fbpx

Certification Process

Approval: Technical Manager

Related Clauses: 17021-1:2015 5.1.2, 9.1.1-2, 9.5.3.3

Related Procedure “Impartiality”

IQS General Conditions of services & Specific Conditions of certification services Application Forms for the relevant products Template “Certification Transfer Form”

This procedure defines instructions for all IQS services. Some services require additional instructions, defined in appendices

. 1 Application requirements

To be able to develop a proposal for potential or existing client, specific required information is obtained from the client through the document “Application Form”. The information required includes:

  • Standard of certification
  • Details of activities for the definition of scope
  • Client information:

Ø Name, address, contact information

Ø Information on sites to be covered by certification (complexity of sites, campus, multi-site)

Ø Number and importance of temporary sites

Ø Number of employees and details on shift activity

Ø Significant aspects of organization process and operations, and relevant legal obligations

Ø Information about outsourced process used by the client that will affect conformity to requirement

Ø Information concerning the use of consultancy related to the management system Standard of certification

This necessary information and or data can be transmitted to IQS in any format (e.g. phone conversations, e-mail, product-related brochures provided by the client) and consolidated by IQS in an application form. Records shall be retained either with the client file or by the commercial department. Some of this information can be obtained from product related brochures/Adds, provided by the client. Brochures/Adds provide IQS

1.1 Application requirements for multi-site Organization

 Multi-site:

A multi-site Organization is defined as an Organization having an identified central function (hereafter referred to as a central office but not necessarily the headquarters of the Organization) at which certain activities are planned, controlled or managed and a network of local offices or branches (sites) at which such activities are fully or partially carried out.

Site

A site could include all land on which activities under the control of an Organization at a given location are carried out including any connected or associated storage of raw materials, by-products, intermediate products, end products and waste material, and any equipment or infrastructure involved in the activities, whether or not fixed. Alternatively, where required by law, definitions laid down in national or local licensing regimes shall apply. Where it is not practicable to define a location (e.g. for services), the coverage of the certification should take into account the Organization’s headquarters activities as well as delivery of its services. Where relevant, the certification body m ay decide that the certification audit will be carried out only where the Organization delivers its services. In such cases all the interfaces with its central office shall be identified and audited.

 Temporary Site

Temporary sites that are covered by the Organization’s management system may be subject to audit on a sample basis to provide evidence of the operation and effectiveness of the management system. They may, however be included within the scope of a multi-site certification subject to agreement between the certification body and the client Organization. Where included in the scope, such sites shall be identified as temporary.

 Multi-site Organization

A multi-site Organization need not be a unique legal entity, but all sites shall have a legal or contractual link with the central office of the Organization and be subject to a common management system, which is laid down, established and subject to continuous surveillance and internal audits by the central office. This means that the central office has rights to require that the sites implement corrective actions when needed in any site. Where applicable this should be set out in the formal agreement between the centr al office and the sites. Examples of possible multi-site Organizations are:

  • Organizations operating with franchises
  • Manufacturing companies with a network of sales offices (this document would apply to the sales network) · Service companies with multiple sites offering a similar service
  • Companies with multiple branches

2 Application Review requirements

The application received from the client is reviewed to:

  • Determine the type of accreditation that can be offered;
  • Ensure that IQS has the ability and competence to perform the audit;
  • Determine the audit scope;
  • Ensure competent resources are available to perform the audit;
  • Ensure impartiality threats have been reviewed (with the support of the Impartiality Committee where necessary) and results of the review confirm the risks are at an acceptable level as described in Impartiality Procedure.
  • Determine audit time

Specificities per scheme are detailed in Appendices. If IQS declines the application following the application review, the reasons for declining an application shall be documented and made clear to the client. Audit time is determined according to

  • specific rules per product
  • the complexity of client sites and processes.

Unless otherwise specified in specific instructions, the application review documents are recorded to demonstrate all items above have been considered and reasons for accepting the application and issuing the proposal are justified. Proposals are then issued and sent to the client and they at least include:

  • Client details;
  • Audit time for the 3-year cycle;
  • Standard and scope;
  • IQS general conditions of services
  • IQS specific conditions of certification services (including information and process descriptions and complaints procedures)
  1. Approving Proposals

Each IQS entity and production center produces an authorization matrix that demonstrates who is authorized to approve and sign proposals. The matrix is product and contract value dependent, and reflects the status of local entity in IQS network The persons signing proposals shall be trained for the products for which they are approved and demonstrated to the relevant Technical Manager that they have sufficient understanding and knowledge of the proposal process to produce accurate proposals. The Technical Manager shall only take a sample of proposals to review (Recommend 5%) to ensure that the process is being undertaken in accordance with IQS requirements. It is not required for the Technical Manager to conduct a 100% review of all proposals.

  1. Types of Contract

IQS services are covered by a signed contract with the client. To facilitate this process, IQS established two types of contracts described below. Unless specifically requested by the client, expiring term contracts are not offered.

 4.1. Open Ended Contracts (IQS Standard Contract)

These contracts have no expiry date and are developed in such a manner to allow IQS services to be offered on a continuous basis, without requirement to re-sign the contract. These contracts allow for audit day and price increases to be undertaken where necessary or in accordance with the contract terms. In case individual countries wish to use open-ended contracts, they must comply with the IQS general conditions and certification specific conditions.

 4.2. Expiring contracts

They are only used when client refuses to sign Open Ended Contract. These contracts are established for defined periods, this can be any period in agreement with the client; however, the minimum period is one year. Where the contract period is less than three years or the duration of certification cycle, this shall be reflected in the certificate validity.

  1. Contract Review

When a client signs the proposal, this then becomes the contract, therefore once this is received from a client the sales bac k office shall review the document to ensure that no changes have been made or requested by the client. If all details are consistent with the original proposal the signed contract is passed to the production back office for action, the sales back office shall also indicate the clients preferred initial audit period. If the clients ask for a second and different accreditation after contract review stage, and initial certification decision has been made and the certificate issued, this requires a new and separate certification decision.

5.1. Contract review for multi-site Organization

IQS shall provide information to the Organization via its offer terms and conditions about the application of IAF MD1 requirement and the relevant management system standards before starting the audit process, and should not proceed if any of the provisions are not met. Before starting the audit process, IQS should inform the Organization that the certificate will not be issued if during an initial audit nonconformities are found. IQS’s procedures should ensure that the initial contract review identifies the complexity and scale of the activities covered by the management system subject to certification and any differences between sites as the basis for determining the level of sampling. IQS shall identify the central function of the Organization with which it has a legally enforceable agreement for the provision of certification activities.

IQS shall check, in each individual case, to what extent sites of an Organization operate substantially the same kind of processes according to the same procedures and methods. Only after a positive examination that all the sites proposed for inclusion in the multi-site exercise meet the eligibility provisions may the sampling procedure be applied to the individual sites. If all the sites of a service Organization where the activity subject to certification is performed are not ready to be submitted for certification at the same time, the Organization shall be required to inform IQS in advance of the sites that it wants to be included in the certification and those which are to be excluded.

  1. Transfer of Accredited Certification

The transfer of certification is defined as the recognition of an existing and valid management system certificate, granted by one accredited certification body, hereinafter referred to as the “issuing certification body”, by IQS for the purpose of issuing a IQS certificate. When a transfer of certification is envisaged from one certification body to another, the accepting certification body shall have a process for obtaining sufficient information in order to take a decision on certification.

6.1. Minimum Requirements Accreditation:

Only certificates which are covered by an accreditation of an EA, PAC, IAAC or IAF MLA signatory shall be eligible for transfer. If the existing certification is accredited by a body that belongs to a regional MLA only, the transfer shall be limited to other accreditations valid within that regional agreement. Organizations holding certificates that are not covered by such accreditations shall be treated as new clients. For a list of IAF MLA signatories refer to the IAF web-site www.iaf.nu Transfer shall normally only be of a current valid accredited certificate but, in the case of a certificate issued by a certification body that has ceased trading, or that has had its accreditation withdrawn, IQS, at its discretion, can consider such a certificate for transfer on the basis described in this procedure. Certificates which are known to have been suspended or to be under threat of suspension shall not be accepted for transfer.

6.2. Pre-Transfer Review

A pre-transfer review of the current certification of the prospective client shall be carried by the Technical Manager or person appointed by him/her. This review is normally conducted by means of document review. This review shall cover the following aspects:

  • Confirmation that the client’s certified activities falls within the accredited scope of the accepting certification / registration body.
  • The reasons for seeking a transfer.
  • That the site(s) wishing subject to the transfer hold a valid accredited certificate, in terms of authenticity, duration, scope of activities covered by the management system and scope of accreditation. If practical, the validity of certification and the status of outstanding nonconformities shall be verified with the issuing certification body unless it has ceased trading.
  • A consideration of the last assessment/re-assessment reports, subsequent surveillance reports and any outstanding nonconformities arising there from. This consideration shall also include any other available, relevant documentation regarding the certification process i.e. handwritten notes, checklists.
  • Complaints received and action taken.
  • The stage in the current certification cycle. Outstanding non-conformities shall be closed out, if practical, with the issuing certification / registration body, before transfer. Otherwise they shall be closed out by IQS prior to issuing a certificate

6.3. Transfer Visit

If the information supplied by the prospective client is not sufficient or satisfactory, even after contacting the issuing Certification Body, then a visit must be considered to clarify outstanding issues from the transfer review. This can be achieved either by a conference call or a visit to the client premises or a meeting at the IQS office. Records of visits and transfer review evidence must be kept.

 6.4. Transfer Audit

An audit is conducted in two specific cases:

  • Where outstanding issues were not solved by the transfer review and the subsequent visit to the client; this audit concentrates only on these outstanding issues.
  • Where certification, recertification or surveillance audit report were not made available or surveillance are overdue, then the prospective client must be treated as new client

6.5. Decision

If no further outstanding or potential problems are identified by the pre-transfer review a certificate, dated from the date of completion of the review, may be issued following the normal decision making process. The pattern of the previous certification / registration regime shall be utilized to determine the program of on-going surveillance and recertification unless, as a result of the review. Template “Certification Transfer Form” shall be used to document the review.

  1. Changes to contracts

Amendments to contract must be considered when significant changes are occurring to the management system of the client such as but not limited to increase and decrease of audit days, additional sites, extension and reduction of scope, additional products, number of employees. In addition, a review shall be made to determine audit activities necessary to decide whether the certification can be maintained or not. These additional audit activities can be performed either during surveillance audit or additional audit. Where amendments to the contracts are made, the reasons for the changes shall be documented. The information, collected for the original contract review, is modified and the differences highlighted. Adjustments to the relevant sections of the contract shall be made i.e. Audit days, product codes, sites and the contract shall be agreed by the client. IQS shall notify its clients of any changes to its requirements for certification. This rule is mention ed in the IQS General Conditions of Services.

  1. Renewal Process for Expiring Contracts

Used when client refuses to sign Open Ended Contract. Data collected for Initial certification must be verified and updated if necessary particularly changes in the Organization and number of employees. When generating a proposal, the following output is required:

  • Audit day (both on-site and off-site ensuring the rules for ‘on and off’ site time are respected) allocation for main period of the proposed contract
  • Records of audit day calculations and justifications for any changes, these shall be retained with the client file.
  • Product Code allocation
  • Accreditations that can be offered
  • Compliance with IQS Certification Pricing Policy
  • Compliance with local rules The approval of proposal and contract review are carried out with the same approach and requirements as for initial proposals.
  1. Multi-site Calculation

9.1. Eligibility of an Organization

for sampling The processes at all the sites have to be substantially of the same kind and have to be operated to similar methods and procedures. Where some of the sites under consideration conduct similar, but fewer processes than others, they may be eligible for inclusion under multi-site certification providing that the sites(s) which conduct the most processes, or critical processes are subject to full audit. Organizations which conduct their business through linked processes in different locations are also eligible for sampling providing all other provisions of this document are met. Where processes in each location are not similar but are clearly linked, the sampling plan shall include at least one example of each process conducted by the Organization (eg. fabrication of electronic components in one location, assembly of the same components by the same company in several other locations). The Organization’s management system shall be under a centrally controlled and administered plan and be subject to central management review. All the relevant sites (including the central administration function) shall be subject to the Organization’s internal audit program and all shall have been audited in accordance with that program prior to the certification body starting its audit. It shall be demonstrated that the central office of the Organization has established a management system in accordance with the relevant management system standard under audit and that the whole Organization meets the requirements of the standard. This shall include consideration of relevant regulations. The Organization should demonstrate its ability to collect and analyze data (including but not limited to the items listed below) from all sites including the central office and its authority and also demonstrate its authority and ability to initiate Organizational change if required:

  • System documentation and system changes;
  • Management review;
  • Complaints;
  • Evaluation of corrective actions;
  • Internal audit planning and evaluation of the results;
  • Changes to aspects and associated impacts for environmental management systems (EMS) and
  • Different legal requirements. Not all Organizations fulfilling the definition of multi-site Organization will be eligible for sampling. Not all management systems standards are suitable for consideration for multi-site certification. For example, multi-site sampling would be unsuitable where the audit of variable local factors is a requirement of the standard. Specific rules apply also for some schemes, and the requirements of such schemes shall take precedence. IQS’s procedures to restrict such sampling where site sampling is inappropriate to gain sufficient confidence in the effectiveness of the management system under audit. Such restrictions are defined with respect to:
  • Scope sectors or activities (i.e. based on the assessment of risks or complexity associated with that sector or activity);
  • Size of sites eligible for multi-site audit;
  • Variations in the local implementation of the management system such as the need for frequent recourse to the use of plans within the management system to address different activities or different contractual or regulatory systems;
  • Use of temporary sites that operate under the management system of the Organization and which are not to be included within the scope of certification.

 9.2. Sampling Methodology

The sample shall be partly selective based on the factors set out below and partly non-selective, and shall result in a representative range of different sites being selected, without excluding the random element of sampling. At least 25% of the sample shall be selected at random. Taking into account the provisions mentioned below, the remainder shall be selected so that the differences among the sites selected over the period of validity of the certificate is as large as possible. The site selection may include among others the following aspects:

  • Results of internal site audits and management reviews or previous certification audits;
  • Records of complaints and other relevant aspects of corrective and preventive action;
  • Significant variations in the size of the sites;
  • Variations in shift patterns and work procedures;
  • Complexity of the management system and processes conducted at the sites;
  • Modifications since the last certification audit;
  • Maturity of the management system and knowledge of the Organization;
  • Environmental issues and extent of aspects and associated impacts for environmental (EMS) management systems;
  • Differences in culture, language and regulatory requirements; and
  • Geographical dispersion. This selection does not have to be done at the start of the audit process. It can also be done once the audit at the central office has been completed. In any case, the central office shall be informed of the sites to be included in the sample. This can be on relatively short notice, but shall allow adequate time for preparation for the audit.

 9.3. Size of Sample

IQS determines the sample to be taken when auditing sites as part of the audits and certification of a multisite Organization. Each IQS office shall have records on each application of multi-site sampling justifying it is operating in accordance with this document. The following calculation is the basic procedure used by IQS for sampling of multi-site Organizations. The minimum number of sites to be visited per audit is: Initial audit: the size of the sample shall be the square root of the number of remote sites: (y=Mx ), rounded to the upper whole number. Surveillance audit: the size of the annual sample shall be the square root of the number of remote sites with 0.6 as a coefficient (y=0.6 Mx), rounded to the upper whole number. Re-certification audit: the size of the sample shall be the same as for an initial audit. Nevertheless, where the management system has proved to be effective over a period of three years, the size of the sample could be reduced by a factor 0.8, i.e.: (y=0.8 Mx), rounded to the upper whole number. IQS will review each application and the risk levels of activities of the Organization and decide to adjust either the sampling methodology and/or sampling levels. In all cases where adjustments are made and justifications are recorded, and supported by a robust risk analysis. The central office shall be audited during every initial certification and recertification audit and at least annually as part of surveillance. The size or frequency of the sample shall be increased where the IQS’s risk analysis of the activity covered by the management system subject to certification indicates special circumstances in respect of factors such as:

  • The size of the sites and number of employees (eg. more than 50 employees on a site)

; · The complexity or risk level of the activity and of the management system;

  • Variations in working practices (eg. shift working);
  • Variations in activities undertaken;
  • Significance and extent of aspects and associated impacts for environmental management systems (EMS);
  • Records of complaints and other relevant aspects of corrective and preventive action; · Any multinational aspects; and
  • Results of internal audits and management review. In such cases a sampling plan and methodology will be defined and recorded. When the Organization has a hierarchical system of branches (e.g. head (central) office, national offices, regional offices, local branches), the sampling model for initial audit as defined above applies to each level.

example

1 head office: visited at each audit cycle (initial or surveillance or recertification)

4 National offices: sample = 2: minimum 1 at random

27 regional offices: sample = 6: minimum 2 at random

1700 local branches: sample = 42: minimum 11 at random.

9.4. Additional Sites

On the application of a new group of sites to join an already certified multi-site network, each new group of sites shall be considered as an independent set for the determination of the sample size. After inclusion of the new group in the certificate, the new sites shall be cumulated to the previous ones for determining the sample size for future surveillance or recertification audits.

 9.5. Audit Time per IAF Rule

The number of man-days per site should be consistent with the tables shown in Annex A (Quality Management Systems) and Annex B (Environmental Management Systems) of IAF Mandatory Document MD5 for QMS and EMS audit duration -2015. Reductions can be applied to take into account the clauses that are not relevant to the local sites and are only examined at the central office. The complexity of the activity is another factor that may be taken into consideration. The total time expended on initial assessment and surveillance (understood as the total sum of the time spent at each site plus the central office) should never be less than that which would have been calculated for the size and complexity of the operation if all the work had been undertaken at a single site (i.e. with all the employees of the company in the same site). In most cases it will be considerably more. The reduction of audit duration shall not exceed 30% of the times established from tables QMS 1 or EMS 1. This may not apply to the situations described in the IAF MD 1 for the individual sites in multisite operations where a limited number of processes are present and the implementation of all the requirements of the management system standards can be verified. The methodology described below is to be used to build the auditor time and justify how the calculation has been established. Starting point

  • Consider first the total number of employees for the company as if it was a single site and allocate auditor days according to the table this is the starting point Sampling: Apply the rule for sampling, – select sites for initial and surveillance audits:
  • Calculate the audit days in each site by splitting the total number of days as calculated above
  • Then, calculate the audit days for each sampled site as if it was a single site number of employees at the site Finalizing the calculation
  • Compare the 2 calculations site by site
  • Adjust the auditor days’ site by site, considering the complexity of activities, the processes, the level of decentralization of the company, the clauses not applicable to the site. Justify the decision for variations and keep record in the file

9.6. Audit

The IQS team leader must assure that the same management system governs the activities at all the sites, is actually applied to all the sites and that all the eligibility criteria for the Organization are met. This requirement also applies to a management system where electronic documents, process control or other electronic processes are used. IQS shall justify and record the rational e for proceeding with a multi-site approach. If more than one audit team is involved in the audit or surveillance of the network, IQS managing office shall designate a unique audit leader whose responsibility is to consolidate the findings from all the audit teams and to produce a synthesis report.