{"id":24148,"date":"2021-02-21T22:12:26","date_gmt":"2021-02-22T03:12:26","guid":{"rendered":"https:\/\/www.oxebridge.com\/emma\/?p=24148"},"modified":"2021-02-21T22:14:01","modified_gmt":"2021-02-22T03:14:01","slug":"parsing-iso-17021-1s-melange-of-procedure-callouts","status":"publish","type":"post","link":"https:\/\/www.oxebridge.com\/emma\/parsing-iso-17021-1s-melange-of-procedure-callouts\/","title":{"rendered":"Parsing ISO 17021-1’s Melange of Procedure Callouts"},"content":{"rendered":"

I’m excited to be back at work helping develop certification bodies<\/a>, something that I had done many years ago, but which fell aside under the flood of AS9100 implementations I did throughout the 2010’s. This month alone I am lucky enough to be working on setting up three different CBs, and it’s exciting work. Not many can do it.<\/p>\n

It means I am spending a lot of time in ISO 17021-1<\/a>, as a real user of the standard, digging deep through it, mining for gems. ISO 17021-1 is a crucial work within the ISO certification world, but you wouldn’t find many people who know much about it. It’s the standard that applies to certification bodies, like BSI and SGS, and which defines their requirements. If you’re certified to ISO 9001, and unless you hired a cert mill, your CB is accredited to ISO 17021-1.<\/p>\n

So you’d think the rules governing the industry’s judges would be reasonably well-written.<\/p>\n

You’re adorable!<\/p>\n

ISO 17021-1 is written by the ISO Committee on Conformity Assessment (CASCO). That committee was, until recently, lead by long-time ISO staffer Sean MacCurtain, and is supposed to be one of the more put-together ISO committees. So you might be surprised to see just how terrible ISO 17021-1 is, and how it reveals it was hammered together by a cast of dubiously-qualified characters all firing in different directions.<\/p>\n

Now, don’t get me wrong: the rules are important. I’m constantly holding CBs accountable to them, so I acknowledge we need what’s written in 17021-1. It’s just the way<\/strong> it’s written that is both frustrating and hilarious.<\/p>\n

For example, the folks on CASCO don’t really know what a “document” is. I’m serious, and you’ll agree completely about two minutes from now. Stick with me.<\/p>\n

In prior ISO standards, the text called out the need for “documented procedures” whenever the authors wanted a user to have… well, a documented procedure. Then, the word “records” was used to call out requirements for records.<\/p>\n

In the 2010s, though, a new crop of standards developers overtook most of ISO’s committees, and brought with them a need to make things as confusing as possible, to sell their consulting services later.\u00a0CASCO, which has always been largely populated by CB reps and consultants<\/a>, was infected with this problem far, far earlier. Back in 1996, the original ISO Guide 62 simply called out a need for “procedures.” By the time that guide was turned into a full standard (ISO 17021), the CB reps had taken over CASCO, and started to muddy things up.\u00a0 The latest edition — published in 2015 — makes things much, much worse.<\/p>\n

Let’s start with clause 5.2 on “management of impartiality.” That clause requires the following:<\/p>\n

The certification body shall have a policy<\/strong> <\/em>that it understands the importance of impartiality in carrying out its management system certification activities….<\/p><\/blockquote>\n

OK, so it calls out a “policy<\/em>.” Most will agree that needs to be documented, so there’s not much confusion there. Now we move to the very next paragraph in the same clause, which reads:<\/p>\n

The certification body shall have a process <\/strong><\/em>to identify, analyze, evaluate, treat, monitor, and document [risks]….<\/p><\/blockquote>\n

As a former chemical process engineer, this casual usage of the word “process<\/em>” drives me crazy.\u00a0 ISO 9001 tried to get people to understand process management, but obviously failed. ISO standards developers still do not understand that a process and a procedure are two very different things<\/strong><\/em>, and so they use the terms interchangeably. But technically a process may invoke measurement (KPIs, etc.) while a procedure doesn’t; so the distinction is important. If you’re a CB getting just getting started, you’re already scratching your head, asking, “Am I supposed to write this stuff down or not?<\/em>”<\/p>\n

Moving ahead in the standard a bit, clause 6.1 on “Organizational Structure” then requires:<\/p>\n

The certification body shall document <\/strong><\/em>its organizational structure….<\/p><\/blockquote>\n

Okay, that’s clearly calling out a document, even if I wouldn’t know whether the org structure is supposed to be in a procedure or not. One assumes a chart will do.<\/p>\n

But then, on just the next page, it calls out something entirely different:<\/p>\n

The certification body shall have formal rules<\/strong><\/em> for the appointment, terms of reference and operation of any committees that are involved in the certification activities.<\/p><\/blockquote>\n

“Formal rules<\/em>?” This, by the way, is a holdover from the earliest 2000’s versions of ISO 17021, and they haven’t edited it since. One can assume that “formal rules<\/em>” should be written, but to be fair, it doesn’t really say<\/strong> <\/em>that.<\/p>\n

Moving to clause 7.1.1 on “Competence,” the standard then requires this:<\/p>\n

The certification body shall have processes <\/strong><\/em>to ensure that personnel have appropriate knowledge and skills….<\/p><\/blockquote>\n

