There is no single reliable implementation timeline for ISO 22163 that applies to every organisation. The preparation period depends on the certification scope, the maturity of the existing management system, process stability and the quality of records demonstrating effective operation. A credible schedule can only be established after a gap analysis, assignment of responsibilities and assessment of the time required not merely to define controls, but to apply them, complete internal audits and verify the effectiveness of corrective actions. An audit assesses an operating system, not a set of prepared procedures.
IRIS as an operational transformation project
ISO 22163 implementation should be treated as a change in how rail-sector operations are managed, not as a documentation exercise carried out for an audit. The standard defines requirements for a quality management system in the railway sector, while IRIS provides the framework for organisational assessment and certification. The management system is the actual network of processes, responsibilities, data and decisions operating across the business. Certification confirms the outcome of an assessment of that system; it does not replace the system itself. The current edition of the standard and the applicable IRIS scheme rules should always be verified as of the project start date and before publishing related information.
Polish companies most often begin implementation in response to a customer requirement, planned entry into the rail supply chain, tender conditions, business expansion or a need to establish clearer process accountability. Whatever the driver, senior management should first define the system boundaries: the legal entities and sites included in certification, relevant product and service groups, the extent of design responsibility and any outsourced processes. Without these decisions, the implementation schedule is largely theoretical because it is unclear where evidence of conformity must be generated or who is accountable for its reliability.
The project should not be delegated solely to the quality function. A management system representative may coordinate the gap analysis, documentation and audit preparation, but the critical evidence is generated in sales, design, purchasing, production, infrastructure and equipment maintenance, and complaint handling. A stated commitment to controlling customer requirements is insufficient if sales does not record changes to agreed requirements, design does not maintain traceability of verification, or purchasing does not assess how suppliers affect product conformity. Project ownership should sit with a member of senior management who has the authority to resolve cross-process conflicts and allocate resources.
An existing ISO 9001 system may shorten the preparation period, but only if it operates effectively and produces consistent records, performance measures and monitoring results. Holding an ISO 9001 certificate does not in itself demonstrate readiness for sector-specific requirements. The scenarios discussed in How to prepare a company for ISO 9001 certification in 90, 180 and 270 days — realistic scenarios should therefore not be transferred automatically to a railway-sector project. The sector-specific requirements and their relationship with the certification scheme are outlined in IRIS (ISO/TS 22163) — Quality Management System for the Railway Sector.
What actually determines the timeline
The implementation timeline should be divided into two periods. The first covers the gap analysis, process design, assignment of responsibilities and completion of the operating controls. The second begins when the agreed arrangements are put into practice: records are generated, indicators show actual performance, internal audits and management reviews take place, and the effectiveness of corrective actions can be evaluated. Producing documentation quickly does not automatically reduce the time needed to demonstrate that the system works.
Preparation is accelerated by an effective ISO 9001 system, stable processes, reliable indicators, clearly assigned responsibilities, effective control of customer requirements and management availability for timely decisions. The schedule is extended by fragmented documentation, absent process ownership, weak traceability, uncontrolled changes, immature supplier evaluation and insufficient effectiveness data. The number of sites, the number of processes within scope and the number of employees performing quality-critical activities also matter. Each of these factors increases the number of points at which consistency between defined controls and operational practice must be demonstrated.
| Scenario | Starting position and constraints | Condition for proceeding to audit | Main schedule risk |
|---|---|---|---|
| Accelerated | Mature, stable processes and complete data; gaps relate mainly to sector-specific requirements | A complete cycle of records is available and the effectiveness of newly introduced controls has been verified | Hidden inconsistencies between sites or processes |
| Standard | An operating ISO 9001 system is in place, but some controls, indicators and responsibilities require further development | Significant gaps have been closed, and internal audits and management review have been completed | Overestimating the maturity of a certified system |
| Remedial | Processes require redesign; overdue actions, weak traceability or uncontrolled changes are present | Operational practice has stabilised and there is evidence that remedial actions are effective | Recurring nonconformities and delayed management decisions |
An organisation should be assigned to one of these scenarios on the basis of a gap analysis, not the management system representative’s declaration. Records from audits, reviews, supplier evaluations, risk management and process monitoring should be examined, together with the number of open nonconformities, complaints and overdue corrective actions. A practical test is to trace a selected order from customer requirements through changes and deliveries to acceptance and the response to deviations. Breaks in this chain usually reveal the true scale of implementation work.
