What Is Rail Assurance?
A Guide for Businesses New to Rail
If your business is looking to work in the UK rail industry for the first time, you’ll quickly encounter terms such as rail assurance, supplier assurance, RISQS, competence management and rail compliance.
For businesses coming from construction, engineering or other regulated industries, many of the underlying principles may already be familiar. But the rail industry has its own requirements, standards and ways of demonstrating that suppliers are capable of delivering work safely and effectively.
This is where rail assurance comes in.
Put simply, rail assurance is the process of providing confidence that an organisation, its people and its systems are capable of managing the risks associated with the work it undertakes in the rail industry.
It isn’t one certificate, one audit or one set of documents. It is an ongoing process of demonstrating that the appropriate controls are in place — and that they actually work.
What Does Rail Assurance Mean in Practice?
Rail is a safety-critical industry. The consequences of inadequate processes, unsuitable products, poor competence management or uncontrolled risk can extend well beyond an individual contractor or project.
Rail organisations therefore need confidence in the businesses they engage.
For a supplier, that can mean demonstrating that you have appropriate arrangements covering areas such as:
- Health and safety
- Quality management
- Environmental management
- Employee and contractor competence
- Risk management
- Operational controls and procedures
- Supplier and subcontractor management
- Document and record control
- Incident management and learning
- Monitoring, auditing and continuous improvement
Exactly what is required will depend on what your organisation does, who you are supplying and the risks associated with your work.
A consultancy providing professional services will not necessarily face the same assurance requirements as a contractor undertaking safety-critical work on railway infrastructure.
That’s why one of the first steps for any business entering rail should be understanding which requirements actually apply to its activities.
Is Rail Assurance the Same as RISQS?
No. And this is an important distinction.
RISQS, the Railway Industry Supplier Qualification Scheme, is a major part of supplier assurance within the GB rail industry. It enables suppliers to demonstrate their capabilities and allows rail buyers to assess and identify suitable organisations.
But RISQS is not the entirety of rail assurance.
Depending on your business, client and activities, your assurance requirements could also involve management systems, industry or client standards, competence requirements, audits, product acceptance, specific contractual requirements and ongoing monitoring of your performance.
Some buyers also carry out their own assurance activities in addition to industry-wide supplier qualification schemes.
For example, a business may successfully complete the relevant RISQS process but still need to demonstrate compliance with the particular requirements of the organisation or contract it is working for.
Think of RISQS as one important component within a wider rail assurance framework, rather than the end of the journey.
If you’ve specifically been asked to obtain RISQS, read our guide to RISQS Accreditation: What You Need to Know.
Why Is Supplier Assurance So Important in Rail?
Supplier assurance is fundamentally about managing risk.
Rail organisations rely on large and complex supply chains. They need confidence that the companies supplying products, services and works have the capability to fulfil their responsibilities safely and consistently.
That means looking beyond whether a supplier can simply perform a technical task.
A buyer may also need assurance that the organisation has suitable management systems, employs competent people, understands its responsibilities, manages subcontractors effectively and can demonstrate that appropriate controls are being followed.
For businesses new to rail, this can be one of the biggest adjustments.
You may already be an experienced engineering or construction company with an excellent track record in another sector. That experience is valuable — but rail clients may still require you to demonstrate your capability against rail-specific assurance requirements.
What Does a Rail Assurance System Look Like?
There isn’t a single standard “rail assurance system” that every supplier can download and implement.
Your arrangements need to reflect your business, your activities and the requirements placed upon you.
However, an effective approach generally follows a continuous cycle:
Understand the requirements → establish appropriate controls → implement them → provide evidence → monitor performance → identify gaps → improve.
This distinction is important.
Rail assurance isn’t simply about having a collection of policies stored on a server.
An auditor or client may want to establish whether employees understand those policies, whether procedures are actually followed, whether competence is being maintained and whether the business reviews its performance and acts when something goes wrong.
The aim is to provide confidence that your systems work in practice, not just on paper.
Where Does RISQS Fit Into This?
For many businesses, RISQS will be their first significant encounter with formal rail supplier assurance.
RISQS uses the Railway Industry Commodity Classification List (RICCL) to classify the products and services supplied to the railway. The codes relevant to your activities help determine the supplier assurance requirements that apply.
Depending on the products or services you supply, these requirements can include verification or a formal audit.
This makes selecting the correct scope particularly important for businesses entering rail.
You can learn more in our guide to What Is the RISQS RICCL List?.
