Direct Answer
Management system oversight is the structured set of independent checks — traceability, segregation of duties, internal audit, and management review — that lets an organization detect a control failure before an outsider does. At Harvard Medical School, that oversight did not exist for the morgue of its Anatomical Gift Program. A single manager controlled receipt, custody, and disposition of donated human remains for four years without independent verification. The theft was uncovered by a federal investigation, not by the institution. The result: an eight-year prison sentence, a $53 million settlement, and a reputational scar that a functioning management system oversight structure would have cost a fraction to prevent.
Management system oversight is the difference between an institution that catches a betrayal in month two and one that learns about it from a federal indictment four years later. Harvard Medical School was the second kind.
From 2018 through 2022, the manager of the morgue serving Harvard Medical School's Anatomical Gift Program removed organs, brains, skin, hands, faces, and dissected heads from donated cadavers after they had been used for teaching and research but before they were cremated and returned to families. He carried them out of the building, took them home, and sold them. Cedric Lodge was sentenced on December 16, 2025, to 96 months in federal prison. His wife received twelve months and a day. Six additional people who bought remains from him have been sentenced, with terms running from six months to fifteen years.
In August 2026, Harvard agreed to pay $53 million to resolve the civil lawsuits brought by donor families. That figure is the visible cost. The invisible cost is larger, and it is the reason this case belongs in every quality manager's briefing folder rather than in the true-crime section.
The question everyone asks first is the right one: why wasn't there oversight? The answer is not that Harvard was uniquely careless. It is that no regulator required management system oversight of this activity, no external body inspected it, and the institution never built the internal structure that would have made the absence of a regulator irrelevant. That is a repeatable failure pattern, and it is not confined to morgues.
The Facts
What Happened at Harvard — and Why Management System Oversight Never Caught It
Four Years. One Person. No Checks.
The mechanics matter, because the mechanics are where management system oversight was supposed to live. A donated body arrives under an anatomical gift agreement that states exactly what the institution may do with it and what must happen at the end. It is logged in. It is used for teaching and research. It is then cremated, and the cremated remains are returned to the family or handled as the donor directed.
Read that timeline as a control chart rather than a news story. The event occurs in 2018. Detection occurs in 2022, by an external party, in the course of investigating someone else entirely. The gap between occurrence and detection is the entire measure of management system oversight, and here it was four years wide.
The court's language is what should hold a quality professional's attention. The Supreme Judicial Court characterized the supervision failure as extraordinary and described a program with little to no controls in place to prevent the harm. It noted that a comparable theft had occurred at a university morgue in California in the early 2000s — a known sector event that never became a control anywhere else. It pointed to visible warning signs that were ignored or tolerated. And the lawsuits alleged the institution had disregarded published guidance from the American Association for Anatomy.
That last point is the one that converts this from a scandal into a management system lesson. Guidance existed. Someone had already written down what good practice looked like. What was missing was the mechanism that turns guidance into an obligation, an obligation into a control, a control into a record, and a record into something a second person actually looks at. That mechanism is management system oversight, and no amount of institutional prestige substitutes for it.
The Void
Why Wasn't There Any Oversight? The Regulatory Void Behind the Case
No Regulator. No Inspector. No Alarm.
Direct Answer
There was no external oversight because none is required. Whole-body donation and non-transplant tissue handling sit outside FDA regulation, and there is no mandatory federal accreditation or licensing requirement for the facilities that receive tens of thousands of donated bodies each year. Organ donation is tightly controlled; anatomical donation for teaching and research is not. In that void, management system oversight is the only oversight available — and it is voluntary, which means somebody has to choose it before anything goes wrong.
Most people assume that an activity this sensitive must be inspected by somebody. It is a reasonable assumption and it is wrong. Regulation varies by state, and there is currently no mandatory federal accreditation or licensing requirement for body donation organizations or non-transplant tissue banks, which are not regulated by the FDA. The practical consequence is that hundreds of facilities receiving donated human bodies operate with essentially no federal oversight at all.
