{"text_format":"1","workbook":"xlsx","n_sheets":2,"sheets":["Document Review + Checklist","Sheet1"],"not_rendered":{"charts":0,"images":2,"macros":1,"external_links":0,"defined_names":1,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Document Review + Checklist","index":0,"n_rows":1942,"n_cols":8,"rows_kept":1942,"cut":false,"hidden":false,"merged":[[1776,6,1778,6],[1776,7,1778,7],[1779,1,1781,1],[1779,2,1781,2],[1779,3,1781,3],[1779,4,1781,4],[1779,5,1781,5],[1779,6,1781,6],[1779,7,1781,7],[1776,1,1778,1],[1776,2,1778,2],[1776,3,1778,3],[1776,4,1778,4],[1776,5,1778,5],[1769,6,1771,6],[1769,7,1771,7],[1772,1,1774,1],[1772,2,1774,2],[1772,3,1774,3],[1772,4,1774,4],[1772,5,1774,5],[1772,6,1774,6],[1772,7,1774,7],[1769,1,1771,1],[1769,2,1771,2],[1769,3,1771,3],[1769,4,1771,4],[1769,5,1771,5],[1763,6,1765,6],[1763,7,1765,7],[1766,1,1768,1],[1766,2,1768,2],[1766,3,1768,3],[1766,4,1768,4],[1766,5,1768,5],[1766,6,1768,6],[1766,7,1768,7],[1763,1,1765,1],[1763,2,1765,2],[1763,3,1765,3],[1763,4,1765,4],[1763,5,1765,5],[1756,6,1758,6],[1756,7,1758,7],[1760,1,1762,1],[1760,2,1762,2],[1760,3,1762,3],[1760,4,1762,4],[1760,5,1762,5],[1760,6,1762,6],[1760,7,1762,7],[1756,1,1758,1],[1756,2,1758,2],[1756,3,1758,3],[1756,4,1758,4],[1756,5,1758,5],[1750,6,1752,6],[1750,7,1752,7],[1753,1,1755,1],[1753,2,1755,2],[1753,3,1755,3],[1753,4,1755,4],[1753,5,1755,5],[1753,6,1755,6],[1753,7,1755,7],[1750,1,1752,1],[1750,2,1752,2],[1750,3,1752,3],[1750,4,1752,4],[1750,5,1752,5],[1743,6,1745,6],[1743,7,1745,7],[1746,1,1748,1],[1746,2,1748,2],[1746,3,1748,3],[1746,4,1748,4],[1746,5,1748,5],[1746,6,1748,6],[1746,7,1748,7],[1743,1,1745,1],[1743,2,1745,2],[1743,3,1745,3],[1743,4,1745,4],[1743,5,1745,5],[1737,6,1739,6],[1737,7,1739,7],[1740,1,1742,1],[1740,2,1742,2],[1740,3,1742,3],[1740,4,1742,4],[1740,5,1742,5],[1740,6,1742,6],[1740,7,1742,7],[1737,1,1739,1],[1737,2,1739,2],[1737,3,1739,3],[1737,4,1739,4],[1737,5,1739,5],[1730,6,1732,6],[1730,7,1732,7],[1734,1,1736,1],[1734,2,1736,2],[1734,3,1736,3],[1734,4,1736,4],[1734,5,1736,5],[1734,6,1736,6],[1734,7,1736,7],[1730,1,1732,1],[1730,2,1732,2],[1730,3,1732,3],[1730,4,1732,4],[1730,5,1732,5],[1724,6,1726,6],[1724,7,1726,7],[1727,1,1729,1],[1727,2,1729,2],[1727,3,1729,3],[1727,4,1729,4],[1727,5,1729,5],[1727,6,1729,6],[1727,7,1729,7],[1724,1,1726,1],[1724,2,1726,2],[1724,3,1726,3],[1724,4,1726,4],[1724,5,1726,5],[1716,6,1718,6],[1716,7,1718,7],[1719,1,1721,1],[1719,2,1721,2],[1719,3,1721,3],[1719,4,1721,4],[1719,5,1721,5],[1719,6,1721,6],[1719,7,1721,7],[1716,1,1718,1],[1716,2,1718,2],[1716,3,1718,3],[1716,4,1718,4],[1716,5,1718,5],[1708,6,1710,6],[1708,7,1710,7],[1713,1,1715,1],[1713,2,1715,2],[1713,3,1715,3],[1713,4,1715,4],[1713,5,1715,5],[1713,6,1715,6],[1713,7,1715,7],[1708,1,1710,1],[1708,2,1710,2],[1708,3,1710,3],[1708,4,1710,4],[1708,5,1710,5],[1701,6,1703,6],[1701,7,1703,7],[1704,1,1706,1],[1704,2,1706,2],[1704,3,1706,3],[1704,4,1706,4],[1704,5,1706,5],[1704,6,1706,6],[1704,7,1706,7],[1701,1,1703,1],[1701,2,1703,2],[1701,3,1703,3],[1701,4,1703,4],[1701,5,1703,5],[1695,6,1697,6],[1695,7,1697,7],[1698,1,1700,1],[1698,2,1700,2],[1698,3,1700,3],[1698,4,1700,4],[1698,5,1700,5],[1698,6,1700,6],[1698,7,1700,7],[1695,1,1697,1],[1695,2,1697,2],[1695,3,1697,3],[1695,4,1697,4],[1695,5,1697,5],[1688,6,1690,6],[1688,7,1690,7],[1691,1,1693,1],[1691,2,1693,2],[1691,3,1693,3],[1691,4,1693,4],[1691,5,1693,5],[1691,6,1693,6],[1691,7,1693,7],[1688,1,1690,1],[1688,2,1690,2],[1688,3,1690,3],[1688,4,1690,4],[1688,5,1690,5],[1682,6,1684,6],[1682,7,1684,7],[1685,1,1687,1],[1685,2,1687,2],[1685,3,1687,3],[1685,4,1687,4],[1685,5,1687,5],[1685,6,1687,6],[1685,7,1687,7],[1682,1,1684,1],[1682,2,1684,2],[1682,3,1684,3],[1682,4,1684,4],[1682,5,1684,5],[1679,1,1681,1],[1679,2,1681,2],[1679,3,1681,3],[1679,4,1681,4],[1679,5,1681,5],[1679,6,1681,6],[1679,7,1681,7],[1671,6,1673,6],[1671,7,1673,7],[1674,1,1676,1],[1674,2,1676,2],[1674,3,1676,3],[1674,4,1676,4],[1674,5,1676,5],[1674,6,1676,6],[1674,7,1676,7],[1671,1,1673,1],[1671,2,1673,2],[1671,3,1673,3],[1671,4,1673,4],[1671,5,1673,5],[1665,6,1667,6],[1665,7,1667,7],[1668,1,1670,1],[1668,2,1670,2],[1668,3,1670,3],[1668,4,1670,4],[1668,5,1670,5],[1668,6,1670,6],[1668,7,1670,7],[1665,1,1667,1],[1665,2,1667,2],[1665,3,1667,3],[1665,4,1667,4],[1665,5,1667,5],[1658,6,1660,6],[1658,7,1660,7],[1662,1,1664,1],[1662,2,1664,2],[1662,3,1664,3],[1662,4,1664,4],[1662,5,1664,5],[1662,6,1664,6],[1662,7,1664,7],[1658,1,1660,1],[1658,2,1660,2],[1658,3,1660,3],[1658,4,1660,4],[1658,5,1660,5],[1652,6,1654,6],[1652,7,1654,7],[1655,1,1657,1],[1655,2,1657,2],[1655,3,1657,3],[1655,4,1657,4],[1655,5,1657,5],[1655,6,1657,6],[1655,7,1657,7],[1652,1,1654,1],[1652,2,1654,2],[1652,3,1654,3],[1652,4,1654,4],[1652,5,1654,5],[1645,6,1647,6],[1645,7,1647,7],[1648,1,1650,1],[1648,2,1650,2],[1648,3,1650,3],[1648,4,1650,4],[1648,5,1650,5],[1648,6,1650