If you’re preparing for qualification, we’ve also explained The RISQS Certification Process and What’s in a RISQS Audit?.
Does Working for Network Rail Mean Additional Assurance Requirements?
Potentially.
Network Rail uses RISQS as part of its supplier qualification and assurance arrangements for relevant suppliers, but its requirements do not stop there.
Depending on the role your organisation performs, you may encounter Network Rail standards, contractual requirements and additional assurance processes.
For example, Network Rail has specific assurance arrangements for organisations undertaking Principal Contractor duties on its managed infrastructure. It also operates a product acceptance process for certain new or modified products, equipment and systems.
This illustrates why it’s important not to approach rail assurance as a checklist consisting simply of:
Get RISQS → pass audit → finished.
The requirements depend on what you are doing, where you are doing it and who you are doing it for.
We’re Already ISO Certified. Does That Mean We’re Rail-Ready?
Not necessarily — but it can give you a strong foundation.
Businesses entering rail may already hold certifications such as ISO 9001, ISO 14001 or ISO 45001 and have mature quality, environmental and health and safety management systems.
Those systems can provide much of the underlying structure needed for effective rail assurance.
However, ISO certification doesn’t automatically demonstrate that every rail-specific requirement relevant to your work has been addressed.
The sensible approach is therefore not to throw away what you already have and start again.
Instead, assess your existing management systems against the requirements associated with the rail work you intend to undertake and identify where additional controls, processes or evidence are needed.
For more on this relationship, see RISQS & ISO: Key Standards That Support Compliance and Audit Success.
Is Rail Assurance Just About Passing Audits?
No.
Audits are an important way of testing whether appropriate arrangements exist and are being implemented, but effective assurance should continue between audits.
Businesses change.
Employees join and leave. Competence requirements change. New suppliers are appointed. Procedures are updated. Legislation and industry requirements evolve. Companies take on different types of work.
A management system that was suitable when you passed an audit may not remain suitable indefinitely if nobody actively maintains it.
Strong rail assurance therefore involves ongoing monitoring and review rather than a rush to become compliant immediately before the next assessment.
This also makes businesses better prepared when clients request evidence, new opportunities arise or an audit is approaching.
What Does a Rail Assurance Consultant Do?
For companies with substantial internal rail compliance teams, much of this expertise may already exist within the organisation.
For SMEs and businesses entering rail for the first time, employing dedicated rail assurance or HSEQ personnel may not be practical.
An external rail assurance consultant can provide that expertise without the cost of building a full internal function.
Depending on the organisation, this might involve:
- Identifying the requirements associated with proposed rail activities
- Reviewing existing management systems
- Conducting gap assessments
- Supporting RISQS registration and audit preparation
- Developing or improving policies and procedures
- Supporting competence management
- Preparing teams for audits and client assessments
- Reviewing compliance as the business changes
- Providing ongoing rail assurance and HSEQ support
The objective shouldn’t be to create a compliance system that only the consultant understands.
Good assurance support should leave your organisation understanding its responsibilities, operating appropriate systems and able to demonstrate its own competence.
New to Rail? Start With What You’re Trying to Achieve
If you’re entering the rail industry, don’t start by collecting certificates or downloading policies.
Start with the opportunity.
Who do you want to work for? What will you supply? What work will you undertake? Where will that work take place?
Those answers determine the assurance requirements you need to investigate.
From there, you can assess what your business already has, identify what is missing and build a proportionate route towards becoming rail-ready.
If a client has already told you that RISQS is required, read A Client Has Told Us We Need RISQS. What Do We Do? for a step-by-step starting point.
Rail Assurance Support From Simpson Consultancy
Simpson Consultancy is a UK rail assurance specialist, supporting construction, engineering and supply-chain businesses with rail compliance, RISQS, management systems and ongoing assurance.
We work with businesses at different stages of their rail journey — from organisations exploring their first rail opportunity to established suppliers that need ongoing support maintaining compliance.
For companies new to rail, we can help you understand the requirements associated with the work you’re pursuing, assess your existing systems and establish a practical route towards becoming ready to operate within the rail supply chain.
And once you’re there, we can help you stay there.
If you’re considering entering the UK rail industry and aren’t sure what assurance requirements apply to your business, speak to Simpson Consultancy.
We’ll help you understand what you need, what you already have and what needs to happen next.
Need Support?
Ready to get started? Learn more about RISQS audit support here: https://simpsonconsultancy.co.uk/risqs/
Contact us today for a no-obligation consultation and let us help you achieve RISQS certification with confidence.
