ISO management systems

Management systems that improve control—not shelf weight.

Lead-auditor expertise across eight ISO standards, with readiness, implementation and internal audit support tailored to your management system.

Discuss ISO support

ISO / Lead-auditor expertise

Eight standards.
One commitment to quality.

Pegasus provides lead-auditor expertise across the following management-system standards, with each audit scoped to your organisation and its requirements.

ISO 14001: Environmental management
ISO 9001: Quality management
ISO 45001: Occupational health and safety management
ISO/IEC 42001: Artificial intelligence management
ISO/IEC 27001: Information security management
ISO/IEC 20000: IT service management
ISO 22000: Food safety management
ISO 13485: Medical devices quality management

Lead-auditor expertise supports audit and assurance work. Independent certification bodies make certification decisions. Applicable editions, standard parts and sector-specific requirements are agreed in the engagement scope.

Who this helps

Built around a buying situation.

SMEs formalising operational control
Integrated management-system owners
Organisations preparing for independent certification

Useful when

The trigger is already visible.

Certification is planned but scope and ownership are unclear
Several standards have created duplicate processes
Internal audit finds documents but not effective control

The position

Lead-auditor expertise. Connected management systems.

Pegasus provides lead-auditor expertise across ISO 14001, ISO 9001, ISO 45001, ISO/IEC 42001, ISO/IEC 27001, ISO/IEC 20000, ISO 22000 and ISO 13485. Common processes can be coordinated while retaining each standard’s distinct sector, risk and evidence requirements. Audit scope and applicable requirements are agreed before each engagement.

A defined scope and accountable decision owners

Controls matched to the real operating context

Evidence that can be reviewed, tested and improved

Scope

What the work includes.

Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.

Scope and readiness baseline

Define scope, context, interested parties, process, risk and a prioritised readiness baseline.

Integrated system implementation

Integrate policies, responsibilities, operational controls, competence, documented information and measures into daily work.

Internal audit and management review

Deliver risk-based internal audit, management-review support and corrective-action verification before independent assessment.

Method

A controlled route from exposure to evidence.

Decision points, responsibilities and verification stay visible from the start.

Discover

Define the exposure, context, evidence, owners and decision that matters.

Design

Select proportionate controls and make responsibilities and hold points visible.

Implement

Embed the agreed system into the real operating workflow.

Verify

Test whether controls work and whether the evidence supports the conclusion.

Improve

Close actions, learn from exceptions and strengthen the system over time.

Outputs

Evidence designed for use.

Scope and evidence map

Prioritised findings and action ownership

Practical control or implementation pack

Verification record and next-step roadmap

Professional boundaries

Precision includes saying what the work does not claim.

Pegasus does not award accredited certification.
Certification decisions remain independent of consultancy support.

Questions answered

Before you scope the work.

Does Pegasus issue ISO certificates?

No. Pegasus provides consultancy, implementation and internal audit support. Certification is performed independently by a certification body.

Can several ISO standards share one system?

Yes. Common governance and improvement processes can be integrated, provided each standard's distinct risks, operational controls and evidence remain effective.

Start the conversation

Bring the exposure. Leave with a controlled route forward.

A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.