staff member demonstrates match the procedure?

First step

Do not rush to force people back onto an outdated procedure. First establish which way of working is correct, safe and effective; then align the process and the documented information with each other.

3. Records are filled in afterwards, not as the work happens

Records are not material produced for the auditor. They are the evidence the organization itself needs of what happened, who did it and what the result was.

When records are reconstructed from memory days or weeks later, their accuracy and traceability weaken. That, in turn, reduces the ability to detect failures in time and to make sound decisions.

Example

Day-to-day work records are not kept at the time; before an audit, they are all written up at once.

Check question

Were the last three records created while the work was happening, or filled in afterwards?

First step

Make the record as simple as possible. Define who enters what information and when, and make it part of the workflow itself.

4. The same nonconformity keeps coming back

Fixing a nonconformity on the spot — a correction — and preventing its recurrence — corrective action — are two different concepts.

Not every nonconformity requires corrective action to eliminate its cause. But the need for such action must be evaluated — and where action is taken, its effectiveness must be checked.

Example

Deliveries are regularly late, yet only the delivery staff get reminded — the possible causes in planning, capacity, supply and information flow are never evaluated.

Check question

For the last recurring nonconformity, did you evaluate whether cause-eliminating action was needed — and whether the same conditions could arise elsewhere?

First step

Treat separately what happened, why it happened, and what must change to prevent recurrence. Set a clear owner, a deadline and a method for checking effectiveness.

5. Objectives and indicators are not used to make decisions

Objectives may be written on the board, reports produced and meetings held — but if no real decisions come out of them, the system cannot serve as a management tool.

Quality objectives should be measurable and monitored regularly. What matters is analysing the measurement results and using them to make decisions about process performance, customer satisfaction and the need for improvement.

Example

An objective says “reduce defects”, but by how much, by when and measured by whom is undefined. A month’s results worsen, and still no decision follows on causes, actions or resources.

Check question

What was the last management decision made on the basis of actual performance information?

First step

Choose a few indicators that directly affect customer and business outcomes. Define the measurement frequency, the owner, the attention threshold, and the decision sequence that follows when results worsen.

The 15-minute internal checklist

With your management team, choose one important process and answer the following five questions on the basis of real evidence.

Watch the five questions in the short video. The video is in Mongolian; this page carries the same five questions in English.

Watch the YouTube Short →
  1. With no audit approaching, is the system work connected to this process happening regularly?
  2. Do the documented information and the actual work match?
  3. Were the last three records created at the time of the work?
  4. For recurring nonconformities, was the need for cause-eliminating action evaluated — and the effectiveness of any action taken?
  5. What decision has been made on the basis of this process’s performance information?

“It should be so” is an assumption, not evidence. Every “no” or “don’t know” shows you where to start improving.

From paper to a working system

A working management system does not have to be perfect. But people should understand their roles, use documented information that fits the work, generate evidence at the time of the work, evaluate the causes of nonconformities — and management should make decisions based on performance information.

If any of these five signs appears, do not rush to change everything at once. Choose the one process with the greatest effect on customers, quality, time or cost, and examine it from four sides: documented information, actual practice, records and results.

Societas Prima Transitus — ISO consulting services.

We advise you on building and implementing a management system tailored to your organization — ISO 9001 (quality), ISO 14001 (environment), ISO 22000 (food safety), ISO 45001 (occupational health and safety), ISO 27001 (information security).

We do not issue certificates. The certification decision is made by an independent certification body.

← Learning Library

Have a question about ISO?

Write to us with your question.

Get in touch