Bureau Veritas Contract Combined Certification and Consulting Services [UPDATED]

[UPDATED – see below.]

Oxebridge has learned that the Saudi Arabian office of Bureau Veritas, an accredited ISO 14001 registrar, was contracted to provide ISO 14001 documented procedures, potentially in violation of ISO 17021-1 accreditation rules.

The Public Transport Company (PTC), a joint venture between RATP-Dev and SAPTCO, contracted with Bureau Veritas in March of 2016 for “system development support” which included a project directive “to prepare management system documentation for PTC against the requirements of ISO 14001:2015, OHSAS 18001:2004 and ISO 50001:2011 standards.”  The contract included a statement that the “scope is limited to preparation of documents only and not the implementation.” The agreement came after PTC met with Bureau Veritas in their Riyadh office in February. The value of the contract was 420,000 Saudi Riyal, or nearly $120,000. The full set of services included a gap analysis of PTC’s current maturity against the three standards, followed by development of management system procedures.

Bureau Veritas is accredited for various standard certification schemes by both ANAB in the US and UKAS in the UK. Oxebridge is still researching which accreditation body holds the accreditation for the Saudi Arabia office of BV, specifically for ISO 14001.

Bureau Veritas is accredited under ISO 17021-1 which specifically prohibits a registrar from offering consulting services. Clause 5.2.5 of those rules indicates:

The certification body and any part of the same legal entity and any entity under the organizational control of the certification body shall not offer or provide management system consultancy.

That standard then defines “management system consultancy” as: “participation in establishing, implementing or maintaining a management system” and then gives a specific example of such consulting, saying this includes “preparing or producing manuals or procedures.”

Recall that the contract specifically tasked Bureau Veritas with “preparation of documents“, meaning the contract nearly used the exact wording ISO 17021-1 uses when defining prohibited practices.

The contract raises further concerns because despite the scope of work being the development of management system procedures, the bulk of the contract appears to have come from Bureau Veritas’ standard management system certification contract, as the terms and conditions all refer to certification services. This results in an entangling of the documentation preparation services described in the scope of work with Bureau Veritas’ certification services defined in the rest of the contract, linking them together in a single, legal contract issued by the BV certification office.

Making the contract more curious is the inclusion of an unusual requirement inserted into the “Acceptance Terms” intended to prohibit PTC from disclosing the contract to third parties:

The contract is to be kept confidential and not to be disclosed to any third party including consultant(s) without prior approval of Bureau Veritas.

The fact that the condition specifically prohibited revealing the contract to “consultants” gives the appearance that Bureau Veritas specifically wanted it to remain out of the view of professionals who might have identified a conflict of interest and then taken action.

Oxebridge received the contract and a request to file a formal complaint from a representative of SAPTCO who indicated frustration with the arrangement, on the basis that ISO registrars are not supposed to provide consulting services. The source wrote, “I am just concerned on this practice happening in my country and I want this to stop.” 

The contract was approved by Bureau Veritas’ Saudi CEO Hanna Jabbour and PTC Project Director Thierry Mons. Both Mr. Jabbour and Mr. Mons have been contacted for comment, but have not responded to date.

Oxebridge has sent both ANAB and UKAS a copy of the contract, along with an note that a formal complaint would be forthcoming. A representative from ANAB wrote:

Please know based on feedback ANAB has received over the past two weeks, including information from another stakeholder as well as another accreditation body, we have already lodged a formal complaint within our system, the investigator has been assigned and the investigation is actively under way.

I can confirm, through public documents, that BVC Saudi Arabia is not a critical location under the ANAB accreditation for BVC; however, it is an additional office that is considered noncritical and its activity is certainly of interest to ANAB.

ANAB has already been in touch with BVC headquarters and we will pursue this seriously.

It’s not clear what a “critical location” means, and ANAB has been contacted for clarification.

No one from UKAS, Bureau Veritas nor PTC have responded to requests for clarification.

