Latest / Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance / How to Become a Successful Consultant | Interview with Carlos Cruz

Transcript

How to Become a Successful Consultant | Interview with Carlos Cruz · Secure & Simple — Podcast for Consultants and CISOs on Cybersecurity Governance and Compliance

• 0:00
  Dejan Kosutic: Welcome to Secure and Simple podcast. In this podcast, we demystify cybersecurity governance compliance with various standards and regulations and other topics that are of interest for consultants, and other cybersecurity professionals. I'm Dejan Kosutic, and I'm the host of Secure and Simple podcast. Today, my guest is Carlos Cruz. He's the founder of a consulting company called Metanoia and also the main ISO 9,001 and ISO 14,001 expert at Advisera.
• 0:32
  You might wonder why an independent consultant that deals with quality and environmental management could be interesting for this cybersecurity podcast. And the thing is that Carlos is already thirty years in the consulting business and faces almost the same challenges as consultants for ISO 27,001 or NEIS Cybersecurity Framework or SOC two or any of these other security frameworks. Now he has performed more than 100 consulting jobs, close to 100 certification audits, more than 200 internal audits and more than 200 trainings. So this is really an impressive career and something that not many people actually have achieved in their consulting career. So in this episode today, we'll discuss how he managed to become a successful consultant and you'll be able to learn, you know, firsthand what are the dos and don'ts when building a consulting business.
• 1:36
  Welcome to the show, Carlos.
• 1:38
  Carlos Cruz: Thank you, thank you for having me.
• 1:43
  Dejan Kosutic: Great. Basically you started what? Like thirty years ago you started consulting business. How did actually this consulting business look back then in the 1990s when you started your consulting career?
• 1:57
  Carlos Cruz: It was like this. I was working as a chemical engineer for eight years in the chemical industry and I had some jobs. So I I was working when I at the company, they wanted to implement ISO 9,001. ISO nine I didn't know nothing about ISO 9,001. It was nineteen nineteen eighty nine.
• 2:20
  Okay? Nineteen eighty And then okay. That we had, we implemented with a lot of difficulties. Then I had another job where again, to implement ISO 9,001. And I said to myself, I like this.
• 2:34
  And and I and I wanted to my idea was something like this. I want to be an expert on this. But for for a company, they don't want an expert. They don't need an expert, and I wanted to be an expert in this because I like it. So what I did was I I quit my job and I started it I looking back, it's oh, it's it was okay.
• 2:58
  I had some money in the bank and I started, okay. Let's see what what to do. So what I did was I I answered to some newspaper ads Mhmm. Looking for trainers, and and I contacted some consulting companies looking for freelancers. Mhmm.
• 3:17
  And that's how I started. That's how I started. Then I wrote some books, and then from there I got some some customers from there. And I started the blog in 02/2004 and I got also a lot of customers from there. So something like that.
• 3:37
  And then, okay, word-of-mouth and
• 3:40
  Dejan Kosutic: yeah. Great. So what would you say that helped you the most in these very first days of your consulting business? Was this really this training that you did or anything else that you mentioned in the beginning?
• 3:56
  Carlos Cruz: I think the most important in the beginning in the beginning was contacting organizations that could have could look were looking for some kind of freelancers. Okay? Mhmm. Because at the time at the time perhaps perhaps the situation with twenty seven thousand one is similar to what was at the time with nine thousand one.
• 4:24
  Dejan Kosutic: Uh-huh.
• 4:25
  Carlos Cruz: It was something new or there was a lot of demand. Now demand for 09/2001 is not so great as Yeah. Twenty seven thousand one. And and I contacted several organizations that perhaps they are looking for a freelancer, consultant freelancer because so a freelancer is someone that can start working, providing money for them right now, and they don't have any risk. Well, the risk is if it is a lousy consultant, yeah, it's a risk.
• 4:59
  But if they have job work, okay, they they they give you work. If they don't have work, they say
• 5:05
  Dejan Kosutic: Yep. Goodbye. Yeah.
• 5:07
  Carlos Cruz: Yeah. Yeah.
• 5:07
  Dejan Kosutic: And I think Okay. And and this this you also mentioned that you have started that you started with a blog, that you have written a book. So How important were these activities for, let's say, promoting your consulting business?
• 5:24
  Carlos Cruz: Very, very, very important. The book, I remember in the 90s, I found a very old, from the 60s, copy of an article from one of the quality gurus, Mr. Joseph Juran. Okay? And you wrote an article in the 60s that was something like this: So you want to be a quality control consultant, and the first thing he said was some wrote was something like: Start three, four years before and write a book.
• 6:00
  Because when you write a book you are an expert.
• 6:04
  Dejan Kosutic: So this is all that's needed, right? I
• 6:09
  Carlos Cruz: like a lot ISO 9,001, but I like even more about linking with strategy, balance scorecard, strategy maps. Mhmm. And I wrote a book where I tried to mix the two things, and it was very very successful for my my own market. It is very small, but it was very successful. It had three editions.
• 6:34
  So it was very And then several people contact me that were working for organizations that I consider them as platforms. So technological centers, accounting companies. Accounting is very important because an accounting company, their business really is trust. Okay?
