Types of management system organization
Annex B sets out the three relationships between an entity and its management system organization, and the membership consequences of each.
This annex is informative. It explains and illustrates; it does not create a requirement. A finding cannot rest on it alone. The normative guidance is in clauses 6 to 8.
What annex B asks
Three relationship types are set out, with consequences for membership. In Type A the entity and the system organization are the same, and the board is the same body as the system's leadership. In Type B the entity contains the system organization, more than one system may operate, and the board may share some members with each system without being identical. In Type C one system is shared by several entities. Where those entities have a direct interest, each board may have members on the system's leadership; where a third party runs the system as a service, that is unlikely. The annex is informative and the figure shows the possibilities. Its practical use is diagnostic: each type carries a different failure, and the membership list shows whether the organization has actually chosen one.
Why it matters
The three types are a diagnostic, not a taxonomy for its own sake. Each one carries a different risk. Type A risks collapsing governance into management. Type B risks a system that cannot say whose objectives it serves. Type C risks a shared system that serves the provider rather than the members. The membership detail is the tell. If the reader cannot say who sits on the governing body and who sits on the top management of each system, the organization is probably in the wrong type on paper or has never tested the arrangement. The annex gives the board a way to ask the question without an org chart argument.
What good looks like
Place the organization on the annex figure and record the evidence for the choice. Then test the membership: list the governing body, the top management of each system and the overlap. Ask each system to state whose objectives it serves. Repeat the test after a merger, a divestment or the creation of a shared service. Where the type is mixed, which is common in a group, record the type for each system rather than forcing one label on the entity.
Evidence a board or an auditor asks for
The completed annex figure with the evidence for the choice; the membership lists and overlap; the objectives statement for each system; the change record after a structural event.
- Record The completed annex figure with the evidence for the choice
- Record the membership lists and overlap
- Record the objectives statement for each system
- Record the change record after a structural event
Where it commonly fails
- One label applied to a group with several different relationships
- Membership left to inheritance rather than decision
- A shared system with no member representation and no assurance route
What to do before publication
Before the edition 3 text is published, put clause B on the annexes, informative agenda, name the owner of each line above and give it a review date. When the final draft or the published text is available, compare it with this record and note every difference.
Read across
- 1 Scope
- 3 Terms and definitions
- 8.2.1 Type A: The entity and the ISMS organization are the same
- 8.2.2 Type B: The entity contains the ISMS organization
- 8.2.3 Type C: One ISMS is shared by multiple entities