Initial engagement with the certification body may be planned earlier, but a firm audit date should preferably be agreed only after the gap analysis and with sufficient contingency for corrective action. The railway sector requires particular attention to traceability, change control, customer requirements and supply-chain management. Specific time ranges are therefore meaningful only after confirming the scope, process maturity and quality of the available evidence.
Where cost and risk increase
Implementation costs rise primarily when the system scope, process-owner responsibilities and dependencies between sales, design, purchasing, production, acceptance and nonconformity management are defined too late. Work then has to be repeated: processes are remapped, forms are revised, data is reconstructed and conflicting rules are reconciled. The mechanism is similar to the one discussed in How much does NIS2 and uKSC implementation cost? Building a budget for audits, documentation, training and safeguards without costly mistakes: expenditure is driven by the starting position, scope and number of dependencies, not by the number of documents. This does not mean that regulatory requirements should be transferred between these areas.
Before procedures are drafted, gaps in process flow, decision-making authority, information handovers and data sources need to be addressed. Copying ready-made documentation usually conceals these weaknesses. A procedure may be formally sound yet fail to reflect the actual order flow or the way designs, suppliers, acceptance decisions or concessions are approved.
The implementation budget should distinguish between consultancy fees, the working time of process owners and the implementation team, training, changes to tools, internal audits, the certification audit and certification itself. The cost of the certification audit requires an individual quotation prepared in accordance with the current rules for determining audit duration.
A typical issue arises when a procedure formally requires risk assessment and change control, but a production order is amended by email, a design deviation lacks unambiguous approval, or a new supplier begins work before its evaluation has been completed. Individual records may exist without forming a coherent decision trail. It is then unclear who assessed the impact of the change, which customer requirements were reviewed or whether the configuration was updated. This type of gap creates a cost-of-quality issue, increases complaint risk and forces the organisation to reconstruct evidence before the audit.
Immaturity in configuration, project, supplier, risk and customer-requirement management often becomes visible only when records are sampled. A declared control may work for one product but become inconsistent when another order, site or supplier is selected. The plan should therefore account for the working hours of the people involved, the number of systems and registers requiring alignment, and the time needed to close gaps in records. Replacing an IT system is justified only where the current tools cannot provide traceability, access control or data consistency. Similar evidence-based reasoning applies when considering How to prepare a company for a second-party audit of a key supplier.
An evidence-based implementation plan
The implementation plan should begin with an assessment of the current state, not with drafting procedures. This assessment should cover the system scope, process mapping, customer requirements, current practices, applicable documents, available records and performance data. The output should be a gap analysis linked to specific processes, owners and deadlines. Progress should be measured by the closure status of actions, not by the number of documents produced.
Three situations require a clear distinction:
- no defined method of operation;
- a method has been documented but is not being followed;
- the method is being followed but does not generate reliable evidence.
Each requires a different response. The first calls for solution design, the second for effective operational deployment, and the third for suitable evidence of execution and control.
The system should be designed around actual workflows and decision points. Each process needs an owner, defined risks, indicators, control criteria, required records and clear rules for transferring responsibility. This is particularly important at the interfaces between sales, design, purchasing and delivery, where requirements are most often lost or changes introduced without adequate control.
Sector-specific practices relating, among other matters, to project, risk, configuration, change, supplier and nonconformity management should be embedded in the relevant processes to the extent applicable to the organisation’s activities. They should not operate as separate appendices maintained solely by the quality function.
A useful test of the system design is to select a representative order and trace it from requirement acceptance through to final acceptance. The organisation should be able to demonstrate approval of customer requirements, design decisions, risk evaluation, and control of suppliers, configuration, changes and nonconformities. If the complete route cannot be reconstructed from records, the implementation stage is not complete, even if the documentation has been approved. Readiness should be based on consistent evidence from several selected orders or projects and confirmation that the process operates without last-minute reconstruction of data before the audit.
Competence should be developed in line with assigned responsibilities. Senior management needs to understand which decisions require its involvement and how management review should be conducted. Process owners need to understand how to control performance and risks; internal auditors need to know how to evaluate evidence; and operational personnel need to understand the requirements applicable to their activities and records. Guidance on interpreting requirements and determining competence needs is available in IRIS (ISO/TS 22163) Requirements — Quality Management System for the Railway Sector. Training alone does not demonstrate implementation. Competence must be evident in process decisions, actions and records.
