Performance, Built on Compliance and Quality

For leaders and managers in the EU, the UK and the UAE

Sell more, and keep what you sell.

Most owners who ring us want one thing before anything else: more sales. So that is where we start. We look at who you sell to and how, at what your sales people do with their week, at the way the department runs when the manager is on holiday, and at the compliance and quality behind each deal, because a sale that comes back as a refund in March was never really a sale. A lot of our clients are chasing buyers in the EU, the UK or the UAE who want to see how a supplier works before they sign anything. Plenty of others just want to be clearly better than the firm down the road. Stefan leads every engagement, and a small team of qualified people does the work with him.

The first 30 minutes are free, by video call. You tell us where things stand, and we tell you honestly whether the paid diagnostic is worth doing.

“We have seen a real improvement in efficiency and communication. The answers are reliable and competent.”

Advisor, a government ministry, 2023 · Stefan leads every engagement · More references

Four colleagues round a table going through printed charts and reports

Where do you want to start?

The site covers advisory work, two writing series and Stefan’s own record, which is a lot to take in on a first visit. These four doors cover most of the people who land here.

Something else? See every starting point →

New: AI agents, governed. Somebody in your firm is about to let a piece of software email customers in your name. Before it does, we write the three things it will need: a job description, an owner and a file. How we do it, and why a digital worker needs a compliance manager. For the AI that helps a person do a job, see AI in operations.

The 8X Method mark

Our own method

The 8X Method

Every diagnostic and every engagement we run follows the 8X Method. We built it from our own work with owners, directors and managers, and we have sharpened it client by client.

How the method works →

What all our work is for

Performance, backed by compliance and quality.

01

Performance

Leaders and managers who decide faster and on better information. You see it in margin, cash, complaints and the time work takes.

02

Compliance

Each rule that applies to you has an owner, and the proof is on file, so managers are not firefighting.

03

Quality

The work is done the same way each time and checked, so managers can trust the figures they get.

Free tools

Check your own business before we talk

We built these for founders who want a straight answer on their own. They are free and need no sign-up, and the health check runs in your browser, so your answers stay with you.

New: free sales tools

Three markets: the EU, the UK and the UAE

Our clients are businesses in the European Union, the United Kingdom and the United Arab Emirates, and businesses that want to sell into those markets. Large customers, public buyers and regulators in all three expect suppliers to show how they manage compliance and quality. The standards we work to, ISO 9001, ISO 37301 and ISO 31000, are international, so one well-run system answers those questions wherever you sell.

European Union

Selling in or into the EU

For firms based in the EU, or winning customers there. The practice is run from inside the EU, so EU rules and EU buyers are home ground.

United Kingdom

Selling in or into the UK

For UK firms, and for firms that want UK customers. The same systems, built with UK law and UK buyers in mind.

United Arab Emirates

Selling in or into the UAE

For businesses in the UAE, and for firms selling there. Compliance and quality systems that give customers and partners the proof they ask for.

Ahead of the local competition

In many local markets, few firms have anyone looking after compliance and quality properly.

When you can show a buyer your records in minutes, and your work comes out right the first time, you stand out against competitors who cannot. Where national law needs a specialist view, in an EU member state, the UK or the UAE, we work alongside a local adviser. None of this is legal advice.

Who the practice is for
  • Financial services
  • iGaming
  • Property and real estate
  • Professional services
  • Manufacturing
  • Hospitality
  • Retail and e-commerce
  • Healthcare and pharma
  • Public bodies
  • NGOs

Credentials

20 yearsBuilding and running businesses in Malta and the UK
2,000+High-value projects delivered for clients
ISO standardsSystems built to ISO 37301, ISO 31000 and ISO 9001
FSB · Malta ChamberMember of both, and on the Chamber’s future-of-work committee

The full record, with numbers you can check →

Results from real engagements

More case studies →

Jobs from our own record, sales first. Client names are left out, and every figure is the one the client reported to us.

Sales · Importer

About 40× turnover

An importer grew its turnover about fortyfold in three years.

Sales · Professional services

+50% sales a year

Professional services companies we worked with put on around half again in sales, year after year.

Sales · Estate agency

6 to 20+ properties a year

An estate agency was selling six properties a year. It now sells more than twenty.

Quality

80% fewer returns

A distributor of industrial components had slow processes, and its departments barely spoke to each other. We rebuilt the work around a single workflow, from order to invoice, with one set of records everyone used. Six months later returns were down 80%, and the cash flow had settled.

Working to a standard

A 12-month qualification, passed

A global semiconductor manufacturer needed a moisture-controlled bag qualified for sensitive components. We delivered it on a documented control process, and it passed after a twelve-month testing cycle.

Governance and funding

Cases built for due diligence

For a property developer we built a five-year cash flow model to raise bank and investor funding. For an installations firm we ran a government investment incentive claim from start to finish, and the claim was secured.

