Selling in or into the EU
For firms based in the EU, or winning customers there. The practice is run from Malta, so EU rules and EU buyers are home ground.
Compliance, With Quality
For businesses in the EU, the UK and the UAE
I run an advisory practice under my own name for businesses that want to perform better through compliance management and quality management. Some want to win customers in the EU, the UK or the UAE who ask for proof of how they work. Others want to pull ahead of local competitors who have no support like this. I lead every engagement, and a small team of qualified people does the work with me.
I map the rules that apply to you, put the controls in, and make sure the evidence is there when someone asks. I work to ISO 37301 for compliance and ISO 31000 for risk.
How it works → Offer 2I build a quality system around how your people already work, then get it ready for an ISO 9001 audit if you want the certificate.
How it works → Offer 3For firms with nobody running operations. I come in one to eight days a month, and compliance and quality get checked as part of the job.
What the role covers →My clients are businesses in the European Union, the United Kingdom and the United Arab Emirates, and businesses that want to sell into those markets. Large customers, public buyers and regulators in all three expect suppliers to show how they manage compliance and quality. The standards I work to, ISO 9001, ISO 37301 and ISO 31000, are international, so one well-run system answers those questions wherever you sell.
For firms based in the EU, or winning customers there. The practice is run from Malta, so EU rules and EU buyers are home ground.
For UK firms, and for firms that want UK customers. The same systems, built with UK law and UK buyers in mind.
For businesses in the UAE, and for firms selling there. Compliance and quality systems that give customers and partners the proof they ask for.
Ahead of the local competition
In many local markets, few firms have anyone looking after compliance and quality properly.
When you can show a buyer your records in minutes, and your work comes out right the first time, you stand out against competitors who cannot. Where national law needs a specialist view, in an EU member state, the UK or the UAE, I work alongside a local adviser. None of this is legal advice.
Credentials
Three jobs from my own record. I have left the client names out, and the results are the ones the clients reported.
Quality
80% fewer returns
A distributor of industrial components had slow processes, and its departments barely spoke to each other. We rebuilt the work around a single workflow, from order to invoice, with one set of records everyone used. Six months later returns were down 80%, and the cash flow had settled.
Working to a standard
A 12-month qualification, passed
A global semiconductor manufacturer needed a moisture-controlled bag qualified for sensitive components. We delivered it on a documented control process, and it passed after a twelve-month testing cycle.
Governance and funding
Cases built for due diligence
For a property developer I built a five-year cash flow model to raise bank and investor funding. For an installations firm I ran a government investment incentive claim from start to finish, and the claim was secured.
Compliance and quality work is often bought as insurance. I look at it differently. If the work is done properly, you should see it in three places.
I spend time with the people doing the job, watch how they do it, and write that down. Then we strip out the steps where things go wrong. Less rework. Fewer complaints. Fewer jobs out late. Your staff get back the hours they spent fixing last week's work.
A redone job, a refund, a credit note, a late fee, a fine, a customer who quietly goes elsewhere. None of these has its own line in the accounts. The American Society for Quality calls much of this the cost of poor quality. I go through the year's numbers with you, put a rough figure on it, and we start with the biggest item.
A buyer's lawyers or a bank's credit team usually ask to see licences, contracts, the complaints log, the incident log, and how the firm runs when the owner is away. Every gap turns into another question. Some turn into a lower offer. I would rather you find those gaps now than in a data room. The sale, the valuation and the loan are for your lawyer and accountant. I get the records in order.
The research. Two studies worth reading. Levine and Toffel, 2010 (free 2008 report): Californian firms with ISO 9001 against matched firms without it. The ISO firms were likelier to survive, and their sales, jobs and payroll grew faster. Ponemon Institute, 2017: 53 multinationals, mostly on data protection. On average, non-compliance cost them about 2.71 times what compliance did. Neither is a promise for your firm. What I will do is go through your figures with you and show you where I think the money is leaking.
I run each engagement in the same order, and you are free to stop after any stage. If the Diagnostic shows that you need nothing more, I will tell you so.
Start with the Diagnostic if you are not sure. Half the point of it is to find out whether you need a project in the first place. If you sign a Build project within 60 days of the findings call, I credit the Diagnostic fee in full against the project fee. For the detail, go to the compliance management page or the quality assurance page.