Once the system is operating, the steering committee should periodically review progress against the gap analysis, the proportion of processes with defined owners, indicators, risks and control criteria, and the availability of records covering the full delivery cycle. Review frequency should reflect the pace of change and the scale of outstanding work. Completion of each stage should be approved by the deliverable owner together with the person responsible for implementation, using predetermined exit criteria. Progression to an internal or certification audit is justified only after the system has been tested on actual cases and identified gaps have been closed and verified.
The audit dress rehearsal
The purpose of a dress rehearsal is to evaluate system performance under conditions similar to a certification audit, not to check whether files and folders are complete. The internal audit should be process-based and risk-based, covering all relevant processes and sites within the system scope. Rather than auditing individual departments in isolation, auditors should trace specific orders, projects, changes, deliveries and nonconformities across successive areas of the organisation. Sampling should include underperforming processes, significant changes, supplier issues and areas with a history of nonconformity.
The credibility of the assessment depends on auditor independence and the quality of record sampling. A person responsible for a process should not audit their own work. This also applies to processes managed by the quality function, which should be examined by a competent auditor from outside that area or by a suitably selected external auditor. The full internal audit needs to be conducted early enough to allow time for root-cause analysis, implementation of actions and verification of effectiveness. A rehearsal performed too late usually results in administrative closure of findings without confirmation that the intended results have been achieved.
A representative sample can be built around an order covering requirement agreement, planning, purchasing, delivery, inspection and acceptance, and then linked to a technical change, delayed delivery or complaint. The auditor can then evaluate not only whether documents exist, but also whether decisions are consistent with the records, whether indicators are reliable and how deviations are handled. Readiness is demonstrated by complete samples covering the full lifecycle of a product, service, order or project, adequate audit-plan coverage of processes and sites, and the genuine status of nonconformities.
Following the trial audit, senior management should conduct a review based on current data rather than a presentation prepared solely for the meeting. The review should result in documented decisions concerning resources, risks, process performance, suppliers and improvement actions. Particular attention should be given to the effectiveness of corrective action. Training, a revised form or formal task closure does not demonstrate that the cause has been eliminated. Evidence is needed that the problem has not recurred and that the revised method works in practice.
During the dress rehearsal, it is useful to apply the principles described in How to prepare a company for a second-party audit of a key supplier, particularly regarding process-owner preparation, evidence availability and fact-based responses. The difference in purpose must nevertheless be maintained: a customer audit typically focuses on the customer’s requirements, specific products and delivery risks, whereas a certification audit assesses the organisation’s declared scope and the conformity and effectiveness of its processes at system level. The reference point for this assessment remains IRIS (ISO/TS 22163) — Quality Management System for the Railway Sector.
The readiness decision
Audit readiness means that the organisation can present consistent evidence that the system operates throughout the declared scope. It is not demonstrated by completing procedures or formally approving documentation. Senior management should confirm that processes are being followed, results can be traced through records, and process owners can explain decisions, deviations and the actions taken.
Final confirmation of the audit date should be managed as a formal decision gate. The conditions for proceeding to audit are:
- an approved management system scope;
- implementation of all processes within that scope;
- availability of representative records;
- completion of internal audits;
- completion of management review;
- verification of the effectiveness of completed corrective actions.
Open gaps should remain only where their impact, owners, response deadlines and monitoring arrangements have been defined and senior management has consciously accepted the residual risk.
The audit should be postponed if records do not cover the normal lifecycle of an order or project, responsibilities remain unclear, systemic issues are still open, or the effectiveness of corrective actions has not been verified. A significant mismatch between documentation and practice also justifies postponement. A change-control procedure is not evidence of readiness if actual technical changes have been approved outside the defined process or without evaluating their impact.
The decision paper submitted to senior management should rate each criterion as “met”, “conditionally met” or “not met”, and identify unresolved systemic risks, action owners and response deadlines. The conclusion must be unambiguous: “proceed”, “proceed conditionally” or “postpone”. The formal decision belongs to the management responsible for the scope and resources, not to the management system representative alone.
A credible schedule is built after diagnosing gaps and assigning resources, not by counting backwards from the desired certificate date. The final assessment should consider audit-readiness criteria and the requirements presented in IRIS (ISO/TS 22163) Requirements — Quality Management System for the Railway Industry.
Masz pytania? Porozmawiajmy.
Bezpłatna konsultacja – bez zobowiązań.
