Two TUV SUD auditors were arrested in Brazil after being found to have certified the Vale tailings dam which collapsed, killing over 180 people so far. Authorities and investigators found that the two auditors had been pressured to provide Vale a passing safety certificate for fear that the company would fire TUV if they provided a truthful report.

It was later found that Vale had hired an earlier firm which also indicated the dam was in unsatisfactory condition; Vale fired that firm and hired TUV SUD to replace them, raising questions if Vale knew TUV SUD would ensure a  successful certification.

One of the auditors, Mr. Makoto Namba, told investigators that he was pressured by Vale to sign the safety certificate, and did so believing that if he did not TUV SUD would lose its contract with Vale, and he would be fired. Previously, Mr. Namba wrote in an inspection report that “everything suggests it won’t pass,” referring to the dam’s safety status.

Oxebridge has learned that Mr. Namba worked for a consulting firm Bureau de Projetos e Consultoria Ltda., which has an exclusive contract with TUV SUD. This would again raise concerns over conflicts of interest when allegedly independent certification bodies rely on private consultants to carry out duties, thus injecting a financial risk in their objectivity.

Similar such arrangements in the Arthur Andersen accounting firm led to the Enron financial scandal, resulting in Sarbanes-Oxley regulations. The accounting firm Ernst and Young allowed its sister certification body, EY CertifyPoint, to issue an ISO 27001 certificate to Equifax, which was later subject to the greatest personal data breach in history; that certification attested to Equifax having satisfactory controls to prevent such a breach.

The Brazilian construction company Odebrecht was found to have bribed dozens of South American political figures, which led to the ouster or detention of multiple political leaders including former Peruvian Presidents Alejandro Toledo, Alan Garcia, Ollanta Humala and Pedro Pablo Kuczynski. Despite this, Odebrecht’s construction operations in Peru continue to receive ISO 9001 certifications from the certification body Bureau Veritas.

It’s unclear what standard TUV SUD was certifying the Vale dam to, and what control procedures the auditors were held to.

TUV SUD has since suspended certifying any Vale operations, which are thought to include at least 30 other sites.

The two auditors have since been released by Brazilian police, presumably for having cooperated in the investigation.