Fractional COO
In some firms the owner does the operations job at night, after everything else. The fractional COO role is for that firm. It is one to eight days a month, part on site and part off site. On those days I chair the monthly review and go through the processes and the registers with the people who own them. I look at suppliers and at staff sign-offs. You get one report from me every month. I am not appointed as a director, and I do not take a role that needs a regulator's approval.
Fractional COO Packages and pricesI design and run compliance, risk and quality systems to internationally recognised ISO standards. Alignment is a design principle, not a badge: the structure and intent of the standard shapes the system, sized to how your organisation actually works, and built so it holds up when someone checks.
Compliance
ISO 37301
Compliance management systems
The backbone of how I build a compliance framework: governance, obligations, controls and evidence that stand up under scrutiny.
Risk
ISO 31000
Risk management
Risk assessed and managed as a discipline, so the register drives real decisions instead of sitting in a drawer.
Quality
ISO 9001
Quality management systems
Quality systems that keep the work consistent, documented and audit-ready, day to day.
Anti-bribery
ISO 37001
Anti-bribery management systems
Controls proportionate to your exposure, from third-party due diligence to gifts and hospitality.
The practice
I lead every engagement, and my team does the work with me. You deal with me from the first call until the work is signed off, and I review what the team delivers before it reaches you. Each member of my team holds at least a degree and has experience in or close to quality, curriculum development or accreditation. I check the certificates and the experience myself before anyone works on a client engagement. Before the work starts, I tell you who will be working on it and what each person will do.
The practice is run from Malta, and I am in the United Kingdom regularly. It takes work in the European Union, the United Kingdom and the United Arab Emirates. I own other businesses. Before I accept an engagement I check it for a conflict of interest with any of them. You can read how an engagement is run, and what happens to your information, on the Trust page. My own record is on the About page and the CV.
These are short pieces taken from two of my books. Each picks one compliance or quality model and tells it through a real company. Each ends on a question you could ask at your own management meeting this week.
Key Compliance Models
Three teams were watching the risk. All three had gone slack at the same time. That is the HSBC story in one line.
Key Quality Models
Most people change how they work and never check if it helped. They just move on. Next month, the same problem is back.
Key Compliance Models
UBS did not lack a process on paper. A process that is not lived is not a control. It is a document.
It does two things. On the compliance side I build frameworks to ISO 37301 and risk management to ISO 31000. For firms in regulated sectors I also build training and competence frameworks, and I get an organisation ready for whichever duties apply to it. On the quality side it is ISO 9001 systems: processes, document control, internal audit and getting ready for certification. I work with businesses, public bodies and NGOs. All of it is advice given to one organisation at a time, and the documents are written for that organisation. There is also a part-time role, the fractional COO, in which I apply both inside one firm's operation.
In three ways. It goes after the cost of work done twice, refunds, late fees and fines, most of which never shows up as its own line in the accounts. It lets managers decide more without going to the owner. And when a buyer, a bank or a large customer asks for your records, you have them, so there is less for them to pick at. I cannot promise a figure. I can show you where I think the money is going and start with the biggest item.
Stefan Gauci Scicluna. I lead every engagement and you deal with me from start to finish. My team does much of the work with me, and I tell you who is working on yours before it starts.
No, and nobody in my position can. An ISO certificate comes from an accredited certification body. My part is to build the system with you and prepare you for the day. The decision is theirs, and I will not promise you an outcome.
I recommend starting with the Diagnostic. It takes two or three days of my time and leaves you with scored findings and a 90-day plan. If you already know what you need, skip the Diagnostic and use the contact page. I will want to know who you are, what is putting you under pressure and when it has to be done. You will usually hear back within a couple of working days.
The EU, the UK and the UAE. The practice is run from Malta. I work from the law of the place you trade in, and Scotland does some things differently from England. My own ground is the United Kingdom, Malta and European Union rules. For UAE law, or the national law of another EU member state, I work alongside a local adviser.
Start a conversation
Tell me what you want done and by when. You will get a plain yes or no on whether this practice is the right one for it, and if it is, how I would go about it.