TERMPLAIN-ENGLISH DEFINITION
Accredited certification bodyAn independent auditor licensed (in NZ, by JAS-ANZ) to issue ISO certificates. Consultants build; certification bodies certify. Anyone offering both is selling a conflict.
Annex A (ISO 27001)The catalogue of 93 information security controls. You don't implement all of them — you justify which apply in the Statement of Applicability.
Aspects & impacts (ISO 14001)What your operation touches (aspects — fuel use, discharge, waste) and what that does (impacts). The register that ranks them drives the whole environmental system.
ClauseA numbered requirement in a standard. Clauses 4–10 are the auditable core in modern ISO management standards, and they share a common structure across standards.
Context of the organisationClause 4: who you are, who cares (interested parties), and what issues shape the system. Auditors start here; so do we.
Corrective actionThe fix for a nonconformity's root cause — not just the symptom. The trail from finding → cause → fix → verification is what auditors read first.
Gap analysisThe audit of what you have against what the standard asks, before building anything. Output: a findings list ranked by severity and the build plan.
HACCPHazard Analysis and Critical Control Points — the food safety method ISO 22000 wraps a management system around.
HSWAThe Health and Safety at Work Act 2015 — NZ's safety law. ISO 45001 doesn't replace it; it evidences how you meet it.
IMS (Integrated Management System)One system certified to multiple standards — typically 9001 + 14001 + 45001. Shared clauses built once; roughly 40% cheaper than three separate builds.
Internal auditYour own clause-9.2 check that the system works, done by someone independent of the work audited. The strongest single signal of a real system.
Interested partiesEveryone with a stake the system must consider: workers, clients, regulators, neighbours, iwi. Their needs feed the risk register.
JAS-ANZThe Joint Accreditation System of Australia and New Zealand — the body that accredits certification bodies. A certificate without JAS-ANZ (or equivalent) accreditation behind it carries little weight.
Management reviewThe scheduled leadership review of system performance — inputs and outputs are prescribed. Done well it's a business meeting, not a compliance ritual.
NonconformityA requirement not met. Minor: an isolated slip. Major: a systemic failure or missing clause — what pre-certification audits exist to catch.
PDCAPlan–Do–Check–Act, the improvement loop every ISO management standard is shaped around. Kaizen — 改善 — is the same idea as a working habit.
Pre-certification auditThe full dress rehearsal before the real Stage 1/Stage 2 — every clause, every register. You meet your certifier already knowing the answer.
RegisterA living list the system maintains — risks, incidents, training, obligations, assets. Registers are where systems live or die between audits.
Stage 1 / Stage 2Certification's two visits: Stage 1 checks the system exists on paper and readiness; Stage 2 checks it runs in practice. Pass both, certificate issued.
Statement of ApplicabilityThe ISO 27001 document declaring which Annex A controls apply and why — the single most-read page in an ISMS audit.
Surveillance auditThe certifier's annual check-in between certifications. Routine if registers are live; panic if they froze the day the certificate arrived.
Takt timeAvailable time ÷ demand — the drumbeat a balanced line runs to. The starting number of every line-balancing engagement.
Verified controlsSafety controls checked in the field as actually implemented and effective — not just listed in a register. The 45001 habit WorkSafe most wants to see.
Value stream mapThe end-to-end drawing of material and information flow, with time. Shows where the lead time actually goes — usually into waiting nobody owns.