So you’ve built an IMS. Now what?

Step one

Where you are

Take stock before you touch anything. The build did a great deal; it decided nothing.

01What the build gave you

02How thorough you were

Tick what is true of your questionnaire.

All three ticked: the steps below are review and sharpening, and the depth is yours to set. Any unticked: the same steps are the planning you have not yet done. Do them with the same people in the room, budget the time, and expect each to take twice as long as it reads.

03What done looks like

At the end of the first quarter these records exist. Everything below is in service of this list.

Step two

Review and approve every document

The rough-in becomes a system here. Each document is read by the role that owns it against how the firm actually works, changed through the agent, reviewed by a second person and approved by a third. The record is the pull request and the merge.

01Put names against the five roles

The questionnaire gave the roles titles. The People register needs names. Every document carries three of them in its frontmatter: owner, reviewer and approver.

Top Management

Chairs the monthly review. Approves 20 of the 21 documents.

Quality Manager

Owns 13 documents. Approves the Management Review procedure.

OHS Coordinator

Owns 6 documents. Standing reviewer on most of the rest.

Document Controller

Owns Document & Record Control. Runs the acknowledgement campaigns.

Worker Rep

Reviews the Policy, Consultation, Incident Reporting and the Emergency Plan. Sits in the risk workshop.

One rule, and the build enforces it: a document’s owner and its reviewer can never be its approver. tools/check_docs.py fails the build if they are, and branch protection on main gives that teeth. Because Top Management approves 20 documents, the director cannot own or review those 20. The check requires two people; three is the honest minimum, one to own, one to review, one to approve. In a firm this size these are hats, not jobs. Decide who wears which now, and put the names in the People register.

02Split the set

Owners drive. Each owner takes their documents in the order below, two a week; at that pace the set is through in six weeks. The reviewer and approver for each are in its frontmatter and in the Document Index.

Order. The documents people live under first: the Policy, Incident Reporting, the Emergency Plan, Document & Record Control, Operational Control, Customer Requirements. Then the rest. Any document with worker_consultation_required: true needs a consultation record in docs/records/consultation/ linked from its pull request before it can be approved; the Policy and the OHS procedures are the usual ones.

03Learn the lifecycle once

Every owner, reviewer and approver reads the Document Lifecycle for Authors page, twenty minutes, and logs it on the Training Completion form. Those are the first rows in the Training Log. The Author, Reviewer & Approver Guide is the reference; keep it open. Reviewers and approvers can work entirely from GitHub in the browser. Anyone who prefers the editor installs the GitHub Pull Requests extension from DIY Step three.

04Review with the agent in VS Code

The owner opens the repository in VS Code, opens the document and reads it against how the firm works. Where it is wrong, instruct the agent; do not edit by hand. Name the section, say what it claims, say what you actually do:

Open the Operational Control & Service Delivery procedure. Section 3.2 says
the job lead verifies the deliverable. Here the job lead drafts and a second
senior verifies. Rewrite 3.2 to match. Resolve the [ORG-DECISION] at 3.4: job
files live in SharePoint under Projects/<job number>. Keep status Draft,
bump version 0.1 to 0.2, add a Revision History row.

Read the diff before you accept it. Every [ORG-DECISION] and every LATER left in the document is decided now, or assigned a name and a date in the pull request; do not approve a document around an open marker. A reviewer who wants changes rather than comments checks out the same branch and instructs the agent the same way.

05Push for review

When the document reads true, have the agent set status: Under Review, then push. Branches are named doc/<ID>-<slug>. The agent is barred from git writes by the repository’s CLAUDE.md; people push.

git checkout -b doc/ORG-011-service-delivery
git add -A
git commit -m "Review ORG-011: verification by a second senior; job file location"
git push -u origin doc/ORG-011-service-delivery

On GitHub, open the pull request, complete its checklist and request the reviewer named in the frontmatter. The reviewer reads Files changed and either comments or approves. A reviewer’s approval finishes the review; it does not approve the document.

06Approve

The approver checks four things, then merges.

Review

The named reviewer has approved the pull request.

Checklist

Every item in the pull request template is ticked.

Consultation

If the frontmatter requires it, the record in docs/records/consultation/ is linked.

Checks

The build checks pass.