• 6:57
  Dejan Kosutic: Yeah.
• 6:57
  Carlos Cruz: And so cast their customers, when they have a a difficulty, they have something that well, what is this? ISO 9,001. Customers are asking me to to be ISO 9,001 certified. What is this? Can you help me?
• 7:12
  And they say oh, they say something like, okay. We know what it is. Even if they don't know, we know what it We'll we'll we'll find someone to work with you. And so some of these companies contacted me. And so some of these companies I've been working since 02/2009.
• 7:29
  Great. Provide
• 7:30
  Dejan Kosutic: Ice cream through the book. Right? Because you have written the Yeah. Through the book. And also through the
• 7:35
  Carlos Cruz: through the blog. Yes. It's more or less the same.
• 7:39
  Dejan Kosutic: Yeah. So in your experience, you have written this first book, is it really difficult to write a book? Is it really difficult to find, let's say, a topic for a book?
• 7:50
  Carlos Cruz: I don't find it difficult. Okay. Because my first book, that connection between balanced scorecard and the ISO 9,001, I really got some some ideas that I consider that were innovative. Mhmm. And I was and I I already tested them in company with with fantastic results with fantastic And so, yeah, I have something here that is innovative.
• 8:19
  No one is thinking about this. Let me okay. And it's yeah. I remember I lost that, but I remember and I didn't take any picture. But I I remember before starting writing the book, I made a mind map of the book with images where I I I made some images and I put in a door in my office at the time.
• 8:40
  And it was yeah. It was. Then I wrote another book about implementing ISO 14,001, but with a with a link to strategy again. Uh-huh. So if your if your business is more like design or innovation, I believe that the focus of your environmental management system shouldn't be the same as a company that the focus is low cost or low price.
• 9:12
  Dejan Kosutic: Yeah. Yeah.
• 9:13
  Carlos Cruz: So yeah, it was something like that.
• 9:16
  Dejan Kosutic: So if I understood well, it's important to find let's say something that is common like these standards, but then find something that is specific in your approach to these standards and then write a book around it. Right? Is this the the approach
• 9:28
  Carlos Cruz: that you're taking up? Yeah. It's it's
• 9:32
  Dejan Kosutic: a very good point. And, I at least from my experience it's not that these books are bringing really lots of money in, it's more that they are bringing clients in and I think this is really really important to understand when writing a book. Because after all, it's really a big effort, right? It's not something that you would write in day or two.
• 9:52
  Carlos Cruz: No, no, no. It's discipline. Oh, definitely. It is. Discipline, okay.
• 9:59
  Dejan Kosutic: Oh, yeah. Yeah, it definitely does. Anyway, you mentioned this connection between ISO standards and strategies. So why do you think this is important? Why do you think it's good for consultants?
• 10:17
  Carlos Cruz: Because I think that it's important not to just get the flag on the pole. Okay? Say that you are a certified company, but but having an impact in the business. Okay? And with with quality, with ISO 9,001, we can do it.
• 10:42
  I don't think that with other standards, we could it's not so easy. Okay? It's not so easy because they are more technical. But with with quality, so we are looking about we think we are thinking about customers. So okay.
• 10:56
  And you and and you start with what kind of customers? Okay? I remember working many years ago with a general manager in the company, a manufacturing company, and he was asked we were we were talking about customer satisfaction. And he was saying, oh, Carlos, should we aim for 100% customer satisfaction? We we we want that all customers are satisfied.
• 11:21
  And at the time, I don't remember what was my answer to him, honestly. But now I know that, no, we don't want satisfy all customers unless all customers are target customers. Okay? Because if you are working for a customer or if you are trying to seduce, to conquer customers that want design, that want innovation, they are not looking for low cost or low price. It's different.
• 12:01
  Dejan Kosutic: I understand why this connection between strategy and quality management could be interesting for a company, but why is this interesting for a consultant? You know, why you as a consultant see this as as an opportunity?
• 12:14
  Carlos Cruz: Because because if you find companies that are looking for this kind of approach, okay, you are not competing with low cost consultants. Okay? And you can or the customers can see really the impact because they instead of using, I call childish indicators, okay, like reduce the number of complaints or, like, reduce the number of defects. No. You you have indicators have those indicators, but you have also indicators like return of investment, like Mhmm.
• 13:01
  EBITDA. And so when you look
• 13:04
  Dejan Kosutic: at the you know? And you
• 13:06
  Carlos Cruz: see, oh, return on capital, and you see the numbers. Yeah. And I remember many years ago, one of the first books that I read about balanced scorecard, the numbers that the authors mentioned, according to my experience, are really, really, really correct. So if you are working with a company that their business is low cost, in one year twelve months you see the result. If you are working with a company that the business is about customer service okay two years and a half you see the result.
• 13:42
  Okay if you are working with a company that is innovation, okay three, five years is the time to So
• 13:50
  Dejan Kosutic: you're saying that it's possible actually to connect quality management with directly these KPIs that are strategic so to say for a company, like a return on investment, these kind of things? Is this if I understood what you're yeah.
