ISO 29001 case study
ISO 29001 case study: quality, safety and supply chain for an oil and gas organisation
How an oil and gas organisation implemented ISO 9001, ISO 14001, ISO 45001, ISO 29001 and API Spec Q1 together to build a dependable supply chain, improve maintenance and reduce incidents in a demanding industry.
Key points
- An oil and gas organisation implemented five management system standards together: ISO 9001, ISO 14001, ISO 45001, ISO 29001 and API Spec Q1.
- Its two aims were a supply chain it could depend on and strong safety performance in a demanding, high-risk industry.
- Supplier assessment and procurement moved onto Sterling's software platform, maintenance improved, downtime fell, and incidents and their consequences were reduced.
- ISO 29001 certificates come from accredited certification bodies and API Spec Q1 registration from API's own registrar; Sterling does not certify.
The organisation and what it needed
This ISO 29001 case study concerns an organisation working in oil and gas, an industry where a late part, an unplanned stoppage or a missed hazard carries consequences far beyond the site where it starts. The organisation stays anonymous here, as it does in Sterling's own case studies.
Two needs shaped the programme. The first was a dependable supply chain: confidence that what it bought, and the providers it bought from, would perform as expected. The second was strong safety performance in a complex industry. Both needs pointed to the same answer, a management system that treats quality, environment and safety as parts of one way of working.
What was implemented
The organisation implemented five standards as one programme:
- ISO 9001, the quality management foundation.
- ISO 14001, for environmental management.
- ISO 45001, for occupational health and safety.
- ISO 29001, the sector-specific quality management standard for suppliers to the petroleum, petrochemical and natural gas industries.
- API Spec Q1, the American Petroleum Institute's quality specification for product manufacturers.
Within that programme, supplier assessment and procurement were moved onto Sterling's software platform, so that evaluating providers and buying from them ran through one system. Alongside this, the safety side of the system focused on identifying hazards early and on emergency response plans that were joined up across the organisation rather than written in isolation.
What changed
The results the organisation reported fall into three areas.
Supply chain
Supplier assessment and procurement now run on Sterling's software platform, giving the organisation one place to evaluate the providers its supply chain depends on and to manage what it buys from them.
Maintenance and downtime
Maintenance improved and downtime fell, which matters in an industry where an idle asset is costly and a failed one can be dangerous.
Safety
Early hazard identification, joined-up emergency response plans and a stronger safety culture reduced incidents and their consequences.
Looking back on the programme, its VP of operations said the company had fundamentally improved how it operates.
About ISO 29001
ISO 29001 is written for organisations that supply products and services to the petroleum, petrochemical and natural gas industries. It contains every requirement of ISO 9001:2015, reproduced unchanged, and adds sector requirements aimed at supply-chain risk. The current edition is ISO 29001:2020, with Amendment 1:2024 adding the consideration of climate change to the context clauses.
Several of those additions map directly onto the themes of this case, as the table shows. Certification to ISO 29001 is carried out by an independent certification body accredited for the standard. API Spec Q1 is a separate programme: registration to it comes from APIQR, API's own registrar, not from the body that certifies ISO 29001.
| Case theme | Where ISO 29001 addresses it |
|---|---|
| Supplier assessment | 8.4.2.1: performance of external providers assessed at planned intervals, with controls adjusted to the result |
| Maintenance | 7.1.3: documented maintenance processes, with methods, frequency, acceptance criteria and responsibilities defined |
| Hazards and risk | 6.1.3: a defined risk and opportunity process covering identification, analysis, evaluation and treatment |
How Sterling runs a programme like this
What follows describes how Sterling generally approaches an integrated oil and gas programme; it is not a description of this client's engagement.
Sterling has advised on management systems since 2003, with 8,100+ client engagements in 60+ countries and offices in 21 countries. Every programme starts with a gap analysis against each standard in scope, then the client chooses one of two alternative support levels. Under Design™, Sterling's expert and experienced consultants develop the system and the client implements it under their advice and supervision. Under Drive™, Sterling designs and builds the system under the client's approval, fully managed.
Either way, Effivity, used in 50+ countries, is included at no additional cost, so risks, suppliers, maintenance, audits and corrective actions are managed in one place from the start. The engagement also covers internal auditor training for your audit team, as applicable to your standard.
How Sterling supports oil and gas suppliers
One integrated system for quality, environment and safety
We build ISO 29001 and its companion standards with your people, prepare the evidence an auditor expects and stay with you through the independent certification audit. We ensure successful certification for our clients. The accredited certification body audits and decides.
Book a free discovery callISO 29001 for oil and gas suppliers: questions buyers ask
Is API Spec Q1 registration issued by the same body as an ISO 29001 certificate?
No. An ISO 29001 certificate is issued by a certification body accredited for that standard. API Spec Q1 registration is granted by APIQR, the American Petroleum Institute's registrar. An organisation holding both deals with two separate audit programmes, although one well-built management system can supply the evidence for each.
How does ISO 29001 expect an oil and gas supplier to assess its own providers?
It asks for the performance of external providers to be assessed at planned intervals and for controls to be adjusted in response, with the level of control linked to risk. Evidence that verification activities are effective must be retained, so a one-off approval list does not meet the requirement on its own.
What does ISO 29001 require for equipment maintenance?
Maintenance processes must be documented: what is maintained, the method and frequency, the testing methods and acceptance criteria, and who is responsible. For equipment used to deliver services, usage history and a list of critical spare parts are also expected, and the standard notes that risk-based maintenance approaches can be applied.
More ISO 29001 guides
Every guide in the ISO 29001 series is written for one question and links back to the hub for the whole picture.
- ISO 29001 requirements explained, clause by clause
- ISO 29001 certification process, step by step
- ISO 29001 certification cost: what moves the price
- ISO 29001 documented processes: the full list
- ISO 29001 internal audit: risk-based intervals and reporting
- ISO 29001 and ISO 9001:2026: what to ask your certification body
- ISO 29001 vs API Spec Q1 and Q2
- Effivity for ISO 29001: the guide
- ISO 29001 training: who needs what, and the evidence of competence
Keep exploring
Explore more about ISO 29001
Watch a video on how to implement ISO 29001 and API Spec Q1 here.
Watch a video on ISO 29001 requirements here.
Talk to a consultant
Plan your integrated ISO 29001 programme with confidence.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
hello@sterling-grc.com+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice