In a surprise move, the United Kingdom Accreditation Service (UKAS) has volunteered to investigate the certification body, United Registrar of Systems (URS), after Oxebridge reported it has certified another registrar in Russia.
The issue arose after an ISO Whistleblower user reported that URS had issued an ISO 9001 quality management system certification to Russian Register (RR), in violation of the accreditation rules under which URS operates. Those rules, called ISO 17021-1, prohibit one certification body (CB) from issuing a management system certificate to another CB. This practice is considered a threat to impartiality.
Oxebridge filed a formal complaint with URS, and submitted a copy to UKAS, which accredits URS to ISO 17021-1. As part of that accreditation. UKAS enforces ISO 17021-1 compliance through annual audits; it is not clear how UKAS failed to find the problem on its own, years prior.
URS responded by denying the complaint, inventing a justification that ISO 17021-1 allows URS to certify another CB if the scope of certification does not conflict with that of URS. In fact, ISO 17021-1 makes no such allowance, and denies cross-CB certifications entirely.
Oxebridge immediately rejected the complaint and announced its intention to escalate the matter to UKAS. Then, UKAS notified Oxebridge it was launching an investigation on its own, based on URS’ response. Oxebridge has followed up with a formal escalation anyway, in order to maintain the formal record.
The move is unusual because accreditation bodies such as UKAS are loath to process complaints against the CBs that pay their revenue. UKAS has previously sided with its CBs in official complaints even when evidence of crimes was provided. It is not clear why UKAS chose this issue to enforce, given its prior history of allowing such lapses to go un-investigated.
In a prior case, UKAS sided with registrar LRQA after it was discovered a company had broken contract bidding laws by submitting a forged “photoshopped” ISO 9001 certificate in order to illegally bid on a lucrative oil contract. The fake certificate contained the logos of both LRQA and UKAS, but rather than pursue trademark infringement or report the crime to officials, UKAS and LRQA colluded to grant the company a legitimate certificate in exchange for a 3-year auditing contract. The certificate was then dated the same day as the alleged audit, a technical impossibility that suggested the official certificate was, itself, fraudulent. UKAS then ruled that LRQA was within its rights to cut off all communications with Oxebridge, despite this violating ISO 17021-1’s requirements that CBs process complaints fairly and objectively.
In the current matter, it is not clear how URS’ position will survive any formal scrutiny, since the ISO 17021-1 standard is clear and unambiguous on its restriction of cross-CB certifications. But accreditation bodies have allowed CBs to “invent” interpretations of accreditation standards on the fly, including one that suggests the entirety of ISO 17021-1 is moot until a certificate is produced.
So far the International Accreditation Forum, which oversees UKAS, has not commented at all on the issue.
The IAF has refused to respond to formal requests on a separate matter, related to the discovery that an accreditation body has been accrediting CBs that bought an ISO 17021-1 “template kit” sold by one of the accreditation body’s Board members. This conflict of interest means the AB was essentially auditing its own work when conducting accreditation audits of CBs.
Oxebridge is exploring legal options to force the IAF into complying with its obligations. The IAF is reportedly exploring moving its locations from the United States, presumably to avoid being subject to US courts. It is currently registered in Delaware.
URS had been the subject of a prior whistleblower complaint which alleged it allowed its staff to improperly quote ISO certification audits. Oxebridge accepted the closure of that complaint after URS claimed to take corrective action.