The certification body SRI Quality System Registrar has closed a complaint filed last year, after its client SP Scientific was charged by the US government for multiple violations of ITAR.
The International Trafficking in Arms Regulation prohibits companies from allowing the escape of sensitive technical data to foreign nations. The US Bureau of Industry and Security (BIS) charged SP Scientific with multiple violations, including exporting technical data to China without a permit. SP eventually paid $80,000 in fines to settle the case.
SP Scientific was certified to ISO 9001 both during and after the incident, raising questions on how SRI not only could have missed the violations during its routine ISO 9001 audits, but then allowed SP to maintain its certification after the publication of the BIS charging letter. Oxebridge filed a complaint with SRI on the matter in June of 2022.
At first, SRI could not find records that showed SP was even certified by it, and resorted to Google searches on the SP website to verify their own certification. That suggests SRI was not in compliance with its accreditation requirements under ISO 17021-1, which requires a CB to maintain a directory of its certified clients.
Eventually, the certificate was found, and SRI processed the complaint.
Now, nine months later, SRI management has responded saying that the matter is closed, but without any evidence of corrective action or any details on what was done. SRI’s VP of Certification, Ed Maschmeier, simply wrote:
SRI conducted a corrective action follow up on 2/10/23 and the issue you notified SRI of is considered resolved.
The letter did not even reference the original complaint, prompting Oxebridge to search its own records to see what SRI was responding to.
Based on a prior email from SRI, which indicated it had requested corrective action by SP, it appears that SRI did not investigate its own culpability in the matter, such as checking why its auditors did not uncover the problem during an ISO 9001 audit. Instead, SRI appears to have pushed the matter solely back on SP.
At no point did SP lose its ISO 9001 certification, and the company’s website still shows it as certified.
The incident raises another question as to what ISO certifications are attesting to if companies can violate the law, be caught and penalized, and yet still maintain certifications attesting to the validity of their management systems.