Then the approver sets status: Approved, approved_date and next_review_date and merges to main. The merge commit is the approval record; the template writes no other. In the same change the Document Register row moves to Approved with its Version, Approved Date, Last Reviewed Date and Next Review Date. Ask the agent to do it over MCP, or do it by hand in Airtable:

Update the Document Register row for ORG-011: Status Approved, Version 0.2,
Approved Date today, Last Reviewed Date today, Next Review Date twelve months
out.

Pages rebuilds on the merge. The approved document is live behind the login, and the intranet now says something you decided.

07Run the campaign and the induction

Once the Policy and any other document with acknowledgement_required: true is Approved, the Document Controller opens the acknowledgement campaign. The automation is already wired: staff receive the form, rows land in Policy Acknowledgements, and a snapshot goes to docs/records/acknowledgements/. Do not run it on a Draft. People acknowledge decisions, not proposals.

In the same week every staff member works through the IMS Induction page, twenty to thirty minutes, and logs it on the Training Completion form. A 30-minute all-hands is optional. If you hold one, say where the intranet is, what the two forms are for, and end with one sentence that promises thinking rather than paperwork: next, we define our first offer.

Step three

Choose the offer to define first

One service, one market, chosen by margin and recorded by decision.

01Why one offer

A management system exists to define quality and then deliver it. Quality cannot be defined for the firm as a whole. It is defined where a particular service meets a particular buyer, and it differs across that grid even when the service name stays the same.

The template is built on this. Product & Market Offer Definitions holds one subsection per offer, an offer being a service in a market, and every job draws its baseline requirements from there. Beyond the eight company-wide objectives, objectives exist only as a sleeve attached to an offer that a management review has selected. There is no place in the system to define quality in general, because there is no such thing.

The company-wide objectives, on time, on cost, to specification, are table stakes. Every competent firm claims them and every client assumes them. They do not tell a consultant what a good report for this client looks like, and they will not move your work from acceptable to chosen.

If you are not with me here, the rest of this procedure will not land. The long-form argument is in Every sector is a buyer. None of them is your market.

02Rank by gross profit

You cannot do this for every offer, so pick the one that pays. Pull the last twelve months of closed jobs from your job costing. The IMS keeps no jobs table by design; job files live in your own job-tracking arrangement. For each job: revenue less direct cost (hours at cost, subcontract, laboratory, travel). Group by service and market. Sort by the total. Revenue is the wrong column; a line that turns over the most and earns the least is the one to fix last, or drop.

A fifth of the lines will carry most of the margin; Perry Marshall’s 80/20 Sales and Marketing is the best short introduction to why that is and what to do about it. Take the top one. If the data does not exist, take the director’s estimate for the last quarter, minute it as an estimate, and start capturing direct cost per job in the job system this week; the objectives in Step four need it.

03Find the painful tail

The same ledger shows the other tail: the lines that produce the overruns, the reworked reports and the bounced submissions. Some are fixable. The cheaper move for most is to stop chasing them: take them off the website, stop quoting them cold, and still do them when a good client asks. Note them in the minutes with the decision.

04Start the post-job feedback now

The objectives plan leaves the CW-1 feedback mechanism for you to decide. Decide it now, because it is the cheapest evidence the system will ever produce and it comes from live work. At every job close from this week:

Two questions

Ask the client what worked and what they would change. Log both in the Customer Feedback & Complaints register.

Rework or bounce

If the deliverable was reworked, or an assessor sent it back, the job lead raises a row in the Nonconformity & CAPA Register.

Five minutes a job. It feeds CW-1 to CW-3, the customer-feedback slice of the monthly review, and the nonconformity stream in Step seven.

05Record the decision

At the next management-review session, whichever slice is scheduled, table three items: the offer selected, the sleeve opened for it, and the process owner named. The procedure requires every session to end in decisions, so this one qualifies. Minutes go to docs/records/management-reviews/YYYY-MM-<slice>.md, a row goes in the Management Review Log, and the offer gets its row in the Product & Market Offers register. The objectives plan is explicit: without that recorded decision no sleeve exists, whatever the register says.

Step four

Ask the people who use it

Quality for this offer is whatever its users need it to be. Find out from them, not from the proposal template.