A former operator interviewed by CBS News put the entry barrier in blunt commercial terms, observing that it is harder to sell hot dogs from a cart than to open a whole-body donation program. Legislators have noticed. Senators Chris Murphy and Thom Tillis introduced the Consensual Donation and Research Integrity Act, which would create standards for registration, inspection, chain of custody, labeling and packing, and proper disposition. The bill's sponsors noted that while donating a body for transplantation is highly regulated and transparent, no federal law governs donation for research or educational use. The bill has not become law.
Voluntary structures do exist. The American Association of Tissue Banks accredits programs and requires complete tracking of donors through the entire donation process. ISO 20387, the international standard for biobanking, specifies requirements for competence, impartiality, and consistent operation across the full chain of collection, preparation, preservation, storage, and distribution of biological material, and accreditation to it is available in the United States. Professional guidance from the American Association for Anatomy has existed for years.
Every one of those is optional. And that is the structural insight this case delivers to anyone running a management system in any sector: a voluntary standard that nobody has adopted into a documented obligation, assigned to an owner, audited against, and reviewed by leadership is not oversight. It is a pamphlet. Management system oversight is what converts available good practice into enforced practice, and the conversion has to be deliberate.
Across 28 years and 200+ ISO certification and surveillance audits attended, MSI has watched this exact assumption cause damage in sectors nobody thinks of as risky. Records departments. Sample retention. Returned goods. Scrap and destruction routes. Anywhere something valuable leaves a system through a door that nobody watches, management system oversight is either designed in or it is absent, and the organization usually finds out which from someone else.
The Mechanics
Where Management System Oversight Actually Broke: Four Control Failures
Named. Numbered. Preventable.
Strip away the horror and four ordinary control failures remain. Each one has a clause number. Each one is the sort of finding an internal auditor writes on a Tuesday in a manufacturing plant without anyone calling it a scandal.
1. Traceability terminated one step before the end
ISO 9001 Clause 8.5.2 requires an organization to use suitable means to identify outputs where that is necessary to ensure conformity, to identify the status of outputs with respect to monitoring and measurement requirements, and to control unique identification where traceability is a requirement — retaining the documented information needed to enable it. MSI's guidance on the production and service provision procedure makes the point that deciding how far traceability must reach is itself the work, and most organizations stop the chain one step short of where the risk actually sits.
Here the chain covered arrival and teaching use. It did not cover disposition. Nothing reconciled what was cremated against what was received. A traceability chain that ends before the final transformation is not a traceability chain; it is a receiving log. Effective management system oversight requires that the last step be the most heavily evidenced step, because the last step is the one with no downstream witness.
2. One role held receipt, custody, and disposition
ISO 9001 Clause 5.3 requires top management to assign and communicate responsibilities and authorities for relevant roles. The clause exists so that no single role closes its own loop. When the person who receives an item is also the person who certifies its destruction, the organization has designed a process with a built-in blind spot and staffed it with trust.
Trust is not a control. It is a hiring outcome. The distinction is the entire premise of management system oversight, and it is why a mature organization separates duties in exactly the places where it trusts people most — not because it suspects them, but because a control that depends on the honesty of one person protects nobody, including that person.
3. No internal audit was ever scoped to the disposition process
Four years is many audit cycles. A single audit carrying the objective verify that disposition records reconcile to receipt records for the anatomical gift program would have closed the window in weeks. That objective was never written because the process was never in an audit program at all.
This is the most common finding MSI encounters in internal audit planning work: audit programs cover the processes that are easy to audit and the ones a registrar will look at, and quietly omit the processes where consequence-of-failure is highest and evidence is hardest to gather. Management system oversight fails at exactly the point where audit convenience and audit necessity diverge.
4. A voluntary obligation was never adopted as a real one
The anatomical gift agreement was a promise to a specific interested party — the donor and the donor's family — about exactly what would happen to a body. ISO 9001 Clause 4.2 requires an organization to determine its interested parties and their relevant requirements. ISO 14001:2026 sharpens the same idea with the concept of compliance obligations: requirements an organization has to comply with, and those it chooses to comply with, which become binding the moment the choice is made.
A signed donor agreement is a chosen compliance obligation in the purest form. So is published professional guidance an institution says it follows. Management system oversight means those obligations get written into a register, mapped to controls, evidenced in records, and reviewed by leadership — the same discipline MSI applies in document and records control, where the decision about what gets controlled is made before the first procedure is written rather than after the first incident.
Direct Answer
The four failures behind the case are the four failures that management system oversight exists to prevent: traceability that stops before final disposition, a single role holding receipt through destruction, an internal audit program that never scoped the high-consequence process, and a voluntary obligation that was never adopted as a controlled requirement. None of them is exotic. All four are auditable in an afternoon.
Close the four gaps with procedures that already make the decisions
MSI's ISO Procedure Templates and Guides library covers the exact controls named above — traceability and operational control, document and records control, purchasing and supplier control, internal audit, and corrective action — written as working documents with every judgment call already made and annotated from 200+ audits attended. Editable Microsoft Word, one architecture across ISO 9001, ISO 13485, ISO 14001, ISO 45001, and ISO 7101.
No Exemption
Universities Are Not Exempt From Management System Oversight
Prestige. Governance. Proof.
Direct Answer
No. A university that receives donations, runs clinics and laboratories, feeds and houses thousands of people, and holds custody of regulated materials is a service organization operating at industrial scale. ISO 9001 applies to any organization regardless of size, type, or nature, and ISO 21001 exists specifically for educational organizations. The exemption universities assume from management system oversight is cultural, not legal — academic governance was built to assess scholarship, not to verify that a disposition record was signed by a second person.
This is the part of the case that deserves more attention than it gets. Strip the institution's name off the file and describe the operation to an auditor: an organization receives a valuable, irreplaceable item from an external party under a signed agreement specifying exactly what may be done with it, stores it, uses it in a controlled process, and then transfers it to an external provider for destruction, with a promise to return evidence of that destruction to the original party. That is a custody-and-disposition service with a customer, a contract, a supplier, and a required record. Nothing about it is academic, and nothing about it needs a different management approach than a returns-and-destruction process at a contract manufacturer.
Universities do have governance. What they mostly do not have is operational governance. Regional accreditation reviews degree programs, faculty credentials, learning outcomes, and financial health. Peer review assesses scholarship. Institutional review boards assess research ethics with living subjects. Every one of those mechanisms is legitimate and none of them samples a reconciliation record. The result is an institution with sophisticated academic governance layered over service operations that nobody has ever audited for control effectiveness — which is exactly the shape of the failure the court described.
Consider what a mid-size research university actually operates on any given Tuesday. Teaching hospitals and outpatient clinics. Laboratories holding controlled substances, select agents, and radioactive materials. Animal facilities. Food service and housing at the scale of a small city. Athletics programs with medical, travel, and equipment operations. Museums and collections. Environmental permits, hazardous waste manifests, a vehicle fleet, a police force, a procurement operation moving hundreds of millions of dollars. Several of those are more heavily regulated than the manufacturing plants that certify to ISO 9001 as a matter of routine. Management system oversight is not an imposition on a university. It is the missing layer under work the institution is already doing.
The capability is not the obstacle either, and it is worth being clear about that. Universities are extremely good at building controlled processes when a funder demands one — federal grant compliance, effort reporting, and financial audit have driven genuinely rigorous documented procedures in research administration for decades. The discipline exists on campus. It has simply been applied where money is at risk and not where dignity is. That is a prioritization decision, not a capacity limit, and it is reversible in a single planning cycle.
There is also a standard written for exactly this sector. ISO 21001, the educational organizations management system standard, sits on the same harmonized structure as ISO 9001 and carries the full operational spine at Clauses 8 through 10 — control of external providers, traceability and nonconforming outputs, internal audit, and management review. It applies to any organization supporting competence through teaching, learning, or research, and to educational units inside larger organizations whose core business is something else. An institution running a donation program feeding an anatomy curriculum sits squarely inside that scope.
A word on SOPs specifically, because this is where the objection usually lands: we already have procedures. Most organizations do. An SOP that exists but has no named owner, no event-based review trigger, no record produced as a byproduct of the work, and no audit objective pointed at it is not a control — it is a document. MSI's guidance on document and records control and on the order in which procedures should be built both start from the same observation: most management systems are not built, they accumulate, and an accumulated set of SOPs reliably produces the appearance of management system oversight without the substance of it.