• 14:04
  Carlos Cruz: When I work with companies that way, we we remove quality from the equation. We we see we we we speak about the management system.
• 14:13
  Dejan Kosutic: So quality management removes quality from equation. That's a good one.
• 14:21
  Carlos Cruz: Yeah, but
• 14:22
  Dejan Kosutic: it's true. Anyway, I'm not sure if you know, when I did my doctorate, actually my thesis was around what is the connection between strategy of a company and cyber security, right? What you're speaking here about is not only related to quality or environmental, it's actually related also, it's I would say applicable to any of these other fields like cyber security. And I mean, to be honest, there is not much research on it. I was almost the only one who researched this kind of a connection and still it's not something that is mainstream.
• 15:00
  So it's still, at least in cyber security, not really becoming so, I would say obvious, but I would say it's something that's coming and surely it's coming in quality management as well.
• 15:15
  Carlos Cruz: May I add that perhaps it's because the market for 27,001 consultancy is still open. Okay? There there are more much more projects. But when the market when the the number of companies looking for certification or for implementing the the ISMS starts to reduce or not growing so much, then comes the need for differentiation among consultants. And then comes that.
• 15:50
  Dejan Kosutic: Let's maybe focus a little bit on this. So, how do you actually differentiate other than this, let's say, strategy link, how do you differentiate with other consultants, other competitors? Why do actually clients choose you over some other competitor?
• 16:11
  Carlos Cruz: I think that I think for example in my last three or four projects, okay, what I realized is that for example they they they found me, okay, through word-of-mouth Mhmm. And because they were looking for they were searching for a consultant with experience with the process approach. It's one of the things that I I really love the process approach. And they so it was from from that. So they recognize or someone spoke to them recognizing that I was an expert in the process approach.
• 16:52
  Okay?
• 16:53
  Dejan Kosutic: Okay. But did they actually found you, I mean, through direct recommendation from other clients or did they found you through, let's say, I don't know, LinkedIn or or webinars or your these books that you're writing? So how did this word-of-mouth actually spread towards these clients of yours?
• 17:09
  Carlos Cruz: It's like this. For example, one of the cases. Because of the book that I wrote, I really don't know if it was because of the book or because of the blog. Some guys asked me to give some training to customers about twenty years ago. We still get in touch, and from time to time, they contacted me for providing training.
• 17:40
  And what happened was that they had some big customer looking for this kind of expertise in process approach, and they and they contacted me. But things the origin was the book or the blog, and from there Uh-huh. Okay. They they yeah.
• 17:57
  Dejan Kosutic: Yeah. So if I understood well, if you want to be a successful consultant, you have to, present your knowledge, to the world, right, Through blogs and other books and other means of let's say communication and marketing so to say. Yeah.
• 18:12
  Carlos Cruz: There are people, it's a very honest way, there are people that try to buy attention. Okay? And it's a very honest honest way. But I don't know if because of my background in engineering I don't like that. Okay?
• 18:28
  And it's not it's not something that I'm happy with. Okay? But so what I try to do is to earn attention. How do I earn attention? By writing these things, writing these articles or participating in some conferences me.
• 18:49
  That's how I I try to for me, the best customer is a customer that is they already know that they have a problem that they need help for. So I don't want to be the guy that is trying to sell them that you need to do this.
• 19:05
  Dejan Kosutic: Okay. Yeah. And how much time do you actually spend on on these, let's say, well, I wouldn't call them promotional activities, but let's say spreading the word. So is it like, I don't know, 20%, thirty %, fifty % of your time?
• 19:22
  Carlos Cruz: No. It's it's I would say it's it's marginal. It's 1010%, fifteen %, but it's it's a discipline. For example, my blog. My blog is I started in, I believe, September 2004.
• 19:39
  And nowadays, from last year, I I write every day. It's a kind of a discipline. It's like that marketing guy Seth Godin. Every day I write something. Okay?
• 19:50
  Sometimes it's because of my professional work, but sometimes it's about, for example, about other things like you know that recently that Dragi report on productivity in Europe. Okay I wrote about that. I write a lot about exports, productivity, so things like like that.
• 20:15
  Dejan Kosutic: Where do you find the ideas? How do you actually conclude which topics to cover in your blog?
• 20:27
  Carlos Cruz: Every day, except on weekends, day I wake up very early and before starting to work I do a six kilometer walk. Okay? Wow.
• 20:43
  Dejan Kosutic: That's good. Every I do four. I don't make six, I do four.
• 20:47
  Carlos Cruz: Yeah. And I have a mini iPad and I I read a book. Mhmm. I read a book. I read books.
• 20:58
  I read newspapers. I read some blogs and and from there I get some some ideas, things that interest me and or things that I see that I don't I don't agree with or I guess I agree a lot with and I believe that those ideas need some resonance. That's why I write about that.
• 21:22
  Dejan Kosutic: Okay, but are these, let's say, topics that you're reading more like business in general or are they focused specifically on quality and environmental management?