How did they get there? The same way each time. First the diagnostic. Out of that came a sales strategy, written down. Then new technology, where the old way was costing sales, and new people, hired because the strategy said that was the job to fill. After that, a meeting every week with the new hires to see how they and the new tools were getting on, small changes, and the same again the following week, until sales were where the owner wanted them.

  1. Diagnostic
  2. Sales strategy
  3. New technology
  4. New people, hired to the strategy
  5. Weekly follow-up

Where it shows up in the numbers

Compliance and quality work is often bought as insurance. We look at it differently. If the work is done properly, you should see it in three places.

Operations

Work done once

We spend time with the people doing the job, watch how they do it, and write that down. Then we strip out the steps where things go wrong. Less rework. Fewer complaints. Fewer jobs out late. Your staff get back the hours they spent fixing last week's work.

Profit

Money you are losing without seeing it

A redone job, a refund, a credit note, a late fee, a fine, a customer who quietly goes elsewhere. None of these has its own line in the accounts. The American Society for Quality calls much of this the cost of poor quality. We go through the year's numbers with you, put a rough figure on it, and start with the biggest item.

Company value

A business that is easier to sell or fund

A buyer's lawyers or a bank's credit team usually ask to see licences, contracts, the complaints log, the incident log, and how the firm runs when the owner is away. Every gap turns into another question. Some turn into a lower offer. We would rather you found those gaps now than in a data room. The sale, the valuation and the loan are for your lawyer and accountant. We get the records in order.

The research. Two studies worth reading. Levine and Toffel, 2010 (free 2008 report): Californian firms with ISO 9001 against matched firms without it. The ISO firms were likelier to survive, and their sales, jobs and payroll grew faster. Ponemon Institute, 2017: 53 multinationals, mostly on data protection. On average, non-compliance cost them about 2.71 times what compliance did. Neither is a promise for your firm. What we will do is go through your figures with you and show you where we think the money is leaking.

How an engagement runs

We run each engagement in the same order, and you are free to stop after any stage. If the Performance, Compliance and Quality Diagnostic shows that you need nothing more, we will tell you so.

Before any fee: a free 30-minute call. We talk by video call for 30 minutes, at no charge. You tell us what worries you, and we tell you whether a diagnostic is worth doing. If it is not, we say so, and that is the end of it. Book it here.

  1. Performance, Compliance and Quality DiagnosticThis part takes two or three days, at a fixed fee of €2,250, excluding VAT. We go through your paperwork and sit down with two or three of your staff. Then we mark what we have seen against whichever standard or regulator applies to you. At the end you have a few pages of findings and a plan for the next 90 days. We talk both through on a call.
  2. BuildThis is a project with a fixed scope, and it fills the gap that the Performance, Compliance and Quality Diagnostic found. That might be a compliance framework or a risk framework. It might be a quality management system, or the controls a buyer or a funder has asked to see.
  3. SustainOnce a system is built, somebody has to look after it. Keep, Assure and Assure Plus are three ways of having the practice do that for 12 months, with Stefan accountable for the work. Under all three we update your documents once a year for changes in the law or the standard. Under Assure and Assure Plus we also check every quarter whether people still follow them.
  4. Add where neededSome work is a one-off: a mock inspection, a day of internal audit, an update after a rule change, a report for your board, or a block of advisory hours.
Show prices in

Start with the Performance, Compliance and Quality Diagnostic if you are not sure. Half the point of it is to find out whether you need a project in the first place. If you sign a Build project within 60 days of the findings call, we credit the Performance, Compliance and Quality Diagnostic fee in full against the project fee. For the detail, go to the compliance management page or the quality assurance page.

Fractional COO

Help running the operation, a few days a month.

In some firms the owner does the operations job at night, after everything else. The fractional COO role is for that firm. It is one to eight days a month, part on site and part off site. On those days we chair the monthly review and go through the processes and the registers with the people who own them. We look at suppliers and at staff sign-offs. You get one report from us every month. Nobody from the practice is appointed as a director, and we do not take a role that needs a regulator's approval.

Fractional COO Packages and prices
  • Meetings every week, month and quarter, with the monthly review minuted.
  • Processes with one owner and one written version each.
  • Registers for obligations (ISO 37301) and for risks (ISO 31000).
  • Checks on suppliers, and on who is signed off to do what.
  • One report a month for the owner or the board.

The standards we work to

We design and run compliance, risk and quality systems to internationally recognised ISO standards. Alignment is a design principle, not a badge: the structure and intent of the standard shapes the system, sized to how your organisation actually works, and built so it holds up when someone checks.

Compliance

ISO 37301
Compliance management systems

The backbone of how we build a compliance framework: governance, obligations, controls and evidence that stand up under scrutiny.

