Is There a Right Way and Wrong Way to do ISO (or AS)?

Yes — but obviously this is controversial.

The most common issue or mistake with ISO systems is the structure of the documentation.  One approach is to structure documentation around the ISO standard.  One document is written for each requirement of the standard until all of the requirements are “explained” in a document.  This approach is very effective at meeting the requirements of the standard and is easy to “boilerplate” – which is why some consultants are comfortable with this approach.  The resulting documents don’t provide much additional value as they really only describe the standard and thus aren’t much use for improvement or even straightforward management.  Because the documentation and the processes it described doesn’t have much meaning to the organization, the documents are often ignored and thus as things change in the organization, documentation doesn’t get updated and problems occur with certification.  This approach usually requires constant and deliberate management to keep ISO registered.

An alternative approach is the “process approach” which is advocated by ISO itself.  In this approach, documented procedures are written that describe the activities in the organization.  These documents are actually quite useful as they clarify the right way of doing things and can be used for review and improvement.   The documents become a tool through which the business is organized and operated.  Maintenance is not a chore but a natural part of what is done.

These two extremes are easy to understand and one is described above as clearly better than the other.  However, it is very difficult to achieve a process based system.  What should I include in the procedure?  What level of detail?  How and where do I get the requirements?  Should the requirements from one section be in one procedure?  What if requirements seem inapplicable?  It is also true that in smaller organizations the benefits to be obtained from any ISO system are less substantial than they are in a larger organization.  Consequently the ease of implementation and simple acknowledgment of the expected maintenance effort are easy to accept as a price for certification.

If you are using a consultant you should demand a process based system.  Before contracting get them to describe and commit to that approach.  If you attempting ISO alone and you are a small organization (very small 1-5 people and not real expectation of growth) then you have more options.