,6],[1648,7,1650,7],[1645,1,1647,1],[1645,2,1647,2],[1645,3,1647,3],[1645,4,1647,4],[1645,5,1647,5],[1639,6,1641,6],[1639,7,1641,7],[1642,1,1644,1],[1642,2,1644,2],[1642,3,1644,3],[1642,4,1644,4],[1642,5,1644,5],[1642,6,1644,6],[1642,7,1644,7],[1639,1,1641,1],[1639,2,1641,2],[1639,3,1641,3],[1639,4,1641,4],[1639,5,1641,5],[1632,6,1634,6],[1632,7,1634,7],[1636,1,1638,1],[1636,2,1638,2],[1636,3,1638,3],[1636,4,1638,4],[1636,5,1638,5],[1636,6,1638,6],[1636,7,1638,7],[1632,1,1634,1],[1632,2,1634,2],[1632,3,1634,3],[1632,4,1634,4],[1632,5,1634,5],[1625,6,1627,6],[1625,7,1627,7],[1629,1,1631,1],[1629,2,1631,2],[1629,3,1631,3],[1629,4,1631,4],[1629,5,1631,5],[1629,6,1631,6],[1629,7,1631,7],[1625,1,1627,1],[1625,2,1627,2],[1625,3,1627,3],[1625,4,1627,4],[1625,5,1627,5],[1619,6,1621,6],[1619,7,1621,7],[1622,1,1624,1],[1622,2,1624,2],[1622,3,1624,3],[1622,4,1624,4],[1622,5,1624,5],[1622,6,1624,6],[1622,7,1624,7],[1619,1,1621,1],[1619,2,1621,2],[1619,3,1621,3],[1619,4,1621,4],[1619,5,1621,5],[1613,6,1615,6],[1613,7,1615,7],[1616,1,1618,1],[1616,2,1618,2],[1616,3,1618,3],[1616,4,1618,4],[1616,5,1618,5],[1616,6,1618,6],[1616,7,1618,7],[1613,1,1615,1],[1613,2,1615,2],[1613,3,1615,3],[1613,4,1615,4],[1613,5,1615,5],[1606,6,1608,6],[1606,7,1608,7],[1609,1,1611,1],[1609,2,1611,2],[1609,3,1611,3],[1609,4,1611,4],[1609,5,1611,5],[1609,6,1611,6],[1609,7,1611,7],[1606,1,1608,1],[1606,2,1608,2],[1606,3,1608,3],[1606,4,1608,4],[1606,5,1608,5],[1600,6,1602,6],[1600,7,1602,7],[1603,1,1605,1],[1603,2,1605,2],[1603,3,1605,3],[1603,4,1605,4],[1603,5,1605,5],[1603,6,1605,6],[1603,7,1605,7],[1600,1,1602,1],[1600,2,1602,2],[1600,3,1602,3],[1600,4,1602,4],[1600,5,1602,5],[1594,6,1596,6],[1594,7,1596,7],[1597,1,1599,1],[1597,2,1599,2],[1597,3,1599,3],[1597,4,1599,4],[1597,5,1599,5],[1597,6,1599,6],[1597,7,1599,7],[1594,1,1596,1],[1594,2,1596,2],[1594,3,1596,3],[1594,4,1596,4],[1594,5,1596,5],[1588,6,1590,6],[1588,7,1590,7],[1591,1,1593,1],[1591,2,1593,2],[1591,3,1593,3],[1591,4,1593,4],[1591,5,1593,5],[1591,6,1593,6],[1591,7,1593,7],[1588,1,1590,1],[1588,2,1590,2],[1588,3,1590,3],[1588,4,1590,4],[1588,5,1590,5],[1582,6,1584,6],[1582,7,1584,7],[1585,1,1587,1],[1585,2,1587,2],[1585,3,1587,3],[1585,4,1587,4],[1585,5,1587,5],[1585,6,1587,6],[1585,7,1587,7],[1582,1,1584,1],[1582,2,1584,2],[1582,3,1584,3],[1582,4,1584,4],[1582,5,1584,5],[1575,6,1577,6],[1575,7,1577,7],[1579,1,1581,1],[1579,2,1581,2],[1579,3,1581,3],[1579,4,1581,4],[1579,5,1581,5],[1579,6,1581,6],[1579,7,1581,7],[1575,1,1577,1],[1575,2,1577,2],[1575,3,1577,3],[1575,4,1577,4],[1575,5,1577,5],[1567,6,1569,6],[1567,7,1569,7],[1570,1,1572,1],[1570,2,1572,2],[1570,3,1572,3],[1570,4,1572,4],[1570,5,1572,5],[1570,6,1572,6],[1570,7,1572,7],[1567,1,1569,1],[1567,2,1569,2],[1567,3,1569,3],[1567,4,1569,4],[1567,5,1569,5],[1561,6,1563,6],[1561,7,1563,7],[1564,1,1566,1],[1564,2,1566,2],[1564,3,1566,3],[1564,4,1566,4],[1564,5,1566,5],[1564,6,1566,6],[1564,7,1566,7],[1561,1,1563,1],[1561,2,1563,2],[1561,3,1563,3],[1561,4,1563,4],[1561,5,1563,5],[1554,6,1556,6],[1554,7,1556,7],[1558,1,1560,1],[1558,2,1560,2],[1558,3,1560,3],[1558,4,1560,4],[1558,5,1560,5],[1558,6,1560,6],[1558,7,1560,7],[1554,1,1556,1],[1554,2,1556,2],[1554,3,1556,3],[1554,4,1556,4],[1554,5,1556,5],[1548,6,1550,6],[1548,7,1550,7],[1551,1,1553,1],[1551,2,1553,2],[1551,3,1553,3],[1551,4,1553,4],[1551,5,1553,5],[1551,6,1553,6],[1551,7,1553,7],[1548,1,1550,1],[1548,2,1550,2],[1548,3,1550,3],[1548,4,1550,4],[1548,5,1550,5],[1541,6,1543,6],[1541,7,1543,7],[1544,1,1546,1],[1544,2,1546,2],[1544,3,1546,3],[1544,4,1546,4],[1544,5,1546,5],[1544,6,1546,6],[1544,7,1546,7],[1541,1,1543,1],[1541,2,1543,2],[1541,3,1543,3],[1541,4,1543,4],[1541,5,1543,5],[1535,6,1537,6],[1535,7,1537,7],[1538,1,1540,1],[1538,2,1540,2],[1538,3,1540,3],[1538,4,1540,4],[1538,5,1540,5],[1538,6,1540,6],[1538,7,1540,7],[1535,1,1537,1],[1535,2,1537,2],[1535,3,1537,3],[1535,4,1537,4],[1535,5,1537,5],[1532,1,1534,1],[1532,2,1534,2],[1532,3,1534,3],[1532,4,1534,4],[1532,5,1534,5],[1532,6,1534,6],[1532,7,1534,7],[1525,6,1527,6],[1525,7,1527,7],[1528,1,1530,1],[1528,2,1530,2],[1528,3,1530,3],[1528,4,1530,4],[1528,5,1530,5],[1528,6,1530,6],[1528,7,1530,7],[1525,1,1527,1],[1525,2,1527,2],[1525,3,1527,3],[1525,4,1527,4],[1525,5,1527,5],[1519,6,1521,6],[1519,7,1521,7],[1522,1,1524,1],[1522,2,1524,2],[1522,3,1524,3],[1522,4,1524,4],[1522,5,1524,5],[1522,6,1524,6],[1522,7,1524,7],[1519,1,1521,1],[1519,2,1521,2],[1519,3,1521,3],[1519,4,1521,4],[1519,5,1521,5],[1511,6,1513,6],[1511,7,1513,7],[1514,1,1516,1],[1514,2,1516,2],[1514,3,1516,3],[1514,4,1516,4],[1514,5,1516,5],[1514,6,1516,6],[1514,7,1516,7],[1511,1,1513,1],[1511,2,1513,2],[1511,3,1513,3],[1511,4,1513,4],[1511,5,1513,5],[1505,6,1507,6],[1505,7,1507,7],[1508,1,1510,1],[1508,2,1510,2],[1508,3,1510,3],[1508,4,1510,4],[1508,5,1510,5],[1508,6,1510,6],[1508,7,1510,7],[1505,1,1507