For institutions where the stakes are public rather than commercial, MSI's treatment of government internal audit works through the same problem in an agency setting, where a missed control is measured in public trust. Multi-campus systems carry the additional obligation covered in connected quality management: a control adopted at one location has to reach the others, or the institution has fixed one instance of a systemic weakness and left the rest live.
ISO 9001:2026
What ISO 9001:2026 Changes About Management System Oversight of Ethics
Culture. Conduct. Evidence.
ISO 9001:2026 publishes on 16 September 2026, with a three-year transition anticipated to close around September 2029. The clause structure holds and the process approach is unchanged, but one addition speaks directly to this case. Clause 5.1 gains an explicit top-management duty to promote a quality culture and demonstrate ethical behavior, and Clause 7.3 extends the awareness requirement so that people working under the organization's control understand both. A supporting note explains that culture and ethics can be demonstrated through shared values, beliefs, history, attitudes, and observed behaviors.
Skeptics have argued, with some justification, that promoting a culture is unenforceable as written and that anyone claiming the standard now audits ethics is overstating it. MSI has made that caveat in print, in its analysis of what ISO 9001:2026 means for boardrooms and in the practical treatment of auditing quality culture. The critics are right about the text. They are wrong about the opportunity, and the Harvard case shows why.
Culture in this case was not an abstraction. The court record describes visible signals that were ignored or tolerated over years — including, remarkably, a personal license plate identifying the morgue manager as the Grim Reaper, which the court read as evidence of an unprofessional insensitivity given his position. Nobody escalated it. Nobody documented it. Nobody treated tone as a signal about control environment, because no clause told them to.
From 16 September 2026, a clause does. That does not make culture measurable by itself. What it does is give management system oversight a place in the standard to hook the evidence that already exists: speak-up channel data and what happened to each report, escalation records, competence and authorization decisions, management-review discussions about conduct, and the disposition of concerns raised about a specific person or process. Those artifacts are objective. An auditor can sample them. MSI's treatment of the ISO 9001 gap analysis for the 2026 edition notes that every certified organization on earth starts with a shortfall against this clause, because there is no 2015 equivalent to fall back on.
The practical instruction for a quality leader is narrow and useful. Do not attempt to audit whether people feel ethical. Audit whether the organization has a route by which a concern travels from the person who notices it to a decision-maker, whether that route produced records in the last twelve months, and whether anything changed as a result. That is management system oversight of culture, expressed as evidence rather than sentiment, and MSI's guidance on the ethics and culture changes in the 2026 update works through what auditors are likely to sample.
Healthcare
What ISO 7101 Adds to Management System Oversight in Healthcare
Dignity. Governance. Trust.
Direct Answer
ISO 7101:2023 is the first international consensus standard for healthcare quality management, and it makes dignity, respect, and people-centred care explicit system requirements rather than values statements. For an academic medical center, that is precisely the management system oversight layer the Harvard morgue lacked: a governance structure that treats the person behind the donation as a service user whose stated wishes are a controlled requirement, with leadership accountable for evidencing that they were honored.
ISO 7101 was developed under ISO Technical Committee 304 with contributions from around thirty nations, and ANSI holds the secretariat as the U.S. member body. It asks healthcare organizations to create a culture of quality starting with strong top management and to build care around respect, compassion, equity, and dignity.
A skeptic will say that no standard would have stopped a determined thief, and that is true. It is also beside the point. Standards do not stop determined people. Management system oversight shortens the interval between the act and the discovery, and that interval is where all the damage compounds. Four years of undetected theft produced 47 plaintiffs across twelve lawsuits. Four weeks would have produced a police report and a personnel action.
The structural feature that makes ISO 7101 relevant to non-clinical functions is that it does not confine quality to the bedside. Morgues, records rooms, supply chains, and gift programs are all inside the scope of a healthcare quality management system, and each one carries an obligation to a service user who cannot advocate for themselves. MSI's work on ISO 7101 documentation and on the patient experience procedure both start from the same premise: the promise made to a person is a requirement, and requirements need records.
Healthcare organizations weighing the standard can start with MSI's overview of immediate action steps under ISO 7101 and the companion piece on patient safety and operational efficiency outcomes. Almost no U.S. organization has implemented the standard yet, which makes early adoption a genuine differentiator rather than a catch-up exercise — MSI is taking on founding partner engagements for exactly that reason.