• 21:33
  Carlos Cruz: For many years I wrote, would say, sixty-seventy percent on quality and environmental issues, and then the other on general regarding economy, exports, productivity. Okay. In the last years, what I did is I have more topics on that on in in the in the in the blog, and I started and I I started the blog in my in the the site of my company. And Mhmm. There, I have these very more technical topics.
• 22:15
  Now
• 22:16
  Dejan Kosutic: I assume that some of your clients are also giving recommendation to other potential clients, So this direct word-of-mouth. So how do you actually get a client to be let's say so satisfied that he or she actually recommends you to someone else?
• 22:34
  Carlos Cruz: First, I never ask them. Okay? I never ask them to do that. But okay. I I believe that it's you know, when I started this this this job as consultant, trainer, auditor, the main motivation was I like the topic.
• 22:55
  So I studied I I remember in the nineties, I read a lot, a lot, a lot of books on on these topics. I still read. But in in the nineties, when I started, I read a lot of books, and it's something that provide us or give us confidence on the topics. Then I realized for my surprise that most of the questions or the difficulties of the customers are not so esoteric, are more like
• 23:23
  Dejan Kosutic: Uh-huh.
• 23:23
  Carlos Cruz: They don't know. They don't they are not they are they are not confident, and and so they ask very simple questions. But the fact that I worked before in the industry and don't make strange recommendations, like, or theoretical recommendations, and because of my that that experience, because of the way I approach the the consulting work, perhaps because of that, and my knowledge, perhaps because of that. Okay? And yeah.
• 23:57
  Dejan Kosutic: Okay. But I assume that, you know, that if if your clients are actually recommending you that this means that they that you actually exceeded their expectations in some way. Right? So that they're so satisfied with you that they're actually surprised on what they got from you. So how do you achieve actually this wow moment that they're really so satisfied that actually they recommend you to someone else?
• 24:26
  Carlos Cruz: I think it's the relationship. Okay? The relationship that we that we develop with them, I think is the kind of approach in terms of organization, in terms of in terms of preparing the my agendas, preparing the the meetings. Mhmm. And then they see the results.
• 24:52
  Okay? Then then they see the results and I try to be flexible. Sometimes I I believe that it's sometimes it's one of my mistakes. I sometimes I be I am too flexible and and because I try to to adjust my approach to to their approach, but I think it's it's that. It's the flexibility and organization preparation and the relationship.
• 25:23
  Dejan Kosutic: And do you have something let's say different in your approach when compared to other consultants?
• 25:31
  Carlos Cruz: Okay, I think I think the think the think the biggest difference is there are some topics that I I think we don't need to waste time. So for example, if we are implementing a management system, we will need for example to have corrective action. Okay? So I don't I don't need to invent a wheel with corrective action. I can have a procedure and present them and from there okay.
• 26:12
  But most of the work is customized. Okay? So I don't present them something like okay this is it, implement this and let's do it. No. What I try to do is to what do you do?
• 26:30
  And I okay we do the flowchart. What do you do? We do the flowchart. Then we see, okay. We do the gap analysis.
• 26:37
  Is something missing here from 09/2001? Okay. And I believe it's that customization that some that that they they may they may they may like the approach because the numb that way the the changes are minimal. Okay? The changes that because for example in, I don't know, in the commercial area most of the time everything is there.
• 27:01
  Okay. In purchasing, there are something new. Sometimes they need to to to have a formal evaluation of suppliers. Don't don't they don't have something formal. But okay.
• 27:12
  But we develop something that it's up to them. So I had some customers. I I had in the all these years, I have perhaps, I don't know, five six customers that tried with several consultants, tried to be implement the system and be certified, and they couldn't get certified because and I then I saw why because their system was very very bureaucratic, and I and with them, I worked with them trying to simplify things and they were certified. So that's also something that is different. So reducing the number of papers.
• 27:56
  Dejan Kosutic: I like simplification, this is what this podcast is about, to make these complex topics really easy to understand and simple to use. It's really a very important concept for any of these standards. Anyway, on your website I noticed that you said Metanoia, promoters of imperfect competition. You explain what this means?
• 28:21
  Carlos Cruz: That is about strategy. Because when you read textbooks on economics, they speak about perfect competition. Perfect competition is the ideal. Okay? Okay.
• 28:39
  Now I'm working with bigger companies. But in in when I started, I started with small and medium enterprises. Mhmm. And small and medium enterprises have no chance with perfect competition. Okay?
• 28:54
  Because perfect competition means mature product, means volumes, and they they cannot compete with the giants. And so Okay. The only way to they have to compete is they going after imperfect competition. So Uh-huh. Having a brand or having some differentiation in their product or in their service.
• 29:16
  That's why I I I I it's my my mantra is the perfect is the imperfect competition is is the the solution for for small and medium enterprises. Because Uh-huh. If they are trying to compete on price, they don't have any chance of winning.
• 29:37
  Dejan Kosutic: So if I understood well, this is more about differentiation and finding some niches that are not covered. Right?
• 29:42
  Carlos Cruz: Yeah. Yeah. It's about that. Exactly. About that.
• 29:45
  Dejan Kosutic: Yeah. But it seems to me this concept can also be applied to consultants, right, in their markets, finding niches and basically differentiating, right? Okay, yeah, it's very interesting.
