Pure ISO
ISO management systems, on one record.
One module for the standards you hold. Documents, clauses, audits, and the management review. AI drafts. A person signs.
The benefit
The gap is visible before the auditor arrives.
Activate only what you hold
Nine standards sit on one system. You turn on the ones you hold, or are working towards. The rest stay off.
The clause has an owner
Each clause is compliant, partial, a gap, or not applicable. Evidence is linked. An open gap is a named action, not a spreadsheet row.
AI drafts. A person audits.
A gap assessment is generated from the records you already hold. It is badged as a draft. It does not count toward readiness until a named auditor signs it.
Ready when someone asks
The readiness score can be explained: clauses, documents, how recent the audit is, how recent the review is, minus open major nonconformities. ISO 31000 shows maturity, not certification.
What it is
The integrated management system for the standards you hold.
Pure ISO is one module. Each company turns on the standards it holds. The same parts cover all of them: documents, the clause register, audits, nonconformities, the management review, and objectives.
Where a standard uses Annex SL, the clauses follow that structure. A new edition is an update to that standard, not a new system.
It is not a certification body. It does not issue a certificate. It holds the record the auditor reads, and the readiness score that tells you whether that record is complete.
The standards
Nine standards. Activate the ones you hold.
- 2018 + Amd 1:2024ISO 45001Occupational health and safety. Worker consultation, the hierarchy of controls, and incidents as nonconformities.
- 2022 + Amd 1:2024ISO/IEC 27001Information security. 93 Annex A controls in four themes. A Statement of Applicability is required.
- 2015 + Amd 1:2024ISO 9001Quality. The operational records sit with the process. A later edition can be added as an update.
- 2026ISO 14001Environment. Published April 2026. New planning clauses, and the management review split. Transition runs to May 2029.
- 2018 + Amd 1:2024ISO 50001Energy. The energy review, significant energy uses, the energy performance indicators, the baseline, and the data collection plan.
- 2012 + Amd 1:2024ISO 39001Road traffic safety. The numbering does not follow the usual Annex SL pattern. Crash investigation, internal audit, and management review are included.
- 2019 + Amd 1:2024ISO 22301Business continuity. The business impact analysis and the risk assessment, the strategies, the plans, and the exercise programme.
- 2018ISO 31000Risk management. It is not a certifiable standard. The record is a maturity self-assessment, not an audit.
- 2023ISO/IEC 42001AI management. 38 controls in nine groups. A Statement of Applicability, and an AI system impact assessment.
What the module does
What the standards share.
- Document controlRequired documents for each standard, written in the app. Version history, approval, and the review date.
- Clause complianceEvery clause for the standards you hold, with a status, an owner, and the evidence linked to it.
- Internal audits and nonconformitiesAudits against the clause set. A finding becomes a nonconformity with a corrective action.
- Management review and objectivesThe review inputs the standard actually asks for. Objectives with a baseline, a target, and a measurement series.
- AI gap assessmentOn request, a draft internal audit from the records you already hold. A named person reviews, amends, and signs.
- Statement of ApplicabilityFor 27001 and 42001 the statement is built from the control register. Every control, included or excluded, with a justification.
The AI rule
AI drafts. A named person audits.
A gap assessment reads the records you already hold: the clause register, documents, evidence links, nonconformities, prior audits, and the business profile. It works through the audit questions and returns a draft, with a result for each clause, the citation, and suggested findings.
Unevidenced clauses return “not assessed”. The system does not guess. Nonconformities are created only when a person completes the audit. Drafts are badged and excluded from the readiness score until signed.
That is what keeps the audit objective, which is what clause 9.2 asks where the standard uses it. The AI does not audit. A person does.
Related