What a management system does

It assigns work, produces a record, and feeds that record back

A management system is people, process and technology, working together to produce an expected outcome or service. Each element contributes. None of them is the system on its own.

Process defines the sequence. It sets the steps, the inputs, the outputs, the work products and the system of internal controls. It is the most durable of the three. Business purpose changes least often, so the processes that serve that purpose stay in place longest. Technology and people change more often. That is why management-system definitions such as ISO 9001 put process at the centre of satisfying the customer: the process is what remains when the tools and the people have changed.

ISO 9001 does not give an organisation a process model. It requires a process approach, and it leaves the organisation to decide what the processes are. A process, in the standard's terms, is a set of interrelated or interacting activities that use inputs to deliver an intended result. The process approach is one of the seven quality management principles. Clause 0.3 describes it as the systematic definition and management of processes, and their interactions, so as to achieve the intended results in line with the quality policy and the strategic direction. The organisation is managed as a system of processes, not as a set of departments.

The auditable requirement is Clause 4.4. The organisation must establish, implement, maintain and continually improve a quality management system, including the processes needed and their interactions. For each process it must determine the inputs required and the outputs expected, the sequence and interaction, the criteria and methods needed to operate and control it, the resources and that they are available, the responsibilities and authorities, the risks and opportunities, how the process is evaluated and changed if it is not achieving its intended results, and how it is improved. It must keep documented information to support the operation of the processes, and retain enough to have confidence that they are being carried out as planned.

That is as far as the standard goes. It does not name the processes. It does not say how many there are. It does not supply a sequence. Completing a template mapped to the clauses is not what Clause 4.4 asks for. Determining the processes, running them, and being able to show that they ran, is. Control Objectives for AI Systems (AICOB) is the process model. It is the organisation's answer to the gap the standard leaves open: it names the processes, puts them in an order, and assigns an owner to each one.

Technology provides the infrastructure and the compute a technology-driven system needs. It holds the records, runs the workflow and makes the process visible. It does not define the sequence, and it does not hold the authority.

People provide authority, oversight, direction, approvals, confirmation and intervention. A process with no person who can stop it, approve it or be asked about it is a description. The governing body directs and monitors. Management runs the steps. The named owner is accountable for the work product.

From those three elements the system does three things. It assigns work to a named owner. It produces a record of that work as the work is done. It feeds the record back to the person who owns the duty and to the person who oversees it. Everything else a system is said to do is a consequence of those three.

This is the practical answer to the question compliance teams are actually asking: how do we meet a growing set of duties without rebuilding the evidence for each one from scratch. The answer is not a larger checklist. It is a system in which the same process can serve more than one instrument, because the work product is explicit and the mapping is explicit.

It assigns work

Assignment is the first thing a list does not do. A list says that a control should exist. A system says who will do the step, when it starts, and what has to be true before it can be closed. The owner is a role, not a department. "Compliance" is not an owner. A named role, with authority to act and a duty to record, is.

Assignment is also what makes governance and management usable in the same system. The governing body evaluates, directs and monitors. It does not run the step. Management runs the step. Operations is the daily work inside that line. A system that collapses those into one box produces shared ownership, which in practice is no ownership. A system that keeps them apart can show, for any material outcome, both the governing-body role and the management owner.

The AI Assurance Institute's process model, Control Objectives for AI Systems (AICOB), is built this way. Forty control objectives sit in five families: Evaluate, Direct and Monitor; Align, Plan and Organise; Build, Acquire and Implement; Deliver, Service and Support; and Monitor, Evaluate and Assess. The same line appears in the Institute's other products as Direct, Act, Establish, Implement, Operate and Review. Governance is kept apart from management. Management then runs in a line.

It produces a record

The record is not a report written at the end. It is the work product of the step. A stage gate that checks the record exists before the next stage starts is producing evidence by operating. A dashboard that is filled in after the release, from memory and from email, is reconstructing it.

The record has to be specific enough to sample. An assessor, a notified body or an authority who asks what happened the last time the control was supposed to fire needs the system, the owner, the inputs and the work product. A completeness percentage does not answer that question. A locked record, with the approver and the time, does.

This is why separation of duties belongs in the system and not in a policy. Whoever prepares a record should not be the person who approves it. A system that enforces that, or that warns and records when it is breached, is producing a record an auditor can use. A system that allows the same person to draft and sign, with no trace, is producing a file.

It feeds the record back

A record that nobody sees again is an archive. A management system closes a loop. Monitoring, incidents and nonconformities feed into corrective action. An approved corrective action opens its own tracked record. Review looks at the records the processes left and produces a decision. A material finding returns to the governing body. That is the feedback a completeness score cannot give.

The feedback is different for each seat. The governing body needs the estate, the exceptions and the evidence. Management needs the blocked stage, the overdue action and the incomplete record. Operations needs the next step and the criteria for closing it. The same model can serve all three because the process, the owner and the work product are the same objects. The view changes. The system does not.

One process, more than one instrument

The cost of a growing rulebook is not the reading. It is the duplication. An organisation that keeps a separate file for the EU AI Act, another for ISO/IEC 42001, another for the GDPR and another for NIS2 will do the same work several times and still not be able to show that it was the same work.

A management system avoids that only when the mapping is explicit. One process-control activity, named against a named article, clause or control, can support more than one instrument. The work is done once. The record is produced once. The mapping says which duties that record serves. A mapping that is a colour on a spreadsheet, with no process behind it, is a claim. A mapping that points at a work product is a fact.

AICOB is the spine the Institute maps other instruments onto: the EU AI Act, the GDPR, quality-management requirements, security and service-management practice, and AI and IT governance frameworks including ISO/IEC 38500, ISO/IEC 38507 and ISO/IEC 42001. The map is maintained where the work is done, not in a separate catalogue that drifts.

Where the platforms sit

The platforms are the environment in which this work is done. They are not a document repository filled after the fact. Tasks are created, assigned and completed against the processes the organisation has defined. Records are generated as the work is performed. Traceability runs from the activity to the subject, to the requirement, and to the evidence retained.

The Institute's platforms for this system are available in two forms. They can be deployed stand-alone. They can also run on Nextcloud, an open-source collaboration platform an organisation can host itself or have hosted. Nextcloud adds file storage, user and group management, and federation, so selected records can be shared with a group company, an authorised representative or a key supplier without consolidating every system into one. The process model is the same in both. Nextcloud is the environment the record stays in.

None of this certifies the organisation or declares it compliant. Those decisions sit with the assessor, the notified body or the authority. The system makes the work visible so the decision can be made on evidence. That is what a management system does. The next article is what a list does instead.