Management System Gap Analysis Oakfield Property Services Ltd Industry: Residential construction, property maintenance and refurbishment Business size: 8 employees Location/operating area: West Midlands Assessment basis: Information supplied by the organisation Assessment scope: 25 management-system areas ________________________________________ 1. Executive Summary 1.1 Organisational context Oakfield Property Services Ltd is an owner-managed residential refurbishment, repair and maintenance business serving homeowners, landlords and small property management companies across the West Midlands. The business employs eight people and also uses specialist subcontractors. The organisation currently relies on a combination of: • Xero for accounting and invoicing. • WhatsApp for day-to-day staff communication. • Google Calendar for job scheduling. • Google Drive for quotations and customer documentation. • Basic quotation and invoice templates. • Project-specific health and safety risk assessments for larger projects. • Verbal communication of most staff responsibilities. The information supplied indicates that the business has established several useful operational tools. However, these tools do not yet form a fully defined or consistently controlled management system. 1.2 Overall conclusion Oakfield Property Services Ltd appears to operate through practical experience, direct owner oversight and informal working arrangements. This is common in small, owner-managed construction and maintenance businesses, but it creates increasing risk as workload, staffing levels, customer expectations and subcontractor use grow. The most significant confirmed weaknesses are: • No quality management process. • No business continuity plan. • No standard risk-assessment process for smaller jobs. • No formal employee handbook. • No documented staff induction process. • No supplier approval system. • No documented performance review system. • Staff responsibilities being communicated mainly verbally. There is also insufficient evidence to determine whether adequate systems exist for governance, recruitment, training, customer service, purchasing, information security, meetings, continuous improvement and several other areas. 1.3 Rating summary Rating Number of areas Percentage Complete 0 0% Partial 13 52% Missing 2 8% Insufficient Information 10 40% Total 25 100% No area has been rated Complete because the supplied information does not demonstrate that any system is fully defined, consistently implemented, monitored and reviewed. A rating of Insufficient Information does not necessarily mean that the area is weak. It means that the evidence supplied is not enough to determine whether an adequate system exists. 1.4 Principal risks The main potential risks arising from the confirmed weaknesses are: • Inconsistent identification and control of health and safety risks on smaller jobs. • Variable workmanship and inconsistent completion standards. • Unclear accountability between the owner, employees and subcontractors. • Inconsistent induction and supervision of new starters. • Engagement of suppliers or subcontractors without consistent checks. • Customer complaints or remedial work not being captured and analysed. • Loss of important operational or customer information. • Excessive dependence on the owner and individual employees. • Disruption following illness, loss of premises, loss of systems, equipment failure or other unexpected events. • Difficulty demonstrating due diligence to customers, insurers, regulators or commercial partners. 1.5 Recommended management-system approach The business does not require a large or highly bureaucratic system. A proportionate management framework should be developed around a small number of controlled processes, checklists and registers. The initial focus should be on: 1. Standardising health and safety assessment for all jobs. 2. Defining responsibilities and authority. 3. Introducing consistent job planning and completion controls. 4. Establishing subcontractor and supplier approval checks. 5. Introducing a basic induction and employee-information framework. 6. Protecting and controlling business information. 7. Establishing business continuity arrangements. 8. Measuring quality, customer outcomes and operational performance. Where recommendations touch on employment law, health and safety, data protection, tax, financial controls or contractual obligations, they are provided as general management guidance. Oakfield Property Services Ltd should obtain advice from appropriately qualified professionals where necessary. ________________________________________ 2. Assessment Method 2.1 Rating definitions Complete The information supplied demonstrates that an appropriate system is documented or clearly defined, implemented consistently, assigned to responsible people, monitored and reviewed. Partial Some relevant tools, practices or controls are present, but one or more important elements are absent, informal, inconsistent or undocumented. Missing The supplied information expressly confirms that no relevant system or process exists. Insufficient Information The supplied information does not establish whether a relevant system exists or whether it is adequate. 2.2 Evidence distinctions Each assessment distinguishes between: • Supplied information: Facts directly stated in the business description. • Confirmed findings: Conclusions directly supported by the supplied information. • Reasonable assumptions: Limited operational inferences that may be useful but are not treated as established facts. • Potential risks: Possible consequences of weaknesses; these are not statements that an incident has occurred. • Evidence limitations: Information required to confirm or revise the rating. ________________________________________ 3. Detailed Management System Assessment 3.1 Strategic Planning Rating: Insufficient Information Supplied information • The business is owner-managed. • It provides residential refurbishment, repair and maintenance services. • Work is mainly obtained through referrals, local advertising and repeat customers. Reason for rating No information has been supplied about: • Business objectives. • Growth plans. • Target markets. • Financial targets. • Capacity planning. • Investment priorities. • Succession planning. • Periodic strategic reviews. The information does not establish whether strategic planning takes place informally or through a documented process. Potential risks • Decisions may be reactive rather than aligned with agreed priorities. • Staffing and subcontractor capacity may not match future workload. • The business may accept work that is outside its preferred risk, capability or profitability profile. • Growth may increase pressure on the owner and existing systems. • Important long-term risks may not be addressed. Recommended improvements • Prepare a concise annual business plan covering: o Revenue and profitability objectives. o Preferred types of work. o Geographic coverage. o Staffing and subcontractor requirements. o Equipment and vehicle investment. o Key operational risks. o Management-system priorities. • Review the plan quarterly. • Define three to five measurable priorities for each year. • Record major strategic decisions and assigned actions. Further evidence required • Current business plan or objectives. • Financial and growth targets. • Management planning records. • Evidence of periodic strategy reviews. ________________________________________ 3.2 Leadership Rating: Partial Supplied information • The business is owner-managed. • Staff responsibilities are mostly communicated verbally. Reason for rating There is identifiable owner leadership, but responsibilities and expectations are mainly communicated verbally. The evidence does not demonstrate documented delegation, defined authority or a structured leadership process. Confirmed finding Responsibility communication is predominantly informal. Potential risks • Employees may be unclear about decision-making authority. • Tasks may be duplicated or omitted. • The owner may become a bottleneck for routine decisions. • Accountability may be difficult to establish when errors or delays occur. • Employees and subcontractors may receive inconsistent instructions. Recommended improvements • Produce a simple organisation chart. • Define the responsibilities of the owner and each principal role. • Identify who may: o Approve quotations. o Purchase materials. o instruct subcontractors. o Change job scope. o Agree additional work. o Confirm job completion. o Handle complaints. • Introduce short written role profiles. • Communicate standards through regular team briefings. • Record important decisions and changes to responsibilities. Further evidence required • Organisation chart. • Role descriptions. • Delegated authority limits. • Evidence of leadership meetings or staff briefings. ________________________________________ 3.3 Governance Rating: Insufficient Information Supplied information • The business is owner-managed. Reason for rating No evidence has been supplied about legal responsibilities, company decision-making, statutory records, insurance oversight, policy approval, delegated authority or periodic compliance review. Owner management alone does not establish whether governance arrangements are adequate. Potential risks • Important statutory or contractual obligations may not be assigned. • Decisions may not be adequately documented. • Insurance, licences, registrations or company records may not be reviewed systematically. • Excessive reliance may be placed on the owner’s personal knowledge. • Conflicts between commercial, safety and operational priorities may not be formally resolved. Recommended improvements • Create an annual governance and compliance checklist. • Define responsibility for: o Company filings. o Insurance renewals. o Tax and payroll oversight. o Health and safety arrangements. o Data protection. o Employment documentation. o Contract and customer-term reviews. • Record significant decisions affecting risk, finance, staffing and contractual commitments. • Review the adequacy of insurance with a qualified broker. • Obtain professional legal, accounting or compliance advice where required. Further evidence required • Company compliance calendar. • Insurance schedule. • Details of external professional advisers. • Evidence of statutory and contractual reviews. • Decision-making and approval arrangements. ________________________________________ 3.4 Human Resources Rating: Partial Supplied information • The business employs eight people. • There is no formal employee handbook. • Staff responsibilities are mostly communicated verbally. • There is no documented performance review system. Reason for rating The organisation employs staff and therefore must carry out some HR administration. However, confirmed gaps exist in employee guidance, documented responsibilities and performance review. The supplied information does not cover contracts, leave, absence, conduct, grievance, disciplinary arrangements or employee records. Confirmed findings • No formal employee handbook exists. • No documented performance review system exists. • Responsibilities are mainly communicated verbally. Potential risks • Employees may receive inconsistent information about workplace expectations. • Employment matters may be handled inconsistently. • Managers may have difficulty addressing conduct, attendance or performance issues. • The business may be unable to evidence fair and consistent treatment. • Employees may not understand reporting routes or basic workplace procedures. Recommended improvements • Develop a proportionate employee handbook covering: o Working hours. o Attendance and absence reporting. o Holidays. o Conduct. o Health and safety. o Use of vehicles, tools and equipment. o Confidentiality and information security. o Use of phones and messaging. o Grievance and disciplinary arrangements. o Equal opportunities and dignity at work. • Review employment contracts and HR procedures with a qualified employment adviser. • Create written role descriptions. • Introduce confidential personnel files with controlled access. • Establish annual or six-monthly employee reviews. Further evidence required • Employment contracts. • Holiday and absence records. • Payroll and personnel record arrangements. • Disciplinary and grievance procedures. • Evidence of right-to-work checks. • Data-retention arrangements for employee information. ________________________________________ 3.5 Recruitment Rating: Insufficient Information Supplied information • The business has eight employees. • It uses a mixture of employees and specialist subcontractors. Reason for rating No information has been supplied about recruitment planning, job descriptions, advertising, candidate selection, interview records, reference checks, right-to-work checks or trade-competence verification. Potential risks • People may be recruited without consistent competence checks. • Role expectations may be unclear. • Recruitment decisions may be inconsistent or poorly documented. • Required employment or eligibility checks may not be completed or retained. • The business may recruit individuals whose skills do not match the work. Recommended improvements • Introduce a recruitment checklist. • Use written role descriptions and minimum competence criteria. • Standardise: o Application information. o Interview questions. o Reference checks. o Right-to-work verification. o Licence and qualification checks. o Offer approval. • Retain recruitment records securely and only for an appropriate period. • Obtain employment and data-protection advice where necessary. Further evidence required • Recent recruitment records. • Job descriptions. • Interview and selection process. • Right-to-work procedures. • Reference and qualification checks. ________________________________________ 3.6 Staff Induction Rating: Partial Supplied information • There is no documented induction process. Reason for rating The absence of a documented process is confirmed. However, the information does not establish that no informal induction takes place. The area is therefore rated Partial rather than Missing. Confirmed finding There is no documented induction process. Potential risks • New starters may not receive consistent safety, quality or conduct information. • Important information may be overlooked. • Training and instructions may not be evidenced. • New employees may not know who has authority to assign or approve work. • Equipment, vehicle, customer-property or information-security expectations may be unclear. Recommended improvements Create a short induction checklist covering: • Employment documentation. • Role and responsibilities. • Reporting lines. • Health and safety arrangements. • Emergency contacts. • Accident and near-miss reporting. • Use of tools, vehicles and personal protective equipment. • Customer conduct and property protection. • Data protection and confidentiality. • Job scheduling and communication. • Quality and completion standards. • Required training and competence. • Employee acknowledgement and sign-off. Further evidence required • Description of any current informal induction. • Records for recent starters. • Safety briefings. • Training records. • Probation arrangements. ________________________________________ 3.7 Training Rating: Insufficient Information Supplied information No specific information has been provided about employee or subcontractor training. Reason for rating The evidence does not establish whether training needs are identified, competence is assessed, qualifications are checked or refresher training is controlled. Potential risks • Employees may undertake work without current competence. • Mandatory or task-specific training may expire unnoticed. • Workmanship and safety standards may vary. • Training may not reflect changing equipment, materials or regulations. • The business may be unable to demonstrate competence following an incident or complaint. Recommended improvements • Create a training and competence matrix. • Record: o Role. o Required skills. o Qualifications and cards. o Training completed. o Expiry dates. o Refresher requirements. • Assess practical competence, not only certificate possession. • Include subcontractor competence evidence where relevant. • Review training needs at induction and during performance reviews. • Seek competent health and safety advice when determining training required for particular work activities. Further evidence required • Training records. • Trade qualifications. • Competence assessments. • Training budget. • Refresher arrangements. • Expiry-date monitoring. ________________________________________ 3.8 Sales Rating: Partial Supplied information • Work is obtained through referrals, local advertising and repeat customers. • Basic quotation templates are in place. • Google Drive is used to store quotations and customer documents. • Xero is used for invoicing. Reason for rating There is an established route from enquiry to quotation and invoicing, supported by basic tools. However, no evidence has been supplied about enquiry recording, qualification, estimating controls, quotation approval, follow-up, conversion measurement, scope-change control or contract acceptance. Potential risks • Enquiries may be missed or not followed up. • Quotations may contain inconsistent assumptions or exclusions. • Work may be underpriced. • Verbal scope changes may cause disputes. • The business may not know which lead sources or job types are most valuable. • Commitments may be made without confirming capacity. Recommended improvements • Create a central sales and quotation register. • Record: o Enquiry date and source. o Customer. o Job type. o Site visit. o Quotation value. o Status. o Outcome. o Reason lost. • Standardise quotation content, including: o Scope. o Exclusions. o Assumptions. o Customer responsibilities. o Payment terms. o Validity period. o Change-control arrangements. • Require written customer acceptance before starting material work. • Introduce a written variation process for additional work. • Review conversion rate and average job value monthly. Further evidence required • Current quotation template. • Customer terms and conditions. • Enquiry records. • Pricing and estimating process. • Quotation approval arrangements. • Evidence of written scope acceptance. ________________________________________ 3.9 Marketing Rating: Partial Supplied information • Work is obtained through referrals, local advertising and repeat customers. Reason for rating The business uses identifiable marketing channels. However, the information does not demonstrate a defined marketing plan, target-customer profile, controlled budget, brand standards, lead-source analysis or measurement of marketing effectiveness. Potential risks • Marketing expenditure may not generate suitable work. • The business may depend excessively on referrals. • Demand may be unpredictable. • Marketing messages may attract work outside the business’s preferred scope or capacity. • Customer reviews and reputation may not be managed systematically. Recommended improvements • Define priority customer groups and preferred job types. • Prepare a simple annual marketing plan. • Record the source of every enquiry. • Review the cost and conversion rate of advertising channels. • Introduce a consistent process for requesting customer reviews. • Maintain accurate and consistent business information across directories and advertising. • Define who may approve public content and promotional claims. Further evidence required • Current advertising channels and expenditure. • Website and directory arrangements. • Lead-source data. • Customer review process. • Marketing objectives. ________________________________________ 3.10 Customer Service Rating: Insufficient Information Supplied information • The business receives repeat work. • It stores customer documents in Google Drive. • It communicates operationally through existing digital tools. Reason for rating Repeat work may suggest positive customer relationships, but it does not demonstrate that a defined customer-service system exists. No information has been supplied about customer communication standards, complaint handling, appointment confirmation, satisfaction measurement, warranties or remedial work. Reasonable assumption Some customer communication must take place to arrange and complete work. Its consistency and adequacy cannot be established. Potential risks • Customers may receive inconsistent updates. • Complaints may not be recorded or resolved consistently. • Commitments made verbally may not be evidenced. • Recurring customer concerns may not be identified. • Responsibility for remedial work may be disputed. Recommended improvements • Define minimum customer communication stages: o Enquiry acknowledgement. o Site visit confirmation. o Quotation issue. o Start-date confirmation. o Delay or change notification. o Completion confirmation. o Invoice and aftercare. • Create a complaints and remedial-work log. • Establish response and escalation expectations. • Collect brief post-completion feedback. • Record warranties or guarantees accurately without making unsupported commitments. Further evidence required • Customer communication examples. • Complaint records. • Customer satisfaction information. • Warranty or guarantee terms. • Process for defects and remedial work. ________________________________________ 3.11 Operations Rating: Partial Supplied information • Google Calendar is used for scheduling jobs. • WhatsApp is used for daily staff communication. • Google Drive stores quotations and customer documents. • Risk assessments are completed for larger projects. • There is no standard risk-assessment process for smaller jobs. • Staff responsibilities are mainly communicated verbally. • The business uses employees and specialist subcontractors. Reason for rating Several basic operational tools are in place, but the system appears fragmented. There is no evidence of a standard job-control process covering planning, mobilisation, site information, materials, variations, completion and handover. Confirmed findings • Scheduling and day-to-day communication use digital tools. • Smaller jobs do not follow a standard risk-assessment process. • Responsibilities are mainly communicated verbally. Potential risks • Job information may be incomplete or spread across several systems. • Staff may attend sites without clear scope, materials or instructions. • Changes may not be authorised or priced. • Customer commitments may not be communicated to the delivery team. • Job completion may not be checked consistently. • Subcontractor work may not be integrated or supervised adequately. Recommended improvements Introduce a standard job-management workflow: 1. Enquiry recorded. 2. Site survey completed. 3. Scope and quotation approved. 4. Job risk and requirements assessed. 5. Labour and subcontractors assigned. 6. Materials ordered. 7. Customer start date confirmed. 8. Daily or milestone updates recorded. 9. Variations authorised. 10. Completion inspection completed. 11. Customer sign-off obtained where appropriate. 12. Invoice issued. 13. Defects, feedback and lessons recorded. Use a unique job number across Calendar, Drive, Xero and operational records. Further evidence required • Current scheduling method. • Examples of job packs. • Job handover arrangements. • Variation controls. • Completion and snagging process. • Subcontractor coordination arrangements. ________________________________________ 3.12 Purchasing Rating: Insufficient Information Supplied information No specific purchasing process has been described. Reason for rating The information does not establish how materials, tools, equipment or services are requested, approved, ordered, received, checked or matched to supplier invoices. Potential risks • Unauthorised or duplicate purchases. • Incorrect materials arriving on site. • Project delays due to late ordering. • Materials being charged to the wrong job. • Margin loss where purchase costs are not linked to quotations. • Inadequate control of returns, credits or faulty goods. Recommended improvements • Establish a proportionate purchasing procedure. • Define who may order and approve purchases. • Use job numbers on purchase records. • Set spending-authority limits. • Record: o Supplier. o Item. o Quantity. o Agreed price. o Job. o Order date. o Delivery status. • Check delivered materials against the order. • Match invoices to orders or receipts before payment. • Track returns and supplier credits. Further evidence required • Current ordering method. • Approval limits. • Purchase records. • Invoice-matching controls. • Materials-return process. ________________________________________ 3.13 Suppliers Rating: Partial Supplied information • The business uses specialist subcontractors. • There is no supplier approval system. Reason for rating Suppliers and subcontractors are used, but there is no formal approval system. The supplied information does not confirm that no checks take place at all, so the broader area is rated Partial rather than Missing. Confirmed finding There is no supplier approval system. Potential risks • Suppliers or subcontractors may be engaged without consistent checks. • Insurance, qualifications or trade competence may not be current. • Poor performance may recur because it is not recorded. • The business may become responsible for resolving subcontractor defects. • Customer, safety or data-protection obligations may not be communicated down the supply chain. • The employment status of individuals may be misunderstood. Recommended improvements Create an approved supplier and subcontractor register covering: • Contact and business details. • Services or trades supplied. • Insurance evidence. • Qualifications or competence. • References or previous experience. • Health and safety information. • Agreed terms. • Data-protection or confidentiality requirements where relevant. • Performance history. • Approval and review dates. Introduce subcontractor work orders defining scope, price, timing, standards and responsibility for defects. Seek professional advice on insurance, contractual terms, tax status and employment-status considerations where appropriate. Further evidence required • Supplier and subcontractor list. • Insurance certificates. • Qualification records. • Current agreements. • Payment and tax-status arrangements. • Past supplier-performance information. ________________________________________ 3.14 Finance Rating: Partial Supplied information • Xero is used for accounting and invoicing. • Basic quotation and invoice templates exist. Reason for rating A recognised accounting platform and basic financial documents are in use. However, no evidence has been supplied about budgeting, cash-flow forecasting, management accounts, margin review, credit control, payment approval, bank reconciliation, payroll controls or financial authority limits. Potential risks • Cash-flow shortages may not be identified early. • Job profitability may be unclear. • Overdue debts may not be followed up consistently. • Costs may not be allocated accurately to projects. • Payments may be made without adequate review. • The business may focus on revenue without understanding margin. Recommended improvements • Produce a rolling 13-week cash-flow forecast. • Review monthly: o Revenue. o Gross margin. o Overheads. o Cash position. o Debtors. o Creditors. o Work in progress. • Track estimated versus actual job costs. • Introduce a documented credit-control routine. • Set approval rules for payments, refunds, credits and write-offs. • Maintain regular bank reconciliations. • Review financial controls with the company’s accountant or qualified financial adviser. Further evidence required • Management accounts. • Cash-flow forecasts. • Debtor and creditor reports. • Bank-reconciliation arrangements. • Payment approval process. • Job-costing information. • Accountant’s responsibilities. ________________________________________ 3.15 Risk Management Rating: Partial Supplied information • Health and safety risk assessments are completed for larger projects. • There is no standard process for smaller jobs. • No business continuity plan exists. • No supplier approval system exists. Reason for rating Risk assessment takes place in a limited context, but it is not consistently applied to all jobs. There is no evidence of a broader business-risk register or periodic risk review. Confirmed findings • Larger projects receive health and safety risk assessments. • Smaller jobs do not follow a standard process. • Confirmed weaknesses also exist in business continuity and supplier approval. Potential risks • Hazards on smaller jobs may be underestimated. • Commercial, financial, operational and information risks may not be considered systematically. • Risk controls may depend on individual judgement. • Changes in site conditions or scope may not trigger reassessment. • Significant risks may not have assigned owners. Recommended improvements • Create a simple business-risk register. • Cover: o Health and safety. o Workforce availability. o Subcontractors. o Finance and cash flow. o Customer disputes. o Quality. o Vehicles and equipment. o Cyber and data loss. o Supply disruption. o Owner dependency. • Assign an owner, control and review date to each significant risk. • Introduce a proportionate job-risk screening process for every job. • Escalate higher-risk work to a more detailed assessment. • Review risks quarterly and after significant incidents. Further evidence required • Existing risk assessments. • Insurance claims or incident history. • Commercial risk controls. • Contract review process. • Evidence of risk reviews. ________________________________________ 3.16 Health & Safety Rating: Partial Supplied information • Health and safety risk assessments are completed for larger projects. • There is no standard process for smaller jobs. • The organisation undertakes construction, repair and maintenance work. • The workforce includes employees and specialist subcontractors. Reason for rating A health and safety control is present for larger projects, but it is not standardised across all work. No evidence has been provided about the wider health and safety management arrangements. Confirmed finding Smaller jobs are not covered by a standard risk-assessment process. Potential risks • Routine jobs may contain hazards that are not formally identified. • Control measures may differ between employees. • Subcontractor activities may not be coordinated. • Site-specific hazards may not be communicated. • Accident, ill-health, enforcement, insurance or civil-liability exposure may increase. • The business may be unable to demonstrate consistent risk management. Recommended improvements As an immediate priority: • Introduce a job-risk screening checklist for every job. • Define when a detailed risk assessment and method statement is required. • Record site-specific hazards before work begins. • Confirm required competence, equipment and personal protective equipment. • Include subcontractor activities in planning. • Establish clear arrangements for: o Accident and near-miss reporting. o First aid. o Emergency response. o Equipment inspection. o Hazardous substances. o Manual handling. o Work at height. o Electrical safety. o Asbestos awareness and management where relevant. o Customer and public protection. • Obtain advice from a competent health and safety professional to confirm applicable requirements and proportionate controls. Further evidence required • Health and safety policy or arrangements. • Existing risk assessments and method statements. • Accident and near-miss records. • Equipment inspection records. • Training and competence evidence. • Personal protective equipment arrangements. • Subcontractor coordination process. • Evidence of competent health and safety advice. ________________________________________ 3.17 Information Security Rating: Insufficient Information Supplied information • WhatsApp is used for daily staff communication. • Google Calendar is used for scheduling. • Google Drive stores quotations and customer documents. • Xero is used for accounting and invoicing. Reason for rating The business relies on cloud-based and messaging systems, but no information has been supplied about access controls, password security, multi-factor authentication, backup, device management, staff access removal, data sharing