As international organizations seek to distance their support of Russian defense and manufacturing companies currently under international sanctions, such is not the case for the AS9100 certification scheme actors. A review of official OASIS data, published by the International Aerospace Quality Group (IAQG), reveals that crucial AS9100 certificates have been granted — repeatedly — to Russian firms under sanctions.

As the Ukraine invasion continues, this is nothing less than shameful.

Technically, the IAQG is an international NGO, which grants it supra-legal powers, making it nearly answerable to no court in the world. It’s based out of Belgium, which still puts it under the control of EU regulations.

But the AS9100 standards, OASIS database, and other related activities are actually managed and operated by the Society for Automotive Engineers (SAE), which is a US-based company located in Pennsylvania. SAE prefers to take a back seat to IAQG when controversy arises, but is the sole recipient of revenue when AS9100 standards are sold. SAE also receives fees from every AS9100 certified company for the maintenance of OASIS. There are likely other fees that SAE collects that I’m not aware of.

So SAE and IAQG both benefit from money collected from every AS9100 certificate granted to anyone, no matter where in the world those companies may operate. Unfortunately, that means SAE and IAQG are receiving money from companies under international sanctions.

None of the ISO 9001 or AS9100 certification/accreditation bodies apply any form of due diligence of “KYC” (know your customer) protocols to ensure they are not doing business with criminal organizations, terrorists, or other bad actors. The only requirement is that an applicant company must be legally registered in some country or another, and then pay its bill. This rules out any criminals operating informally in dark alleys, but doesn’t rule out state-sponsored, or state-run corporate criminal enterprises.

A review of official OASIS data showed that 108 AS9100 certificates have been issued to firms in Russia. Of these, I identified 36 that were for companies under current sanctions or prior sanctions which were in effect at the time the certificates were granted. Almost all of these are international sanctions, meaning issued by the US, UK, EU, and other regional authorities. Four were issued by Ukraine and not necessarily picked up by the rest of the international community. Given that Ukraine is now under invasion by Russia, I think those sanctions matter.

Unsurprisingly, the overwhelming bulk — 20 out of 36 — of these were issued by Quality Austria. The rest were issued by Russian Register, the TUV companies, Bureau Veritas, and DQS. Of those certified by QA, many of these were large-scale certificates issued to “multiple sites” or “campuses.”

There are multiple problems with Quality Austria’s open support of Russia and its criminal actors. First, Quality Austria issued many of these certificates to subsidiaries or daughter companies to Rostec, which has been under EU sanctions for years. Next, Quality Austria utilizes Rostec as its official certification body representative in Russia, meaning that Quality Austria is essentially certifying its own offices.

Worse still, this entire arrangement has been blessed by Austria’s official accreditation body, Akkreditierung Austria (AA), an official Austrian government office. AA has refused to enforce accreditation rules prohibiting Quality Austria from certifying its own offices, nor has it sought to enforce EU sanctions. AA receives a percentage of every ISO or AS certificate sold by Quality Austria, so they have little incentive to enforce the rules. (We have a current case running in the Vienna criminal court where we allege AA officials received bribes in order to overlook how QA certified its own consulting clients in Qatar.) Austria, meanwhile, has positioned itself as one of Europe’s staunchest allies to Russia and Vladimir Putin.

So it’s not an accident that Quality Austria is ignoring international law, and continuing to do business with Rostec and other sanctioned Russian firms. (One source has indicated to me that top executives at Quality Austria not only knew about the sanctions, but intentionally pursued certifying the sanctioned companies to grab market share that no one else wanted.)

Now remember that AS910 is a defense standard, meaning IAQG, SAE, and the rest are helping the same Russian state-run companies now involved in the Ukraine invasion (and, previously, that of Crimea) to win new business. That is literally aiding and abetting the enemy. Oh, and they’re collecting money for the service, too.

The same is true over at the commercial side of certification. The IAF and accreditation bodies like UKAS, ANAB, Akkreditierung Austria, etc., are benefiting from the sale of ISO 9001 certifications to sanctioned Russian companies. Unlike what we have with OASIS, there’s no central registry of ISO 9001 certificates and no way to crunch the numbers. The (poorly populated) IAF “CertSearch” database doesn’t allow for searching by country, only by doing one-off searches by company name; even then, it limits this to only 10 searches at a time, making the database entirely useless.

The IQNet database is a bit more useful, and IQNet is — like IAF and IAQG — willing to work with sanctioned companies and enemy actors all day long. That database shows the Russian firm Gazprom, for example, holds ISO certificates issued to at least 25 of its companies, issued by (again) Quality Austria and DQS. (In this case, DQS is the majority player.) The IQNet database only reports 25 results, so the actual number of Gazprom companies certified may be much higher.

But IAF, IQNet, IAQG, SAE and others may find themselves isolated quickly on the world stage. Organizations the world over are distancing themselves from Russia, and canceling contracts or banning them outright. FIFA, IOC, UEFA — even Eurovision! — are ejecting Russia. The typically neutral government of Switzerland is joining the movement, something that will apply pressure on ISO itself, which operates out of Geneva.

There is a solution, however, and it’s twofold:

First, the IAF must order that any sanctioned company anywhere in the world (not just Russia) have its certification revoked immediately. IAQG will be forced to follow suit, since it operates under the IAF’s mandatory procedures.

Next, IAF must develop a new Mandatory Document (MD) that requires accreditation bodies and certification bodies to perform KYC protocols, denying access to certification to companies involved in criminal activities or under sanctions. Certification or Accreditation Bodies who ignore the new MD must then be de-listed entirely, and ejected from the certification scheme.

To be clear: the IAF and IAQG are obligated to abide by international law. They may feel above the law, but are not actually so.

To download a PDF of the OASIS data of Russian companies, click here.

About Christopher Paris

Christopher Paris is the founder and VP Operations of Oxebridge. He has over 30 years' experience implementing ISO 9001 and AS9100 systems, and is a vocal advocate for the development and use of standards from the point of view of actual users. He is the author of Surviving ISO 9001 and Surviving AS9100. He reviews wines for the irreverent wine blog, Winepisser.


Traditional Tri-System