Standards and compliance systems according to your industry

The right compliance system depends on the company's activities, processes and risks. A restaurant, a factory, a hotel, a wholesale pharmaceutical wholesaler and a logistics company do not have the same obligations or the same control points. ISO 9001, ISO 14001, HACCP and GDP should therefore be chosen and implemented according to the actual business, and not according to a universal package of documentation.

Companies often start with the name of the standard. It may be in the wrong order.

First you need to understand the business, legal requirements, customer expectations and process risks. Only then can it be determined which system has a real business or regulatory purpose.

Otherwise, a firm may receive a large number of procedures and still have weak controls where they are most needed.

Activity determines which system has the highest value

ISO standards such as ISO 9001 and ISO 14001 can be applied to organizations of different sizes and sectors. ISO 9001:2026 regulates the quality management system, while ISO 14001:2026 provides a framework for managing environmental impacts.

HACCP and GDP have a different context.

For food businesses, we align HACCP implementation with the Law on Food Safety (59/2026), the Law on Official Controls (72/2026), the Food Hygiene Regulation (91/2026) and other applicable 2026 rules, alongside requirements aligned with the EU framework. GDP rules and the supervision of CInMED play a special role in the distribution of medicines. ISO standards have a different, voluntary function: they help an organization systematically manage quality or environmental impact.

There are specific regulatory obligations for food and drug distribution. That is why the choice of system should not be reduced to the question of which certificate the company wants.

A practical choice looks like this:

One company may need multiple systems.

It is then more efficient to connect common processes than to maintain separate structures that repeat each other.

HACCP for restaurants must function during a full shift

The restaurant works with a large number of raw materials, short deadlines and frequent changes during the day.

That's why the HACCP system must be easy to use in the kitchen, warehouse and receiving of goods.

Control usually includes hygiene, food intake, temperature regimes, storage, preparation, heat treatment and prevention of cross-contamination.

A system that exists only on paper represents a special risk.

If the chef or the person receiving the goods does not know what he is controlling and how to react to a deviation, the amount of documentation does not solve the problem.

In 2026, Montenegro adopted a new Law on Food Safety, while the Regulation on Food Hygiene regulates requirements for facilities, equipment, water, waste, heat treatment, personal hygiene, training and food transport.

For a restaurant, therefore, HACCP should be built according to the actual menu, equipment and food flow.

HACCP for hotels must cover many different processes

The hotel can have a restaurant, buffet, banquet kitchen, room service, bar, warehouse and several places for food preparation.

This increases the number of points where deviation can occur.

Seasonal business brings additional complexity.

A large number of new employees in a short period of time requires clear instructions, distribution of responsibilities and practical training.

The system should therefore be adapted to each relevant zone, but without creating different rules for the same risk.

Common procedures can regulate reception, hygiene, cleaning and storage. Special controls then monitor the processes that differ between the main kitchen, buffet or banquet preparation.

Thus, HACCP remains reviewed even with a large volume of work.

Factories need a system that connects quality and production

An industrial company often considers ISO 9001 first.

The standard is applicable to organizations of all sizes and sectors and governs the processes required for consistent product or service quality. The current version of ISO 9001:2026 was published in September 2026.

For the factory, this can mean clearer control:

• customer requirements;
• procurement and suppliers;
• production process;
• measuring and control equipment;
• non-compliant products;
• complaint;
• maintenance of competences;
• corrective measures;
• quality indicators.

The value is not in the certificate itself.

Value is created when management can see where the process is deviating, how much the deviation costs, and what action removes the cause.

Industrial plants often link ISO 9001 and ISO 14001

The production process can simultaneously have quality requirements and significant impacts on the environment.

Then ISO 14001 complements the quality system.

ISO 14001:2026 regulates the systemic management of environmental aspects, resource use, waste and other relevant impacts. A new version was released in April 2026.

A company does not have to maintain two completely separate structures.

ISO systems use a compatible framework, so it is possible to link documentation, internal audits, risks, objectives, competencies and management reviews.

Specific controls, however, remain separate.

Product quality control does not have the same goal as waste or resource consumption control.