or cyber-incident response. Potential risks • Customer or financial information may be accessed without authority. • Information may remain available to former employees or subcontractors. • Business operations may be disrupted by account loss or cyberattack. • Personal data may be shared through inappropriate channels. • Important records may be deleted or overwritten. • The organisation may have difficulty responding to a personal-data incident. Recommended improvements • Complete an information-security and data-protection review. • Enable multi-factor authentication on business systems. • Use named user accounts rather than shared credentials. • Define access according to role. • Remove access promptly when a person leaves. • Introduce password and device-security rules. • Confirm backup and recovery arrangements. • Define which information may be shared through WhatsApp. • Maintain an incident-reporting process. • Review privacy notices, retention arrangements and data-processing responsibilities with a qualified data-protection adviser where necessary. Further evidence required • User-access lists. • Multi-factor authentication status. • Backup arrangements. • Device ownership and security controls. • Privacy notices. • Data-retention schedule. • Information-sharing practices. • Cyber-insurance arrangements. • Data-breach response process. ________________________________________ 3.18 Quality Management Rating: Missing Supplied information • There is no quality management process. Reason for rating The supplied information expressly confirms the absence of a quality management process. Confirmed finding No quality management process exists. Potential risks • Workmanship standards may vary between employees and subcontractors. • Customer requirements may not be translated into clear job standards. • Defects may only be identified after handover. • Snagging and remedial costs may increase. • Repeat issues may not be analysed. • The business’s reputation and referral-based sales may be affected. • Responsibility for inspecting and accepting work may be unclear. Recommended improvements Introduce a practical quality-control framework: • Define minimum workmanship and customer-property protection standards. • Use a pre-start job checklist. • Confirm materials and customer requirements. • Identify inspection points for higher-risk work. • Introduce completion and snagging checklists. • Record customer approval or completion acknowledgement where appropriate. • Log defects, complaints and remedial work. • Review subcontractor quality. • Analyse recurring issues and corrective actions. • Store quality records under the relevant job number. A formal certification standard is not necessarily required. The immediate need is a consistent and evidenced method of planning, checking and improving work. Further evidence required The absence is confirmed. Further information would be required to design the system, including: • Types of work undertaken. • Common defects or callbacks. • Existing informal inspection practices. • Warranty arrangements. • Responsibility for final inspection. • Customer acceptance arrangements. ________________________________________ 3.19 Performance Measurement Rating: Insufficient Information Supplied information • There is no documented performance review system. • Xero is used for accounting and invoicing. • Work is obtained through referrals, advertising and repeat customers. Reason for rating A documented employee-performance review system is confirmed as absent. However, performance measurement is broader and may include financial, customer, sales, quality and operational measures. The supplied information does not establish whether these are monitored. Confirmed finding No documented employee-performance review system exists. Potential risks • The business may not identify declining productivity, quality or profitability. • Employee expectations may remain unclear. • Good performance may not be recognised. • Training needs may not be identified. • Management decisions may rely on anecdotal information. • Recurring delays, defects or cost overruns may not be visible. Recommended improvements Introduce a small performance scorecard containing measures such as: • Enquiries received. • Quotation conversion rate. • Revenue and gross margin. • Average debtor days. • Jobs completed on time. • Estimated versus actual job cost. • Customer complaints. • Defects or callbacks. • Health and safety incidents and near misses. • Customer feedback. • Training completion. • Subcontractor performance. Introduce structured employee reviews at least annually, supported by shorter check-ins. Further evidence required • Existing management reports. • Financial and job-performance measures. • Informal employee-review arrangements. • Productivity or time records. • Complaint and defect data. ________________________________________ 3.20 Continuous Improvement Rating: Insufficient Information Supplied information No specific continuous-improvement process has been described. Reason for rating The evidence does not establish whether lessons from jobs, complaints, defects, incidents or financial results are captured and used to improve the business. Potential risks • The same problems may recur. • Improvements may depend on the owner remembering individual events. • Employees may not be involved in solving operational problems. • Corrective actions may not be assigned or followed through. • Opportunities to improve margin, customer service or safety may be lost. Recommended improvements • Create an improvement log. • Record: o Issue or opportunity. o Source. o Root cause where appropriate. o Action. o Owner. o Due date. o Completion evidence. o Effectiveness review. • Discuss lessons learned during regular operational meetings. • Review complaints, defects, near misses and cost overruns. • Prioritise a small number of improvements at a time. Further evidence required • Examples of changes made following problems. • Complaint and defect reviews. • Lessons-learned discussions. • Corrective-action records. ________________________________________ 3.21 Document Control Rating: Partial Supplied information • Google Drive stores quotations and customer documents. • Basic quotation and invoice templates are in place. Reason for rating A central digital storage platform and standard templates exist. However, the evidence does not demonstrate version control, approval, ownership, naming conventions, access restrictions, review dates or withdrawal of obsolete documents. Potential risks • Staff may use outdated quotation, checklist or policy versions. • Documents may be duplicated or difficult to locate. • Unauthorised changes may be made. • Important templates may not be reviewed. • Customer information may be stored inconsistently. • The source of approved instructions may be unclear. Recommended improvements • Create a controlled folder structure. • Introduce standard file naming and job numbers. • Maintain a master document register. • Record: o Document title. o Owner. o Version. o Approval date. o Review date. o Location. • Restrict template editing to authorised people. • Archive or withdraw obsolete versions. • Clearly separate templates, live records and archived information. Further evidence required • Current Google Drive structure. • Sharing permissions. • Template versions. • Existing naming conventions. • Document approval arrangements. ________________________________________ 3.22 Record Management Rating: Partial Supplied information • Google Drive stores quotations and customer documents. • Xero is used for accounting and invoicing. • Google Calendar is used for scheduling. Reason for rating Business records are created and stored across several systems. However, no evidence has been provided about completeness, retention, disposal, backup, access, retrieval or responsibilities for record keeping. Potential risks • Records may be incomplete or spread across systems. • Evidence required for disputes, warranties, tax, employment or safety matters may not be retrievable. • Personal information may be retained longer than