COEL designs and delivers office and laboratory fit-outs from its Cambridge base, serving clients across Oxford, Peterborough, London and the east of England. Almost four decades of trading have taken the business from a small “all hands on deck” team to more than 60 people delivering increasingly complex projects — including the specialised laboratory spaces that Cambridge’s science and technology community depends on.
The challenge
A growing number of tenders, particularly for larger and more regulated clients, required bidders to hold ISO 9001, ISO 14001 and ISO 45001. Without them, capability counted for nothing; COEL found it difficult to get past the entry requirements to demonstrate it.
Certification to all three would open those doors. But COEL’s management system, partially implemented years earlier, had not kept pace with a business now running complex projects with an ever-growing workforce.
The symptoms were familiar for any company that has outgrown its systems. Documents sat in different places. Some processes described how the business used to work, not how it worked now. Departmental systems didn’t always connect, responsibilities and handovers could blur between teams, and too much depended on what individual colleagues happened to know. This made delivery harder to scale.
Certification alone wasn’t the main goal. COEL needed a management system that would satisfy an independent auditor and fix how the business actually ran one system, covering all three standards, built for daily use.
Why Principal Risk Management
COEL had already seen what happens when a management system exists on paper but not in practice. Buying a set of off-the-shelf documents would have repeated that mistake at three times the scale.
Principal Risk Management was appointed to build a single integrated system covering all three standards, designed around COEL’s real workflows, risks and people. One set of processes for the whole business proportionate to its size, usable by its teams, and credible in front of an independent auditor.
Our approach
Identifying the gaps to certification
We started with a gap analysis of COEL’s existing arrangements against all three standards. The partially implemented system wasn’t worthless; parts of it reflected genuine good practice. The analysis identified which existing processes could be retained, which needed updating, and which were obsolete and had to be replaced. That meant COEL kept what already worked, and effort went only where it was needed.
A plan with owners and deadlines
Without structure, implementation projects like this drift. We built a tracked implementation plan that set out every deliverable, its deadline, and who was accountable for it on Principal’s side and COEL’s. At any point, both teams could see what was done, what was due and who held it.
One system, built around how projects actually run
Rather than bolting three sets of ISO documentation onto the business, we redesigned COEL’s project lifecycle around the eight-stage RIBA Plan of Work — the construction industry’s standard framework for organising projects from initial brief to handover and use.
The revised lifecycle introduced defined approval gates between stages, clear handover responsibilities, connected workflows across departments, and the records to evidence each step. Quality, environmental and health-and-safety requirements were embedded into those stages in one integrated system, not three parallel ones.
Processes designed with the people who use them
COEL’s managers and employees helped design and test the practical processes within the system. The people running projects shaped how projects would be governed; the people completing records decided what those records needed to look like. This did more than make the processes workable — it built ownership, and directly reduced the dependence on individual colleagues’ knowledge that had crept in as the business grew.
Testing the system before it counted
Before any external auditor saw the system, we tested it ourselves. A programme of internal audits checked that the new arrangements were embedded and effective, staff training confirmed people understood their responsibilities, and a management review gave COEL’s leadership formal oversight of what was working and what needed adjustment. Gaps were closed while they were still easy to close.
Leading the certification audit
Interface NRM, the independent certification body, assessed COEL’s system over four days. Principal Risk Management led and managed the audit throughout — supplying evidence, answering the auditor’s questions, coordinating employee interviews across the business, and guiding the auditor on a construction site walk to see the system working where it matters most. COEL’s teams could focus on their day jobs while we ran the audit around them.
The outcome
Within six months of starting, COEL was certified to ISO 9001, ISO 14001 and ISO 45001 on the first attempt, with no nonconformities raised.
The commercial effect was immediate. Tenders that had been closed to COEL were now open, and certification helped the business win multiple opportunities it could not previously have qualified for.
COEL now runs every project through one system with defined quality controls, clear handovers, and connected records, so accountability no longer blurs between teams and far less depends on what any one colleague happens to know. That is the real return on ISO certification: not a logo for the tender documents, but a stronger way of running the business.