Oxebridge has filed a complaint against the UK-based certification body United Registrar of Systems (URS), alleging it violated accreditation rules by issuing an ISO 9001 certificate to another CB in Russia.
URS is accredited by multiple international accreditation bodies, but falls under UKAS for its operations in Russia. Under that accreditation, URS is required to operate in compliance with ISO 17021-1. That standard, meanwhile, declares that any accredited CB is prohibited from certifying the quality management system of any other CB. Specifically, clause 5.2.4 of that standard reads:
A certification body shall not certify another certification body for its quality management system.
Nevertheless, URS issued an ISO 9001 certificate to Russian Register (RR), a well-known CB operating out of the Russian Federation. RR also holds ISO 14001, ISO 45001 and OHSAS 18001 certificates from URS.
The restriction against the practice falls under the section of ISO 17021 dealing with conflicts of interest, a section which requires the CB to manage its affairs as to avoid such conflicts. It has been understood for decades that it is an insurmountable conflict of interest for one ISO 9001 CB to certify another ISO 9001 CB.
Typically, ISO 9001 does not apply to certification bodies anyway, as that is what ISO 17021 exists for. Sources from Russia have reported to Oxebridge, however, that Russian authorities often don’t understand the maze of ISO standards, and demand that CBs like Russian Register obtain ISO 9001, not ISO 17021. Rather than try to educate Russian government officials, CBs in Russia “shop” for a CB to issue them an ISO 9001 in order to participate in government tenders.
Most credible CBs avoid the arrangement, but URS has apparently elected to ignore the conflicts of interest and issued the certificates anyway. Sources reported that URS uses low-paid Indian auditors to serve the Russian market.
Witnesses in Russia have reported to Oxebridge that the arrangement is fully known to multiple oversight bodies, including UKAS. Allegedly, a physical copy of the URS ISO 9001 certificate is framed and hung in the lobby of RR, where UKAS auditors would have seen it during each annual office audit.
In addition, RR undergoes regular oversight audits by the accreditation bodies ANAB, RvA, IQNet and IAS, none of which have raised an issue with the URS certification. RR would have also undergone audits by the IAF regional body APAC.
Records indicate that URS has issued the certificate in March of 2017, although it is not known if RR held the certification with URS prior to that. The certificate expired in March 2020, but the URS website shows the certificate remains current, likely having been subject to a routine re-certification audit.
The IAF has taken no action on the issue, despite knowledge of the arrangement. The IAF is tasked with overseeing the enforcement of ISO 17021 rules through regional bodies, but routinely ignores violations in exchange for the collection of annual fees.
The scope of the ISO 9001 certificate issued to RR includes “consulting,” a service which certification bodies are prohibited from offering. The IAF refuses to enforce this rule, as well.
Russian Register also claims to offer AS9100 aerospace audits, but is not listed in the official OASIS database as an AS9100 certification body.
Oxebridge filed a complaint against URS in 2019 regarding its operations in Doha Qatar, also alleging conflicts of interest. Oxebridge closed the complaint after URS took action against a single employee, but is monitoring the situation due to what Oxebridge calls “poor root cause analysis.”
Normally, registrars respond to complaints through a “dilute & dismiss” trick, whereby they paraphrase the original allegation into a watered-down version, and then dismiss the complaint alleging it was already corrected. CBs never provide evidence, citing “confidentiality.” The URS complaint in this case, however, involves the violation of a single clear and unambiguous sentence in ISO 17021, so it will be difficult for URS to engage in the “dilute & dismiss.”
A copy of the latest complaint may be downloaded and read here (PDF).
It is common to get certified for 9/14/45 between counterparts. TUVSUD middle east certified by LMS Certification similarly SGS Gulf Limited certified by BSI and Intertek.
Registrars are allowed to certify each other for ISO 14001 and 45001. The only prohibition is ISO 9001. I will have to look into the cases you mentioned.