,1],[1505,2,1507,2],[1505,3,1507,3],[1505,4,1507,4],[1505,5,1507,5],[1499,6,1501,6],[1499,7,1501,7],[1502,1,1504,1],[1502,2,1504,2],[1502,3,1504,3],[1502,4,1504,4],[1502,5,1504,5],[1502,6,1504,6],[1502,7,1504,7],[1499,1,1501,1],[1499,2,1501,2],[1499,3,1501,3],[1499,4,1501,4],[1499,5,1501,5],[1493,6,1495,6],[1493,7,1495,7],[1496,1,1498,1],[1496,2,1498,2],[1496,3,1498,3],[1496,4,1498,4],[1496,5,1498,5],[1496,6,1498,6],[1496,7,1498,7],[1493,1,1495,1],[1493,2,1495,2],[1493,3,1495,3],[1493,4,1495,4],[1493,5,1495,5],[1487,6,1489,6],[1487,7,1489,7],[1490,1,1492,1],[1490,2,1492,2],[1490,3,1492,3],[1490,4,1492,4],[1490,5,1492,5],[1490,6,1492,6],[1490,7,1492,7],[1487,1,1489,1],[1487,2,1489,2],[1487,3,1489,3],[1487,4,1489,4],[1487,5,1489,5],[1481,6,1483,6],[1481,7,1483,7],[1484,1,1486,1],[1484,2,1486,2],[1484,3,1486,3],[1484,4,1486,4],[1484,5,1486,5],[1484,6,1486,6],[1484,7,1486,7],[1481,1,1483,1],[1481,2,1483,2],[1481,3,1483,3],[1481,4,1483,4],[1481,5,1483,5],[1475,6,1477,6],[1475,7,1477,7],[1478,1,1480,1],[1478,2,1480,2],[1478,3,1480,3],[1478,4,1480,4],[1478,5,1480,5],[1478,6,1480,6],[1478,7,1480,7],[1475,1,1477,1],[1475,2,1477,2],[1475,3,1477,3],[1475,4,1477,4],[1475,5,1477,5],[1468,6,1470,6],[1468,7,1470,7],[1472,1,1474,1],[1472,2,1474,2],[1472,3,1474,3],[1472,4,1474,4],[1472,5,1474,5],[1472,6,1474,6],[1472,7,1474,7],[1468,1,1470,1],[1468,2,1470,2],[1468,3,1470,3],[1468,4,1470,4],[1468,5,1470,5],[1462,6,1464,6],[1462,7,1464,7],[1465,1,1467,1],[1465,2,1467,2],[1465,3,1467,3],[1465,4,1467,4],[1465,5,1467,5],[1465,6,1467,6],[1465,7,1467,7],[1462,1,1464,1],[1462,2,1464,2],[1462,3,1464,3],[1462,4,1464,4],[1462,5,1464,5],[1452,6,1454,6],[1452,7,1454,7],[1456,1,1458,1],[1456,2,1458,2],[1456,3,1458,3],[1456,4,1458,4],[1456,5,1458,5],[1456,6,1458,6],[1456,7,1458,7],[1452,1,1454,1],[1452,2,1454,2],[1452,3,1454,3],[1452,4,1454,4],[1452,5,1454,5],[1446,6,1448,6],[1446,7,1448,7],[1449,1,1451,1],[1449,2,1451,2],[1449,3,1451,3],[1449,4,1451,4],[1449,5,1451,5],[1449,6,1451,6],[1449,7,1451,7],[1446,1,1448,1],[1446,2,1448,2],[1446,3,1448,3],[1446,4,1448,4],[1446,5,1448,5],[1437,6,1439,6],[1437,7,1439,7],[1442,1,1444,1],[1442,2,1444,2],[1442,3,1444,3],[1442,4,1444,4],[1442,5,1444,5],[1442,6,1444,6],[1442,7,1444,7],[1437,1,1439,1],[1437,2,1439,2],[1437,3,1439,3],[1437,4,1439,4],[1437,5,1439,5],[1431,6,1433,6],[1431,7,1433,7],[1434,1,1436,1],[1434,2,1436,2],[1434,3,1436,3],[1434,4,1436,4],[1434,5,1436,5],[1434,6,1436,6],[1434,7,1436,7],[1431,1,1433,1],[1431,2,1433,2],[1431,3,1433,3],[1431,4,1433,4],[1431,5,1433,5],[1424,6,1426,6],[1424,7,1426,7],[1427,1,1429,1],[1427,2,1429,2],[1427,3,1429,3],[1427,4,1429,4],[1427,5,1429,5],[1427,6,1429,6],[1427,7,1429,7],[1424,1,1426,1],[1424,2,1426,2],[1424,3,1426,3],[1424,4,1426,4],[1424,5,1426,5],[1418,6,1420,6],[1418,7,1420,7],[1421,1,1423,1],[1421,2,1423,2],[1421,3,1423,3],[1421,4,1423,4],[1421,5,1423,5],[1421,6,1423,6],[1421,7,1423,7],[1418,1,1420,1],[1418,2,1420,2],[1418,3,1420,3],[1418,4,1420,4],[1418,5,1420,5],[1412,6,1414,6],[1412,7,1414,7],[1415,1,1417,1],[1415,2,1417,2],[1415,3,1417,3],[1415,4,1417,4],[1415,5,1417,5],[1415,6,1417,6],[1415,7,1417,7],[1412,1,1414,1],[1412,2,1414,2],[1412,3,1414,3],[1412,4,1414,4],[1412,5,1414,5],[1405,6,1407,6],[1405,7,1407,7],[1409,1,1411,1],[1409,2,1411,2],[1409,3,1411,3],[1409,4,1411,4],[1409,5,1411,5],[1409,6,1411,6],[1409,7,1411,7],[1405,1,1407,1],[1405,2,1407,2],[1405,3,1407,3],[1405,4,1407,4],[1405,5,1407,5],[1399,6,1401,6],[1399,7,1401,7],[1402,1,1404,1],[1402,2,1404,2],[1402,3,1404,3],[1402,4,1404,4],[1402,5,1404,5],[1402,6,1404,6],[1402,7,1404,7],[1399,1,1401,1],[1399,2,1401,2],[1399,3,1401,3],[1399,4,1401,4],[1399,5,1401,5],[1393,6,1395,6],[1393,7,1395,7],[1396,1,1398,1],[1396,2,1398,2],[1396,3,1398,3],[1396,4,1398,4],[1396,5,1398,5],[1396,6,1398,6],[1396,7,1398,7],[1393,1,1395,1],[1393,2,1395,2],[1393,3,1395,3],[1393,4,1395,4],[1393,5,1395,5],[1386,6,1388,6],[1386,7,1388,7],[1389,1,1391,1],[1389,2,1391,2],[1389,3,1391,3],[1389,4,1391,4],[1389,5,1391,5],[1389,6,1391,6],[1389,7,1391,7],[1386,1,1388,1],[1386,2,1388,2],[1386,3,1388,3],[1386,4,1388,4],[1386,5,1388,5],[1379,6,1381,6],[1379,7,1381,7],[1382,1,1384,1],[1382,2,1384,2],[1382,3,1384,3],[1382,4,1384,4],[1382,5,1384,5],[1382,6,1384,6],[1382,7,1384,7],[1379,1,1381,1],[1379,2,1381,2],[1379,3,1381,3],[1379,4,1381,4],[1379,5,1381,5],[1376,1,1378,1],[1376,2,1378,2],[1376,3,1378,3],[1376,4,1378,4],[1376,5,1378,5],[1376,6,1378,6],[1376,7,1378,7],[1368,6,1370,6],[1368,7,1370,7],[1371,1,1373,1],[1371,2,1373,2],[1371,3,1373,3],[1371,4,1373,4],[1371,5,1373,5],[1371,6,1373,6],[1371,7,1373,7],[1368,1,1370,1],[1368,2,1370,2],[1368,3,1370,3],[1368,4,1370,4],[1368,5,1370,5],[1362,6,1364,6],[1362,7,1364,7],[1365,1,1367,1],[1365,2,1367,2],[1365,3,1367,3],[1365,4,1367,4],[1365,5,1367,5],[1365,6,1367,6],[1365,7,1367,7],[1362,1,1364,1],[1362,2,1364,2],[1362,3,1364