Early Warning
How ISO 19011:2026 Turns Internal Audit Into Management System Oversight
Objective. Evidence. Answer.
ISO 19011:2026 was published on 27 May 2026 and withdrew the 2018 edition immediately, with no transition period. Any audit procedure still citing the third edition is carrying a documentation finding today. The change that matters most for management system oversight is deceptively small: every audit now carries an explicit objective alongside its scope and criteria.
Scope tells the auditor where to look. Criteria tell the auditor what to measure against. The objective tells the auditor what the audit is trying to learn. MSI's breakdown of the six edits ISO 19011:2026 requires in an internal audit procedure works through how that single addition changes what a report can deliver — and the parallel piece on government internal audit shows the same shift in a public-accountability setting, where the cost of a missed control is measured in trust as well as dollars.
Apply it here. A checklist audit of an anatomical gift program asks whether a procedure exists, whether records are retained, and whether staff are trained. All three would have passed. An objective-led audit asks a question: does every body received between January and June appear in a disposition record signed by someone other than the person who handled it? That question has an answer, the answer is a number, and the number would have been wrong. That is the entire difference between paperwork and management system oversight.
The 2026 edition also strengthens guidance on digital evidence and on remote and hybrid auditing, which cuts both ways. Digital records make reconciliation faster; they also make it tempting to audit from a desk. Reconciliation of physical custody is one of the activities that does not survive being done remotely. MSI's guidance on internal audit follow-up makes the related point that a finding only creates value if the corrective action proves effective — verification is a separate act from closure, and a corrective action procedure that never tests effectiveness produces a register of closed findings and a system that has not changed. ASQ's reference material on ISO 19011 is a useful orientation point for teams building an audit program from scratch.
Have someone from outside the process ask the question
An internal audit run by the people who own the process cannot find what the process is designed not to show. MSI performs independent internal audits against ISO 9001, ISO 13485, ISO 14001, ISO 45001, and ISO 7101 — objective-led under the 2026 edition, with findings written to be acted on rather than filed. Twenty-eight years, 200+ audits attended, 80+ certifications supported.
The Real Cost
The Reputational Scar: Why $53 Million Was the Cheapest Part
Preventable. Permanent. Public.
Settlements close. Sentences end. The scar does not. Search the name of that medical school alongside the word morgue and this is what returns, and it will return that way for a very long time. The institution's own deans called the conduct despicable, abhorrent, and a flagrant betrayal of the values of a medical community — an accurate description, and one that will be quoted back at the institution for decades.
Here is what makes the scar particularly painful from a management system perspective: it was entirely preventable, and preventable cheaply. A reconciliation record signed by a second person. One audit objective per year. A line in a compliance obligations register. An escalation route for the concerns that people apparently already had. The total annual cost of that management system oversight would not have approached a rounding error against $53 million, and none of it required new technology, new headcount, or a regulator.
There is a second-order cost that gets less attention and matters more to the sector. Every anatomical gift program in the country now operates in the shadow of this case. Donation is an act of generosity that depends entirely on trust, and trust is a shared asset. When one institution's management system oversight fails publicly, the donation rate at every other institution takes the hit. The families who hesitate next year will not be hesitating about Harvard specifically.
The legal architecture shifted too, which is the part every general counsel in the sector should already have read. Institutions had long relied on the good-faith immunity in the Uniform Anatomical Gift Act to defeat claims like these, and a lower court accepted exactly that argument. The Supreme Judicial Court reversed, holding that immunity cannot shelter an institution that willfully or recklessly ignores misconduct violating its obligations under the Act. The opinion, SJC-13688, found that the failure to adequately supervise exemplified the kind of pervasive noncompliance that demonstrates a lack of good faith.
Translate that into management system language and it is stark. The absence of documented management system oversight was itself the evidence that defeated the legal defense. Not the theft — the supervision failure. An institution that could have produced reconciliation records, audit reports with objectives, and management review minutes discussing custody risk would have been arguing from a materially different position. Records are not bureaucracy. In litigation they are the difference between a defensible institution and an indefensible one, and MSI has made the same argument about what the management review record must actually prove.
