Meridian Health Group - What the Certificate Actually Covers
Meridian Health Group operates 14 outpatient and diagnostic sites totalling about 210,000 m² across three regions. FM is split three ways: an in-house estates team runs hard services on six owned sites, a global outsourced provider delivers soft services everywhere, and the landlord's agent maintains the four leased sites, including a 4,200 m² data centre that Meridian occupies under a full-repairing lease. The board has approved funding to 'get ISO 41001 certification for our buildings' ahead of a payer contract that asks suppliers to demonstrate 'certified facilities management'. The newly hired head of FM has also been told to prepare for ISO 55001 for the asset register and to 'fold it all into the existing ISO 9001 system' to save audit costs. A board member has asked whether the certificate will cover the data centre, since clients frequently ask about its resilience. No FM policy, no objectives and no performance indicators exist, and the outsourced provider holds most of the operational records.
1. The board believes ISO 41001 certifies the buildings themselves. Correct that understanding and advise on how the data centre should be treated in the scope.
Read the worked answer
Correct the framing first. ISO 41001:2018 is a management system standard for facility management. Certification confirms that Meridian's FM management system conforms to the standard within a defined scope; it says nothing about the structural, electrical or fire safety of any building, and it is not a building certificate.
Who can be certified. The standard is written for both demand organisations (those that specify and oversee FM) and supply organisations. Meridian is the demand organisation even where a landlord's agent or an outsourced provider performs the work, provided Meridian's system controls how FM is specified, resourced, delivered and evaluated.
The data centre. Decide on authority and control, not on client appeal. Under a full-repairing lease Meridian carries the maintenance obligation, so the FM system probably does apply and the site should be in scope; but the scope statement must name the interfaces - landlord's agent approvals, change control, access, escalation - and the system must show how those interfaces are managed. If Meridian genuinely cannot direct or monitor FM there, exclude it, document the justification and define the boundary interfaces.
Wording. Draft the scope as activities, sites and FM services, not 'all buildings'. Auditors sample against whatever the scope says, and a vague scope is the most common source of stage 2 argument.
2. What must the FM policy and objectives contain, and who should own them, given that no policy or objectives exist today?
Read the worked answer
The policy is a top-management product, not an FM department artefact. Under clause 5.1 top management must establish a policy appropriate to the organisation's purpose and context, provide a framework for setting objectives, include commitments to satisfy applicable requirements and to continual improvement, and ensure it is communicated and available. At Meridian the policy should therefore speak to patient safety, service continuity, statutory compliance, cost and the payer contract's expectations - not merely to 'efficient facilities'.
Objectives (6.2) must be measurable, monitored, communicated, updated, and consistent with the policy. Because the system exists to support the organisation's objectives, objectives should be derived from them: for example, resilience of the data centre, compliance closure rates, complaint response times in clinical areas, and the availability of records currently locked in the provider's systems.
Ownership: the accountable executive remains accountable (5.1), while 5.3 requires assigned responsibilities and authorities for the system's conformity and for reporting performance. A sensible split is board-level ownership of the FM policy and objectives, with the head of FM holding delegated responsibility for the system and for reporting to management review. If the policy is drafted by the consultant and signed without change, the auditor will test whether top management can explain and defend it.
3. The board wants ISO 41001, ISO 55001 and ISO 9001 'folded into one system' to save audit costs. Is that reasonable, and what are the limits?
Read the worked answer
Partly reasonable, but not as a paperwork exercise. All three are Annex SL management system standards with the same high-level structure (context, leadership, planning, support, operation, performance evaluation, improvement), so clauses 4–7, 9 and 10 can share common processes, and an integrated audit can reduce duplication of evidence.
The limits matter. The standards address different objects of control:
- ISO 9001 governs quality of outputs and customer requirements; it does not address the FM demand/supply interface, service specification, or the FM operating model.
- ISO 55001 governs asset management - the realisation of value from assets across their life cycle, driven by a strategic asset management plan. An asset register is not an FM system.
- ISO 41001 requires the organisation to establish FM objectives flowing from organisational objectives, to control FM service delivery including outsourced processes, and to evaluate FM performance and the demand/supply relationship.
There is also a practical risk: sharing documents can blur accountability, so nobody can say which requirement a procedure exists to satisfy. Integrating is acceptable; subsuming FM into the quality manual and declaring 'covered by 9001' is not. Keep one integrated manual if you wish, but preserve traceability from each ISO 41001 clause to the process and evidence that satisfies it.