,3],[1362,4,1364,4],[1362,5,1364,5],[1355,6,1357,6],[1355,7,1357,7],[1358,1,1360,1],[1358,2,1360,2],[1358,3,1360,3],[1358,4,1360,4],[1358,5,1360,5],[1358,6,1360,6],[1358,7,1360,7],[1355,1,1357,1],[1355,2,1357,2],[1355,3,1357,3],[1355,4,1357,4],[1355,5,1357,5],[1349,6,1351,6],[1349,7,1351,7],[1352,1,1354,1],[1352,2,1354,2],[1352,3,1354,3],[1352,4,1354,4],[1352,5,1354,5],[1352,6,1354,6],[1352,7,1354,7],[1349,1,1351,1],[1349,2,1351,2],[1349,3,1351,3],[1349,4,1351,4],[1349,5,1351,5],[1343,6,1345,6],[1343,7,1345,7],[1346,1,1348,1],[1346,2,1348,2],[1346,3,1348,3],[1346,4,1348,4],[1346,5,1348,5],[1346,6,1348,6],[1346,7,1348,7],[1343,1,1345,1],[1343,2,1345,2],[1343,3,1345,3],[1343,4,1345,4],[1343,5,1345,5],[1337,6,1339,6],[1337,7,1339,7],[1340,1,1342,1],[1340,2,1342,2],[1340,3,1342,3],[1340,4,1342,4],[1340,5,1342,5],[1340,6,1342,6],[1340,7,1342,7],[1337,1,1339,1],[1337,2,1339,2],[1337,3,1339,3],[1337,4,1339,4],[1337,5,1339,5],[1331,6,1333,6],[1331,7,1333,7],[1334,1,1336,1],[1334,2,1336,2],[1334,3,1336,3],[1334,4,1336,4],[1334,5,1336,5],[1334,6,1336,6],[1334,7,1336,7],[1331,1,1333,1],[1331,2,1333,2],[1331,3,1333,3],[1331,4,1333,4],[1331,5,1333,5],[1328,1,1330,1],[1328,2,1330,2],[1328,3,1330,3],[1328,4,1330,4],[1328,5,1330,5],[1325,1,1327,1],[1325,2,1327,2],[1325,3,1327,3],[1325,4,1327,4],[1325,5,1327,5],[1322,1,1324,1],[1322,2,1324,2],[1322,3,1324,3],[1322,4,1324,4],[1322,5,1324,5],[1318,1,1320,1],[1318,2,1320,2],[1318,3,1320,3],[1318,4,1320,4],[1318,5,1320,5],[1312,6,1314,6],[1312,7,1314,7],[1315,1,1317,1],[1315,2,1317,2],[1315,3,1317,3],[1315,4,1317,4],[1315,5,1317,5],[1315,6,1317,6],[1315,7,1317,7],[1312,1,1314,1],[1312,2,1314,2],[1312,3,1314,3],[1312,4,1314,4],[1312,5,1314,5],[1304,6,1306,6],[1304,7,1306,7],[1309,1,1311,1],[1309,2,1311,2],[1309,3,1311,3],[1309,4,1311,4],[1309,5,1311,5]],"merged_total":4737,"flags":["merged_cut"]}
[]
["Name of Conformity Assessment Body"]
["Address"]
["Scheme Applied"]
["Standard Criteria","Environmental Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-2:2016 and applicable IAF Mandatory Documents"]
["IAF Mandatory Documents",{"$f":"_xlfn.IFS(B5=Sheet1!C2,Sheet1!D2,B5=Sheet1!C3,Sheet1!D3,B5=Sheet1!C4,Sheet1!D4,B5=Sheet1!C5,Sheet1!D5,B5=Sheet1!C6,Sheet1!D6,B5=Sheet1!C7,Sheet1!D7,B5=Sheet1!C8,Sheet1!D8,B5=Sheet1!C9,Sheet1!D9,B5=Sheet1!C10,Sheet1!D10,B5=Sheet1!C11,Sheet1!D11,B5=Sheet1!C12,Sheet1!D12,B5=Sheet1!C13,Sheet1!D13,B5=Sheet1!C14,Sheet1!D14)","v":"IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, & 23"}]
["NOTE: Do not insert additional ROW"]
[]
[]
[]
[]
[]
["ISO/IEC 17021-1:2015"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments\n[Note: Findings/ Comments can be (where applicable):\nverify on-site, submit additional documents, not applicable]\n","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["5 General Requirements"]
["5.1 Legal and contractual matters\n5.1.1 Legal responsibility\nIs the certification body a legal entity, or a defined part of a legal entity, such that it can be held legally responsible for all its certification activities?\n*A governmental certification body is deemed to be a legal entity on the basis of its governmental status."]
[]
[]
["5.1.2 Certification agreement\nDoes the certification body have a legally enforceable agreement for the provision of certification service in accordance with the relevant requirements of this part of ISO/IEC 17021 to its client? \nWhere there are multiple offices of a certification body or multiple sites of a client, does the certification body ensure that there is a legally enforceable agreement between the certification body granting certification and issuing a certificate, and all the sites covered by the scope of the certification?"]
[]
[]
["5.1.3 Responsibility for certification decisions\nIs the certification body responsible for, and does it retain authority for, its decisions relating to certification, including the granting, refusing, maintaining of certification, expanding or reducing the scope of certification, renewing, suspending or restoring following suspension, or withdrawing of certification?"]
[]
[]
["5.2 Management of impartiality\n"]
["5.2.1\n Does the certification body undertake conformity assessment activities impartially? \nDoes the certification body allow commercial, financial or other pressures to compromise impartiality? Is the certification body responsible for the impartiality of its conformity assessment activities?"]
[]
[]
["5.2.2\n Does the certification body have top management commitment to impartiality in management system certification activities?\nDoes the certification body have a policy that it understands the importance of impartiality in carrying out its management system certification activities, manages conflict of interest and ensures the objectivity of its management system certification activities?"]