The Pattern
Every Legal Case Is a Nonconformity Report Nobody Filed in Time
Signal. Silence. Settlement.
Direct Answer
Read enough litigation and a single pattern emerges: the lawsuit is a nonconformity that the organization's own management system oversight should have raised first, months or years earlier, at a fraction of the cost. The complaint describes a requirement, a departure from it, an available signal, and a failure to act. That is the exact structure of a nonconformity record under ISO 9001 Clause 10.2. The only variable is who writes it down — an internal auditor, or a plaintiff's attorney.
This is the lesson worth carrying out of every one of these cases, and it generalizes far beyond anatomical donation. Across 200+ certification and surveillance audits attended over 28 years, MSI has observed that organizations rarely lose because a requirement was unknown. They lose because a signal arrived, nobody owned it, and no mechanism forced it into a decision. The requirement was understood. The signal was available. The route from signal to decision did not exist.
In this case the signals were unusually plain. A prior theft at another university morgue years earlier — a sector event that should have triggered a control review at every comparable program in the country and apparently triggered none. Published professional guidance that was reportedly disregarded. Behavior visible enough that a court cited it as an indicator of insensitivity. Each of those was a nonconformity report waiting to be written. Each went unwritten until a federal grand jury wrote a much more expensive version.
Clause 10.2 requires an organization to react to a nonconformity, evaluate the need to eliminate the cause so it does not recur or occur elsewhere, implement action, review effectiveness, and retain documented information about both the nonconformity and the result. The phrase or occur elsewhere carries enormous weight and is almost universally ignored. It is the clause that turns another organization's disaster into your control, and it costs nothing to honor. Management system oversight that reads the sector's failures and converts them into local controls is the cheapest form of insurance available.
Practical translation for a management review agenda: add a standing input called external events, populate it with regulatory actions, court decisions, and published incidents in your sector, and require an owner to state for each one whether the same failure could occur here and what evidence supports that answer. Organizations that adopt this typically report that the first pass is uncomfortable and the second is fast. It is the single highest-yield addition to management system oversight that MSI recommends, and it takes twenty minutes a quarter.
Make leadership review the thing that catches it
Management review is where signals become decisions — or where they die quietly. MSI's ISO Management Review Tool Kits give you the agenda, the input pack, the slide deck, and the minutes format that produce a record capable of proving leadership actually considered the risk, clause by clause, across ISO 9001, ISO 13485, ISO 14001, ISO 45001, and ISO 7101.
Implementation
Seven Steps to Build Management System Oversight Into Any Custody Chain
Map. Separate. Verify.
This applies wherever something of value moves through a controlled process and exits through a door: controlled substances, precious metals, returned product, records slated for destruction, retained samples, scrap with resale value, decommissioned equipment carrying data. The pattern transfers exactly.
1. Map the chain to its true end point
Write down every step from arrival to final disposition, including the ones nobody considers part of the process. The exit step is where management system oversight is most often missing and where consequence is highest. If your process map ends at “used,” the map is incomplete.
2. Separate receipt from disposition
Different people, named in the procedure, with the separation stated as a requirement rather than a habit. Where headcount makes true separation impossible, substitute a documented independent verification at defined intervals and state why in the procedure. MSI's recommended order for building ISO procedures puts roles and authority early for exactly this reason.
3. Make reconciliation a record, not an activity
In equals out, signed, dated, exceptions explained. If it is not a record with an owner and a retention basis, it did not happen. This single artifact does more for management system oversight than any policy statement ever written.
4. Write the promise into a compliance obligations register
Consent agreements, donor wishes, customer contracts, voluntary codes, professional guidance you say you follow. Each entry needs a source, an owner, the control that satisfies it, and the record that proves it. Voluntary becomes binding at the moment of adoption, and that is a feature.
5. Put the process in the audit program with an objective
Not “audit the morgue” but “verify that disposition reconciles to receipt for the full period, sampled at ten percent.” Rank audit intensity by consequence of failure rather than by ease of evidence gathering. Objective-led auditing is the operating core of modern management system oversight.
