05 / Maintenance
The Management System Maintenance Program
Certification is the start of the obligation, not the end of it. MSMP keeps your system running between audits. Internal audits actually scheduled, management review actually held, and someone who knows your system when the auditor calls.
Most management systems don't fail at the certification audit. They fail quietly afterwards. The internal audit slips a quarter, then a year. Management review gets skipped because everyone's busy. The person who built the system leaves and takes the reasoning with them. Then the surveillance audit arrives and the findings are about maintenance, not capability.
That's not a hypothetical. Look at the areas that generate the most findings across ISO audits: internal audit records, ineffective management review, risk actions not tracked, documented information out of date. Every one of those is a maintenance failure. The work was possible; nobody had the time or the calendar entry.
What's included
The recurring work, handled
Scope is agreed in writing and fixed annually. Take the whole programme or the parts you're actually short on.
- Internal audit programme
Planned, scheduled and run independently across your full scope, with findings written the way a registrar writes them. Solves the objectivity problem and means the audit actually happens.
- Management review support
Agenda, inputs assembled, meeting facilitated, outputs recorded. The clause that gets skipped most and cited most.
- Corrective action tracking
Findings followed through to root cause, action, completion and a documented effectiveness review, not closed with a correction and forgotten.
- Document control upkeep
Master list current, revisions controlled, obsolete documents withdrawn, records retrievable when someone asks for them.
- Surveillance audit preparation
Pre-audit review ahead of each visit, so nothing is discovered on the day.
- Standard transition support
When your standard is revised, the gap analysis and update work is already inside the programme rather than a separate project.
- Advisory access
Someone to ask when a question comes up mid-year, instead of guessing and finding out at the audit.
Who it's for
Four situations where this earns its fee
- 01
Nobody owns the system
It was built for certification and quietly became nobody's job afterwards.
- 02
Your quality manager left
The system exists, but the reasoning behind it walked out of the door.
- 03
You need genuine audit independence
In a small organization, the person who understands a process is the person running it. An outside internal auditor solves that.
- 04
Multiple standards to keep current
Two 2026 ISO revisions are in motion. Keeping pace is a standing task, not a one-off.
What a maintenance year looks like
A rhythm rather than a scramble. The point is that each of these happens on a date decided in advance, not in the fortnight before an audit.
Plan the year. first, Audit schedule, review date, transition work and any known changes, agreed up front.
Internal audits, on schedule. then Run across the scope through the year, findings raised and owned.
Management review, properly. after that, All required inputs, real outputs, minutes an auditor will accept.
Close out, then prepare. finally, Corrective actions verified effective, then a pre-audit review before the registrar arrives.
Recognition
MSMP clients qualify as Active Clients
Organizations on a maintenance programme meet the criteria for Active Client status in our Certified Client Recognition Program — directory listing, priority updates, and recognition aligned with your current certification status.
Free, optional, and entirely separate from the maintenance fee.
-
Related
Auditing on its own Internal audits without the full programme, if that's the only gap. Auditing → -
Related
Train your own auditors If you'd rather build the capability in-house than outsource it. Training →
That's fine. We take on maintenance for systems built by someone else — it usually starts with a review of what's actually there.
Questions
Common questions
Do we have to have been a Wilkshire client?
No. We take on maintenance for systems other consultants built, or that a company built itself. It usually starts with a short review of what exists so we know what we're maintaining.
How is this priced?
Fixed annual scope, agreed in writing before anything starts. What drives it is how many standards, how many sites, and how much of the work you want to keep in-house.
Can we take only part of it?
Yes. Plenty of clients take only the internal audit programme, or only surveillance audit preparation. The whole programme suits organizations with nobody owning the system internally.
Does this replace our own people?
No, and we'd be wary of a version that did. It covers the recurring work that reliably slips — audits, review, corrective action follow-through — while your team keeps running the system day to day.
Can you be our internal auditor and our consultant?
Yes. What no consultant can be is your certification body — that separation is fundamental. We stay independent of all registrars.
What happens when our standard is revised?
The transition work sits inside the programme rather than arriving as a separate project. With ISO 14001:2026 published and ISO 9001:2026 coming, that's live for most clients right now.
Next step
System drifting since certification?
Most do. A short call establishes what's actually slipped and what it takes to get back on top of it.