One of my clients is a multi-site manufacturer working toward certification to the ISO ‘trifecta' (ISO 9001, ISO 14001, OHSAS 18001). They are implementing a single integrated system to manage quality, environmental, and safety management.

Cooperation at their sites has been pretty good. But at one production site, line management has been, shall we say, extra touchy, extra defensive, at every phase of the process.

Some of this is understandable, and to be expected. We deal with it all the time. And I like to think we're pretty good at defusing these types of concerns. But here, the defensiveness seemed intractable.

Time came for the first internal audit. We went through the audit regimen, then informed site management that we wanted to sit down and brief them on our findings. The site manager seemed surprised that we'd review audit results with him before submitting our report with senior management. He said they were not accustomed to that.

At first I was puzzled. Why would we not brief site management directly? That's standard audit practice, as far as I'm concerned.

That's when we learned about their environmental consultant. He audits the production facility twice per year. However, he never briefs site management on his conclusions. Instead he turns in his report – which is mainly a recitation of problems – directly to the CEO at corporate headquarters.

This explains the site management's overall negative attitude. To them, these programs and related monitoring have become a complete negative. Understandably so. I explained again that we don't work that way. The site manager then informed me that the environmental consultant had been, in a previous life, an EPA inspector. That turned on a light bulb in my head. This ‘consultant' still thinks of himself as a regulator.

Wrong approach, in my view.

Of course as auditors we are duty bound to audit strictly to the standards, audit thoroughly, and render honest reports. Just as regulators do. But as auditors we are there first and foremost to serve the client. These requires us to go beyond what mere regulators do. It requires us to show client people – especially those at levels below top management – the utmost in common courtesy and respect; to treat the process not as a search for the guilty but as an even handed evaluation of the system, treating the auditees as participants rather than as targets.

That's why we review audit findings with line management before sending them up the line to top management. This approach in no way affects what we report to top management. But it gives the people in the trenches the chance to hear the news first, to make quick fixes where possible, and to be fully prepared for top management's reaction – instead of being blindsided.

Which makes us auditors – not regulators.

Ideally, your consultant should be involved only long enough to help you prepare your system for registration audit. Once the audit is done, you may want to have the consultant help you deal with noncompliances reported by the assessors.

After that, you should be able to operate your system yourself. You should be able to increasingly tailor it to fit your company and your culture and to make it your own. This means your management, from the CEO and the Management Representative down, need to be conversant with the system, work the system every day, and increase their knowledge of the system on an ongoing basis.

The consultant should never become a permanent part of your business, even on an informal basis. If that happens, it means the system is not truly yours. And if your system is not truly yours, you are, by definition, not getting the benefit from it that you should.

I believe that the most effective ISO 9000 implementations are done WITHOUT the aid of a consultant.

There is, however, a pretty significant trade-off.

The help of a good consultant can help you achieve your immediate goal (usually registration audit) faster, and therefore more efficiently, than is typically possible using the "do it yourself" approach. But when a consultant is involved, sometimes client people (sometimes even including the CEO) see the whole effort as an externally driven one.

Without the help of a good consultant, the job can take a long time. The client endures mistakes, false steps, setbacks, disillusionment, and extra expense. It takes very strong, very determined management to persist and prevail, doing it this way. The benefit is that the entire organization tends to come together and accept the process and make it their own.

So you have a choice. Hire a good consultant, and the initial work will go faster and more efficiently -- but it will still take time for the system to become transparent. Do it yourself, and you'll make mistakes and spend, potentially, more than you should -- but the effort will be a unifying one.

Notice I keep using the term "good" consultant. A good consultant is an investment. (A bad consultant is only an expense!) A good consultant: