Compliance, With Quality
Compliance and quality assurance advisory
I run a small advisory practice under my own name, and I do the work myself. My clients are businesses, public bodies and NGOs in the UK, the EU and Malta. Most get in touch after an auditor, a regulator or a big customer asked for proof and nobody had it to hand. Others have a shelf of policies and no idea whether anyone follows them.
I map the rules that apply to you, put the controls in, and make sure the evidence is there when someone asks. I work to ISO 37301 for compliance and ISO 31000 for risk.
How it works → Offer 2I build a quality system around how your people already work, then get it ready for an ISO 9001 audit if you want the certificate.
How it works → Offer 3For firms with nobody running operations. I come in two to four days a month, and compliance and quality get checked as part of the job.
What the role covers →Credentials
Three jobs from my own record. I have left the client names out, and the results are the ones the clients reported.
Quality
80% fewer returns
A distributor of industrial components had slow processes, and its departments barely spoke to each other. We rebuilt the work around a single workflow, from order to invoice, with one set of records everyone used. Six months later returns were down 80%, and the cash flow had settled.
Working to a standard
A 12-month qualification, passed
A global semiconductor manufacturer needed a moisture-controlled bag qualified for sensitive components. We delivered it on a documented control process, and it passed after a twelve-month testing cycle.
Governance and funding
Cases built for due diligence
For a property developer I built a five-year cash flow model to raise bank and investor funding. For an installations firm I ran a government investment incentive claim from start to finish, and the claim was secured.
Compliance and quality work is often bought as insurance. I look at it differently. If the work is done properly, you should see it in three places.
I spend time with the people doing the job, watch how they do it, and write that down. Then we strip out the steps where things go wrong. Less rework. Fewer complaints. Fewer jobs out late. Your staff get back the hours they spent fixing last week's work.
A redone job, a refund, a credit note, a late fee, a fine, a customer who quietly goes elsewhere. None of these has its own line in the accounts. The American Society for Quality calls much of this the cost of poor quality. I go through the year's numbers with you, put a rough figure on it, and we start with the biggest item.
A buyer's lawyers or a bank's credit team usually ask to see licences, contracts, the complaints log, the incident log, and how the firm runs when the owner is away. Every gap turns into another question. Some turn into a lower offer. I would rather you find those gaps now than in a data room. The sale, the valuation and the loan are for your lawyer and accountant. I get the records in order.
The research. Two studies worth reading. Levine and Toffel, 2010 (free 2008 report): Californian firms with ISO 9001 against matched firms without it. The ISO firms were likelier to survive, and their sales, jobs and payroll grew faster. Ponemon Institute, 2017: 53 multinationals, mostly on data protection. On average, non-compliance cost them about 2.71 times what compliance did. Neither is a promise for your firm. What I will do is go through your figures with you and show you where I think the money is leaking.
I run each engagement in the same order, and you are free to stop after any stage. If the Diagnostic shows that you need nothing more, I will tell you so.
Start with the Diagnostic if you are not sure. Half the point of it is to find out whether you need a project in the first place. If you sign a Build project within 60 days of the findings call, I credit the Diagnostic fee in full against the project fee. For the detail, go to the compliance management page or the quality assurance page.
Fractional COO
In some firms the owner does the operations job at night, after everything else. The fractional COO role is for that firm. It is two to four days a month. On those days I chair the monthly review and go through the processes and the registers with the people who own them. I look at suppliers and at staff sign-offs. You get one report from me every month. I am not appointed as a director, and I do not take a role that needs a regulator's approval.
Fractional COOI design and run compliance, risk and quality systems to internationally recognised ISO standards. Alignment is a design principle, not a badge: the structure and intent of the standard shapes the system, sized to how your organisation actually works, and built so it holds up when someone checks.
Compliance
ISO 37301
Compliance management systems
The backbone of how I build a compliance framework: governance, obligations, controls and evidence that stand up under scrutiny.
Risk
ISO 31000
Risk management
Risk assessed and managed as a discipline, so the register drives real decisions instead of sitting in a drawer.
Quality
ISO 9001
Quality management systems
Quality systems that keep the work consistent, documented and audit-ready, day to day.
Anti-bribery
ISO 37001
Anti-bribery management systems
Controls proportionate to your exposure, from third-party due diligence to gifts and hospitality.
The practice
I lead every engagement and do most of the work myself. You deal with me from the first call until the work is signed off. Some engagements need a second specialist, such as an assessor to sample assessment decisions or a second auditor for a mock inspection. When that happens I bring in a specialist I have vetted myself. I check the degree certificate and the relevant experience before anyone works on a client engagement. Before they start, I tell you who they are and what they will do.
The practice is run from Malta, and I am in the United Kingdom regularly. It takes work in the United Kingdom, the European Union and Malta. I own other businesses. Before I accept an engagement I check it for a conflict of interest with any of them. You can read how an engagement is run, and what happens to your information, on the Trust page. My own record is on the About page and the CV.
These are short pieces taken from two of my books. Each picks one compliance or quality model and tells it through a real company. Each ends on a question you could ask at your own management meeting this week.
Key Compliance Models
Three teams were watching the risk. All three had gone slack at the same time. That is the HSBC story in one line.
Key Quality Models
Most people change how they work and never check if it helped. They just move on. Next month, the same problem is back.
Key Compliance Models
UBS did not lack a process on paper. A process that is not lived is not a control. It is a document.
It does two things. On the compliance side I build frameworks to ISO 37301 and risk management to ISO 31000. For firms in regulated sectors I also build training and competence frameworks, and I get an organisation ready for whichever duties apply to it. On the quality side it is ISO 9001 systems: processes, document control, internal audit and getting ready for certification. I work with businesses, public bodies and NGOs. All of it is advice given to one organisation at a time, and the documents are written for that organisation. There is also a part-time role, the fractional COO, in which I apply both inside one firm's operation.
In three ways. It goes after the cost of work done twice, refunds, late fees and fines, most of which never shows up as its own line in the accounts. It lets managers decide more without going to the owner. And when a buyer, a bank or a large customer asks for your records, you have them, so there is less for them to pick at. I cannot promise a figure. I can show you where I think the money is going and start with the biggest item.
Stefan Gauci Scicluna. I lead every engagement and you deal with me from start to finish. Some engagements need a second specialist. When one does I bring in a specialist I have vetted myself, and I tell you who they are before they start.
No, and nobody in my position can. An ISO certificate comes from an accredited certification body. My part is to build the system with you and prepare you for the day. The decision is theirs, and I will not promise you an outcome.
I recommend starting with the Diagnostic. It takes two or three days of my time and leaves you with scored findings and a 90-day plan. If you already know what you need, skip the Diagnostic and use the contact page. I will want to know who you are, what is putting you under pressure and when it has to be done. You will usually hear back within a couple of working days.
The UK, the EU and Malta. The practice is run from Malta. I work from the law of the place you trade in, and Scotland does some things differently from England. My own ground is the United Kingdom, Malta and European Union rules. For the national law of another member state I work alongside a local adviser.
Start a conversation
Tell me what you want done and by when. You will get a plain yes or no on whether this practice is the right one for it, and if it is, how I would go about it.
