[Updated 24 Feb 2015; see below.]

Honda is reeling from a massive recall of its automobiles, prompted by the discovery that three plants of supplier Takata were supplying defective airbags. The airbags, when deployed, run the risk of sending shrapnel into the drivers. To date, five people have been killed, and Honda has replaced its CEO. Millions of vehicles being recalled, and the full financial toll on the automotive industry is yet to be tallied. Takata and Honda have been accused of a ten-year plot to hide and destroy test data that revealed the flaw. A criminal investigation is underway.

The three plants were operated by Takata subsidiary Inflation Systems Inc. (ISI), in Moses Lake WA, LaGrange GA and Monclova Mexico. All three were ISO/TS 16949 certified. So far, the registrar hasn’t come forward, and finding records of the certifications is proving difficult. Oxebridge has reached out to former Takata employees, and hopes to have an answer shortly.

The disaster is yet another blow to the ISO certification scheme, which Oxebridge argues has become a “pay to play” scheme whereby any organization that is willing to pay can obtain and maintain ISO 9001 or related certifications for years, regardless of product or service quality. Oversight for the scheme is supposed to come from IAF-signatory Accreditation Bodies, such as ANAB in the US and UKAS in the United Kingdom, but the revenue structure creates a built-in conflict of interest: Accreditation Bodies are paid by the Certification Bodies they accredit, creating a “negative incentive” for the ABs to enforce rules.

Other disasters that occurred under ISO or related certifications include the Bridgestone-Firestone recalls, the Space Shuttle Columbia disaster, the TUV breast implant scandal and most recently the Orbital Sciences rocket explosion.

The accreditation rules codified in ISO 17021 — which is written by CASCO, a group dominated by CB and AB representatives — allow registrars to dodge responsibility through the claim that all certification audits are “a sample.” The standard reads:

4.4.2 The certification body has the responsibility to assess sufficient objective evidence upon which to base a certification decision. Based on audit conclusions, it makes a decision to grant certification if there is sufficient evidence of conformity, or not to grant certification if there is not sufficient evidence of conformity.

NOTE Any audit is based on sampling within an organization’s management system and therefore is not a guarantee of 100 % conformity with requirements.

9.1.9.8.2 The closing meeting shall also include … advising the client that the audit evidence collected was based on a sample of the information; thereby introducing an element of uncertainty.

Under CASCO, the rules have been consistently diluted to favor Certification Bodies over the needs of end users or the public. In the next draft of ISO 17021, CASCO has dropped two key provisions which would normally help protect the public: the requirement for CBs to maintain an objective Impartiality Committee, and for CBs to maintain a public registry of the certifications they have issued. No ISO 9001 end users were consulted on the changes.

Worsening matters are moves by top industry officials which empower the unaccredited, or self-accredited, “certificate mills.” These organizations print certificates for anyone willing to pay, without conducting proper audits. Recently, a senior official within the IATF International Automotive Oversight Board announced the IATF would have to honor any ISO/TS 16949 certificate bearing any accreditation mark, regardless of whether it was a certificate mill or not. When questioned, IATF representative Joe Bransky refused to denounce the practice, and instead invoked an unheard-of privilege claiming he did not have to respond to Oxebridge questions on the matter, because he did not recognize Oxebridge as a stakeholder. Only certification bodies, Bransky argued, were “parties at interest.”

Joe Bransky has been asked to comment on the Takata scandal.

A 2014 sting operation by Oxebridge revealed certificate mills, including Guberman G-PMC LLC and QualityMasters, agreed to certify “LifeSink LLC,” a fictional manufacturer of cement life vests designed to kill the wearer, even after being supplied with “test data” that showed the product was measured in fatalities. The mills also agreed to certify the company without conducting an actual, on-site audit.

The certificate mill G-PMC was recently discovered to be issuing certificates to “standards” invented by the mill itself, without even providing a copy of the standard to its clients before issuing a certificate. These standards allege to provide certification standards for manufacturers of automotive parts as well as aerospace components, medical devices, Kosher foods, and medical marijuana. Under the IATF ruling, such certifications would have to be honored.

Because of lax industry oversight, the lines between the accredited registrars and the certificate mills are blurring. Oxebridge maintains this increases risk for companies achieving ISO certifications despite bad quality and corrupt practices, such as in the ISI plants.

“A class action lawsuit is likely in the waiting for the registrar who issued the Takata ISO certifications,” Oxebridge VP Christopher Paris said. “We’ll be watching this closely, and cooperating with anyone involved in the investigations or litigation.”

Oxebridge has been pressing for industry reform for over a decade, based on evidence of abdication of responsibility by the Accreditation Bodies and standards bodies, including ANSI and ISO.

UPDATE 24 Feb 2015: Oxebridge has learned that Takata’s North American HQ was previously certified to ISO 9001 by Entela in 1996. Entela was purchased by Intertek in 2004, but Intertek reports that they have no record of any Takata or ISI certs in their system. A search of the older Entela files found nothing as well, but those do not go as far back as 1996.

UPDATE 2: Oxebridge has learned that Takata’s ISO/TS 16949 certificates are currently issued by Det Norske Veritas (DNV-GL.) This may not reflect the North American and Mexico operations, however.