Readers may have noticed we are currently dealing with two high-level complaints related to the same theme. Complaints against SIS Certifications in India and QSCert in Slovakia both center on the point that the CBs achieved accreditation in one country, but then offer accredited certification in dozens of other countries not listed on their official scope of accreditation.
Stating the Obvious
Clearly — and it’s ridiculous that I need to say this out loud — that was not the intent of IAF-backed accreditation. In fact, when the IAF was being cooked up, it promised both ISO and the World Trade Organization that it was going to prevent these sorts of practices.
Unfortunately, the IAF — led by Canada’s Elva Nilsen — has long since stopped doing much of anything other than marketing. Case in point: IAF “Mandatory Document” MD 12 (“Accreditation Assessment of Conformity Assessment Bodies with Activities in Multiple Countries“) lays out the official rules for this exact scenario, so the entire controversy should be dead on arrival… right? One would expect MD 12 to resolve this issue.
Except that MD 12 was published in 2016 and hasn’t been updated since. So even though MD 12:2016 is the most current version, and still cited by IAF in official publications, that document itself is technically “abandoned.” This is because MD 12 first relies on the definition of a CB’s “key activities” by referring to another document, IAF/ILAC A5, that was officially withdrawn in 2017. Then, MD 12 relies on key clauses of ISO 17011, the standard for accreditation bodies, but references clauses from the obsolete 2004 version. The clauses called out don’t exist at all in the current 2017 version of ISO 17011.
So the IAF has sat on an obsolete version of MD12 since, at least, 2017. That’s six years ago, for those doing the math on their fingers. With all their money and international power, we are to believe that IAF couldn’t update this document in six years.
Power Vacuum
And now the chicken comes home to roost. Seeing an opening, CBs have taken advantage of the chaos and began the practice of getting accredited in one country, and then conducting audits in every other country in the world. Again, that was never supposed to be possible, and the IAF promised it wouldn’t happen.
The biggest change since MD 12 was published is that the latest ISO 17011 does away with the idea of “key activities,” which is where the offending CBs hang their hats. Under the old set of rules, a CB only needed to get accredited where they conducted “key activities” such as managing the audits, not physically performing them. In fact, those rules said something to the effect that “what matters is where audits are managed, not where they are conducted” (I’m paraphrasing.) But this was language carried over from the 1990s, before anyone had any idea that any single CB would be doing the bulk of its work using contract laborers in 50+ countries not covered under the accreditation.
Since then, ISO 17011 was updated and the idea of “key activities” was dropped entirely. Now, the various rules discuss “locations” or “entities” used by the CB where conformity assessment activities — meaning audits — are performed. From ISO 17011:2017:
7.4.5 The procedures shall ensure that the assessment team assesses the performance of a sample of the conformity assessment activities representative of the scope of accreditation. The assessment shall cover a sample of locations and personnel to determine the competence of the conformity assessment body to perform the activities covered by its scope of accreditation.
And:
7.8.1 The accreditation body shall provide information on the accreditation to the accredited conformity assessment body that shall identify the … (d) locations of the accredited conformity assessment body and, as applicable, the conformity assessment activities performed at each location and covered by the scope of accreditation.
NOTE: The information can be provided in an accreditation certificate or other suitable means (e.g. electronic media).
In fact, the withdrawal notice for IAF/ILAC A5 clearly says the document was no longer necessary because ISO 17011 had been updated to make these rules clearer. So there’s not much ambiguity here.
But while ILAC may have formally withdrawn its documents, the IAF can’t seem to be bothered.
Meanwhile, we do have another IAF document that has not been abandoned, MD 19: “Witnessing Activities for the Accreditation of Management Systems Certification Bodies“. That document clearly states that AB witnessing of a CB must include “countries where audits in the certification process are performed.”
And another IAF document, MD 23 “Control of Entities Operating on Behalf of Accredited Management Systems Certification Bodies,” reiterates this point further, saying:
The [AB] shall decide on an assessment program of [the CB’s] entities in accordance with the requirements of ISO/IEC 17011, IAF MD 12: Accreditation Assessment of Conformity Assessment Bodies with Activities in Multiple Countries and other applicable documents and shall inform the local AB if applicable.
Yes, that document refers back to the abandoned MD 12 document (sigh), but if ignore that transgression and keep reading, we find this [emphasis added]:
ABs shall determine the frequency of assessment for each CB and its entities in an accreditation cycle based on the requirements of ISO/IEC 17011 and the applicable IAF documents.
What It All Means
So despite the mangled wording of all these documents, it’s still very clear:
- A CB must provide a list of the locations where audits are performed
- The AB must then audit at least a sample of those locations during an initial accreditation audit.
- Only then can the “locations” and “entities” be formally listed on the scope of accreditation.
- Over the accreditation period (typically three years), the full set of “locations” or “entities” must be audited by the AB.
So, if accreditation only applies to locations listed on the accreditation scope, this means — by reduction — accredited activities cannot be performed in locations not listed on the scope of accreditation. That’s in keeping with the IAF’s long history of what it’s supposed to be doing: preventing fraudulent certificates from polluting the ISO certification scheme.
And this means that, yes, technically, two IAF MDs have to be updated — MD 12 and MD 23 — and maybe some others that still refer to the “abandoned” MD 12. It’s an absolute mystery as to why the IAF hasn’t updated its documents, given the time and resources it has on its side. Unless we just yield to the reality that the IAF gave up giving a shit a long time ago.
I have now sent two requests to Elva Nilsen to clarify this point. For the first, she threw the matter over to a staffer who said they would not address it until complaints at the CB, AB, and IAF regional body level are exhausted — meaning, at least 3 to 6 years — and thus Nilsen has every intention of letting these obsolete documents sit idle. I sent her another request today, but have not yet heard back.
Nilsen should thank whatever antediluvian octopus-gods she worships for the fact that she landed a job at IAF. Because no other organization on the planet would allow her to collect a huge paycheck for doing nothing all day.
UPDATE 4 May 2023: A representative of the IAF says they will discuss the MD 12 problem with Elva Nilsen and Kevin Belson, the IAF Technical Committee Chair.
[Image credit: Midjourney]
Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years’ experience implementing ISO 9001 and AS9100 systems, and helps establish certification and accreditation bodies with the ISO 17000 series. He is a vocal advocate for the development and use of standards from the point of view of actual users. He is the writer and artist of THE AUDITOR comic strip, and is currently writing the DR. CUBA pulp novel series. Visit www.drcuba.world
