What to Build for UK Manufacturers Before the Next Audit

Published by CodeNicely, the product studio founded by Meghal Agrawal and Ujjwal Agrawal in 2017

For: Owner or COO of a UK mid-market manufacturer — 50 to 300 employees, ISO 9001 certified or pursuing it — whose ops still run on a mix of spreadsheets, paper job cards, and a 15-year-old MRP system that cannot produce a clean audit trail for a customer or HMRC on demand

If you are 50–300 people, ISO 9001 certified (or chasing it), and running on a 15-year-old MRP plus spreadsheets and paper job cards, do not start with an ERP replacement. Start with a digital job-card system that timestamps operator, machine, material batch and inspection against each production order. That single artefact closes the two clauses UK manufacturers lose most audit points on — 7.1.3 (infrastructure records) and 8.5.2 (traceability) — and it is the backbone every other system you build later will hang off.

The vendor pitches you are getting are wrong for your situation. A full ERP swap takes 12–24 months, costs into seven figures, and the Forterro study of 100 UK mid-market manufacturers found a single day of ERP downtime averages £41,888 — with 82% of respondents already switching, planning to, or considering it. You do not need that risk right now. You need to stop losing audit points and stop carrying uninsured traceability liability. Here is what to commission, in order.

The three operational holes that cost real money

Before the build list, name the gaps honestly. These are the ones an owner already feels every month.

1. You cannot answer a customer quality dispute in under two days

A customer rings about a batch that failed in their line. You pull paper job cards from the archive, cross-reference the inspector's logbook, chase the shift supervisor for which operator ran the cell on the 14th, and try to match it against a goods-in note for the steel coil. Two engineers lose a day and a half. You usually find the answer, but you cannot prove chain of custody to the customer's quality team, and they downgrade you on their vendor scorecard.

2. Your maintenance log is in an engineer's notebook

ISO 9001 Clause 7.1.3 asks for three specific things, per standard audit guidance: a defined maintenance plan, records that the plan was carried out, and a way to link equipment condition to any nonconformance that results. A notebook fails all three. iFactoryApp's 2026 audit checklist names 'no documented infrastructure maintenance plan' as the most common finding against 7.1.3 in manufacturing environments.

3. Your subcontractor and materials traceability is thin enough to be a liability

If a component you fitted gets recalled upstream, can you list every finished good it went into, which customer received them, and on what date? If the answer is 'given a week' — that is the liability. Balloon One's survey of 502 UK F&B manufacturers put the mean estimated cost of a serious recall at £545,249, with only 23.9% describing their traceability data as fully real-time. In engineered components the ceiling is far higher: Apex Insurance documented a West Midlands sub-assembly manufacturer (110 employees, £19m turnover, ISO 9001 and IATF 16949 certified) carrying ~£9.4m of pleaded liability from a single component recall — roughly half annual turnover.

Under IATF 16949, a Clause 8.5.2 traceability failure is a major nonconformance, which suspends your certification until closed (typically within 60 days) or results in withdrawal. If you supply automotive, that ends contracts.

What to build, in order

Build 1: A digital job-card and production record system

This is the one that pays for itself. It replaces paper job cards and the operator clipboard with a tablet (or rugged terminal) at each work cell. For every production order, it captures:

• Operator ID (badge scan or PIN)
• Machine/cell ID
• Start and stop timestamps per operation
• Material batch numbers consumed (barcode scan from the goods-in label)
• In-process inspection results (pass/fail, measurements, inspector ID)
• Any nonconformance raised, with photo and reason code
• Final QC sign-off before the part moves to dispatch

One queryable record per production order. That single data model is what an auditor wants for Clause 8.5.2, what a customer wants when they dispute a batch, and what a recall investigation needs on day one.

What changes once it exists: the two-day quality dispute becomes a five-minute query. Vendor scorecard improves. You stop paying a QA engineer to be a human database. And you now have real production data — cycle times by operator, scrap rates by material batch — which is what enables every later decision about automation or capacity.

What it is bad at: this is not an MES in the broad sense. It will not schedule your shop floor, optimise WIP, or do capacity planning. Do not let a vendor bundle those in on round one — scope creep here is what turns a 10-week build into a 10-month one.

