I have recently taken on a part time position of Quality Manager at a small company that builds metal medical trays. The trays are held together with brackets and are used to contain medical tools for hospitals. The trays are FDA approved, but the company is not ISO certified. The owner would like to be ISO 13485 certified by the beginning of the year, to get additional business. From what I see, major organization is needed. They are a small company - 10 or so employees tops. The owner has been doing all the major ISO related work, but has not kept up on it. The company outsources almost everything! They provide specs for the metal parts to be cut, and then the parts arrive and they put them together, and ship them out. That's it. There is a lacking of documentation to say the least. When an order is prepared, all the parts are put on a movable cart. Nothing really stops someone from walking by and just grabbing one of the many pieces. The carts are identified with a single lot number. Nothing more. I think my biggest hurdle will be getting everyone to follow the process, as everyone just does what they do. They haven't done an internal audit in 2 years. How would you approach this challenge? What would you focus on first? Any comments are appreciated.