necessary. • Records may be deleted accidentally. • Different employees may store records inconsistently. Recommended improvements • Define which records must be retained for each job. • Create a retention schedule covering: o Quotations and contracts. o Job records. o Variations. o Customer communications. o Completion and quality records. o Financial records. o Employee records. o Health and safety records. o Supplier and subcontractor evidence. • Assign responsibility for record completeness. • Define secure disposal arrangements. • Confirm legal retention requirements with qualified legal, accounting, employment and data-protection advisers as appropriate. Further evidence required • Current retention practices. • Backup and recovery arrangements. • Archive structure. • Access permissions. • Record-disposal process. ________________________________________ 3.23 Meetings Rating: Insufficient Information Supplied information • WhatsApp is used for daily staff communication. • Staff responsibilities are mostly communicated verbally. Reason for rating No information has been supplied about regular management, operational, safety or staff meetings. WhatsApp communication does not establish whether structured meetings take place. Potential risks • Priorities and changes may not be communicated consistently. • Decisions and actions may not be recorded. • Problems may remain unresolved. • Employees may receive fragmented instructions. • Strategic and operational issues may be mixed together without clear ownership. Recommended improvements Introduce a proportionate meeting rhythm: • Weekly 20–30 minute operations meeting. • Monthly business-performance review. • Quarterly strategy and risk review. • Job-specific pre-start meetings for larger or higher-risk work. • Short safety briefings or toolbox talks where appropriate. Record decisions, actions, owners and due dates rather than producing lengthy minutes. Further evidence required • Current meeting arrangements. • Examples of agendas or notes. • Attendance and action-tracking practices. • Toolbox-talk arrangements. ________________________________________ 3.24 Communication Rating: Partial Supplied information • WhatsApp is used for daily staff communication. • Google Calendar is used for scheduling jobs. • Staff responsibilities are mostly communicated verbally. Reason for rating Active communication channels exist, but important instructions and responsibilities appear to depend heavily on verbal or instant-message communication. The evidence does not demonstrate communication rules, escalation routes or control of significant decisions. Potential risks • Instructions may become lost in message threads. • Employees may work from incomplete or outdated information. • Important decisions may not be transferred into job records. • Personal and business communications may become mixed. • Sensitive customer information may be shared inappropriately. • Verbal instructions may create disputes about scope or responsibility. Recommended improvements • Define what each communication channel should be used for. • Require significant job instructions, variations and approvals to be stored in the job record. • Use Google Calendar for confirmed scheduling rather than informal messages alone. • Define urgent escalation routes. • Establish expectations for response times and out-of-hours messages. • Avoid storing critical business knowledge only in individual phones or chats. • Include communication responsibilities in role descriptions and induction. Further evidence required • Current WhatsApp practices. • Use of personal or business devices. • Examples of job instructions. • Customer communication channels. • Escalation arrangements. ________________________________________ 3.25 Business Continuity Rating: Missing Supplied information • There is no business continuity plan. Reason for rating The supplied information expressly confirms that no business continuity plan exists. Confirmed finding No business continuity plan exists. Potential risks • Operations may stop if the owner is unavailable. • Job information may be inaccessible following account, device or system failure. • Customers may not be informed consistently during disruption. • Payroll, supplier payments and invoicing may be delayed. • Key supplier, subcontractor, vehicle or equipment failure may interrupt work. • Recovery may depend on individual knowledge rather than an agreed plan. Recommended improvements Prepare a concise business continuity plan covering: • Owner or key-person absence. • Emergency contact and delegation arrangements. • Access to Xero, Google systems and essential passwords. • Loss of phone, laptop or internet access. • Data backup and recovery. • Vehicle or critical equipment failure. • Loss of a key supplier or subcontractor. • Severe weather or site-access disruption. • Customer and employee communications. • Payroll and payment continuity. • Insurance contacts. • Priority jobs and recovery sequence. Test at least one scenario annually and record lessons learned. Further evidence required The absence of a plan is confirmed. To develop it, the business should identify: • Critical activities. • Key-person dependencies. • Essential systems and records. • Recovery-time requirements. • Alternative suppliers and subcontractors. • Insurance coverage. • Emergency-access arrangements. ________________________________________ 4. Priority Matrix Priority reflects the potential seriousness and urgency of the weakness, based only on the supplied information and reasonable risk considerations. It does not indicate that an incident or breach has occurred. 4.1 Critical priorities Recommendation Relevant areas Basis for priority Introduce a standard job-risk screening process for every job, with escalation to detailed assessments where necessary Risk Management; Health & Safety; Operations The supplied information confirms that smaller jobs do not follow a standard risk-assessment process. Construction and maintenance work can involve hazards regardless of job value or duration. Confirm wider health and safety arrangements with a competent professional Health & Safety; Training; Suppliers Wider arrangements, competence controls and subcontractor coordination have not been evidenced. Qualified advice may be required to determine applicable duties and controls. Define emergency delegation and immediate continuity arrangements Business Continuity; Leadership; Governance No business continuity plan exists, and the business is owner-managed. This creates potential dependency on the owner and key systems. 4.2 High priorities Recommendation Relevant areas Basis for priority Introduce quality-control, snagging and completion checks Quality Management; Operations; Customer Service No quality management process exists. The business depends significantly on referrals and repeat customers. Establish supplier and subcontractor approval controls Suppliers; Purchasing; Health & Safety; Quality No supplier approval system exists despite the use of specialist subcontractors. Document roles, responsibilities and authority Leadership; Governance; Human Resources; Operations Responsibilities are mainly communicated verbally. Implement a documented induction checklist Staff Induction; Human Resources; Health & Safety; Information Security No documented induction process exists. Review information security, access, backups and use of WhatsApp Information Security; Record Management; Communication Several cloud and messaging systems are used, but no security controls have been evidenced. Introduce formal variation and job-scope control Sales; Operations; Finance; Customer Service Existing quotation templates provide a starting point, but no change-control process has been evidenced. Develop a basic business continuity plan Business Continuity; Risk Management The plan is confirmed as missing. 