System Certification

ISO 19650 BIM Governance: Public Tender Pre-Qualification & Information Audits

ISO 19650 BIM Governance

Introduction

A contractor can have a skilled modelling team, expensive software and a portfolio of award-winning buildings, and still lose a public tender at the pre-qualification stage.

The question on the form is rarely "do you use BIM?" It is "how do you manage information, who controls it, and can you prove it?" ISO 19650 is the international answer to that question, and clients increasingly want evidence rather than assurances.

Tip: Review your last project to verify information management ownership, approved model location and release authorization are clearly documented and consistent.


Mandatory BIM Adoption for Infrastructure Tenders

  1. Governments and public clients in many countries now state BIM or information management requirements in tender documents for buildings and infrastructure, and the UK was an early example with its Level 2 BIM requirement for centrally procured projects from 2016.

  2. Requirements are increasingly framed around ISO 19650 rather than national specifications, since the standard is international and replaced the older UK BS 1192 and PAS 1192 family.

  3. Infrastructure owners such as rail, highways, water and airport authorities often set their own information requirements on top of the standard.

  4. Pre-qualification questionnaires typically ask for evidence of information management capability, named roles, tools and previous project experience.

  5. Some tenders ask for certification or independent verification, while others accept a documented self-assessment, so the exact ask must be read for each procurement.

  6. Rules change, so teams should confirm the current requirement for the jurisdiction and client rather than relying on last year's tender.


Managing Information Across Asset Lifecycles

  1. ISO 19650-1 sets out concepts and principles for information management using building information modelling.

  2. ISO 19650-2 covers the delivery phase of assets, from appointment through design and construction to handover.

  3. ISO 19650-3 covers the operational phase, so information produced during delivery remains useful for those who run the asset.

  4. Other parts address security-minded approaches and health and safety information.

  5. An Asset Information Model supports operation and maintenance, while a Project Information Model is developed during delivery.

  6. Information requirements should be defined by purpose: why the client needs each piece of data, and when.

  7. Handover is where many projects lose value, when models are delivered in formats the operator cannot use.

  8. Clients increasingly judge suppliers on what happens after practical completion, not only before it.


Scrutinizing Common Data Environments (CDE)

  1. Information should move through defined states, commonly work in progress, shared, published and archive, with approval gates between them.

  2. Naming, classification and metadata conventions should be set in advance and applied consistently.

  3. Roles and permissions need to match the appointment structure, so people see what they should and nothing more.

  4. Version control must show who changed what and when, with the ability to find the approved version on any date.

  5. Suitability codes or status markers should tell users what a file may be used for.

  6. Audit trails and access logs should be available and not routinely deleted.

  7. Exchange with partners using different platforms needs a clear rule on which environment is authoritative.

  8. Backup, retention and archive arrangements should survive the end of the project.

Takeaway: A CDE is judged on its governance, not its brand. A modest system with enforced rules beats a premium platform where anyone can upload anything.


Delivery Plans vs Employer Requirements

Document

Purpose

Owner

Common weakness

Organizational information requirements

The client's information needs tied to its business objectives

Appointing party

Written once and never linked to project decisions

Asset information requirements

What data the client needs about the asset for operation

Appointing party

Too generic, or demanding data nobody will use

Project information requirements

What information is needed at each project stage

Appointing party

Vague deliverables and unclear levels of information need

Exchange information requirements

Requirements issued in the tender to suppliers

Appointing party

Inconsistent with the contract, or contradicted by later instructions

Pre-appointment BIM execution plan

The supplier's proposed approach, capability and resources

Prospective supplier

Copied from a previous bid with little project specifics

Post-appointment BIM execution plan

Confirmed plan after award

Lead appointed party

Not updated when scope, team or software changes

Task information delivery plan

Who delivers what information, in which format and by when

Each task team

Dates do not match the programme

Master information delivery plan

Combined schedule across all task teams

Lead appointed party

Out of date and not used for progress reporting

Assessors read these documents together, looking for traceability from requirement to plan to delivered information.


Uncontrolled Documents on Shared Cloud Drives

  1. Teams share drawings through personal cloud drives or messaging apps because the official system is slow.

  2. Local copies of models and PDFs circulate with no way to confirm they are current.

  3. Email attachments carry design changes that never reach the CDE.

  4. Subcontractors use their own folders and send periodic exports.

  5. Staff leaving the project take access, and sometimes copies, with them.

  6. Document status is unclear, so superseded information is used on site.

  7. Auditors test this by asking staff where they would find the latest version, and then checking it.

  8. Controls such as blocking unmanaged storage, training and enforcing a single route reduce the problem more than policy alone.


Scope Does Not Match Joint-Venture Realities

  1. A certification or assessment scope may cover one company while the project is delivered through a joint venture with several partners.

  2. Roles, such as lead appointed party and information manager, should be assigned clearly in the venture agreement.

  3. Each partner's tools, standards and security levels may differ, so a common set of rules needs to be agreed.

  4. Responsibility for model federation, clash coordination and quality checks should not be left to assumption.

  5. Evidence from one partner's projects does not automatically show capability of the venture.

  6. Tender answers should describe how the consortium works, not only how each member works alone.

  7. Changes in the supply chain during the project need updated plans and records.


Information Security Measures for Sensitive Projects

  1. A security-minded approach, covered by ISO 19650-5, asks for proportionate controls based on the sensitivity of the asset and its information.