[]
[]
["5.2.3\n Does the certification body have a process to identify, analyze, evaluate, treat, monitor and document the risks related to conflict of interests arising from provision of certification including any conflicts arising from its relationship on an ongoing basis?\nWhere there are any threats to impartiality, does the certification body document and demonstrate how to eliminate or minimize such threats and document any residual risk?\nDoes the demonstration cover all potential threats that are identified, whether they arise from within the certification body or from the activities of other persons, bodies or organizations?\nDoes the top management review any residual risk to determine if it is within the level of acceptable risk?\nDoes the risk assessment process include identification of and consultation with appropriate interested parties advising on matters affecting impartiality including openness and public  perception?\n• Sources of threats to impartiality of the certification body can be based on ownership, governance, management, personnel, shared resources, finances, contracts, training, marketing and payment of a sales commission or other inducement for the referral of new clients, etc.\n• Interested parties can include personnel and clients of the certification body, customers of organizations whose management systems are certified, representatives of industry trade associations, representatives of governmental regulatory bodies or other governmental services or representatives of \nnon-governmental organizations, including consumer organizations.\n• One way of fulfilling the consultation requirement of this clause is by the use of a committee of these interested parties"]
[]
[]
["5.2.4\nDoes the certification body certify another certification body for its management system certification activities?"]
[]
[]
["5.2.5\n Does the certification body or any part of the same legal entity under the organizational control of the certification body offer or provide management system consultancy?\nThis also applies to that part of government identified as the certification body.\n• This does not preclude the possibility of exchange of information (e.g. explanation of findings or clarification of requirements) between the certification body and its clients."]
[]
[]
["5.2.6\nDoes the certification body or any part of the same legal entity and any entity under the organizational control of the certification body offer or provide internal audits to its certified clients? The carrying out of internal audits by the certification body and any part of the same legal entity to its certified clients is a significant threat to impartiality.\n• See Note 1 to Clause 5.2.3"]
[]
[]
["5.2.7\n Does the certification body certify the management system for a minimum of two years following the end of the consultancy?\nWhen a client has received management systems consultancy from a body that has a relationship with a certification body, this is a significant threat to impartiality.\n• See Note to 5.2.3."]
[]
[]
["5.2.8\n Does the certification body outsource audits to a management system consultancy organization, as this poses an unacceptable threat to the impartiality of the certification body (see Clause 7.5)?\nThis does not apply to individuals contracted as auditors covered in Clause 7.3."]
[]
[]
["5.2.9\nAre the certification body’s activities marketed or offered as linked with the activities of an organization that provides management system consultancy?\nDoes the certification body take action to correct inappropriate links or statements by any consultancy organization stating or implying that certification would be simpler, easier, faster or less expensive if the certification body were used?\nDoes the certification body not state or imply that certification would be simpler, easier, faster or less expensive if a specified consultancy organization were used?"]
[]
[]
["5.2.10\n Does the certification body ensure that personnel who have provided management system consultancy, including those acting in a managerial capacity, do not take part in an audit or other certification activities if they have been involved in management system consultancy towards the client in question within two years following the end of the consultancy?"]
[]
[]
["5.2.11\nDoes the certification body take action to respond to any threats to its impartiality arising from the actions of other persons, bodies or organizations?"]
[]
[]
["5.2.12\nDo all certification body personnel, either internal or external, or committees, who could influence the certification activities, act impartially and not allow commercial, financial or other pressures to compromise impartiality?"]
[]
[]
["5.2.13\nDoes the certification body require personnel, both internal and external, to reveal any situation known to them that may present them or the certification body with a conflict of interests? Does the certification body record and use this information as input to identifying threats to impartiality raised by the activities of such personnel or by the organizations that employ them?\nDoes the certification body use personnel, either internal or external, unless they can demonstrate that there is no conflict of interests?"]
[]
[]
["5.3 Liability and financing\n"]
["5.3.1\nCan the certification body demonstrate that it has evaluated the risks arising from its certification activities and that it has adequate arrangements (e.g. insurance or reserves) to cover liabilities arising from its operations in each of its fields of activities and the geographic areas in which it operates?"]
[]
[]
["5.3.2\nDoes the certification body evaluate its finances and sources of income and demonstrate to the committee specified in 6.2 that initially, and on an ongoing basis, commercial, financial or other pressures do not compromise its impartiality?"]
[]
[]
["6 Structural requirements\n6.1 Organizational structure and top management\n"]
["6.1.1\n Has the certification body documented its organizational structure, showing duties, responsibilities and authorities of management and other certification personnel and any committees?\nWhen the certification body is a defined part of a legal entity, does the structure include the line of authority and the relationship to other parts within the same legal entity?"]
[]
[]
["6.1.2\n Are the certification activities structured and managed to safeguard impartiality?"]
[]
[]
["6.1.3\n Has the certification body identified the top management (board, group of persons, or person) having overall authority and responsibility for each of the following:\na) development of policies and establishment of processes and procedures relating to its operations;\nb) supervision of the implementation of the policies and procedures;\nc) ensuring impartiality;\nd) supervision of its finances;\ne) development of management system certification services and schemes;\nf) performance of audits and certification, and responsiveness to complaints;\ng) decisions on certification; delegation of authority to committees or individuals, as required, to undertake defined activities on its behalf;\nh) contractual arrangements;\ni) provision of adequate resources for certification activities?"]
[]
[]
["6.1.4\n Does the certification body have formal rules for the appointment, terms of reference and operation of any committees involved in the certification activities?"]
[]
[]
["6.2 Operational Control \n"]
["6.2.1\n Does the certification body have a process for the effective control of certification activities delivered by branch offices, partnerships, agents, franchisees, etc. irrespective of their legal status, relationship or geographical location?\nHave the certification body considered the risk that these activities pose to the competence, consistency and impartiality of the certification body?"]
[]
[]
["6.2.2\nHas the certification body considered the appropriate level and method of control of activities undertaken including its processes, technical areas of certification bodies’ operations, competence of personnel, lines of management control, reporting and remote access to operations including records?"]
[]
[]
["7 Resource requirements\n"]
["7.1 Competence of personnel\n"]
["7.1.1 General considerations\nDoes the certification body have processes to ensure that personnel have appropriate knowledge and skills relevant to the certification standard and geographic areas in which it operates?"]
[]
[]
["7.1.2 Determination of competence criteria\nDoes the certification body have a documented process for determining the competence criteria for personnel involved in the management and performance of audits and certification activities?\nAre competence criteria determined with regard to the requirements of the certification standard for each technical area, and for each function in the certification process?\nThe output of the process shall be the documented criteria of required knowledge and skills necessary to effectively perform audit and certification tasks to be fulfilled to achieve the intended results. Annex A specifies the knowledge and skills that a certification body shall define for specific functions.\n• The term “technical areas” is applied differently on the management system standard being considered.For any management system, the term is related to products, processes and services in the context of the scope of the management system standard. The technical area can be defined by a specific certification scheme (e.g. ISO/TS 22003) or can be determined by the certification body. It is used to cover a number of other terms such as “scopes”, “categories”, “sectors”, etc., which are traditionally used \nin different management system disciplines."]
[]
[]
["7.1.3 Evaluation process\nDoes the certification body have documented processes for the initial competence evaluation, and on-going monitoring of competence and performance of all personnel involved in the management and performance of audits and other certification activities, applying the determined competence criteria?\nDoes the certification body able to demonstrate that its evaluation methods are effective? \nThe output from these processes shall be to identify personnel who have demonstrated the level of competence required for the different functions of the audit and certification process? \n• A number of evaluation methods that can be used to evaluate knowledge and skills are described in Annex B of IS/IEC 17021-1.\n• Annex C of ISO/IEC 17021-1:2015 shows an example of process flow for determining and maintaining competence."]
[]
[]
["7.1.4 Other considerations\nDoes the certification body have access to the necessary technical expertise for advice on matters directly relating to certification activities for all technical areas, types of management systems and geographic areas in which the certification body operates?\nSuch advice may be provided externally or by certification body personnel."]