6. Extend the same controls to external providers
Crematories, couriers, destruction vendors, storage facilities. The obligation does not transfer with the item. MSI's guidance on purchasing and supplier control and on why supplier management programs fail in year two both address the evaluation record that has to function as an approval gate rather than a formality.
7. Give leadership a standing look at it
Custody reconciliation exceptions, escalated concerns and their disposition, and external sector events belong on the management review agenda with named owners. Management system oversight that stops below the leadership table is supervision, not governance — and supervision is precisely what the court found had failed.
Multi-site organizations carry an additional obligation: a control adopted at one location has to propagate to the others, which MSI treats in depth in its work on connected quality management across a multi-site network. A single-site fix to a sector-wide failure mode is a partial answer.
Questions
Management System Oversight: Frequently Asked Questions
Asked. Answered. Sourced.
What is management system oversight?
Would ISO certification have prevented the Harvard morgue thefts?
Why is there no federal regulator for body donation programs?
Which ISO clause covers chain of custody and traceability?
What does ISO 9001:2026 require regarding ethics and quality culture?
How did the court treat the supervision failure legally?
How do you audit something that has no regulator to benchmark against?
Are universities exempt from ISO management system requirements?
What is the fastest way to test our own custody chain this quarter?
Find out where your oversight actually stops
Most organizations discover the end of their traceability chain during an incident. A planning session finds it in an hour, on a normal Tuesday, with nothing at stake. MSI has supported 80+ certifications and trained 600+ professionals across manufacturing, technology, medical device, government, healthcare, and other regulated industries — and the first conversation is about your process, not a clause list.
Call 760-434-9141 to book a planning session, or explore MSI's ISO consulting, SurePath turnkey certification, and the SureResults year-round maintenance program.
Keep Reading
Related Reading on Management System Oversight
Deeper. Adjacent. Practical.
- ISO 9001 ethics requirements 2026 — how the new clause language landed and what it asks of leadership
- The quality systems manager job description — writing accountability for culture into the role itself
- Certification audit preparation — why tone at the top is now something an auditor looks for
- ISO 13485 risk management — linkage as the proof that a control system is live rather than documented
- The calibration maturity model — why reconciliation does not survive being done remotely
- ISO 14001 continual improvement — monitoring, audit, and review as a single defensible loop
References and Sources
U.S. Department of Justice, U.S. Attorney's Office, Middle District of Pennsylvania — Former Harvard Morgue Manager and Wife Sentenced for Trafficking Stolen Human Remains
U.S. Department of Justice — Six Charged With Trafficking in Stolen Human Remains
U.S. Department of Justice — Sentencing in the related purchasing network
U.S. Department of Justice — Further sentencing in the same investigation
Harvard Medical School — Anatomical Gift Program resources and case updates
The Harvard Crimson — Settlement reporting and sentencing reporting
CBS News — Settlement coverage and investigation into the unregulated donation market
Forbes — Settlement analysis and case chronology
The Hill — Settlement administration and class notification
Courthouse News Service — Massachusetts Supreme Judicial Court decision coverage
Keches Law Group — Opinion SJC-13688 summary and quoted holdings
Al Jazeera — Reporting on the liability ruling
CNN — Reporting on the absence of federal oversight for non-transplant tissue
U.S. Senate — Consensual Donation and Research Integrity Act announcement and companion release
ISO — ISO 7101:2023, ISO 19011:2026, ISO 20387 biobanking, and ISO 21001 educational organizations
ANSI — Inside ISO 7101 and ANAB — ISO 20387 accreditation
ASQ — ISO 19011 guidelines for auditing management systems
Global Accreditation Cooperation — accreditation body landscape following the January 2026 merger
About Management Systems International (MSI)
Diana Lynn is President and Principal ISO Consultant at Management Systems International (MSI), a consulting firm she co-founded in 1998. With 28 years of experience including extensive AS9100 work in MSI's early years, MSI's track record includes 80+ certifications supported, 200+ audits attended, and 600+ professionals trained across manufacturing, technology, medical device, government, healthcare, and other regulated industries. Today MSI implements ISO 9001, ISO 13485, ISO 14001, and ISO 45001, with an expanding focus on ISO 7101 healthcare quality.
msi-international.com · 760-434-9141 · Veteran-owned and female-owned.