  2. A security assessment should identify which information is sensitive and who needs access.

  3. Access should be role-based, with stronger authentication for sensitive areas.

  4. Sharing models outside the environment, for example with an overseas design office, needs explicit approval.

  5. Subcontractors and software providers should be bound by security requirements in their appointments.

  6. Disposal and archive rules should cover personal devices and removable media.

  7. Incident reporting routes should exist for lost devices and suspected breaches.

  8. Organizations often pair this work with an ISO/IEC 27001 information security management system for enterprise-wide controls.


Portfolio Scale and Model Layers Driving Mandays

  1. Number of projects and the stage each has reached.

  2. Number of sites and delivery teams using the organization's system.

  3. Size and complexity of the models, and the number of discipline models federated together.

  4. Number of lead appointed parties, task teams and key suppliers involved.

  5. Variety of platforms and software tools used.

  6. Level of automation in information checking and exchange.

  7. Security requirements that add review steps.

  8. Maturity of the system and the history of previous findings.


Enterprise System Audit vs Single Project Reviews

  1. An enterprise review looks at the organization's standard processes, roles, tools and competence.

  2. A project review looks at one appointment, including its plans, CDE and records.

  3. Enterprise evidence supports many bids, which can save repeated explanation in questionnaires.

  4. Project evidence is still needed where the client sets its own information requirements.

  5. A strong enterprise system can be undermined when individual projects ignore it.

  6. Conversely, one well-run project does not prove that the organization manages information consistently.

  7. Many organizations use both: an enterprise assessment for tender readiness and project reviews for delivery assurance.


Attaining Accredited BIM Verification for Tenders

  1. Read the tender documents and identify exactly what evidence is requested and whether certification is mandatory.

  2. Define the scope of the organization, services and sites to be assessed.

  3. Perform a gap analysis against ISO 19650, mainly Part 2 for delivery, and Part 3 where operations are involved.

  4. Establish roles, competence records, CDE rules, naming conventions and information delivery plans.

  5. Apply the system on live projects and gather records of how it works.

  6. Run internal reviews and correct issues before the external assessment.

  7. Choose a certification body whose accreditation covers the BIM scheme you need, and confirm its scope in writing.

  8. Maintain the evidence through the scheme's follow-up arrangements and keep the certificate valid for upcoming tenders.

In the UK, UKAS has accredited BIM information management certification as process certification against ISO 19650-2 under ISO/IEC 17065, with the certification body defining its own scheme. This differs from ISO 9001-style management system certification, so check which route your client accepts.


How Pacific Certifications can help?

BIM information management certification under ISO 19650 is delivered through process certification schemes with their own accreditation requirements, so organizations should confirm a provider's accreditation scope and whether a client will accept it before engaging them. For the management system foundations that support tender pre-qualification, Pacific Certifications can provide:

  • Independent ISO 9001 and ISO/IEC 27001 certification audits

  • Stage 1 documentation and certification-readiness audits

  • Stage 2 implementation and effectiveness audits

  • Annual surveillance audits and triennial recertification audits

Pacific Certifications conducts impartial audits and does not design, implement or manage BIM, information or quality systems for its clients.


Contact Us

To schedule your ISO 19650 certification, contact us at support@pacificcert.com or +91-8595603096.

For training programs on ISO 19650 certification requirements and preparation, contact us at trainings@pacificcert.com.

Apply for ISO 19650 BIM Compliance Assessment
Strengthen BIM governance, construction information management, public tender readiness and audit compliance by aligning project information workflows, document controls and collaborative processes with ISO 19650 requirements.

Read More at: ISO certifications for construction industry

Pacific Certifications

Frequently Asked Questions

Is ISO 19650 certifiable like ISO 9001?
Not in the same way. Certification is offered through schemes run by accredited certification bodies, which assess an organization's information management process against ISO 19650-2. Scheme rules vary.
Is certification required to win public tenders?
It depends on the client and country. Some tenders ask for it, some accept other evidence, and some do not mention it. Read the pre-qualification documents closely.
What is the difference between ISO 19650-2 and ISO 19650-3?
Part 2 covers the delivery phase of an asset, and Part 3 covers its operational phase.
What does a CDE need to show an assessor?
Defined states, controlled access, version history, naming rules and a clear approval process.
Does ISO 19650 replace BS 1192 and PAS 1192?
Yes, ISO 19650 superseded that family as the basis for information management using BIM.
Pacific Certifications

Pacific Certifications

Looking for ISO Certification? Get in touch now!

Pacific Certifications

Pacific Certifications is an independent, internationally recognized certification body providing third-party audit and certification services for management system standards such as ISO 9001, ISO 14001, ISO/IEC 27001, ISO 45001, and other ISO standards. We also provide product certification services and training and personnel certification programs designed to support organizational and professional competence.