• 30:01
  Carlos Cruz: Sometimes it's it's once I had company, an accounting company, that I I contacted them. Because they provide me work. And I contacted them and say, okay. Now I'm moving from one town to another. Do you want to be my accounting firm to do accounting of my company?
• 30:26
  And I it says something like this. No. Why not? Because we follow your ideas. You are not we are you are not our target customer.
• 30:35
  We work with export companies. So I found it a bit yeah. I find it interesting because they were they they're this okay. You you look it's something like this. I have this idea.
• 30:49
  Many companies look about think about customers as children. You know? Children in the sense of you you you are passing in front of a school, you see the playground, and children are running, and the recess are running, and you say, look, the children. It's something that is collective. Okay?
• 31:09
  Dejan Kosutic: Uh-huh.
• 31:10
  Carlos Cruz: But at the end of the day, each we hope each of the oh, each one of those children will be at their home with their father and mother, and they will be a unique human being. Okay? Yeah. For their father. And that's why I think that small and medium enterprises and consultants should look into their customers as unique.
• 31:36
  Okay? To try to find out what is really relevant for them.
• 31:41
  Dejan Kosutic: Now speaking of competition and finding niches for consultants, what do you think, what would you recommend actually to other consultants? How can they find a niche which they can actually defend where they will be the best in the market?
• 31:58
  Carlos Cruz: So I believe that most for someone that is starting, if they already have some kind of previous experience, like working the example that I normally use is banking. I will never work with a banking industry because I don't know nothing about banks, about how they work or regulation or something. When a consultant is starting, think it's important to start in an area where they know they already know the the business. They already know. Yeah.
• 32:36
  Okay? Because they they they are sleeping and they know much more than any other consultants that have no experience that kind of business. So I would say start there. Okay? Start there.
• 32:49
  Even I have even before starting my even before starting working as a consultant, I I helped I was working as quality manager in a company. They were certified. Then I moved to another company, and then they had some they needed some help, and they asked me some some some help. And I was my my home at the time was very near that that company, and I went there. And so another possibility is if you are starting as a consultant, perhaps your previous employer can be Uh-huh.
• 33:26
  Uh-huh. Help because you know them, they know you and if you left them in the good terms perhaps they you can help.
• 33:35
  Dejan Kosutic: They can be our first client maybe.
• 33:38
  Carlos Cruz: They can be our first client.
• 33:40
  Dejan Kosutic: Yeah. Yeah. Very well. Okay. You mentioned to me earlier that you worked worked also with the Japanese.
• 33:46
  Is this correct if I understood well?
• 33:49
  Carlos Cruz: Yes. I one of the the chemical industry companies I work with was 51% Japanese. It was the first Japanese investment in Europe after the second world war.
• 34:04
  Dejan Kosutic: Oh. So Okay.
• 34:06
  Carlos Cruz: Around nineteen sixty something. And I worked for four years in that company. So the Mhmm. One of the one of the managers was Japanese, and there was a lot of Japanese coming there. Then I made some consulting work with a Japanese automotive automotive supplier here in my in my country.
• 34:28
  So yes, I worked with with the Japanese. I went to I work when I was working there, went to Japan sometimes
• 34:35
  Dejan Kosutic: Uh-huh. Uh-huh.
• 34:35
  Carlos Cruz: To see the the mother to see the mother company, the mother.
• 34:40
  Dejan Kosutic: Okay. And what is the approach, let's say, to management of Japanese compared to, let's say, Europe? There some differences and what can you learn from them?
• 34:50
  Carlos Cruz: My first experience or the first thing, the first shock was So I was a young chemical engineer, and I arrived at the company, and they said, okay. We don't care. They they didn't say like this, that we don't care you are a chemical engineer. You are going to work as an operator doing shifts Mhmm. For, I don't know, perhaps one year or nine months, one year.
• 35:15
  I don't it's it was it was many years ago. And so they that's so they they put us working in the in the shop floor. Working in the in the shop floor. Mhmm. I had another experience, so with that automotive company, where I worked very closely with the Japanese manager.
• 35:33
  And I remember we were looking into a a part for a prototype part for a car that I will not mention the name now, but yeah. But but it was in 1990. Okay? And it was it was mad because, say, they the guys in Germany that are drawing this part know nothing about injection molding. They the part
• 36:03
  Dejan Kosutic: was very
• 36:04
  Carlos Cruz: the part they were very complex or and the part was very complex or and so the time for injection take a lot of more minutes, more time than than than necessary. And so Yeah. It was my experience with them was and and and with them, I learned to love, you know, those techniques that we still use when we speak about the quality improvement, things like the Ichikawa diagram, so the fishbone, like the Pareto diagram, like the flowchart, yes, too. And we through them, I learned about Deming. So Deming and then Duran.
• 36:47
  So big masters. I still have the books with me. Big masters in the beginning of my life in quality. I started my life in quality. My approach was from with that, from there, from the quality improvement.
• 37:02
  And then when the company needed someone to to work in the 9,000 project, they picked me.
