CompStack is a governance, risk and compliance service. What you buy is a management system that is current, defensible and ready for inspection on any ordinary day. The software is part of the service. Whether you ever open it is your choice.
You are buying an outcome. If the system is not current on the day someone asks, we have not delivered, whatever the software happens to show.
Nothing below is a criticism of a compliance team. It is what happens when the certificate is the seventh priority on a list of six.
What the organisation exists to do. Serve members, build the infrastructure, deliver the service, make the product. This is what leadership is measured on and what the budget was written for.
A certificate that has to hold. Documents reviewed on schedule, evidence retained, internal audits run, findings closed, risk reviewed, management review held and minuted.
Both draw on the same people. When a delivery deadline and a document review land in the same week, delivery wins. That is the correct call. It is also how findings accumulate.
The usual response is to buy a compliance platform. That moves the work. It does not remove it. The person who had no time to run the management system now has no time to run the management system and administer a tool. Six months later the platform holds last year documents, and the audit pack is still assembled by hand.
We have watched this happen often enough to stop selling the tool on its own.
Almost every organisation carrying a certificate already buys part of this work from outside. A consultant engaged before the audit. A gap assessment. Someone brought in to write the procedures nobody had time to write. The rest is absorbed by people you already employ, and never appears on an invoice at all.
So this is not a new budget line. It replaces a vendor you already use, and covers the work that currently has no owner between visits.
These are the terms we want to be judged on. Every one is checkable by you, on any working day, without asking us to prepare anything.
Surveillance and recertification visits close with no major nonconformity. Minor findings are closed and verified before the next visit.
Name any control. You get its owner, its frequency, the last evidence collected against it and the date, in under a minute. Nobody is given notice.
Every finding carries an owner, a due date, a recorded root cause, and verification by someone other than the owner. How long each has been open is visible without asking.
The pack for the next visit is assembled continuously, against the control it proves. Nothing is rebuilt from memory in the week before an auditor arrives.
One monthly report, drawn from live records, stating what moved, what is late, and what needs a decision from your board.
The same review runs the same way whoever is on it. Quality does not move with how busy the month was, because the sequence is written down and the system will not let a step be skipped.
If the person who holds compliance leaves, the register, the evidence and the decision history are still there, still current, and legible to whoever arrives next.
The last one is the one organisations undervalue. Most compliance systems are held together by one person memory, which is a single point of failure with a resignation letter attached to it.
Six streams of running work and three standing outputs. The cadence is the product.
Kept current, reviewed on schedule, version controlled. Approvals routed to the people named in the chain and recorded.
Collected against every control cycle and filed before it expires. Nothing waits for the week before a visit.
The annual programme planned, scheduled and conducted across every department in scope.
Each one given an owner, a due date, a root cause, and verification by someone other than the owner.
The register maintained, treatments owned, ratings reviewed on the dates they fall due.
The certification pack assembled continuously, so it already exists when the certification body asks for it.
One person who knows your organisation, who you can call, and who does not change every quarter.
Written so your board can read it without a translator, and drawn from live records on the day it is sent.
Anything needing your call arrives stated plainly, with a recommendation and a date.
Log in whenever you want to check something, or never log in and read the report. The work is the same either way. Nothing we do happens in a system you cannot open, and nothing we produce is trapped in a format you cannot export.
This is one document review, from the day it appears on our schedule to the day it closes. The right column is everything that reaches you.
The review date surfaces on our schedule. We read the current issue against what has actually changed since it was written: new processes, findings raised against it, regulatory change logged in the period.
Nothing.
We draft the revision, mark what changed and why, and route it to the document owner named in the approval chain.
The owner opens a marked-up draft and edits it.
Approval routed through the chain in order, with a service level on each step and a reminder when one is late.
One approval, from the person who was always meant to give it.
Issued under version control. The superseded issue is retained. Acknowledgement requested from every member of staff the document applies to.
Nothing.
The review is closed on time and the next date is set.
It appears in the monthly report as done, with the acknowledgement count beside it.
Most of this never reaches your desk. The only things that reach you are the ones that genuinely need your judgement, and they arrive with a recommendation attached.
A service that runs your management system has to be explicit about what it does not touch. These lines are in the engagement letter too.
Every decision. Policy, scope, risk appetite, what gets approved and what does not.
Preparing the decision, with a recommendation and the evidence behind it.
The certificate and the relationship with your certification body.
Making sure the visit is uneventful.
The data. Your workspace, your records, exportable in full at any time.
Keeping it current and complete.
Your independence. We do not certify anything.
Internal audit run as a management activity, kept separate from certification.
Your people. They stay in their jobs and out of the administration.
The administration.
Under ISO/IEC 17021-1 a certification body and its auditors cannot provide management system consultancy to an organisation they certify. We are not your certification body and we do not seek to be. The internal audit we run for you is a management activity under clause 9.2, which is a different thing from the audit your certification body performs, and we keep the two visibly separate.
There is no hostage. The system is already yours and already populated. Take the login and keep going. Every document, control, finding and decision exports in full, in formats your next system can read, on any day you choose.
Months one to three take genuine effort from both sides and we will not pretend otherwise.
Load your real structure, processes and documents. Agree the control set, the applicable requirements and the evidence cadence.
A populated workspace that matches how your organisation actually works, rather than a template with your name on it.
Run the first internal audit against the agreed scope. Open findings properly, with owners and dates.
A current picture of where you stand, with nothing hidden and nothing flattering.
Close what can be closed, verify it, and assemble the readiness pack.
Readiness that does not depend on anyone remembering.
One named person with the authority to agree scope.
Access to what exists today, wherever it currently lives.
Leadership attention, for the decisions only you can make.
We load a scoped workspace against the standards you actually run, and walk that finding back to the control it breaks, the risk it raises, and the person who owns it. Forty-five minutes. You leave with a written view of where you stand, and an honest no if it is not a fit.