In the US, Bureau Veritas was recently temporarily suspended by ANAB for failing to properly transition clients coming from other registrars; that suspension has been lifted, but affected clients are now having to undergo entirely new audits to compensate for the suspect audits which caused the suspension. While these audits are being conducted by Bureau Veritas at no cost, Bureau Veritas is not compensating the clients for lost time or expenses associated with having to host their auditors and provide audit support for the re-audits. Oxebridge is appealing to ANAB to have them force Bureau Veritas to compensate clients affected by their suspension.

In 2015, Oxebridge filed a complaint against Bureau Veritas’ Australian office after it was discovered to have engaged in co-marketing with an ISO 14001 consulting firm that it had previously certified. The consultant, GreenBizCheck, was found to be making claims on its website that Bureau Veritas would fast-track ISO 14001 certification for their clients. Bureau Veritas claimed it had tried for years to get GreenBizCheck to remove the claims, although it only took Oxebridge a few days to have the material removed.

ISO 17021-1 is designed to provide firewalls between consultants and registrars in order to ensure the validity and trust of resulting management system certifications. Oxebridge has found that because certification bodies like Bureau Veritas pay the accreditation bodies like UKAS and ANAB, that the rules are rarely enforced, and often ignored.  Oxebridge routinely files complaints and engages in reform activities to improve the trust in ISO management system certifications,to improve the certification scheme for end users and the public.

UPDATE – 13 December 2016:

The investigation by Bureau Veritas’ accreditation bodies is turning into a confusing mess. Since this story was originally published on Dec. 7, we’ve confirmed that ANAB does not hold the accreditation for BV’s ISO 14001 work, but that UKAS does. Meanwhile, ANAB insists it — and not UKAS — is conducting the investigation. UKAS has written that it is “monitoring the actions being taken,” which could mean the actions taken by ANAB or by BV itself. Now, IAF signatory agreements could allow for one AB to investigate for another, but typically that’s only when it makes sense to do so; it makes no sense to have ANAB investigate for UKAS is UKAS is perfectly capable of doing so itself.

Furthermore, UKAS has also ruled on the “critical” location issue, indicating that the Saudi office is a critical location under its accreditation, even as ANAB said it wasn’t critical for ANAB’s accreditation, the latter of which we have determined doesn’t apply anyway.

So we are left with this state of affairs: ANAB doesn’t hold the accreditation and deemed the Saudi office as “non-critical” but is conducting the investigation anyway; UKAS has confirmed it does hold the accreditation and the Saudi office is “critical,” but is just monitoring… something.

We’ve also spoken with some other industry CB and AB experts who say in this case the issue of “critical” vs. “noncritical” office is irrelevant, as a CB cannot violate ISO 17021-1 no matter what address they do it from, if the people involved are working under the CB’s certification division, which is true in this case. I’ve reviewed the IAF and ANAB documents referenced by Lori Gillespie, and cannot find anything whatsoever that would apply in this case.

There’s another implausible explanation, but one that bears mentioning: it could be that PTC was sold a completely counterfeit service by people with nothing whatsoever to do with BV, but who were posing as BV officers. That means not only did they lie about their identities, but then had PTC sign a forged document. Our sources indicate that documents were delivered, too, so the counterfeiters would have not simply stolen the money, but also delivered the final service. That’s stretching belief to the breaking point, but stranger things have happened.

So far, however, the confusing cross-finger-pointing by UKAS and ANAB is not inspiring confidence in the validity of the ISO certification scheme.

The victims in this — PTC, RATP Dev and SAPTCO — still have not commented, but there is likely a potential for legal action given the monetary value of the contract, which may have been sold under less-than-honest conditions.

UPDATE 14 DECEMBER 2016:

I have received an email from BV KSA Chief Officer Hanna Jabbour that the issue has been formally registered in their system as a complaint:

This will be recorded as a complaint registered no. I&F-AGMFW7 in our system.

This means that UKAS is likely “monitoring” the processing of the complaint in BV’s system, whcih is consistent with typical practice: the AB usually allows the CB to work the complain first, before getting involved. Of course it would have been easier if UKAS simply said that, and it’s still not at all clear what ANAB is doing. But the ball is moving.