• 37:11
  Dejan Kosutic: Deming actually worked in Japan, right? This whole philosophy actually and Japan was something like what, twenty, thirty years I would say in front of Europe when it comes to this PDCA cycle continuous improvements, these kind of things. So it was quite an experience, guess, a learning experience for you when you worked there.
• 37:33
  Carlos Cruz: Think today still the biggest prize in excellence or in quality is the damning prize.
• 37:41
  Dejan Kosutic: Uh-huh. Uh-huh. Yep. Okay. You also mentioned earlier that you had, I would say, bad experience with a consultant while you worked at these companies prior to your consulting career and actually that this bad consultant was one of the reasons why you actually started consulting, right?
• 38:02
  Carlos Cruz: So I knew nothing about ISO 9,001 and my company picked me as the project manager and they contracted a big company. If I tell you the name, you will know the name of the company, big company. At the time, '89, there was no cell phones. Okay? So they we we had
• 38:30
  Dejan Kosutic: Hard to imagine. Yeah. Yeah.
• 38:32
  Carlos Cruz: We had a library in in in that in our you know, in my company, there was a library, and they were working in the library. Library was the meeting point. And they had a phone, No? The the good old phones. And they were always always phoning, always receiving you are I I was thinking, you are here.
• 38:52
  You you should be work working with us, not working for others. So so even even today, when I go to start working with a customer, my phone is always in flight mode. Sometimes, for example, when I'm I'm I'm expecting to receive, for example, an Amazon delivery, I say, this is just for receive so just for sending a message or
• 39:17
  Dejan Kosutic: Yeah.
• 39:18
  Carlos Cruz: Or answering to the guys for but it's and so, you know, my company was a chemical industry plant. We were manufacturing PVC, polypyridyl chloride. Okay? And and they they presented us a proposal for our quality policy. Okay?
• 39:37
  Yeah. And some years later, I realized that the quality policy that they were they they were proposing us was exactly the same quality policy of Ford Motor Company. Okay? Oh. Exactly the same.
• 39:55
  So so, you know, that's why so, I will
• 39:57
  Dejan Kosutic: not follow this. Okay. Let let let's speak a little bit about these bad consultants. You know? Other than, let's say, them copying the documents between different clients, what would you say that characterizes a bad consultant?
• 40:14
  Carlos Cruz: So sometimes I see that I see some I I do audits. Okay? And I see through the audits what I see, I I sometimes my, I would say, my cynical side comes up and says, okay. These guys are selling are selling papers. Okay?
• 40:37
  So they develop a lot of papers to show to the customer, you see, you are paying, but you got you are receiving this amount of paper. So this is a lot of work. So Yeah. So a lot of bureaucracy is what I see. I think and and I believe that in today's world, because the if you have many many consultants that don't don't how to say don't differentiate themselves, and so they are working with winning projects with low prices.
• 41:22
  Okay?
• 41:22
  Dejan Kosutic: Low price, yeah.
• 41:23
  Carlos Cruz: And so what they do, they put so these are companies, and what they do, they put juniors coming out of school with no experience. And so it's it's not good because customers want someone that can someone that can provide them confidence. Confidence. They don't get that. Because you can be you they don't know the standard.
• 41:53
  You can be lying to them. Mhmm. If you are very confident that you are and you and you don't know the standard, you can lie to them and they they accept what you say. Okay? Or another thing that I see is that that I I call it they already have a can a can solution.
• 42:10
  Solution and they say this is the only way. Okay? I sometimes when I speak about the job of the consultant I say it's something that opens minds. Okay? Can open minds because they customer think that there's only one solution.
• 42:27
  I said, no. Look into the standard. If you look into the standard, the standard doesn't say how to do it. Okay? So we can we are free.
• 42:36
  We that we have there there's a lot of of degrees of freedom to do to do how to do it. So, yeah, I think it's it's it's that because they they have a they have a a solution, and they want to provide that solution at all cost because Yeah. Because they they don't want to move away from the path that they are confident there in that path.
• 42:59
  Dejan Kosutic: Because they either don't know anything else or they simply don't want to, let's say, spend more time helping you out with some potential different solutions. This is definitely yeah. It's Yeah. A bad a bad consultant, I would say. Yeah.
• 43:14
  Carlos Cruz: Once I was auditing I don't know now the name. It's it's it's a company where people go there to filtrate their blood. I don't know remember now the the the name. But we go there. They stay there for two, three hours to filtrate the the their blood because they have liver problems.
• 43:40
  The liver is not working well. And I was doing an audit, preparing an audit. They they they provide me their procedures. And and in the middle of a procedure, I saw something that was taken out from an abattoir, okay, where where they kill animals to to to to for for people to eat later. Okay.
• 44:05
  So an abattoir. So and it's what? Because they were they were copying copy pasting, and they forgot to remove that part from from procedure. So
• 44:16
  Dejan Kosutic: yeah. Okay. Yeah. No. It's funny.
• 44:20
  Yeah. Okay. Anyway, good. So you actually are doing the consulting work, but you are also working as a certification auditor. You also work as a trainer.
• 44:31
  So how does this work of a trainer and certification auditor? How does this actually help your consulting work?