01Draw the job map

A job map is the sequence of things the customer is trying to get done before, during and after your deliverable: work out what they need, find who can do it, brief them, get the work, check it, use it, deal with what comes after. Draft it yourselves first, from how the work actually arrives and leaves. The pattern is Bettencourt and Ulwick’s customer-centred innovation map. Then let the agent take a pass:

Read the Operational Control procedure and the last three released reports for
this offer. Draft a job map for the customer: the stages before we are engaged,
during the job and after delivery, one line each, with what the customer is
trying to achieve at each stage.

02Interview the customers and the regulator

Every user of the deliverable, not only the payer. Most environmental reports have two readers with two jobs. If the assessor is unhappy with the half they read, the client who paid for the other half will hear about it. Quality is both.

03Extract the outcomes

Give the agent the de-identified transcripts, the job map and the framework, and let it do the first pass:

Read the seven de-identified transcripts in interviews/ and the job map. For
each stage, list every outcome the interviewees described, score importance and
current satisfaction from what was said, and flag the outcomes that are
important and unmet. Then draft the "Jobs & outcome statements" subsection
for this offer in Product & Market Offer Definitions.

The agent is consistent across seven transcripts in a way a tired reader is not. It is not the judge. The process owner reads every scored line against what they heard in the room and changes what is wrong. What the regulator and the customers said they need also lands in the interested-parties table of Context, Interested Parties & Compliance Obligations, which until now held the template’s generic entries.

04Draft the sleeve

Three to five objectives for this offer, each aimed at an outcome that scored important and unmet. Each one carries:

Measure

What is counted. First-pass acceptance by the assessor; days from brief to release; rework hours.

Baseline

Where it sits now, from the last twelve months or an honest estimate marked as one.

Target

Where it should sit by the end of the year.

Data source

An existing register or log. The plan forbids inventing a new instrument to measure an objective.

Owner role

The process owner, usually.

Review cadence

Monthly or quarterly, at the objectives slice of the review.

An OH&S objective needs two more things before it goes Active: a Linked Risks reference to the register row it addresses, and a Consultation Ref to the record where workers had their say. Table the sleeve at the next session; it is adopted by minute and mirrored as rows in the Objectives & Targets register. Meanwhile the company-wide objectives are measured from the first job closed, not left as decoration.

Step five

Productise it

Write the offer down so that a consultant who has never done it can produce a conforming result, then run real jobs through it.

01Capture what you do now

Before you improve anything, record it. The spreadsheet everyone uses, the report skeleton that lives on someone’s desktop, the checks the senior does in their head before anything leaves. Have the person who does the job best walk through one recent job from brief to release, aloud, with the recorder running. That transcript is the raw material; the agent drafts from it and from nothing else.

02Write the offer

From the walkthrough transcript, the job map and the scored outcomes, complete
the subsection for this offer in Product & Market Offer Definitions under
its four headings: Offer and market; Jobs & outcome statements; How the
offer satisfies them; Claims. Include the deliverables, verification steps,
safety preconditions and compliance obligations. Draft the delivery-plan
template and the start-of-job checklist, and add or update the Document Register
rows.

Read it as the new starter would. Every statement under Claims must be one Top Management will confirm can be substantiated; the template requires that before it is published. Then the offer goes through the Step two sequence like any other document: branch, pull request, review, approval, merge. The Product & Market Offers register row points at it, and Customer Requirements & Contract Review draws every future quote for this offer from it.

03Build the deliverable set

For most offers the key deliverable is a report, and a consultant is only as good as what they start from. Build three things from the best of what the firm has already produced, so a new starter edits down from a full draft instead of writing up from a blank page.

Template

The report itself, with its structure fixed and its words in. Headings and standard sections assembled from the best three or four released reports, each marked as required or conditional by job type; direct text for the standard passages; the standard tables; and a placeholder for each figure stating what it must show. The consultant edits it down; nobody writes it up.

Guideline

What has to be done to get the data behind each section: the field and desk steps, the procedures they rely on (a water quality monitoring procedure for the handheld probe, say: leave it in the sample for at least sixty seconds and wait for the pH to stabilise, because an early reading overestimates), and the report-specific hints a senior knows and a junior does not.

Workbook

If the report needs standard calculations, a spreadsheet template: inputs in open cells, every other cell locked, a version in the filename and a change log on the first sheet. Checked once by a senior, not re-derived by every reviewer. Fewer errors, and review becomes a comparison.

