Hiring for a role most suppliers have never filled

What you are hiring for

Somebody to own the programme described in the entry on ownership: a named person with time and authority who can make records happen.

The confusion to avoid is between security and compliance. A security engineer configures controls. A compliance owner defines scope, writes the plan, chases evidence and faces the assessor. Both are useful and they are different jobs, and job advertisements routinely ask for one and describe the other.

Four things, in order

Experience of being audited. Quality, aerospace or medical device backgrounds all supply this. Somebody who has faced an external auditor understands what evidence is in a way that cannot be taught quickly.

Ability to write. Most of the deliverable is documents that a stranger has to follow. This is rarer than it should be and it is testable in an interview.

Willingness to be unpopular. The role requires telling production that something must be recorded, and telling a director that a change cannot proceed.

Enough technical fluency to ask. Not to configure: to understand an answer and to notice when one is evasive.

What they signal

They signal that somebody studied a body of knowledge and passed an examination, which is real and is not the same as having run a programme. Treat them as a filter for a shortlist rather than as the decision.

Where a certification is genuinely required by a customer or a framework, that is a different matter and will be stated in the requirement.

It is small, and everybody is hiring from it

Demand for people who have done this exceeds supply, particularly outside major cities and particularly for manufacturers who cannot match technology salaries.

Which argues for the alternative below rather than for a longer search.

Frequently the better option

Take somebody who already knows the business, already has the audit instinct and already has standing with production, and buy the specialist knowledge around them: training, a consultant by the day, a mentor.

They will be slower for six months and better afterwards, because the part that cannot be bought is knowing how this business actually works and being trusted by the people in it.

Three

Describe a time you had to get a record kept that nobody wanted to keep. What did you do when an auditor asked for something you did not have? Tell me how you would find out what actually happens on our shop floor.

The third separates people who would read the procedures from people who would go and look.

A real option for a small supplier

An experienced compliance owner two days a week, with an internal person holding the day-to-day, works and is common. What does not work is a fractional owner with no internal counterpart, because the internal authority the role needs cannot be exercised by somebody who is not there.

Benchmark against quality, not against security

Pitching the salary against technology market rates makes the role look unaffordable; pitching it against senior quality roles, which is what it most resembles in a manufacturer, makes it achievable and is defensible internally.

What a new owner should do

Read the contracts. Walk the floor. Find the evidence, wherever it is. Meet the sponsor and agree the monthly slot. And produce one document that did not exist before, so that the role has visibly started.

Elsewhere in people

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• The costs that arrive after the purchase orderThe costs that arrive after the purchase order. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.