hello@sterling-grc.com +1 201 263 4443 New York ISO & GRC consulting in 60+ countries
SterlingInternational Consulting Talk to a consultantTalk to us
← ISO 29001 hub

ISO 29001 case study

ISO 29001 case study: quality, safety and supply chain for an oil and gas organisation

How an oil and gas organisation implemented ISO 9001, ISO 14001, ISO 45001, ISO 29001 and API Spec Q1 together to build a dependable supply chain, improve maintenance and reduce incidents in a demanding industry.

  • Updated September 2026
  • 5-minute read
  • Part of the ISO 29001 hub

Key points

  • An oil and gas organisation implemented five management system standards together: ISO 9001, ISO 14001, ISO 45001, ISO 29001 and API Spec Q1.
  • Its two aims were a supply chain it could depend on and strong safety performance in a demanding, high-risk industry.
  • Supplier assessment and procurement moved onto Sterling's software platform, maintenance improved, downtime fell, and incidents and their consequences were reduced.
  • ISO 29001 certificates come from accredited certification bodies and API Spec Q1 registration from API's own registrar; Sterling does not certify.

The organisation and what it needed

This ISO 29001 case study concerns an organisation working in oil and gas, an industry where a late part, an unplanned stoppage or a missed hazard carries consequences far beyond the site where it starts. The organisation stays anonymous here, as it does in Sterling's own case studies.

Two needs shaped the programme. The first was a dependable supply chain: confidence that what it bought, and the providers it bought from, would perform as expected. The second was strong safety performance in a complex industry. Both needs pointed to the same answer, a management system that treats quality, environment and safety as parts of one way of working.

What was implemented

The organisation implemented five standards as one programme:

  • ISO 9001, the quality management foundation.
  • ISO 14001, for environmental management.
  • ISO 45001, for occupational health and safety.
  • ISO 29001, the sector-specific quality management standard for suppliers to the petroleum, petrochemical and natural gas industries.
  • API Spec Q1, the American Petroleum Institute's quality specification for product manufacturers.

Within that programme, supplier assessment and procurement were moved onto Sterling's software platform, so that evaluating providers and buying from them ran through one system. Alongside this, the safety side of the system focused on identifying hazards early and on emergency response plans that were joined up across the organisation rather than written in isolation.

What changed

The results the organisation reported fall into three areas.

Supply chain

Supplier assessment and procurement now run on Sterling's software platform, giving the organisation one place to evaluate the providers its supply chain depends on and to manage what it buys from them.

Maintenance and downtime

Maintenance improved and downtime fell, which matters in an industry where an idle asset is costly and a failed one can be dangerous.

Safety

Early hazard identification, joined-up emergency response plans and a stronger safety culture reduced incidents and their consequences.

Looking back on the programme, its VP of operations said the company had fundamentally improved how it operates.

About ISO 29001

ISO 29001 is written for organisations that supply products and services to the petroleum, petrochemical and natural gas industries. It contains every requirement of ISO 9001:2015, reproduced unchanged, and adds sector requirements aimed at supply-chain risk. The current edition is ISO 29001:2020, with Amendment 1:2024 adding the consideration of climate change to the context clauses.

Several of those additions map directly onto the themes of this case, as the table shows. Certification to ISO 29001 is carried out by an independent certification body accredited for the standard. API Spec Q1 is a separate programme: registration to it comes from APIQR, API's own registrar, not from the body that certifies ISO 29001.

Case themeWhere ISO 29001 addresses it
Supplier assessment8.4.2.1: performance of external providers assessed at planned intervals, with controls adjusted to the result
Maintenance7.1.3: documented maintenance processes, with methods, frequency, acceptance criteria and responsibilities defined
Hazards and risk6.1.3: a defined risk and opportunity process covering identification, analysis, evaluation and treatment

How Sterling runs a programme like this

What follows describes how Sterling generally approaches an integrated oil and gas programme; it is not a description of this client's engagement.

Sterling has advised on management systems since 2003, with 8,100+ client engagements in 60+ countries and offices in 21 countries. Every programme starts with a gap analysis against each standard in scope, then the client chooses one of two alternative support levels. Under Design™, Sterling's expert and experienced consultants develop the system and the client implements it under their advice and supervision. Under Drive™, Sterling designs and builds the system under the client's approval, fully managed.

Either way, Effivity, used in 50+ countries, is included at no additional cost, so risks, suppliers, maintenance, audits and corrective actions are managed in one place from the start. The engagement also covers internal auditor training for your audit team, as applicable to your standard.

How Sterling supports oil and gas suppliers

One integrated system for quality, environment and safety

We build ISO 29001 and its companion standards with your people, prepare the evidence an auditor expects and stay with you through the independent certification audit. We ensure successful certification for our clients. The accredited certification body audits and decides.

Book a free discovery call

ISO 29001 for oil and gas suppliers: questions buyers ask

Is API Spec Q1 registration issued by the same body as an ISO 29001 certificate?

No. An ISO 29001 certificate is issued by a certification body accredited for that standard. API Spec Q1 registration is granted by APIQR, the American Petroleum Institute's registrar. An organisation holding both deals with two separate audit programmes, although one well-built management system can supply the evidence for each.

How does ISO 29001 expect an oil and gas supplier to assess its own providers?

It asks for the performance of external providers to be assessed at planned intervals and for controls to be adjusted in response, with the level of control linked to risk. Evidence that verification activities are effective must be retained, so a one-off approval list does not meet the requirement on its own.

What does ISO 29001 require for equipment maintenance?

Maintenance processes must be documented: what is maintained, the method and frequency, the testing methods and acceptance criteria, and who is responsible. For equipment used to deliver services, usage history and a list of critical spare parts are also expected, and the standard notes that risk-based maintenance approaches can be applied.

ISO 29001 implementation

ISO 29001 requirements

Get the document

We e-mail the document as a PDF link. Tell us who you are and where to send it.

A quick security check confirms the request comes from a person.

By requesting the document you agree to our privacy notice. Sterling uses these details to send it and to respond to your request. We never sell your data.

Talk to a consultant

Plan your integrated ISO 29001 programme with confidence.

Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.

hello@sterling-grc.com

+1 201 263 4443 (global headquarters) · your nearest office and its number are at the top of this page

What would you like to achieve?

Choose a starting point. The enquiry form takes about a minute.

Your goal
Book my free discovery call

Continue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice