Page 6 - Sept NL 2016a

A2LA Updates
Continued from page 5
ISO/IEC 17065 Explanations:
QUESTION: Per section 4.2.3 of
ISO/IEC 17065, is our organization
required to keep records of all of
the risks to impartiality we have
investigated, even those which were
determined not to be actual risks?
RESPONSE: A2LA expects certification
bodies to keep records of any risks that
have been identified, as well as records
of the actions taken to mitigate the
risks identified. This information is
required to be passed to the Mechanism
for Safeguarding Impartiality (as
required by clause 4.2.4), which is then
required to take this into account and
provide feedback to the CB during its
management review (clause 8.5.2).
While not required, it is recommended
as a positive support to the principles of
certification to keep records of all areas
where an investigation into risks took
place, even when no risk is ultimately
identified. These records may help
to assure stakeholders that the CB’s
operations are transparent and
impartial, and may further help the
certification body in future risk analysis
exercises in the event situations
with its personnel or organizational
relationships change.
QUESTION: My organization issues
a blanket statement on our contracts
which states “your product may be sent
to an outside laboratory for testing in
the event we are unable to perform
timely evaluation” – does this meet
the requirements of section 6.2.2.4(f) of
ISO/IEC 17065?
RESPONSE: Clause 6.2.2.4(f) requires
the certification body to notify the client
in advance of subcontracting in order
for the client to have the opportunity to
object to that action. A2LA understands
that certification bodies may not always
immediately know what outside entity
will be used to perform evaluation tasks
when taking on an application.
At a minimum, the certification body
may issue a blanket statement (or
make known in some other clear
manner) of possible subcontracting to
6
its clients and potential clients. The
client then has an opportunity to object
to the use of external resources, or to
request clarification on the matter.
If clarification is requested, the
certification body is expected to answer
the client’s question, and identify the
potential entity that would be used
before the evaluation activity takes
place in order to allow the customer the
opportunity to object to the use of that
particular external resource, while still out email notifications, actions taken
accepting the possible use of a different by the CB to assure themselves that
external evaluation resource.
Records of correspondence are required
to demonstrate that the CB has given
adequate notice to the client and, if
necessary, has identified the specific
subcontractor if so requested.
The critical idea in this clause is that
the CB has given the client a reasonable
opportunity to object to the use of
outside evaluation resources, whether
that be objecting to a specific entity
(such as a chosen test lab) or objecting
to the entire concept of outsourcing.
(Note that ISO/IEC 17065 does not
explicitly require the certification body re-review of currently certified product
to receive a written approval from the
client to initiate the subcontracting,
but it may be beneficial for a
certification body to attempt to obtain
this documented approval)
QUESTION: Our organization is
considering operating a scheme
where the scheme owner notifies the
clients of changes to the certification
requirements themselves, and does not
require any re-verification of compliance required to take some action of their
until the current certification expires.
Does clause 7.10.1 of ISO/IEC 17065
still apply to our organization, and if
so, how?
RESPONSE: Clause 7.10.1 is required
to be implemented by all certification
bodies, regardless of what changes
and subsequent action (or inaction) is
stated by the scheme.
In all cases of certification changes,
it remains the responsibility of the
accredited certification body to be aware
of these changes, to gain assurance that
the changes have been communicated
to clients in some manner, and to take
some action to verify that the changes
have been implemented by its clients.
If the scheme specifies any further
actions, such as mandating immediate
re-evaluation of any certified product,
then the certification body has further
tasks to undertake.
In the case of a scheme owner sending
the communication has taken place
may be minimal (but caution should
still be taken in the event that a client
is not receiving those notifications). In
other cases, such as the CB being the
scheme owner, a notification blast (e.g.,
via email or letter) to all clients could
be submitted as evidence of the steps
the CB has taken to comply with this
requirement.
With regard to actions taken to verify
implementation, these will depend
on the instructions included (or not
included) by the scheme owner. This
might include re-evaluation of certified
products (as mentioned previously), a
documentation and evaluation results
to verify that the product continues to
comply with certification requirements,
an audit of client facilities, or even a
simple evaluation of products at the
next scheduled certification renewal
point without taking immediate action.
However, in the event that the scheme
or scheme owner is silent on actions to
be taken, the certification body is still
own choosing to verify implementation
of the changes by the client. This could
include (for example) an analysis of the
changes to determine whether or not re-
evaluation is necessary, with a record
of this analysis being kept. If any action
is necessary, as per clause 7.10.3, it
shall be performed in accordance with
the appropriate part of section 7 of the
standard, with records kept of those
activities as required by section 7.12.
Continued on page 7