• 44:49
  Carlos Cruz: So as an auditor doesn't provide me more work, okay? But as an auditor it provides me confidence in what I do, I'm doing because I see what others are doing and I say okay okay, good approach or okay, no, I will not follow this approach, okay? But it provides me so it's a kind of benchmarking, okay?
• 45:17
  Dejan Kosutic: And the learning experience. Right?
• 45:19
  Carlos Cruz: The learning yeah. Yeah. No. About training. About training.
• 45:23
  Yes. Training provides so so I'm I'm invited by companies for for training, for in house training or for intercompany training. And, yeah, from from time to time, there are some some some attendees that then invite me to do some some work there. Not so much implementation, but for example, quality improvement projects. Okay?
• 45:52
  Mhmm. So, like, the last one that I did was like improving efficiency, reducing stoppages and things like that.
• 46:04
  Dejan Kosutic: So what you're saying is that basically training opened doors for you. Right? It it gives you more clients access to more clients. Right?
• 46:12
  Carlos Cruz: Yeah. Yeah. Yeah. Yeah.
• 46:15
  Dejan Kosutic: I guess also, I mean, from my experience is that, when you do training, you also have to prepare yourself, so you actually, have to force yourself to learn about something if you want to present something to to to the students. Right?
• 46:29
  Carlos Cruz: Yeah. Yeah. I was for from some for some years, for almost ten years, I was invited to be to teach at the Catholic University here in in my in my town to teach about environmental management. And Uh-huh. One of the things that I like the most is when you are you are behind or in front of the the the blackboard or the whiteboard, and Yep.
• 46:58
  You it's something it's some the the the experience is a kind of distillation. Everything that you learned is going to be put there. And you see people, and you you are working with people that know nothing about, so their knowledge so you have to you they don't have experience, working experience. You have to to to think about to do some gymnastics to make them to pass the message. And I like that.
• 47:29
  And and because of that, we need to use more examples and and I like that because I think that we example people people can see much better and yes I and and and as as you said it I sometimes I found I find different approaches when I'm preparing this training because I hey. I I'm talking about the so, for example, about clause four point two and four point one. So about context and interested parties and the relationship with risks. Okay? Mhmm.
• 48:04
  When I'm doing training, I already found different approaches. Okay? That I didn't was not using as a consultant, but, overall, this is a different a possibility. Okay. Let's let's let's develop, let's invest in this.
• 48:19
  So, yeah, it's a learning experience for us too.
• 48:25
  Dejan Kosutic: Great. So, how did this doing consulting actually back in the 1990s or 2000s, how is it different from doing consulting nowadays?
• 48:35
  Carlos Cruz: Oh, I think now it's more difficult than thirty years ago. You know? Because in my country, thirty years ago, when a company wanted to implement a management system, they would say, okay. I would say to them, okay. We you need someone to be the the project manager.
• 48:59
  Mhmm. I will need 75, 80 percent of the time of that person to for the project because you want to implement this in one year or one year and or fourteen months or something like that. So okay. And there's there was no problem. Now they would say, no, Carlos.
• 49:19
  We cannot give you someone with 80% of the time. So we can provide you someone with 40%, fifty %. Mhmm. So companies are people are in more stress, more demanded. They it's it's more difficult.
• 49:36
  I believe it's and the and the and the in the whole company, it's like that. So in the world company, so there are no slack. Oh, yeah. Okay. How difficult?
• 49:47
  Dejan Kosutic: Okay. From the racehorse point of view, yeah, definitely. But okay. But I mean, the technology has changed. I mean, okay.
• 49:53
  There were no cell phones, right, back then. Almost no computers back then. So, this point of view, collaboration point of view, how does this really change the consulting business?
• 50:07
  Carlos Cruz: Example, today this is my third meeting. Okay? Like this. Okay? So last week I worked for three days, not three days, but I had three meetings with a customer 300 kilometers away from my office in through Zoom or Teams or yeah.
• 50:31
  You know? So that's a a big difference. Okay? Yeah. That's a big difference.
• 50:36
  So more and more, we are doing remote work. Mhmm. And when we are also using these kind of technologies like some of those technologies I learned from you, like Slack, like from you like Slack, Notion and they are fantastic for this kind of collaborative work, are fantastic.
• 51:04
  Dejan Kosutic: Definitely they are.
• 51:05
  Carlos Cruz: Almost no emails needed.
• 51:08
  Dejan Kosutic: Yeah, yeah, actually I do a webinar on this and explain for a full hour how to use these tools. Now what do you see, what do you think, how the consulting business will change in the next, let's say ten fifteen years?
• 51:23
  Carlos Cruz: So I think that, again, low cost consultants will will feel the the manners, like the say so, feel the the the threat from AI. Okay? Mhmm. Mhmm. Yeah.
• 51:42
  AI. But I always remember, I use it a lot of time, a saying from Kasparov, Gary Kasparov, the the chess player. He I I read I don't know if it is true, but I it's in my mind. I I read something like he said, if a human a fantastic human chess player plays against Deep Blue, Deep Blue wins. But if a normal human plays help with a computer, plays against Deep Blue, the human team will win.
