assurance leadership
WHAT DOES AN AI-AUGMENTED QUALITY AND SUSTAINABILITY FUNCTION LOOK LIKE?
Most management systems describe the company periodically. They do not help it operate daily. The change that matters is that procedures, findings, incidents, evidence and lessons become an operating memory that improves every investigation, audit and control decision. Accountability stays with the person. The memory becomes institutional.
A small team carries a
company-wide system.
A Nordic mid-market EHSQ function usually has one to five people. Common roles are EHSQ manager, quality manager, sustainability lead, quality engineer and coordinator. Site managers, production leaders, HR, procurement and engineering perform much of the work, while the central team owns the system and carries the certification risk.
The function protects revenue and margin. Certifications and customer approvals can be conditions of sale. Weak controls create scrap, warranty claims, injuries, stoppages, environmental liabilities and lost tenders.
Ten processes| 01 | Management-system maintenance and internal audits | 06 | Customer complaints and root-cause analysis |
| 02 | External audits and certification | 07 | Incident and near-miss reporting |
| 03 | Non-conformance and corrective action management | 08 | Environmental and sustainability reporting |
| 04 | Document and procedure control | 09 | Training and competence records |
| 05 | Supplier quality | 10 | Regulatory monitoring |
The information is spread across a QMS or EHS platform, ERP, SharePoint, Teams, email, spreadsheets, training systems and supplier portals. Local interpretation sits in the heads of one quality manager and a few site veterans. Findings, complaints, incidents and environmental figures are recorded, but rarely connected well enough to reveal whether the same control is weakening across products, suppliers or sites.
The management system is rich in records and poor in memory.
Procedures explain how work should run. Findings show where it did not. Incidents, complaints and supplier defects show what happened next. Yet the function still spends much of its attention retrieving and reconciling these fragments instead of testing whether controls work.
Assurance becomes
continuous.
At the heart of the shift, operating memory and operating cadence move together.
The management system becomes an operating memory rather than a document estate. Procedures, findings, incidents, decisions, evidence and lessons can be queried together. A new complaint can be compared with earlier failures. A corrective action can be tested against its stated cause. A procedure change can reveal the roles, products and sites it affects. Certification knowledge stops being one person's biography.
The cadence moves from periodic preparation to continuous assurance. Controls are monitored as work happens. Internal audits begin with exceptions, contradictions and weak signals rather than document collection. Management review begins with recurring causes and weakening controls rather than slide assembly. Sustainability reporting becomes an output of operating data rather than a separate spreadsheet season.
The function's promise changes from keeping certificates to showing where control is weakening, what has recurred and which intervention is most likely to work.
Where it is weakestLegal interpretation, safety-critical judgment and final conformity decisions remain accountable human work. The operating memory can retrieve, compare and propose. It cannot own the conclusion.
A day, a week,
a month.
A serious investor still has quality managers, auditors, safety professionals and sustainability leads in 2028. The central team may remain one to five people. Its capacity moves from document administration and chasing data into field assurance, control design, supplier development and prevention. A larger multi-site company may add a data-and-assurance coordinator rather than another document controller.
The daySite events arrive through mobile forms, voice notes, sensors and connected systems. The workflow checks completeness, structures the record, retrieves similar cases and directs urgent items to a named manager. Environmental readings and training expiries update without an email chase.
A new non-conformance, complaint or incident opens with a chronology, comparable cases, missing facts and possible causal factors. The investigator visits the work, interviews people, challenges the suggestions and determines the finding.
The workflow drafts the record, routes evidence requests and checks whether a proposed action addresses the stated cause. The process owner approves the cause and action. Later evidence shows whether recurrence fell or the control remained weak.
The weekThe EHSQ team reviews an exception briefing. It covers recurring causes, overdue actions, actions unlikely to prevent recurrence, suppliers outside tolerance, changed requirements and controls with missing evidence. Specialists spend more time at sites and with process owners.
The monthManagement review is assembled from live evidence. Leaders examine the few material deviations instead of rebuilding charts. Procedure owners receive proposed changes supported by cases and audit findings. Sustainability metric owners review traceable figures and approved claims.
Before an external auditThe audit workspace maps each clause to current evidence, flags gaps and preserves the provenance of every item. The quality manager tests the representation and confirms what is presented to the certification body.
Continuous readiness, cross-site recurrence analysis and consistent customer answers used to require attention the team did not have. They become part of the normal operating rhythm.