[]
[]
["7.2 Personnel involved in the certification activities\n"]
["7.2.1\n Does the certification body have sufficient, competent personnel for managing and supporting the type and range of audit programmes and other certification work performed?"]
[]
[]
["7.2.2\n Does the certification body employ, or have access to, a sufficient number of auditors,including audit team leaders, and technical experts to cover all of its activities and to handle the volume of audit work performed?"]
[]
[]
["7.2.3\n Does the certification body make clear to each person concerned their duties, responsibilities and authorities?"]
[]
[]
["7.2.4\nDoes the certification body have processes for selecting, training, formally authorizing auditors and for selecting and familiarizing technical experts used in the certification activity? \nDoes the initial competence evaluation of an auditor include ability to apply required knowledge and skills during audits, as determined by a competent evaluator observing the auditor \nconducting an audit?\n• During the selection and training process described above, desired personal behaviours can be considered. These are characteristics that affect an individual's ability to perform specific functions. Therefore, knowledge about the behaviours of individuals enables a certification body to take advantage of their strengths and to minimize the impact of their weaknesses."]
[]
[]
["7.2.5\nDoes the certification body have a process to achieve and demonstrate effective auditing, including the use of auditors and audit team leaders possessing generic auditing skills and \nknowledge, as well as skills and knowledge appropriate for auditing in specific technical areas?"]
[]
[]
["7.2.6\nDoes the certification body ensure that auditors (and, where needed, technical experts) are knowledgeable of its audit processes, certification requirements and other relevant requirements? Does the certification body give auditors and technical expert’s access to an up\u0002to-date set of documented procedures giving audit instructions and all relevant information on the certification activities?"]
[]
[]
["7.2.7\n Does the certification body identify training needs and offer or provide access to specific training to ensure its auditors, technical experts and other personnel involved in certification activities are competent for the functions they perform?"]
[]
[]
["7.2.8\nDoes the group or individual that takes the decision on granting, refusing, maintaining, renewing, suspending, restoring or withdrawing certification, or on expanding or reducing the  scope of certification, understand the applicable standard and certification requirements, and have demonstrated competence to evaluate the outcomes of the audit processes including \nrelated recommendations of the audit team?"]
[]
[]
["7.2.9\n Does the certification body ensure the satisfactory performance of all personnel involved in the audit and certification activities?\nAre there documented process for monitoring competence and performance of all persons involved, based on the frequency of their usage and the level of risk linked to their activities? \nDoes the certification body review and record the competence of its personnel in the light of their performance in order to identify training needs?"]
[]
[]
["7.2.10\n Does the certification body monitor each auditor considering each type of management system to which the auditor is deemed competent?\nDo the documented monitoring procedures for auditors include combination of on-site observation, review of audit reports and feedback from clients or from the market?\nIs the monitoring designed in such a way as to minimize disturbance to the normal processes of certification, especially from the client's viewpoint?"]
[]
[]
["7.2.11\nDoes the certification body periodically evaluate the performance of each auditor on-site?\nIs the frequency of on-site evaluations based on the need determined from all monitoring information available?"]
[]
[]
["7.3 Use of individual external auditors and external technical experts\nDoes the certification body require external auditors and external technical experts to have a written agreement by which they commit themselves to comply with applicable policies and \nimplemented processes as defined by the certification body?\nDo the agreement address aspects relating to confidentiality and impartiality and require the external auditors and external technical experts to notify the certification body of any existing or \nprior relationship with any organization they may be assigned to audit?\n• Use of an individual or employee of another organization individually contracted to serve as an external auditor or technical expert does not constitute outsourcing."]
[]
[]
["7.4 Personnel records \nDoes the certification body maintain up-to-date personnel records, including relevant qualifications, training, experience, affiliations, professional status and competence? \nDoes the record include management and administrative personnel in addition to those performing certification activities?"]
[]
[]
["7.5 Outsourcing"]
["7.5.1\nDoes the certification body have a process in which it describes the conditions under which outsourcing (which is subcontracting to another organization to provide part of the certification activities on behalf of the certification body) may take place?\nDoes the certification body have a legally enforceable agreement covering the arrangements, including confidentiality and conflict of interests, with each body that provides outsourced services?"]
[]
[]
["7.5.2\n Are decisions for granting, refusing maintaining of certification, expanding or reducing the scope of certification, renewing, suspending or restoring, or withdrawing of certification are not outsourced?"]
[]
[]
["7.5.3\nDoes the certification body:\na) take responsibility for all activities outsourced to another body,\nb) ensure that the body that provides outsourced services, and the individuals that it uses, conform to requirements of the certification body and also to the applicable provisions of \nISO/IEC 17021-1, including competence, impartiality and confidentiality, and\nc) Ensure that the body that provides outsourced services, and the individuals that it uses, are not involved, either directly or through any other employer, with an organization to be audited, in such a way that impartiality could be compromised?"]
[]
[]
["7.5.4\n Does the certification body have a process for the approval and monitoring of all bodies \nthat provide outsourced services used for certification activities?\nDoes the certification body ensure that records of the competence of all personnel involved in certification activities are maintained?\n• For Clauses 7.5.1 to 7.5.4, where the certification body engages individuals or employees of other organizations to provide additional resources or expertise, these individuals do not constitute outsourcing \nprovided they are individually contracted to operate under the certification body’s management system (see Clause 7.3)\n• *For Clauses 7.5.1 to 7.5.4, the terms “outsourcing” and “subcontracting” are considered to be synonyms."]
[]
[]
["8 Information requirements\n"]
["8.1 Publicly accessible information\n"]
["8.1.1\n Does the certification body maintain (through publications, electronic media or other means), and make public, without request, in all the geographical areas in which it operates, information about:\na) Audit processes;\nb) Processes for granting, refusing, maintaining, renewing, suspending, restoring or withdrawing certification or expanding or reducing the scope of certification;\nc) Types of management systems and certification schemes in which it operates;\nd) The use of the certification body’s name and certification mark or logo;\ne) Processes for handling requests for information, complaints and appeals;\nf) Policy on impartiality?"]
[]
[]
["8.1.2\nDoes the certification body provide upon request about:\na) geographical areas in which it operates;\nb) the status of a given certification; and\nc) the name, related normative document, scope and geographical location (city and country) for a specific certified client?\n• In exceptional cases, access to certain information can be limited on the request of the client (e.g. for security reasons).\n• The certification body can also make the information in 8.1.2 public by any means it chooses without request, e.g. on its internet website."]
[]
[]
["8.1.3\n Does the certification body ensure that information provided to any client or to the marketplace, including advertising, is accurate and not misleading?"]
[]
[]
["8.2 Certification documents\n"]
["8.2.1\n How does the certification body provide certification documents to the certified client?"]
[]
[]
["8.2.2\n Does the certification document(s) identify the following:\na) the name and geographic location of each client whose management system is certified (or the geographic location of the headquarters and any sites within the scope of a multi-site \ncertification);\nb) the effective date of granting, expanding or reducing the scope of certification or renewing certification which shall not be before the date of the relevant certification decision;\n• The certification body can keep the original certification date on the certificate when a certificate lapses for a period of time provided that:\n- the current certification cycle start and expiry date are clearly indicated;\n- the last certification cycle expiry date be indicated along with the date of recertification audit\nc) the expiry date or recertification due date consistent with the recertification cycle;\nd) a unique identification code;\ne) the management system standard and/or other normative document, including indication of issue status (e.g. revision date or number) used for audit of the certified client;\nf) the scope of certification with respect to types of activities, products and services as applicable at each site without being misleading or ambiguous;\ng) the name, address and certification mark of the certification body; other marks (e.g. accreditation symbol, client’s logo) may be used provided they are not misleading or ambiguous;\nh) any other information required by the standard and/or other normative document used for certification;\ni) in the event of issuing any revised certification documents, a means to distinguish the revised documents from any prior obsolete documents?\n• ISO/IEC 17030 provides requirements for use of third-party marks."]