What drives the cost and timeline: number of distinct work cells that need a terminal, how much of your existing MRP's part master and routing data can be re-used versus re-entered, whether your goods-in process already has barcoded batch labels (if not, that is a prerequisite), and how many inspection types need bespoke forms. A build covering one plant with ~15 work cells and a clean part-master export is a different scale of work from a four-site rollout with heterogeneous equipment.

Build 2: An asset and maintenance system that passes Clause 7.1.3

Once the job-card system is live, extend it — do not buy a separate CMMS. The same database already knows which machine ran which order. Add:

• An asset register with every production-critical machine, its criticality rating, and its maintenance plan (frequency, task list, responsible engineer)
• Preventive maintenance scheduling that generates work orders automatically
• Engineer sign-off on completion, with parts used and time taken
• Breakdown logging linked to the production order running at the time
• A simple dashboard showing plan adherence (% of scheduled PMs completed on time) — this is the number the auditor will ask for

What changes once it exists: you walk into the Clause 7.1.3 portion of the audit with three tabs open — the plan, the completion records, the link to any nonconformance. That is what the standard asks for, verbatim. GlobalReader's 2026 survey found half of manufacturers still make production decisions from paper, spreadsheets and manual logs — this is the population auditors are now actively targeting under the updated standard.

What it is bad at: it is not a condition-monitoring or predictive-maintenance platform. Do not try to bolt on vibration sensors and ML models in the same phase. Get the records right first; the predictive layer only becomes defensible once you have 12 months of clean breakdown and PM data to train against.

Build 3: Subcontractor and materials traceability chain

This is the one that caps your downside. Extend the same data model outward in two directions:

Upstream: every goods-in receipt tagged with supplier, supplier's batch/heat number, your internal batch ID, test certificates attached as scanned PDFs or structured data. Barcode on the pallet from the moment it arrives.

Downstream: every subcontracted operation (plating, heat treatment, special processes) logged against the production order with the subcontractor's job reference and their release certificate. Every finished good linked to its despatch note and customer order.

The query you need to be able to run: 'Given supplier batch X, list every customer who received a finished good containing it, and on what date.' If that query returns in seconds, you have ended an entire class of liability. The AIAG's 2024 recall cost study put the average total cost of a manufacturing product recall at ~€8.7m, with manufacturers who have end-to-end traceability cutting recall-related costs by up to 50%.

What it is bad at: it does not stop a recall happening. It bounds the cost when one does.

What NOT to build yet

• A full ERP replacement. If your current MRP handles purchase orders, stock, and invoicing adequately, leave it. Integrate the job-card system to it via overnight batch — not real-time — in phase one. The Forterro finding that 82% of UK mid-market manufacturers are reconsidering their ERP is a signal to wait, not rush.
• A customer portal. Tempting, but your customers are not asking for it loudly enough to justify the build before the audit exposure is closed.
• Shop-floor analytics dashboards. You have no clean data yet. Build the data capture first; the dashboards are two months of work on top of a working job-card system.
• AI anything. Same reason. AI on paper records is a demo, not a system. Earn the right to it by digitising the record first.

How to sequence it

Treat this as three phases, not three parallel projects. The job-card system is the foundation; the other two reuse its data model, its authentication, its tablets, and its database. Building them separately is how you end up with four quality systems that do not talk to each other — which is the problem you already have.

Phase 1 (job cards) should be scoped tight enough to go live on one production line first, prove the operator adoption, then roll out. Phase 2 (maintenance) can begin in parallel once the asset register is populated — the engineering team can do that data entry while Phase 1 is being built. Phase 3 (traceability) is mostly a matter of extending the schema and tightening the goods-in process; the hard part is supplier compliance (getting batch data on every delivery note), which is a procurement conversation, not a software one.

The headline constraint is people, not technology. Oxford Innovation Advice's October 2024 report surveyed 229 UK manufacturing SMEs and found nearly 85% want more funding for digital skills, with cost and lack of in-house knowledge named as the biggest barriers. Factor training and a shop-floor champion into every phase — the system an operator will not use is worth nothing on audit day.