What runs, and what
stays with the person.
| Process | What the agent does | What stays with the person |
|---|---|---|
| Management system and internal audits | Maps clauses to controls and evidence, proposes samples and questions, records contradictions and drafts findings | Auditors observe work, test control effectiveness and determine findings |
| External audit and certification | Maintains a dated clause-to-evidence index, assembles current records and flags gaps | The management representative confirms every formal statement and conformity representation |
| Non-conformance and corrective action | Builds a chronology, retrieves similar failures, proposes causal hypotheses and tests whether the action addresses the stated cause | The process owner determines the cause, approves the action and judges whether it worked |
| Document and procedure control | Answers from approved versions, detects conflicts and proposes affected documents when a process changes | Owners approve the content, effective date and operational change |
| Supplier quality | Combines defects, audit findings, certificates and delivery events, then drafts review packs and highlights systemic failure | Quality and procurement decide the audit response, development plan and commercial treatment |
| Customer complaints and root cause | Normalises descriptions, links serial numbers and retrieves related complaints, production failures and corrective actions | Quality and engineering decide containment, investigation and root cause |
| Incidents and near misses | Turns mobile or voice reports into structured drafts and flags severity indicators, similar events and missing facts | A safety professional controls classification, investigation and response |
| Sustainability data and questionnaires | Maintains approved claims, metrics, methods and evidence, then drafts cited questionnaire responses | Metric owners approve figures, calculation choices and every external claim |
| Training and competence | Identifies roles affected by a changed procedure, drafts role-specific learning and checks understanding | Managers determine competence and the response to any gap |
| Regulatory monitoring | Compares changes with controlled registers of products, chemicals, processes and sites, then drafts an impact assessment with source text | Legal and technical owners determine applicability and required action |
Four stages on
The Access Ladder.
The connection sequence follows operational value and reversibility. Each stage is a rung in GRAIL's Access Ladder, and each one earns the next.
Controlled procedures, audits, certificates, approved claims and past cases form a permission-controlled knowledge base. Staff can retrieve an approved answer with a citation, prepare an audit and draft a questionnaire without access to live operating systems.
Open corrective actions, incidents, complaints, supplier defects, training status and environmental measures feed exception briefings and trend analysis. The workflow can connect records across the QMS, ERP, maintenance, training and supplier systems without changing them.
Workflows draft records, create audit plans, route actions, request evidence and prepare reports. A named person approves corrective actions, procedure changes, external statements and submissions before anything material is written or sent.
Evidence chasing, record classification, audit-sample preparation and approved reminders run within explicit limits. Safety decisions, certification representations, regulatory conclusions and external disclosures stay with a named person.
Point connections answer record-level questions. A warehouse or lake becomes necessary when the function must join several years of events across product, supplier, site and customer identifiers.
The QMS keeps records, permissions, workflows, signatures and audit history. The operating memory retrieves evidence and proposes action through a briefing or conversational layer. Shared master data matters more than model choice, and every material write preserves its source, reviewer, approval and final system response.
Six things we believe,
from building this.
Quality, EHS and Sustainability have spent years becoming systems of record. The next step is to become systems of attention. Six beliefs define that shift.
A function can pass an audit while recurring failures remain hidden across sites and systems. The greater value is knowing which control is weakening before the next complaint, incident or finding proves it.
Finding the right procedure is useful. Connecting that procedure to prior findings, complaints, incidents and actions changes the quality of the decision. Every resolved case should improve the next investigation.
When evidence is prepared as work happens, auditors no longer need to spend their attention reconstructing the record. They can observe work, test exceptions and challenge whether the control actually works.
The workflow can build a chronology, retrieve similar cases and suggest causal factors. The investigator still has to test them against the work, speak to the people involved and sign the conclusion. Fluent analysis without field judgment creates false confidence.
A separate spreadsheet season is a symptom of disconnected invoices, meters, purchasing records and supplier data. When the evidence arrives with its source attached, the sustainability lead becomes the owner and reviewer of a metric system rather than its collector.
Giving people a drafting tool while leaving audit preparation, management review and action chasing unchanged only adds another layer. Leaders must replace the old collection rituals with exception review, field assurance and control decisions.
These six beliefs do not argue for replacing accountable people. They argue for giving them a complete memory, earlier signals and more time where the work happens.
Roles, rhythm, and
where it fails.
The quality manager becomes the architect of evidence and control effectiveness. Quality engineers move from assembling records toward investigating recurrence. Internal auditors move from checklist preparation toward observation, challenge and process testing. Sustainability leads become metric owners and disclosure reviewers. Site managers carry more responsibility because weak controls become visible sooner.
The team needs competence in evidence design, data lineage, structured root-cause analysis, workflow evaluation and permission design. Prompt technique is not enough. People must know how to inspect sources, distinguish a hypothesis from a finding and recognise when an output needs specialist review.
The rhythmApproved procedures, audits and evidence become searchable with citations
Audit, corrective-action and questionnaire workflows enter the team's normal work
Read access and approved writes connect evidence across several systems
Continuous assurance changes management review and the division of work
Where it failsUncontrolled documents in the index. No clear process owner. Generated volume measured instead of recurrence, closure quality or control effectiveness. Weak product, supplier and site master data. Unrestricted write access. Proposed causes treated as findings. Review work added on top of the old process instead of replacing it.
Involve process owners, site managers, safety delegates and the people whose records and work will change before the new rhythm is set. Adoption begins when the system helps them prevent failure, not when it produces more text.