How an Integrated Management System Can Help SMEs Grow Without Creating More Bureaucracy

As organisations grow, governance often develops one requirement at a time. 

A customer asks for stronger information-security controls. 

A tender requires evidence of quality management. 

AI creates a need for new policies and risk assessments. 

Environmental requirements begin appearing in supply-chain questionnaires. 

Each requirement is reasonable. 

The problem comes when each one creates another disconnected system. 

Different requirements often share the same foundations 

Quality, service management, information security, AI governance and environmental management are different disciplines. 

But look underneath them and many of the management activities are familiar. 

The organisation needs to understand risk. 

Responsibilities need to be defined. 

Objectives need to be established. 

Actions need to be completed. 

Evidence needs to be retained. 

Performance needs to be reviewed. 

Problems need to lead to improvement. 

An Integrated Management System brings those common management activities together rather than recreating them for every discipline. 

What does that mean in practice? 

An organisation might use recognised standards to provide structure across several areas: 

Quality
ISO 9001 

Service Management
ISO/IEC 20000-1 

Information Security
ISO/IEC 27001 

AI Governance
ISO/IEC 42001 

Environmental Management
ISO 14001 

That does not mean maintaining five completely separate ways of managing the organisation. 

For example, there may be one approach to managing organisational risks, with different risks identified across security, AI, environmental performance and service delivery. 

Management reviews can consider performance across several areas. 

Internal audit programmes can be coordinated. 

Actions and improvements can be managed consistently. 

Why does this matter for SMEs? 

Large enterprises may have separate teams for quality, risk, compliance, security, sustainability and AI. 

Most SMEs do not. 

Creating disconnected management systems therefore consumes time that could be spent running and growing the business. 

An integrated approach can make governance more proportionate. 

It also makes it easier for the management system to develop alongside the organisation. 

An SME may initially strengthen quality management because it wants to win larger customers. 

As it grows, service-management requirements may become more important. 

Information-security expectations may increase. 

AI may introduce new governance requirements. 

Sustainability may become increasingly important to customers and supply chains. 

The underlying governance framework can evolve rather than being rebuilt each time. 

Management systems should be working systems 

One of the biggest problems with traditional compliance approaches is that documents can become the management system. 

Policies are stored. 

Registers are updated before an audit. 

Evidence is gathered when somebody asks for it. 

That is very different from using governance to manage the organisation. 

A working management system should provide useful visibility throughout the year. 

What needs attention? 

Which risks are increasing? 

Which objectives are off track? 

What actions are outstanding? 

What did the last audit identify? 

What has changed since the last management review? 

These are management questions, not simply certification questions. 

The thinking behind KA2 Assure 

This integrated approach sits behind KA2’s exploration of KA2 Assure. 

The concept is a practical management-system framework for SMEs, using their existing Microsoft 365 environment to bring together areas such as governance, risks, objectives, actions, audits and evidence. 

The approach is still being developed and validated, including through KA2’s own internal management systems, before determining how it should ultimately be offered commercially. 

The principle, however, is already clear. 

SMEs need governance that can grow with them without creating enterprise-scale bureaucracy. 

An Integrated Management System provides one way of achieving that. 

Could your governance work better together? 

If quality, Information Security, Service Management, sustainability or emerging AI governance requirements are being managed separately, it may be worth looking at where the underlying processes could be brought together. 

The objective is not to create another management system. It is to reduce duplication, improve visibility and build governance that can develop alongside the organisation. 

Talk to KA2 about what a more integrated approach could look like for your business.