For certification consultants and the companies running ISO 9001, 14001 and 27001
Fitting a policy to your own organisation takes a long time, and once it is set there is no record that you kept it. PAASUP ACE helps author the tailored policy and turns everyday work into the evidence.
This is the same system PAASUP runs its own quality, environmental and security operations on.
The policy belongs to the company. A consultant supports the work, and in practice often drafts it. Either way, fitting the policy to your own organisation is what takes the longest.
Traditionally
You receive reference cases and templates, then the company spends man-months redefining them for its own situation. If the standard is revised meanwhile, you start again.
PAASUP ACE
Hold industry, size and scope as a profile and a tailored policy set is generated from the base master. When the profile or the standard changes, only the affected clauses are rebuilt.
Once set, the policy documents usually sit in the consultant's files while the actual records sit in the company's business systems. That is why every audit starts by reconciling the two.
Certification consultant
Client
PAASUP ACE replaces neither the consultant's judgement nor the company's operation. It puts both on the same data, cutting the time spent tailoring and the reconciliation at every audit.
Scrambling to gather meeting minutes, training records and review history at the last minute means you can't even prove the work actually happened. What wasn't recorded didn't happen, as far as the auditor is concerned.
When only one person knows where the documents are and which version is current, the system stalls the year that person is out. Certification has to live in the system, not in a person.
Documents made only for certification sit apart from real work, so nobody opens them again. The next audit starts the same collection work from zero.
Leave approvals, document revisions, training completion and management review meetings are work you'd do regardless of certification. When those records stay linked to the relevant clause of the standard, preparing for an audit stops being a scramble to collect material - it becomes showing what's already there.
Usually the tool that writes the policy and the work of checking it are two different things, so you find out what is missing right before the audit. PAASUP ACE makes an approved clause the monitored item itself, so gaps surface day to day.
Generate a tailored policy set from the base master using an industry, size and scope profile.
The moment it is approved, each clause also gets what counts as satisfying it and a review cadence. You do not enter monitoring items separately.
Approval, document revision, training and meeting records attach to the clause as its evidence. Nothing is produced just for the audit.
Each clause is judged continuously as satisfied, gapped or overdue. A clause with no evidence is not counted as satisfied, and gaps and upcoming reviews are surfaced first.
When the policy changes, the loop runs again. The monitoring definition for a revised clause updates, and that clause is re-judged against the new basis. Audit preparation becomes showing this screen as it is.
Procedures the three standards require in common - training, documentation, internal audit, management review, nonconformity action — run once. Only what differs by standard is managed separately.
The system doesn't replace every requirement of the standards. Procedures that require judgment outside the system - context-of-the-organization and stakeholder analysis, or environmental aspect/impact assessment, for example — still need to be carried out separately. Talk to us and we'll map out which procedures move into the system and which stay outside it.
Every document, register and feature permission keeps both when it was granted and when it was revoked. You can answer, with a record, exactly when a departed employee's access was cut off.
Who opened or downloaded which document, and when, is recorded. Access control is proven by an actual log, not just a written policy.
Document management runs on a self-hosted git repository as the source of truth. Revision history lives in commits - who changed what, and when, can't be edited away after the fact.
Hires, departures and personnel changes stay on record, forming the basis for access revocation and training-scope decisions.
Setting up departments and reporting lines defines approval routing, training scope and permission scope together. Sign in with your Google Workspace account.
Upload the documents you already use into the repository. From then on, every revision keeps a history.
Start with the registers (risk, compliance, training, audits, management review) for the standard you're preparing for. Add the rest when you need them.
Answers that depend on your size and target standards are confirmed in writing after you get in touch.
Tell us your organization's size, which standard you're preparing for, and where your documents currently live - we'll review the scope and order of rollout and get back to you.