[]
[]
["8.3 Reference to certification and use of marks\n"]
["8.3.1\nDoes the certification body have rules governing any management system’s third-party mark that it authorizes certified clients to use?\nDo these rules ensure, among other things, traceability back to the certification body?\nIs there any ambiguity, in the mark or accompanying text, as to what has been certified and which certification body has granted the certification?\nIs the mark used on a product or product packaging seen by the consumer or in any other way that may be interpreted as denoting product conformity?\n• ISO/IEC 17030 provides additional information for use of third-party marks."]
[]
[]
["8.3.2\nHow does the certification body ensure that its marks are not applied to laboratory test, calibration or inspection reports or certificates? Such reports are deemed to be products in this context."]
[]
[]
["8.3.3\n Does the certification body have rules governing the use of any statement on product packaging or in accompanying information that the certified client has a certified management system?"]
[]
[]
["8.3.4 \nDoes the certification body through legally enforceable arrangements require that the certified client:\na) conforms to the requirements of the certification body when making reference to its certification status in communication media such as the internet, brochures or advertising, or other documents;\nb) does not make or permit any misleading statement regarding its certification;\nc) does not use or permit the use of a certification document or any part thereof in a misleading manner;\nd) upon withdrawal of its certification, discontinues its use of all advertising matter that contains a reference to certification, as directed by the certification body (see 9.6.5);\ne) amends all advertising matter when the scope of certification has been reduced,\nf) does not allow reference to its management system certification to be used in such a way as to imply that the certification body certifies a product (including service) or process;\ng) does not imply that the certification applies to activities and sites that are outside the scope of certification; and\nh) does not use its certification in such a manner that would bring the certification body and/or certification system into disrepute and lose public trust?\n"]
[]
[]
["8.3.5\n Does the certification body exercise proper control of ownership and take action to deal with incorrect references to certification status or misleading use of certification documents, marks or audit reports?\n*Such action could include requests for correction and corrective action, suspension, withdrawal of certification, publication of the transgression and, if necessary, legal action."]
[]
[]
["8.4 Confidentiality\n"]
["8.4.1\n Does the certification body, through legally enforceable agreements, have the responsibility for the management of all information obtained or created during the performance\nof certification activities at all levels of its structure, including committees and external bodies or individuals acting on its behalf?"]
[]
[]
["8.4.2\nDoes the certification body inform the client, in advance, of the information it intends to place in the public domain?\nIs all other information, except for information that is made publicly accessible by the client, considered confidential?"]
[]
[]
["8.4.3\n Except as required in ISO/IEC 17021, is information about a particular certified client or individual not disclosed to a third party without the written consent of the certified client or individual concerned?"]
[]
[]
["8.4.4\nWhen the certification body is required by law or authorized by contractual arrangements (such as with the accreditation body) to release confidential information, are the client or individual concerned, unless prohibited by law, notified of the information provided?"]
[]
[]
["8.4.5\n Is information about the client from sources other than the client (e.g. complainant, regulators) treated as confidential, consistent with the certification body’s policy?"]
[]
[]
["8.4.6\nDo personnel, including any committee members, contractors, personnel of external bodies or individuals acting on the certification body's behalf, keep all information obtained or  created during the performance of the certification body's activities, except as required by law, confidential?"]
[]
[]
["8.4.7\n Does the certification body have processes and where applicable equipment and facilities that ensure the secure handling of confidential information?"]
[]
[]
["8.5 Information exchange between a certification body and its clients"]
["8.5.1 Information on the certification activity and requirements\nDoes the certification body provide and update clients on the following:\na) detailed description of the initial and continuing certification activity, including the application, initial audits, surveillance audits, and the process for granting, refusing, maintaining of certification, expanding or reducing the scope of certification, renewing, suspending, or restoring, or withdrawing of certification;\nb) the normative requirements for certification;\nc) information about the fees for application, initial certification and continuing certification;\nd) the certification body's requirements for clients to:\n1. comply with certification requirements,\n2. make all necessary arrangements for the conduct of the audits, including provision for examining documentation and the access to all processes and areas, records and personnel for the purposes of initial certification, surveillance, recertification and \nresolution of complaints, and\n3. make provisions, where applicable, to accommodate the presence of observers (e.g. accreditation assessors or trainee auditors);\ne) documents describing the rights and duties of certified clients, including requirements, when making reference to its certification in communication of any kind in line with the requirements in 8.3; and\nf) information on procedures for handling complaints and appeals?"]
[]
[]
["8.5.2 Notice of changes by a certification body \nDoes the certification body give its certified clients due notice of any changes to its requirements for certification?\nDoes the certification body verify that each certified client complies with the new requirements?"]
[]
[]
["8.5.3 Notice of changes by a certified client \nDoes the certification body have legally enforceable arrangements to ensure that the certified client informs the certification body, without delay, of matters that may affect the capability of the management system to continue to fulfil the requirements of the standard used for certification?\nDo these include, for example, changes relating to:\na) the legal, commercial, organizational status or ownership;\nb) organization and management (e.g. key managerial, decision-making or technical staff);\nc) contact address and sites;\nd) scope of operations under the certified management system; and\ne) major changes to the management system and processes? \nDoes the certification body take action as appropriate?\n"]
[]
[]
["9 Process requirements"]
["9.1 Pre-certification activities\n"]
["9.1.1 Application\nDoes your certification body require an authorized representative of the applicant organisation to provide the necessary information to enable it to establish the following:\na) the desired scope of the certification;\nb) relevant details of the applicant organisation as required by the specific certification scheme, including its name and the address(es) of its site(s), its processes and operations, human and technical resources, functions, relationships and any relevant legal obligation;\nc) identification of outsourced processes used by the organisation that will affect conformity to requirements;\nd) the standards or other requirements for which the applicant organisation is seeking certification; and\ne) whether consultancy relating to the management system to be certified has been provided and, if so, by whom?"]
[]
[]
["9.1.2 Application Review"]
["9.1.2.1\n Does your certification body conduct a review of the application and supplementary information for certification to ensure that:\na) the information about the applicant organisation and its management system is sufficient to develop an audit programme (see Clause 9.1.3)\nb) any known difference in understanding between the certification body and the application organisation is resolved;\nc) the certification body has the competence and ability to perform the certification activity; and\nd) the scope of certification sought, the site(s) of the applicant organisation’s operations, time required to complete audits and any other points influencing the certification activity are taken into account (language, safety conditions, threats to impartiality, etc.)?"]
[]
[]
["9.1.2.2\nFollowing the review of the application, the certification body shall either accept or decline an application for certification. When the certification body declines an application for certification as a result of the review of application, are the reasons for declining an application documented and made clear to the client?"]
[]
[]
["9.1.2.3\n Based on this review, does the certification body determine the competences it needs to include in its audit team and for the certification decision?"]
[]
[]
["9.1.3 Audit programme"]
["9.1.3.1\n Is an audit programme for the full certification cycle developed to clearly identify the audit activity/activities required to demonstrate that the client’s management system fulfils the requirements for certification to the selected standard(s) or other normative document(s)? \nDoes the audit programme for the certification cycle cover the complete management system requirements?"]