The guideline is where the unofficial knowledge goes. One consultancy I worked at decided whether excavated soil could stay on site or had to go to landfill by a number that sat between the health and ecological investigation levels and appeared in no published guideline. It lived in an email from the then head of the EPA’s contaminated land group, and in the memory of the two people who had read it. That is exactly what the guideline holds, email attached. Otherwise it leaves with them.

The agent assembles the first cut from your own released reports and the walkthrough:

Read the last four released reports for this offer and the walkthrough
transcript. Assemble a report template that keeps the best structure of the
four, marks each section as required or conditional by job type, and carries the
standard text, tables and figure placeholders. Draft a guideline of the field
and desk steps behind each section, the procedures they rely on, and the checks
a senior would make. Where the reports contradict each other, list the
differences and stop; I will decide.

None of these is a controlled document in the register’s sense, so control them the same way anyway: one owner, a version number, a change log, and a pull request for every change. Name them from the offer’s subsection so Customer Requirements & Contract Review and the delivery plan can point at them.

04Train and record

Add a Training Curriculum row for the offer. Everyone who delivers it works through the procedure and the templates and logs it on the Training Completion form. Those Training Log rows are the competence evidence for this offer, and the reason a new hire can be put on it in their second week.

05Run the next three jobs through it

Do not wait for the procedure to be perfect. The next three jobs in this offer run on it: a job file opened per Operational Control, requirements taken from the offer baseline per Customer Requirements & Contract Review, the deliverable verified by someone other than its author and marked Released, and the two close-out actions from Step three. Records come from work, not from exercises.

The first job will find something wrong with the procedure. Fix it through the same branch and pull-request sequence. That first revision after a live job, with its merge commit, is the proof the system is alive.

06Extend along the job map

The map from Step four shows the stages above and below yours. The more of the customer’s job an offer covers, the harder you are to replace, and a small firm can go where a large one will not. If a partner, a laboratory, a driller or a subconsultant does one of those stages for you, they are part of the offer: a row in the Supplier & Contractor Register and an evaluation snapshot in docs/records/procurement-evaluations/, per Procurement & Contractor Management. What you have written down in this step is the firm’s knowledge of how to do the work. It used to leave when people did.

Step six

Run the risk workshop

The agent drafted the registers from your answers. Rating them is a decision, and decisions are made by people in a room.

01Why

Nobody expects to crash on the drive to site. On any one trip the seatbelt feels like a formality, and a driver deciding trip by trip would often skip it. Governments do not decide trip by trip. They hold the data across millions of kilometres and decades, they know the crashes will come, and so the belt is required on every trip. That is a risk assessment: the individual odds set aside, the population odds counted, a cheap control chosen against a certain event.

The workshop is where the firm reasons like the government rather than the driver, and the register is what it writes down: the event, how likely and how bad, and the control chosen against it. Your own history is too small a sample to reason from, so borrow the population: your peers have had the incidents you have not yet had, and the industry’s are on the public record.

The rarest events, good and bad, the ones Taleb calls black swans, stay invisible until someone sits down to think about them. The template’s matrix has no special box for them: a Rare likelihood against a Severe consequence lands in the Medium band, which means treat it where a proportionate treatment exists, otherwise accept it with the owner’s documented sign-off.

02Calibrate before you rate

The methodology leaves two decisions to the executive, and neither can be delegated to the agent. Make them at the top of the workshop and minute them.

The scales

What Rare, Unlikely, Possible, Likely and Almost certain mean in years for a firm your size, and what Insignificant to Severe mean in dollars, days and injuries.

Risk appetite

The default: a residual Medium is accepted with the row owner’s sign-off; a residual High or Extreme needs Top Management’s acceptance or a treatment. Confirm it or change it.

The decisions go into the Risk, Opportunity & Hazard Methodology through the Step two sequence; the OHS Coordinator owns it.

03Set it up

Time

Half a day, once. Shorter reviews follow at the cadence each band sets.

Who

As broad across staff as you can afford. The Worker Rep is required, not optional; the methodology says assessment is done in consultation with the workers who do the work. The people who are not executives will name the risks the executives have stopped seeing.

On the table

The agent’s draft Risk & Opportunity and Hazard registers, printed, and the methodology.

