Implementing ISO 55001:2024, in what order

There is a specific moment when an organisation decides it needs an asset management function. Usually something has forced it. A regulator, an auditor, a reporting deadline, a tender that asked a question nobody could answer.

The first thing the organisation does is obtain the standard. The question it asks of the standard is what does this require. The question that determines whether the function turns out to be useful is a different one, and the standard declines to answer it.

What ISO says about its own order

ISO 55001 was revised in July 2024. The second edition cancels and replaces the 2014 edition, and it says this in its introduction:

The order in which requirements are presented in this document does not reflect their importance nor imply the order in which they are to be implemented.

That sentence is easy to read past. It should not be. It means the document that defines the requirements is explicitly refusing to sequence them, and sequence is the entire problem facing an organisation building the thing from nothing.

The refusal is correct on its own terms. A standards committee writing for every organisation of every size in every sector cannot know whether the reader is a water utility with a century of records or a development company that took delivery of its first completed asset last year. Prescribing an order would be prescribing a context. ISO declined, and it was right to.

But the consequence is real. An organisation reading the clauses in numerical order and implementing them in that order will produce something that satisfies an assessor and does very little else. The clauses are a specification for a finished system. They are not a route to one.

What "establishing it right" now means

The second edition changed enough that advice written against the 2014 edition is no longer safe. ISO lists the main changes itself, and four of them alter what a new function has to do on day one.

Asset management decision-making is now a requirement. Clause 4.5 is entirely new, with three parts: a framework, criteria, and methods, processes and tools. An organisation must now document how asset decisions get made and who is entitled to make them. This is the requirement an organisation is most likely to fail first, because what it asks for usually exists only as habit.

The strategic asset management plan has its own clause. In the 2014 edition the SAMP was referred to in several places without ever being gathered into one requirement. It is now Clause 6.2.1.

Data and information were revised, and knowledge is new. The 2014 contents put information requirements at 7.5 and documented information at 7.6; the 2024 contents put documented information at 7.5 and data and information at 7.6. ISO/TC 251 lists 7.6 as revised and says the revision clarifies how data and information differ and makes the requirements clearer and more concise. Clause 7.7, knowledge, is among the new subclauses ISO's foreword lists.

Preventive action became predictive action. Clause 10.3 was renamed and, in ISO's own words, fully technically revised. The question moved from whether to intervene to when, which is a different discipline requiring condition data most organisations do not collect.

Read together, these are not editorial tidying. They are the standard moving towards decisions and data and away from documentation, and they change what a function established in 2026 should look like compared to one established in 2016.

How many organisations have actually done this

ISO publishes an annual count of valid certificates by country and by standard, in the ISO Survey. From 2025 the survey is compiled from IAF CertSearch, the global database of accredited management system certifications, where the dataset can be downloaded free of charge on registration. Anybody who wants the number can obtain it at source, and should, rather than take it from a page like this one.

This article does not use it, because a certificate count measures certification, not asset management practice. An organisation can operate a competent, standards-aligned asset management system and never certify it, and many do, because certification costs money and answers a question nobody has asked them. The converse is also true: a certificate demonstrates that a system was conforming on the day it was assessed, which is not the same as a system that changes decisions.

What the field's own federation says a certificate does not show

What can be said without any count is narrower and firmer. An organisation adopting ISO 55001 now will find very little settled precedent to copy, because there is not much to copy yet. The second edition is barely two years old. Four of the supporting documents in the family, covering financial alignment, public policy, competence and data, were published alongside it in July 2024. Most of the implementation advice in circulation still describes the 2014 structure, which no longer matches the standard it claims to explain.

An organisation starting now is early rather than late, and it will be working from the standard itself more than from anybody else's example.

Why the pressure is arriving in Saudi Arabia now, and from an unusual direction

Elsewhere, asset management adoption has generally been driven by regulators of utilities, by safety regimes, or by the operating cost of ageing networks. In Saudi Arabia a different mechanism is doing the work.

The Saudi Ministry of Finance describes High Order No. 13059 of December 2016 as approving the move of all government entities from cash to accrual accounting. The standards applied are the Saudi public sector accounting standards, which the Ministry adopts and which are based on IPSAS. Accrual accounting obliges an entity to recognise, value and depreciate the assets it controls. To do that, it must first establish what it controls, where those assets are and what condition they are in.

That is an accounting reform. Its practical effect is to require the core dataset of an asset management system, and to tie it to the annual financial statements.

The register is the precondition

The organisations affected are also, in many cases, the organisations that spent the last decade delivering. They were built to procure and construct, and are now becoming organisations that own. An asset management function established under those conditions inherits an asset base it did not specify, records it did not commission, and a reporting obligation it did not design.