4.3 Medium priorities Recommendation Relevant areas Basis for priority Develop a proportionate employee handbook and review employment documentation Human Resources; Governance No formal employee handbook exists. Professional employment advice may be required. Establish training and competence records Training; Recruitment; Health & Safety; Suppliers No training system has been evidenced. Create a central sales and quotation register Sales; Marketing; Finance Sales tools exist, but performance and follow-up controls have not been evidenced. Introduce purchasing approvals and job-linked purchasing records Purchasing; Finance; Operations No purchasing process has been described. Establish document and record controls in Google Drive Document Control; Record Management; Information Security Digital storage exists, but formal controls have not been evidenced. Introduce a complaints, defects and remedial-work log Customer Service; Quality Management; Continuous Improvement No formal customer-service or improvement process has been evidenced. Establish a concise performance scorecard Performance Measurement; Finance; Sales; Quality No broad performance-measurement process has been demonstrated. Introduce structured employee reviews Human Resources; Performance Measurement; Training No documented performance review system exists. Introduce weekly operational and monthly performance meetings Meetings; Communication; Leadership Communication currently relies substantially on WhatsApp and verbal instructions. 4.4 Low priorities Recommendation Relevant areas Basis for priority Prepare an annual strategic plan Strategic Planning Important for longer-term direction, but immediate operational and safety controls should be addressed first. Formalise marketing planning and channel measurement Marketing; Sales Marketing channels already exist, although their effectiveness is not evidenced. Develop a mature continuous-improvement process Continuous Improvement Improvement controls should follow the introduction of basic quality, performance and issue-recording systems. Consider formal management-system certification only after core processes are embedded Quality; Governance; Continuous Improvement Certification is not currently necessary to address the confirmed operational gaps. ________________________________________ 5. Capvern Action Plan 5.1 Immediate Actions — Next 7 Days 1. Assign management-system ownership The owner should appoint a named person responsible for coordinating the improvement programme, even if the owner retains final accountability. 2. Introduce an interim job-risk screening checklist Apply a short checklist to every new and active job, covering: • Site access. • Occupants and members of the public. • Work at height. • Electrical risks. • Hazardous substances. • Manual handling. • Tools and equipment. • Structural or hidden-service risks. • Asbestos-related considerations where relevant. • Required competence and personal protective equipment. • Need for a more detailed risk assessment or method statement. The checklist should be reviewed by a competent health and safety adviser. 3. Confirm current-job responsibilities For every active job, record: • Job lead. • Employees and subcontractors assigned. • Customer contact. • Agreed scope. • Key dates. • Materials required. • Safety requirements. • Who may approve changes. • Who will complete the final inspection. 4. Protect access to critical systems Immediately review access to: • Xero. • Google Drive. • Google Calendar. • Business email. • WhatsApp groups or business accounts. Enable multi-factor authentication where available and remove access that is no longer required. 5. Create an emergency contact and delegation sheet Record: • Who takes control if the owner is unavailable. • Access arrangements for critical systems. • Accountant, insurer and key supplier contacts. • Current jobs and customer contacts. • Payroll and payment responsibilities. • Immediate customer-communication arrangements. Do not record passwords insecurely on the sheet. 6. Create controlled folders and job numbers Assign a unique job number to each current and future job. Use the same reference in Google Drive, Calendar, quotations, invoices, purchase records and customer communications. 7. Record current suppliers and subcontractors Create an initial register listing: • Services provided. • Contact details. • Current jobs. • Insurance status. • Qualification or competence evidence held. • Information still required. 8. Start an issues log Record all open: • Customer complaints. • Snags and defects. • Remedial visits. • Safety issues. • Supplier problems. • Overdue quotations. • Overdue customer payments. Assign an owner and due date to each item. ________________________________________ 5.2 Medium-Term Improvements — 30–90 Days 1. Implement a standard job-management process Develop a simple process from enquiry through to completion and invoicing. Support it with practical checklists rather than lengthy procedures. 2. Introduce quality controls Create: • Pre-start checklist. • Job-specific quality requirements. • Inspection points. • Completion and snagging checklist. • Customer handover or completion record. • Defect and remedial-work log. 3. Implement supplier and subcontractor approval Obtain and review appropriate evidence before approval. Define the work each supplier or subcontractor is authorised to perform. 4. Introduce written roles and delegated authority Prepare: • Organisation chart. • Role profiles. • Purchasing limits. • Quotation approval limits. • Variation approval rules. • Complaint-escalation responsibilities. 5. Develop a documented induction process Use a checklist and retain signed completion records. 6. Establish a training and competence matrix Include employees and regular subcontractors where relevant. Record qualification and refresher dates. 7. Review employee documentation Develop or review: • Employee handbook. • Employment contracts. • Absence and holiday procedures. • Conduct, grievance and disciplinary arrangements. • Confidentiality and information-security requirements. • Performance-review process. Obtain qualified employment-law advice before implementation. 8. Strengthen sales and contract controls Update quotation templates and customer terms to address: • Scope. • Exclusions. • Payment terms. • Programme assumptions. • Customer responsibilities. • Variations. • Delays. • Completion. • Defects and aftercare. Obtain qualified legal advice before relying on revised contractual terms. 9. Implement financial management reporting Review monthly: • Revenue. • Gross margin. • Cash position. • Debtors. • Creditors. • Job profitability. • Work in progress. • Expected cash commitments. 10. Introduce formal communication routines Establish: • Weekly operational meeting. • Monthly performance review. • Recorded actions. • Rules for storing important instructions outside WhatsApp. 11. Establish record and document controls Create: • Folder structure. • Naming convention. • Document register. • Retention schedule. • Template approval and review process. • Access-control procedure. 12. Develop a business continuity plan Document and test the arrangements for owner absence, system loss, data loss, supply interruption and other material disruptions. ________________________________________ 5.3 Strategic Development — 3–12 Months 1. Establish an annual strategic planning cycle Agree: • Growth objectives. • Target customers. • Preferred job profile. • Profitability expectations. • Staffing and subcontractor capacity. • Investment needs. • Principal risks. • Improvement objectives. 2. Introduce an integrated management scorecard Track a small set of relevant financial, customer, operational, quality, people and safety measures. 3. Develop employee performance and development reviews Link reviews to: • Role expectations. • Quality of work. • Customer conduct. • Safety. • Productivity. • Attendance. • Training. • Development goals. 4. Establish systematic customer feedback Measure satisfaction, complaints, referrals and repeat business. Use findings to improve job delivery. 5. Improve job costing and profitability analysis Compare: • Quoted labour and materials. • Actual labour and materials. • Subcontractor costs. • Variations. • Remedial costs. • Final margin. 