Out the door

Every row rated, owned, treated and dated. An attendance list.

04Work the register

Row by row, aloud. Each row leaves the room with:

Owner Role

One name, who will answer for it at review.

Existing Controls

What is already in place, honestly.

Inherent, Residual

Likelihood and consequence before and after those controls; the rating is computed.

Acceptance

Within criteria and accepted, or escalated. A human decision, recorded as one.

Treatment

What will be done, with its level on the hierarchy: eliminate, substitute, engineer, administer, protect. Administrative or PPE controls alone cannot close a High or Extreme residual.

Next Review

Set by band: Low yearly, Medium six-monthly, High quarterly, Extreme monthly until it is not.

Add what is missing. Close what is not real. Rate the opportunities as carefully as the risks; the good swans are on the same register. Touch every cell. The hierarchy of controls is the one in Safe Work Australia’s model Code of Practice, which is where an auditor will expect it to have come from.

05File it

The attendance list and the notes go to docs/records/consultation/; that record is the consultation evidence the OH&S objectives and several documents point at. A snapshot of both registers goes to docs/records/. Before the room empties, take thirty minutes with whoever handles compliance and walk the Compliance Obligations register: every row a real obligation from a real instrument, none invented.

Step seven

Start the machine, then stop

The system improves itself only if things are fed into it. Three homes, one session a month, and a short list of what not to do yet.

01Feed the three homes

Hazards, incidents

Near misses, hazards and injuries go on the Hazard & Incident Report form and land in the Incident Register; investigation records in docs/records/incidents/. Staff learn it on the Hazard and Incident Reporting page.

Nonconformities

A defective deliverable, rework, a report sent back by an assessor, an audit finding. Whoever finds it raises the row directly in the Nonconformity & CAPA Register: Description, Correction, Root cause, Corrective action, and an Effectiveness Check before it can close. The Quality Manager confirms the check.

Feedback, complaints

The Customer Feedback & Complaints register, fed by the two close-out questions. A complaint that reveals a nonconformity is linked to a CAPA row and resolved there.

The first stream is safety and everyone knows it. The second and third are quality, and without them the first quarter yields safety records only. The job lead owns them.

02The monthly session

The Schedule already holds twelve dated slices, one a month, seeded at instantiation:

01

Prior actions and system changes

02

Quality objectives and KPIs

03

Customer feedback and satisfaction

04

OH&S performance

05

Audit results

06

Risk and opportunity effectiveness

07

Compliance evaluation results

08

Consultation and participation

09

Objectives and sleeve review

10

Nonconformity and corrective action

11

Resources and external providers

12

Improvement and strategic alignment

Top Management chairs; the Quality Manager and the OHS Coordinator attend; others are invited by slice. A standing calendar entry, forty-five minutes. Minutes go to docs/records/management-reviews/YYYY-MM-<slice>.md and a row to the Management Review Log. The procedure’s rule: no session ends without explicit decisions and actions. Ask the agent for the pack the day before:

This month's review slice is Customer feedback & satisfaction. From the
Schedule, the Customer Feedback & Complaints register, the Nonconformity
& CAPA Register and the open actions in last month's minutes, draft the
session pack and a minutes file with the decisions and actions sections left
blank.

03Internal audit is a conformance check

The Schedule also holds twelve audit slices, and the Internal Audit procedure says how each is run; records go to docs/records/internal-audits/. One thing about them belongs here. An audit checks whether people do what the procedure says. A procedure nobody follows has no value, and the usual reason nobody follows it is that remembering is easier than fetching it. When an audit finds that, the fix is the procedure, not the people: make it shorter than the memory it replaces.

04Leave these alone this quarter

05Then

When the first offer is running on its procedure and its objectives have a quarter of numbers, go back to Step three and select the next one by a new recorded decision. With every document Approved, the registers rated in consultation and a quarter of records from live work, you hold the evidence an external auditor asks to see. When you book one, ask what they want to see running, and show them the list in Step one. The next procedure in this guide covers keeping it running.

Book a call →

Documentation, not legal, safety or compliance advice. No ISO standard text is reproduced; you need licensed copies of the standards. Certification depends on your arrangements and your certification body’s assessment. The template is governed by its disclaimer and terms of use.