Hospital Group Seeking Certification in Twelve Months
A hospital group operates six sites, with 12,000 clinical and non-clinical assets including 47 operating theatre ventilators, 9 standby generators and 120 patient hoists. The computerised maintenance management system (CMMS) covers only 41% of the asset register; the rest is tracked in spreadsheets maintained by each site's maintenance supervisor. Breakdown maintenance accounts for 68% of work orders. There is no asset management policy; a 2019 "maintenance strategy" document exists but was never approved. The board's new strategy names "safe, uninterrupted clinical services" as the top priority. A newly hired head of estates proposes applying for ISO 55001 certification within 12 months and asks for your view on the first steps and on whether that timeframe is realistic.
1. Which requirements of ISO 55001 are most obviously unaddressed in this organisation, and what objective evidence would an auditor look for in each case?
Read the worked answer
Map the symptoms to requirements rather than listing clauses generically.
Leadership and policy. There is no approved asset management policy and no evidence that top management has set expectations for asset management. An auditor would ask for a policy authorised and communicated by top management, and for records showing it is reviewed and available to relevant personnel. A 2019 unapproved document is evidence of absence, not presence. Scope of the asset management system. With six sites and inconsistent data ownership, the boundary of the system is undefined. Evidence sought: a documented scope stating which sites, asset types and activities are covered, and why exclusions were chosen. Information requirements and information management. The 41% CMMS coverage and proliferating spreadsheets are the core problem. Evidence sought: a defined set of information requirements (what data, for whom, at what quality), plus controls showing the asset register is complete, consistent and maintained. An auditor will test traceability: pick a ventilator or hoist and follow it from register to work order to inspection record. Operational planning and control. 68% breakdown work suggests maintenance is predominantly reactive and undocumented as a planned regime. Evidence sought: defined maintenance strategies per asset class, criteria for what is planned versus run-to-failure, and records of execution. Monitoring and evaluation. No performance indicators are described. Evidence sought: defined measures, targets, analysis and reporting to management review. Competence and awareness. Evidence sought: records that staff supervising clinical assets understand the risk significance of what they maintain.
2. Advise on the sequencing of policy, scope and SAMP, and state whether 12-month certification is realistic.
Read the worked answer
Recommended sequence and reasoning.
- Context and stakeholders first (informally, then documented). The board's stated priority - safe, uninterrupted clinical services - and the expectations of clinicians, regulators and insurers define what the system must deliver. Objectives that are not traceable to these will not survive an audit interview with top management.
- Policy second. The policy is the authorising instrument: it commits top management, frames the objectives and obliges the organisation to provide resources. Attempting scope or plans before the policy exists leaves the work without authority and invites the organisation to treat the exercise as a documentation project.
- Scope third. Scope determines which assets, sites and processes must be brought under control. Doing this before the SAMP prevents the common failure of a plan that describes the whole estate while the system only governs a fraction of it.
- SAMP and objectives fourth. Only now can objectives, risk treatment and asset management plans be written with a defined boundary and an authorised purpose.
- Then operational control, data remediation, internal audit and management review.
On the 12-month target. It is achievable only under strict conditions: the scope is deliberately limited (for example, clinical-critical and life-safety assets first), executive sponsorship is real rather than nominal, and the data remediation is resourced. The realistic risk is not missing the date but achieving certification on a system whose asset register is still 41% complete outside the audited sample. Certification confirms conformity of the management system; it does not certify asset condition or data completeness. A system built to pass an audit rather than to control risk will produce major nonconformities at the next surveillance audit. Recommend a phased scope with a stated expansion path, an early gap assessment, and a decision gate at month six.