6. Formalise risk and governance reviews Conduct quarterly reviews of: • Business risks. • Insurance. • Legal and regulatory obligations. • Financial controls. • Health and safety. • Information security. • Business continuity. • Supplier performance. 7. Embed continuous improvement Use data from defects, complaints, near misses, cost overruns and customer feedback to select and track improvement projects. 8. Review management-system maturity After the core controls have operated for several months, assess whether additional formalisation or external certification would provide commercial value. Certification should be driven by customer, tender, risk or growth requirements rather than treated as an end in itself. ________________________________________ 6. Information Gaps and Further Questions The following evidence is required to validate the assessment and determine whether any Insufficient Information or Partial ratings should be revised. 6.1 Strategic Planning • Are annual revenue, profit or growth objectives set? • Is there a written business plan? • Which types of work and customers are most profitable or strategically preferred? • Are staffing, vehicles, equipment and subcontractor capacity planned? • Is succession or owner absence considered? 6.2 Leadership and Governance • Is there an organisation chart? • Who has authority to approve quotations, purchases, payments and variations? • Who takes control when the owner is unavailable? • What statutory and compliance obligations are tracked? • Which advisers support the business? • How are important management decisions recorded? • What business insurance is held, and how is its adequacy reviewed? 6.3 Human Resources and Recruitment • Are written employment contracts in place? • How are holidays, sickness and attendance managed? • Are grievance and disciplinary arrangements documented? • How are right-to-work checks completed and retained? • Are references and qualifications checked before employment? • Is probation used? • How are employee records secured and retained? • Have worker and subcontractor employment-status arrangements been professionally reviewed? 6.4 Induction and Training • What information is currently given to new starters? • Is any informal induction recorded? • What trade qualifications and safety training are held? • How are training-expiry dates monitored? • How is practical competence assessed? • What training is required for specific tools, equipment and job types? • Are subcontractor qualifications checked? 6.5 Sales and Marketing • How are enquiries recorded? • How are quotations priced, checked and approved? • Are written customer terms used? • How are verbal or written variations controlled? • Are deposits or staged payments used? • What proportion of quotations is accepted? • Which marketing channels generate enquiries and profitable work? • How are customer reviews requested and managed? 6.6 Customer Service • How are appointments, delays and completion dates communicated? • Is there a complaints process? • Are complaints, defects and remedial visits recorded? • Are customer satisfaction and repeat-business rates measured? • What warranties or guarantees are offered? • How are disputes escalated? 6.7 Operations • Is a job file or job pack created for every job? • How is work handed from quotation to delivery? • How are labour, materials and subcontractors scheduled? • How are daily instructions recorded? • How are scope changes approved? • Who inspects completed work? • Is customer sign-off obtained? • How are keys, property access and site security managed? 6.8 Purchasing and Suppliers • Who may place orders? • Are spending limits defined? • Are purchase orders used? • How are deliveries checked? • How are materials assigned to jobs? • Are supplier invoices matched to orders or receipts? • What insurance and competence checks are completed for subcontractors? • Are written subcontractor terms used? • Is supplier performance reviewed? 6.9 Finance • Are monthly management accounts prepared? • Is a cash-flow forecast maintained? • How often are bank accounts reconciled? • Who approves payments? • How are overdue invoices followed up? • Is job profitability measured? • How are payroll and subcontractor payments controlled? • What responsibilities are performed by the accountant or bookkeeper? 6.10 Risk Management and Health & Safety • Is there a health and safety policy or documented arrangements? • What criteria determine whether a risk assessment is required? • Are method statements used? • Are accidents and near misses recorded? • What equipment inspections are completed? • How are hazardous substances controlled? • How are work-at-height risks managed? • How is asbestos risk considered before intrusive work? • Who provides competent health and safety advice? • How are employees and subcontractors briefed on site-specific risks? • What emergency and first-aid arrangements exist? 6.11 Information Security and Data Protection • Are multi-factor authentication and named user accounts enabled? • Are personal or shared devices used? • Who can access customer, employee and financial information? • How is access removed when someone leaves? • Are systems backed up? • Has data recovery been tested? • What customer information is shared through WhatsApp? • Is there a privacy notice? • Are personal-data incidents recorded and managed? • Is cyber insurance held? 6.12 Quality and Continuous Improvement • How is workmanship currently checked? • Are completion or snagging checklists used informally? • What defects or callbacks occur most frequently? • Who decides whether work is acceptable? • How is subcontractor work inspected? • Are lessons from complaints or errors discussed? • Are corrective actions assigned and followed up? 6.13 Performance Measurement • Which financial and operational measures are currently reviewed? • Are job duration, labour hours and material costs compared with estimates? • Are quotation conversion, complaints, defects or customer satisfaction measured? • Do employees receive informal feedback? • How are poor performance and development needs addressed? 6.14 Documents, Records, Meetings and Communication • How is Google Drive structured? • Who owns and approves templates? • Are older versions removed? • What records must be held for every job? • Are retention periods defined? • Are records backed up? • What meetings take place? • Are decisions and actions recorded? • Are staff using personal WhatsApp accounts and phones? • How are important messages transferred into permanent job records? 6.15 Business Continuity • Which activities must continue without the owner? • Who has emergency access to systems and records? • What would happen if Google, Xero, telephone or internet access were lost? • Are alternative suppliers and subcontractors available? • How would payroll and payments continue? • How quickly must critical operations be restored? • What insurance support is available after a serious disruption? • Have any continuity scenarios previously occurred, and what was learned? ________________________________________ 7. Final Conclusion Oakfield Property Services Ltd has a practical foundation consisting of recognised accounting, scheduling, communication and document-storage tools. These arrangements support current activity but are not yet integrated into a consistent management framework. The greatest immediate value will come from strengthening controls around: • Health and safety. • Job planning and completion. • Quality. • Roles and authority. • Staff induction and competence. • Suppliers and subcontractors. • Information protection. • Business continuity. The recommended approach is proportionate formalisation rather than excessive documentation. A small set of clearly owned processes, checklists, registers and review meetings should materially reduce operational dependence on verbal communication and individual memory. The assessment should be reviewed when the information gaps have been addressed. Several areas currently rated Insufficient Information may already have informal controls that were not described, while some Partial ratings may require further action once current practices are examined in detail.