Most will not get upset by this, but the sudden shift to plural (“processes<\/em>” vs. “process<\/em>“) is maddening. I’ve had auditors tell me that if the standard indicates a plural, then you must have “more than one<\/em>” of a thing. Therefore, an accreditation auditor can ask to see multiple “processes<\/em>” and — assuming they really mean “procedures<\/em>” — you’d have to produce multiple documents. If you wanted to combine them into one, you’d technically be in violation of the standard. Sigh.<\/p>\n

The very next clause, 7.1.2, jumps back to the singular:<\/p>\n

The certification body shall have a process <\/em><\/strong>for determining the competence criteria for personnel…<\/p><\/blockquote>\n

Argh! And then, 7.1.3 goes one step further:<\/p>\n

The certification body shall have documented processes <\/strong><\/em>for the initial competence evaluation…<\/p><\/blockquote>\n

Now, not only are we back to plural, but here the clause distinguishes that — in this case — the processes must be “documented<\/em>.” Does that mean in all the other cases, they didn’t need to be documented? Now everything we’ve been assuming up to now is thrown out.<\/p>\n

Oh, we’re not done yet. Jumping forward to 8.3.1 we see this:<\/p>\n

A certification body shall have rules<\/strong> <\/em>governing any management system certification mark that it authorizes certified clients to use.<\/p><\/blockquote>\n

Or clause 9.4.1:<\/p>\n

The certification body shall have documented procedures<\/strong><\/em> for determining audit time.<\/p><\/blockquote>\n

Or 9.6.5:<\/p>\n

The certification body shall have a policy and documented procedure(s)<\/strong> <\/em>for suspension, withdrawal or reduction of the scope of certification, and shall specify the subsequent actions by the certification body.<\/p><\/blockquote>\n

Or 9.7:<\/p>\n

The certification body shall have a documented process<\/strong><\/em> to receive, evaluate and make decisions on appeals.<\/p><\/blockquote>\n

Or 9.9.4:<\/p>\n

The certification body shall have a documented policy and documented procedures<\/strong><\/em> on the retention of records.<\/p><\/blockquote>\n

Or 10.2.1:<\/p>\n

The certification body\u2019s top management shall establish and document policies and objectives <\/strong><\/em>for its activities.<\/p><\/blockquote>\n

Or 10.2.2:<\/p>\n

All applicable requirements of this part of ISO\/IEC 17021 shall be addressed either in a manual or in associated documents.<\/strong><\/em><\/p><\/blockquote>\n

Or 10.2.4:<\/p>\n

The certification body shall establish procedures <\/strong><\/em>to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of its records…<\/p><\/blockquote>\n

In all, by the time ISO 17021-1 is done, it has used upwards of fifteen different terms<\/strong><\/em> referring to stuff that should be written down. Beyond the hard requirements, there are a host of other terms used in the standard which strongly imply the need for a written thing, such as “the certification body shall make clear…<\/em>” or ” the certification body shall provide information on…<\/em>.”, or multiple references to “legally enforceable agreements.<\/em>”<\/p>\n

If CASCO just had an editor<\/em><\/strong>, none of this would happen. But ISO can’t afford a proofreader, apparently. Sean MacCurtain had enough money to retire young, so I’m not sure what he was being paid to do, exactly. It certainly wasn’t catching obvious goof-ups like these.<\/p>\n

The thing is, this stuff matters. When someone like me is guiding a new CB into developing its various policies and procedures, it helps to know what the accreditation bodies will be demanding to see. It shouldn’t be left up to interpretation, since my interpretation might differ from, say, ANAB’s — and that can mean a costly nonconformity during the initial accreditation audit. Standards are supposed to be beneficial because they ensure everyone speaks the same language about a certain topic; it’s frustrating when committees like CASCO can’t get their writers to speak the same language from one page to the next, in the same standard!<\/p>\n

It’s standardization, for heaven’s sake. It’s in ISO’s name! You’d think they could standardize the words they use in their publications.<\/p>\n

Well, I suppose I shouldn’t complain. The reason certification bodies have to bring on a hired gun like me to set up their systems<\/a> is because CASCO has made the ISO 17021-1 standard so impossible to understand. Maybe I should be paying for Sean MacCurtain’s next vacation!<\/p>\n

There are precious few people on the planet who can help set up a CB, so feel free to reach out to me<\/a> if you get stuck and need help. Send me an email… or is it a message? A documented infobite? A digital textogram?<\/p>","protected":false},"excerpt":{"rendered":"

The standard for certification bodies uses over 15 different terms to refer to “procedures,” making implementation a nightmare without third-party help.<\/p>","protected":false},"author":2,"featured_media":24151,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","mc4wp_mailchimp_campaign":[],"footnotes":""},"categories":[5],"tags":[61,198,23,43,52,304,789],"class_list":["post-24148","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-opinion","tag-accreditation-bodies","tag-casco","tag-certification-bodies","tag-iso","tag-iso-17021","tag-iso-17021-1","tag-iso-casco","et-has-post-format-content","et_post_format-et-post-format-standard"],"_links":{"self":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/24148","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/comments?post=24148"}],"version-history":[{"count":5,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/24148\/revisions"}],"predecessor-version":[{"id":24154,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/posts\/24148\/revisions\/24154"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/media\/24151"}],"wp:attachment":[{"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/media?parent=24148"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/categories?post=24148"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.oxebridge.com\/emma\/wp-json\/wp\/v2\/tags?post=24148"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}