For wholesalers, GDP is part of the basic regulatory system

For wholesale distribution of medicines, we use the current Law on Medicines (Official Gazette Nos. 14/26 and 94/26) and CInMED GDP guidelines published on 22 July 2026. The scope of support follows the authorisation, actual flow of medicines and state of the quality system.

Drug distribution requires a different approach than general logistics.

In Montenegro, legal and natural persons who carry out the wholesale trade of medicines must act according to the Guidelines of Good Practice in the distribution of medicines for human use. CInMED issues a GDP certificate when the prescribed conditions are met.

GDP includes much more than warehouses.

The system connects the responsible person, suppliers, customers, receiving, storage, temperature monitoring, transport, deviations, CAPA, complaints, returns and withdrawal of medicines.

That is why a generic quality system is not enough.

The process must follow the specific pharmaceutical products, storage conditions and method of distribution.

GDP transport must maintain the same conditions as storage

Transport is not a gap between two controlled spaces.

It is part of the distribution process.

If the drug requires defined conditions, the organization must know how to maintain and prove them from the warehouse exit to the customer's receipt.

The risk depends on the product, route, transport time, external conditions and equipment.

Therefore, the control method is not determined only by the type of vehicle.

An assessment of the actual transport process is required.

If the company uses an external carrier, contracting the service does not remove the need for process quality control.

Logistics companies should first determine what they actually store

Not every warehouse needs GDP.

Storage of furniture, food products and medicines have completely different risks.

That's why the term "quality system for logistics" is not precise enough by itself.

ISO 9001 can help a logistics company manage receiving, storage, picking, delivery, claims and performance measurement.

If the business includes medicines within the framework of regulated distribution, special GDP requirements appear.

If it involves food, food safety and hygiene requirements become relevant.

First, the object of storage is determined. Then the system is selected.

For service companies, ISO 9001 regulates what is hard to see

With the service, the customer often cannot physically inspect the product before purchasing.

Quality depends on the process.

It can be the speed of the response, the accuracy of the information, the deadline for implementation, the method of handling complaints or consistency between employees.

ISO 9001 is therefore not intended only for factories.

The standard also provides a framework for service organizations, regardless of size or sector.

A good implementation first maps the user's journey through the service.

Only then are the controls and indicators that have real value determined.

More standards do not necessarily mean more administration

A company may simultaneously have quality, environmental and sector-specific requirements.

The worst approach is for each new system to have its own procedures for activities that already exist.

Then employees keep two or three records for the same event.

An integrated approach brings together common elements.

A single documentation control can support multiple systems. The same applies to competencies, internal audits, corrective measures and part of risk management.

Special requests remain where they really need to be special.

The result is less duplication and clearer accountability.

A legal obligation and a customer request are not the same thing

A company may introduce a particular system for a number of reasons.

One reason is the law or sector regulation.

Another can be a tender, a request from a large customer, a contract with an international partner or an internal rule of the group.

ISO 9001 is a voluntary international standard and certification according to it is not mandatory in itself.

There are special regulatory obligations in Montenegro regarding HACCP in the food business and GDP in the wholesale trade of drugs.

This difference affects the priority of the project.

The regulatory requirement must first be properly identified. A commercial standard can then be added when it brings business value.

The most common mistake is choosing a standard before risk analysis

A company sometimes requests an ISO certificate because a competitor has it.

That is not a good enough reason to choose the system.

First, you need to determine what result the organization wants.

If the problem is uncontrolled service quality, ISO 9001 may be a logical direction.

If production creates significant environmental aspects, ISO 14001 may have greater operational value.

If the company works with food or distributes medicines, sector requirements must be part of the initial analysis.

ConsultHQ therefore ties the initial assessment to the activity, processes and regulatory context, and not just to the name of the standard.

An initial assessment determines the right path to compliance

The first step can be a brief overview of the business.

It is necessary to determine the activity, locations, products or services, key processes, existing documentation and requirements of customers or competent authorities.

After that, it is determined what the company really needs.

For one company, the result can be HACCP implementation. For another ISO 9001, ISO 14001 or integrated system.

Wholesalers will have a different priority and GDP requirements.

Thus, the project starts with a concrete risk and business goal, instead of a package of documents that may not correspond to the activity.