• 52:17
  So I believe that consultants that that do some kind of differentiation and work together with AI, they can they can they continue to to work as consultants because there is the human side, the human experience, there's the there's the hallucination from AI also. Okay. But that that that team, AI and consultants can make a difference I believe. Okay make
• 52:54
  Dejan Kosutic: a Yes yes.
• 52:55
  Carlos Cruz: You can provide more work in less time. You can yeah you can you can work or you can develop all your work based on initial information from AI. Yeah. Yeah.
• 53:12
  Dejan Kosutic: And you you can definitely perform a better analysis. Right? You can actually summarize much more information in less time, and then you can make some conclusions. And these conclusions actually have to be made by a consultant or or by a human being, right, to to make actually some some strategic insight. So I don't believe really this that AI will be able to do this in the next ten to fifteen years, but this kind of summarization, the analysis is definitely something AI can help a lot.
• 53:41
  This is definitely our way to go.
• 53:43
  Carlos Cruz: Yeah. This and also, again, this all this this remote approach, I think will will be more and more used. And and, you know, there's that webinar on the remote audits that I say, and it's really it's really true. If you are looking you are studying a document through Teams or Zoom, it's it's more effective than if you are reading the document with people speaking at your side and in in in on-site. It's it's it's still blows my mind that yeah.
• 54:21
  It's okay. So yeah.
• 54:24
  Dejan Kosutic: Yeah. Okay. So let's let's with this thought, let's let's draw this this episode to its end. So maybe just for the end, what would you say could be, let's say, top three things that consultants should be doing and top three things that consultants should not be doing? Just to kind of summarize, you know, what makes a successful and unsuccessful consultant?
• 54:52
  Okay.
• 54:55
  Carlos Cruz: I I can I can say, I can use my experiences? First, study, study, study. Okay? On and so try to be an expert in the topic that you are Mhmm. Helping others with.
• 55:11
  So study, study, study. Yeah? Then the other would be some look into these these tools that can help in your work. So tools that can make the the the collaborative work more more easier easier. Yeah.
• 55:34
  I think it's and and, of course, do some so do something to earn attention. Okay? Mhmm. Promote, I know consultants that pay for pay for someone, for some companies doing cold calling and so and so and so. So if you are happy with that, go ahead with that.
• 56:01
  Okay? I I think it's it's important to to try to earn attention. Mhmm. So show that show that you are an expert your ideas, with your opinions, with your work. So promotion is important.
• 56:21
  Mhmm. So about what not to do, I would I so that's more difficult I would say
• 56:30
  Dejan Kosutic: Don't go with low cost.
• 56:32
  Carlos Cruz: Don't don't go with low cost. You you can only go with low cost when you are when you live at your parents' house or something like that. Because when you have to pay the bills, okay, and when you when you you need to invest in your education. So for example, I I didn't mention before, but in my first years, I went to The United States to I was a member of the American Society for Quality. I went there for the the the the annual conventions and then for some ISO nine thousand one special conventions.
• 57:10
  I went there six or seven times, and I found it very, very useful because the the the speakers were very open. They they gave a lot of information. It was it was fantastic. So you need to invest in your education so don't go low cost or run away from low cost as soon as possible. Okay?
• 57:31
  Dejan Kosutic: Yeah yeah.
• 57:31
  Carlos Cruz: And don't don't be rigid in your approach so try to be flexible, try to listen to to the the others, to customer. I think that it's it's those two that And respect the time that you that the customer is paying you. And respect the time that the customer is paying you.
• 57:58
  Dejan Kosutic: Yeah. Great. These are really great tips and and let's bring this conversation to the end. So these are really great insights and I think a lot of consultants, you know, cyber security and non cyber security consultants can learn a lot, you know, from from these insights. And thanks, Carlos.
• 58:18
  It's been a pleasure talking to you today.
• 58:21
  Carlos Cruz: Oh, thank you. I hope I could provide some ideas for your audience, okay?
• 58:29
  Dejan Kosutic: Yep, yep, okay. Thanks, bye bye.
• 58:32
  Carlos Cruz: Thanks, bye bye.
• 58:35
  Dejan Kosutic: Thanks for making it this far in today's episode of Secure and Simple podcast. Here's some useful info for consultants and other professionals who do cybersecurity governance and compliance for a living. On Advisera website you can check out various tools that can help your business. For example, Conformia software enables you to streamline and scale ISO 27,001 implementation and maintenance for your clients. White label documentation toolkits for NIS 2, DORA, ISO 27,001 and other ISO standards enable you to create all the required documents for your clients.
• 59:12
  Accredited Lead auditor and Lead implementer courses for various standards and frameworks enable you to show your expertise to potential clients. And a learning management system called Company Training Academy with numerous videos for NIS2, Dora, ISO 27001 and other frameworks enable you to organize training and awareness programs for your clients workforce. Check out the links in the description below for more information. If you like this podcast, please give it a thumbs up, it helps us with better ranking and I would also appreciate if you share it with your colleagues. That's it for today.
• 59:51
  Stay safe.