On cost and timeline — the honest version

Every vendor will give you a number in the first meeting. Ignore it; they are guessing. What actually moves the number for a build like this:

• Number of work cells and sites. One plant with 15 cells is a different build from three plants with 60.
• State of your existing data. A clean part master and routing export from the current MRP saves weeks. A part master that lives half in the MRP and half in a storeroom spreadsheet adds them back.
• Integration depth with the current MRP. Overnight batch sync is straightforward; real-time bidirectional is an order of magnitude more work.
• Compliance scope. ISO 9001 alone is lighter than ISO 9001 + IATF 16949 + a customer-specific CSR (e.g. a tier-1 automotive quality requirement).
• Operator training and change management. Usually underestimated by half.

To turn a range into a real quote, three things need scoping: a walk of the shop floor to count cells and see the current paper flow, an export of the current MRP's part and routing data to assess re-usability, and a conversation with your QA lead about which clauses you have been dinged on in the last two audits. That is the input a serious partner — CodeNicely included — needs before putting a number in writing.

How CodeNicely can help

The pattern above — a core transactional system first, then extend the same data model outward rather than buying separate products — is exactly what we did for GimBooks, the YC-backed accounting SaaS for Indian SMBs. GimBooks' customers had the same problem shape as a UK mid-market manufacturer: existing tools (handwritten ledgers, in their case; paper job cards in yours) that were fine until compliance requirements tightened, and a legitimate fear that 'upgrading' meant a system too heavy for day-to-day use. We built the invoicing and record-keeping core first, kept it usable by a non-technical operator on a phone, and layered GST compliance, inventory and reporting on the same spine as separate modules — not separate products.

For a UK manufacturer, that translates to: digital job cards that a shift operator can actually use on a tablet, then maintenance records on the same database, then traceability on top — with your existing MRP left alone until you are ready. Full IP ownership, no vendor lock-in, and the system belongs to you after the engagement. If you are weighing this against a full ERP replacement, our SMB transformation practice and digital transformation hub are the right starting points.

Frequently Asked Questions

Do I need to replace my existing MRP system to pass the next ISO 9001 audit?

No. Auditors do not care what system the record lives in — they care that it exists, is complete, and links infrastructure, production and nonconformance. A job-card and maintenance system built alongside your existing MRP, integrated via overnight sync, closes the most common 7.1.3 and 8.5.2 findings without touching purchasing, stock or finance. Full ERP replacement is a separate decision with its own payback case.

How much does a custom factory operations build cost for a UK mid-market manufacturer?

The honest answer is that the range is wide and driven by cell count, site count, state of existing data, integration depth and compliance scope. A single-site, single-line pilot of a digital job-card system is a different scale of commitment from a multi-site rollout with real-time ERP integration and IATF 16949 scope. A serious estimate needs a shop-floor walk, a part-master export, and your last two audit reports. Avoid any vendor who quotes you a number in the first meeting — they are either lowballing to win the room or they will revise upward later.

Is off-the-shelf MES software a better option than a custom build?

Sometimes. If your processes are standard (e.g. discrete assembly with common inspection patterns) and your budget tolerates the licensing model, an off-the-shelf MES is faster to deploy. Custom becomes the right call when you have process specifics your competitors do not — bespoke inspection regimes, unusual subcontractor flows, a customer-specific quality requirement — or when total cost of ownership over five years matters more than time to first value. Most UK mid-market manufacturers end up with a hybrid: packaged software for the commoditised parts, custom for the parts that are genuinely yours.

How long before we see audit-ready records after starting a build like this?

The build timeline is one variable; the records themselves only become 'audit-ready' after you have accumulated enough history for an auditor to sample. In practice that means commissioning the system well before the audit window — not the month before — so that by audit day you have several months of operator entries, PM completions and traceability chains to show. The specifics depend on your audit cycle, which is a conversation to have with your certification body and your build partner together.

What happens if operators refuse to use the new system?

This is the single biggest risk, and it is not a software problem. The mitigations are: involve a respected shop-floor operator in the design from week one, keep the tablet interface to the minimum fields the audit actually requires (not the maximum fields the QA team would like), and run the first four weeks in parallel with paper before switching. Systems fail on the shop floor because they were designed by people who have never run a milling cell on a Tuesday afternoon. Build with operators, not for them.