What the inheritance costs

The order the dependencies require

If the standard will not sequence the requirements, something has to, and the honest way to do it is to derive the order from what each requirement needs in order to be answerable at all.

This is the ordering this publication uses. It is not ISO's, it is not endorsed by ISO, and the reasoning is set out so it can be argued with.

The chain runs like this. You cannot state a scope until you know what the organisation is for and who depends on it, so context precedes scope. You cannot write decision criteria until the scope tells you which decisions are yours, so 4.5 follows 4.3. A policy is a statement of intent about decisions, so it follows the criteria rather than preceding them, which reverses the usual instinct to write the policy first because it is the easiest document to produce. The strategic asset management plan converts that intent into a plan, so it needs the policy. Objectives are drawn from the plan. Risk and opportunity are assessed against the objectives, because a risk is only a risk relative to something you are trying to achieve.

The standard says its clause order implies no order of implementation. This is the order the dependencies imply, and it is this publication’s own.

014.1, 4.2Context and stakeholdersNothing. This is the floor.
024.3, 4.4Scope of the systemRequires context, to know what is inside it.
034.5Decision-makingRequires scope, to know which decisions are yours.
045.2PolicyRequires criteria, or it declares intent about nothing.
056.2.1The SAMPRequires policy, which it converts into a plan.
066.2.2ObjectivesDrawn from the plan.
076.1Risk and opportunityRequires objectives. A risk is only a risk relative to one.
087.2CompetenceRequires knowing what the system asks people to do.
097.6Data and informationRequires 4.5, to know which decisions the data serves.
108OperationExecution of a plan that now exists.
119Performance evaluationRequires something to evaluate against.
1210.3Predictive actionRequires operating history to predict from.

Nothing here is in the standard. The clauses are, and the order is ours, argued from what each requirement needs before it can mean anything.

FIG. 01The twelve requirement groups in the order their dependencies allow. Clause references are ISO's; the ordering is this publication's, and ISO states in the introduction to ISO 55001:2024 that its own clause order implies no order of implementation.

Then the supporting clauses, which are conventionally treated as administrative and are the point at which most systems quietly fail. Competence requirements can only be determined once you know what the system asks people to do. Data requirements can only be specified once you know which decisions the data serves, which is why Clause 7.6 has to come after 4.5 and not, as most implementations have it, at whatever point the software is procured.

Only then does operation mean anything, because operational control is the execution of a plan that now exists. Performance evaluation requires something to evaluate against. Improvement, and in particular predictive action, requires enough operating history to predict from.

What follows

The parts of this series each take one group of requirements and treat it as a complete subject: what the clause asks for, what changed in 2024, what it looks like when it has been done to satisfy an assessor rather than to work, and what it costs to build properly.

They are placed across the four stages of the lifecycle rather than gathered into one, because the requirements do not all bite in the same place. Decision-making and the SAMP shape what gets built and belong at inception. Competence and externally provided services bite during delivery. Data and knowledge are tested at handover. Operational control, evaluation and predictive action belong to the operating life.

Each part also names the assurance domain that later tests whether the thing was built as described, because a management system nobody examines is a filing convention.

There is one more reason to be deliberate about the order. A function established badly is harder to fix than one not yet established, since the second has no sunk cost, no incumbent process and nobody whose credibility is attached to the current arrangement. The organisations now standing these functions up under reporting pressure have exactly one opportunity to do it in a sensible order, and that pressure is pushing hard in the other direction.

Sources. ISO 55001:2024, Asset management, Asset management system, Requirements, second edition, July 2024, prepared by ISO/TC 251, ISO standard 83054. Clause structure, the list of main changes and the quoted sentence are taken from the introduction and foreword as published by ISO. ISO 55000:2024 provides the vocabulary and overview. Further guidance referred to by ISO 55001 is published as ISO 55002, ISO/TS 55010 on the alignment of financial and non-financial functions, ISO 55011 on public policy, ISO 55012 on people involvement and competence and ISO 55013 on the management of asset data. Certificate counts by country and by standard are published in the ISO Survey, compiled from 2025 onwards from the IAF CertSearch database and downloadable there free of charge on registration. No count is used in this article, because a certificate count measures certification rather than practice. The Saudi Ministry of Finance's accounting standards page describes the transition to accrual accounting as approved by High Order No. 13059 of December 2016, and describes the Saudi public sector accounting standards as based on IPSAS.

ISO 55001 tells you what to build. It will not tell you what to build first