Risk

ISO 31000
Risk management

Risk assessed and managed as a discipline, so the register drives real decisions instead of sitting in a drawer.

Quality

ISO 9001
Quality management systems

Quality systems that keep the work consistent, documented and audit-ready, day to day.

Anti-bribery

ISO 37001
Anti-bribery management systems

Controls proportionate to your exposure, from third-party due diligence to gifts and hospitality.

What alignment means

  • The standard shapes the design, the controls and the evidence, sized to your organisation.
  • Obligations mapped to the regulation and the risk, with proof you can put in front of an auditor.
  • A gap analysis against the standard, and a prioritised plan you can act on.
  • Policy turned into behaviour, so the right way is the way people actually work.

What it does not mean

  • This is an advisory practice, not a certification body.
  • Certification against a standard is issued by an accredited certifier, not by us.
  • Alignment gets you ready for certification if you want it; it is not the same as holding the certificate.

The practice

Who does the work.

Stefan leads every engagement, and our team does the work with him. You deal with Stefan from the first call until the work is signed off, and he reviews what the team delivers before it reaches you. Each member of our team holds at least a degree and has experience in or close to quality, curriculum development or accreditation. He checks the certificates and the experience himself before anyone works on a client engagement. Before the work starts, we tell you who will be working on it and what each person will do.

The practice is run from inside the EU, and Stefan is in the United Kingdom regularly. It takes work in the European Union, the United Kingdom and the United Arab Emirates. Stefan owns other businesses. Before we accept an engagement we check it for a conflict of interest with any of them. You can read how an engagement is run, and what happens to your information, on the Trust page. My own record is on the About page and the CV.

Business Insights

All insights →

These are short pieces taken from two of Stefan’s books. Each picks one compliance or quality model and tells it through a real company. Each ends on a question you could ask at your own management meeting this week.

The Three Lines Model: business, compliance and audit as three separate lines

Key Compliance Models

The Three Lines Model

Three teams were watching the risk. All three had gone slack at the same time. That is the HSBC story in one line.

1 min read
PDCA: Plan, Do, Check, Act, the Deming Cycle

Key Quality Models

PDCA, the Deming Cycle

Most people change how they work and never check if it helped. They just move on. Next month, the same problem is back.

1 min read
ISO 31000: a living loop of identify, analyse, evaluate and treat

Key Compliance Models

ISO 31000, Risk Management

UBS did not lack a process on paper. A process that is not lived is not a control. It is a document.

1 min read

Common questions

What does the advisory practice do?

It does two things. On the compliance side we build frameworks to ISO 37301 and risk management to ISO 31000. For firms in regulated sectors we also build training and competence frameworks, and we get an organisation ready for whichever duties apply to it. On the quality side it is ISO 9001 systems: processes, document control, internal audit and getting ready for certification. We work with businesses, public bodies and NGOs. All of it is advice given to one organisation at a time, and the documents are written for that organisation. There is also a part-time role, the fractional COO, in which we apply both inside one firm's operation.

How do compliance and quality management help profit and company value?

In three ways. It goes after the cost of work done twice, refunds, late fees and fines, most of which never shows up as its own line in the accounts. It lets managers decide more without going to the owner. And when a buyer, a bank or a large customer asks for your records, you have them, so there is less for them to pick at. We cannot promise a figure. We can show you where we think the money is going and start with the biggest item.

Who will I be working with?

Stefan Gauci Scicluna leads every engagement, and you deal with him from start to finish. Our team does much of the work with him, and we tell you who is working on yours before it starts.

Do you issue ISO certificates?

No, and no adviser can. An ISO certificate comes from an accredited certification body. Our part is to build the system with you and prepare you for the day. The decision is theirs, and we will not promise you an outcome.

Where do I start?

For compliance or quality work, we recommend starting with the Performance, Compliance and Quality Diagnostic. It takes two or three days of our time, costs a fixed €2,250 excluding VAT, and leaves you with scored findings and a 90-day plan. If you want a fractional COO, you start with the Operations Diagnostic instead: one day or four days, at the fixed fees on the packages page, credited in full against your first package if you sign up within 60 days. If you already know what you need, skip both and use the contact page. We will want to know who you are, what is putting you under pressure and when it has to be done. You will usually hear back within a couple of working days.

Which countries do you cover?

The EU, the UK and the UAE. The practice is run from inside the EU. We work from the law of the place you trade in, and Scotland does some things differently from England. Our own ground is United Kingdom and European Union rules. For UAE law, or the national law of another EU member state, we work alongside a local adviser.

Start a conversation

Want more from the people who run your organisation?

Tell us what you want done and by when. You will get a plain yes or no on whether we are the right team for it, and if we are, how we would go about it.

Make an enquiry