As recounted yesterday, ProShop ERP is in a bit of a mess of its own making. A few of its clients decided to use its QMS platform software to do some very dumb things, and rather than talk them out of it, ProShop helped them and then made a marketing campaign out of it. That has proved… unwise.

Ruh-Roh

But, as with all things in the ISO certification scheme, you know there’s some shady certification body (CB) skulking around in the root cause department. In this case, it’s the weirdo CB called IAPMO Systems Certification Body, which we’ll call SCB for short.

As I wrote the other day, in the middle of the ProShop webinar, one client bragged that their QMS was so good that the SCB auditor was able to cut their 2-day audit down to only four hours. The client was clueless that this meant (a) she was ripped off, since she paid for 16 hours of auditing she never got, and (b) her QMS flex isn’t what she thinks it is, since she got her AS9100 while the CB violated minimum audit day requirements. (See AS9101, ISO 17021-1 and IAF MD5, if you’re a nerd.)

Then, another SCB client — during the same webinar — threw up a slide showing that SCB scheduled their AS9100 Stage 1 and Stage 2 back-to-back, shoving a Wednesday in between them. This means that SCB’s scheduling office already decided there would be no findings during Stage 1 which would require the client to pause and take action on. And, surprisingly, there were no findings at Stage 1. In fact, there were no findings at Stage 2, either. Miracle!

Finally, the SCB auditor helped shoot a promotional video for ProShop ERP, telling everyone how great it is… another violation of ISO 17021-1 and AS9101. You see, CBs are supposed to be sober, mature professionals who remain objective and impartial. They aren’t supposed to be shooting videos (apparently during the audit?) for a QMS software company.

Here’s a screenshot, showing the SCB auditor in the video, next to the client, even wearing his official CB polo shirt:

So I went back to the archives here to see what I had on this wacko CB. There isn’t much.

IAPMO started as the “International Association of Plumbing & Mechanical Officials” out of Canada but then grew to have a network of third-world CB branch offices in countries like Indonesia, India, and even China. Some of these operate as IAPMO R&T, others as SCB.

Back in June of 2016, IAPMO was required to release a disclaimer that one of its reps, Michael Madewell, also ran an ISO consultancy called ISO Ready, and that IAPMO “expressly disclaims any implication that choosing to work with ISO Ready will result in a certification process that is simpler, easier, faster or less expensive.” Apparently, something happened back then that prompted this public clarification.

But keep that name in mind as you read on.

Blame the Website Guy

Fast forward to 2022, when the SCB website claimed accreditation for a host of standards it held no accreditation for, like ISO 14001. Brett Pollack, SCB’s director, wrote back and pulled the old excuse of, “We just had a full rebrand and new website launch … and still working out the kinks daily.” Yeah, right.

When I pointed out that his website also claimed SCB was a “CMMC Accreditation Body” — which is impossible, because The CyberAB is the sole CMMC Accreditation Body — Pollack just went silent. As these sorts of people tend to do.

Now, two years later, the SCB website still claims they are a CMMC AB. I guess it takes that many years for a highly credentialed cybersecurity auditing firm to fix a simple website:

By the way, I checked, and SCB isn’t even listed as a CMMC auditing body candidate.

Delete the Evidence!

Now we come to the shady shit they pulled with the ProShop debacle.

The video of the ProShop webinar popped up online one day after the webinar itself. As soon as that happened, I sent a complaint over to SCB, pointing them to the recording of this public event. I waited until the video was published so they couldn’t say I was making the allegations up out of thin air; now they could go see the video themselves.

I copied SCB’s accreditation body, ANAB, but Lori Gillespie is apparently on vacation or something (again?) so she still hasn’t read it yet.

Then, silence. But it was only the first day, so that’s not unusual by itself. CBs are required by ISO 17021-1 (and SCB’s own procedure) to acknowledge complaints, but one can’t expect them to do it in a few minutes. So I certainly didn’t think anything about it.

Until I learned that SCB had immediately contacted ProShop, and asked them to remove the video.

Let’s pause on that note.

First, this means that — yeah — SCB certainly did get the complaint. But then, rather than follow the rules and acknowledge receipt before doing anything else, their first instinct was to be utter boltheads and try to get the evidence taken down.

These window-lickers claim to be ISO 27001, NIST-800 and CMMC certification auditors — you know, cybersecurity experts — but they think if a video is uploaded to the internet, no one will download it? That they can pretend this never happened? I mean, the first thing I did when I saw the ProShop video go up was download it, because I knew someone would try to erase it.

Ignoring the absolute stupidity of SCB’s move here, it’s very troubling that their first instincts were to contact the software vendor instead of their auditors, and then to cover up the crime scene. This suggests, then, that the auditors are a symptom of a far bigger problem within the corporate culture of IAPMO SCB.

If I were SCB, I’d be silently pulling the audit reports of the two clients, and checking how many days the auditors listed on the report, to see if they just full-on falsified an aerospace record. Then, I’d talk to the scheduler to see why they put Stage 1 and Stage 2 back to back. And then, I’d get on the phone to the auditor and ask him why he thought it was a good idea to shoot a promotion video for a QMS consulting company.

But, no. Their first action was to have the video removed.

But that failed because, I’m guessing, SCB eats paste and paint chips. ProShop doesn’t own the video; it’s the property of Modern Machine Shop, which is owned by Gardner Publications. You can bet that right now, SCB is pleading with Gardner to take the thing down.

So I wrote to SCB again, calling them out on this and telling them it would have no effect, since I already saved the video. I again cc’ed Gillespie at ANAB but also added SCB’s VP, Shirley Dewi. Now she’s no saint, but maybe she had no idea of the shitshow going on at the hands of her lieutenants.

Oh, then I got an acknowledgment of the complaint. And who wrote it? Michael Madewell.

LOL.

And it’s the usual copy-and-paste nonsense, invoking their “procedures.”

Well, guess what? I read their “internal procedure,” and there’s nothing in it giving them permission to delete evidence. Here, you read it. Do you see anything about that?

I’ve since entered an OASIS ticket so the AS9100 oversight bodies can ignore be aware of the matter, too. But we all know how this ends. ANAB will hide its head in the sand, the IAQG will do nothing, the video will be removed, and some lawyer will threaten me with copyright violations if I re-publish the video myself.  Then, one of the ProShop clients will probably send a cease-and-desist letter about my opinion piece pointing to the stuff they said in public, as if I’m the bad guy here. Everything will continue as normal, and people will still be able to get quickie AS9100 certs from CBs who apparently have nothing but disdain for core concepts like objectivity and impartiality.

And then airplanes will keep falling out of the sky, because this entire industry has become a joke.

So, now, what should have been just a dumb thing some clients said in the heat of a marketing moment has become a full-on industry scandal. We have a CB trying to delete evidence, ANAB having to come up with some reason to avoid doing their one job, the IAQG ICOP overseers possibly having to step in, and the legitimacy of AS9100 audits once again being questioned.

And it’s only Thursday.

UPDATE 2:26 PM Eastern, 18 April 2024: As expected, the webinar video has been taken down, so it appears SCB was successful in getting the evidence deleted. To any investigators, I have a copy if you need it.

CORRECTION 22 April 2024: I misreported the dates for Novo Modo’s Stage 1 and Stage 2, saying they were separated by a Saturday and Sunday. In fact, Stage 1 was performed on Tuesday, with Stage 2 on the Thursday of the same week, so they were separated by a single day (Wednesday). I have updated the reporting above.

UPDATE 26 April 2024: the faces of people in the screenshots have been digitally obscured upon the request of ProShop ERP.

Advertisements
Traditional Tri-System