[]
[]
["9.1.3.2\n Does the audit programme for the initial certification include a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration of certification?\nDoes the first three-year certification cycle begin with the certification decision?\nDo subsequent cycles begin with the recertification decision (See Clause 9.6.3.2.3)?\nDoes the determination of the audit programme and any subsequent adjustments consider the size of the client, the scope and complexity of its management system, products and processes as well as demonstrated level of management system effectiveness and the results of any previous audits?\n• Annex E of ISO/IEC 17021-1 is a flowchart of a typical audit and certification process.\n• The following list contains additional items that can be considered when developing or revising an audit programme, they might also need to be addressed when determining the audit scope and developing the audit plan:\n- Complaints received by the certification body about the client;\n- Combined integrated or joint audit;\n- Changes to certification requirements;\n- Changes to legal requirements;\n- Changes to accreditation requirements;\n- Organisational performance data (e.g. defect levels, key performance indicators data)\n• If specified by the industry specific certification scheme, the certification cycle can be different from three years."]
[]
[]
["9.1.3.3\nAre surveillance audits conducted at least once a calendar year, except in recertification years?\nIs the date of the first surveillance audit following initial certification not more than 12 months from the certification decision date?\n• It can be necessary to adjust the frequency of surveillance audits to accommodate factors such as seasons or management systems certification of a limited duration (e.g. temporary construction site)"]
[]
[]
["9.1.3.4\nWhere the certification body is taking account of certification already granted to the client and to audits performed by another certification body, does the certification body obtain and retain sufficient evidence, such as reports and documentation on corrective actions, to any nonconformity?\nDoes the documentation support the fulfilling of the requirements in this part of ISO/IEC 17021? \nDoes the certification body, based on the information obtained, justify and record any adjustments to the existing audit programme and follow up the implementation of corrective actions concerning previous nonconformities?\n"]
[]
[]
["9.1.3.5\n Where the client operates shifts, are the activities that take place during shift working considered when developing the audit programme and audit plans?"]
[]
[]
["9.1.4 Determining audit time"]
["9.1.4.1\nDoes the certification body have documented procedures for determining audit time?\nDoes the certification body determine the time needed to plan and accomplish a complete and effective audit of the client’s QMS/EMS?"]
[]
[]
["9.1.4.2\n In determining the audit time, does the certification body consider, among other things, the following aspects:\na) the requirement of the relevant management system standards;\nb) complexity of the client and its management system;\nc) technological and regulatory context;\nd) Any outsourcing of any activities included in the scope of the applied management system;\ne) results of any prior audits;\nf) size and number of sites, their geographical locations and multi-site considerations;\ng) the risks associated with the products, processes or activities of the organisation;\nh) when audits are combined, joint or integrated?\n• Time spent travelling to and from audited sites is not included in the calculation of the duration of the management system audit days.\n• The certification body can use the guidance established in ISO/IEC TS 17023 for determining the duration of management system audit when documenting these procedures."]
[]
[]
["9.1.4.3\n Are the duration of the management system audit and its justification recorded?"]
[]
[]
["9.1.4.4\nDoes the time spent by any team member that is not assigned as an auditor (i.e. technical experts, translators, interpreters, observers and auditors-in-training) not count in the above established duration of the management system audit?\n• The use of translators can necessitate additional audit time."]
[]
[]
["9.1.5 Multi-site sampling\nWhere multi-site sampling is used for the audit of a client’s management system covering the same activity in various geographical locations, does the certification body develop a sampling programme to ensure proper audit of the management system?\nIs rationale for the sampling plan documented for each client? Sampling is not allowed for some specific certification schemes, and where specific criteria have been established for a specific certification scheme, e.g. ISO/TS 22003, these shall be applied.\n• Where there are multiple sites not covering the same activity sampling is not appropriate."]
[]
[]
["9.1.6 Multiple management systems standards\nWhen certification to multiple management system standards is being provided by the certification body, does the planning for the audit ensure adequate on-site auditing to provide confidence in the certification?\n"]
[]
[]
["9.2 Planning Audits\n"]
["9.2.1 Determining Audit objectives scope and criteria"]
["9.2.1.1\nDoes the certification body determine the audit objectives?\nDoes the certification body establish the audit scope and criteria, including any changes, after discussion with the client?"]
[]
[]
["9.2.1.2\n Do the audit objectives describe what is to be accomplished by the audit and include the following:\na) determination of the conformity of the client's management system, or parts of it, with audit criteria;\nb) evaluation of the ability of the management system to ensure the client organization meets applicable statutory, regulatory and contractual requirements;\n• A management system certification audit is not a legal compliance audit.\nc) determination of the effectiveness of the management system to ensure the client organization can reasonably expect to achieving its specified objectives; and\nd) as applicable, identification of areas for potential improvement of the management system?"]
[]
[]
["9.2.1.3 \nDoes the audit scope describe the extent and boundaries of the audit, such as physical locations, organizational units, activities and processes to be audited?\nWhere the initial or re-certification process consists of more than one audit (e.g. covering different locations), does the scope of an individual audit not cover the full certification scope, but the totality of audits is consistent with the scope in the certification document?\n"]
[]
[]
["9.2.1.4\nIs the audit criteria used as a reference against which conformity is determined, and does it include:\n- the requirements of a defined normative document on management systems;\n- the defined processes and documentation of the management system developed by the client?"]
[]
[]
["9.2.2 Audit Team selection and assignments"]
["9.2.2.1.1 General\nDoes the certification body have a process for selecting and appointing the audit team, including the audit team leader and technical experts as necessary, taking into account the competence needed to achieve the objectives of the audit and requirements for impartiality? \nIf there is only one auditor, Does the auditor have the competence to perform the duties of an audit team leader applicable for that audit?\nDoes the audit team have the totality of the competencies identified by the certification body as set out in Clause 9.1.2.3 for the audit?"]
[]
[]
["9.2.2.1.2\n In deciding the size and composition of the audit team, is consideration given to the following:\na) audit objectives, scope, criteria and estimated audit time;\nb) whether the audit is combined, joint or integrated;\nc) the overall competence of the audit team needed to achieve the objective of the audit (See Table A.1 of ISO/IEC 17021-1)\nd) certification requirements (including any applicable statutory, regulatory or contractual requirements);\ne) language and culture?\n• The team leader of a combined or integrated audit is expected to have in-depth knowledge of at least one of the standards and an awareness of the other standards used for that particular audit."]
[]
[]
["9.2.2.1.3\n Is the knowledge and skills of the audit team leader and auditors supplemented by technical experts, translators and interpreters, and operate under the direction of an auditor? \nAre translators or interpreters selected such that they do not unduly influence the audit?\n• The criteria for the selection of technical experts are determined on a case-by-case basis by the needs of the audit team and the scope of the audit."]
[]
[]
["9.2.2.1.4\n Are auditors-in-training included in the audit team as participants, provided an auditor is appointed as an evaluator?\nIs the evaluator competent to take over the duties and have final responsibility for the activities and findings of the auditor-in-training?"]
[]
[]
["9.2.2.1.5\nDoes the audit team leader, in consultation with the audit team, assign to each team member responsibility for auditing specific processes, functions, sites, areas or activities?\nDo these assignments take into account the need for competence, and the effective and efficient use of the audit team, as well as different roles and responsibilities of auditors, auditors-in-training and technical experts?\nAre changes to the work assignments made as the audit progresses to ensure achievement of the audit objectives?"]
[]
[]
["9.2.2.2 Observers, technical experts and guides"]
["9.2.2.2.1 Observers\nIs the presence and justification of observers during an audit activity agreed to by the certification body and client prior to the conduct of the audit?\nDoes the audit team ensure that observers do not unduly influence or interfere in the audit process or outcome of the audit?\n• Observers can be members of the client’s organisation, consultants, witnessing accreditation body personnel, regulators or other justified persons."]
[]
[]
["9.2.2.2.2 Technical experts\nIs the role of technical experts during an audit activity agreed to by the certification body and client prior to the conduct of the audit?\nDoes a technical expert not act as an auditor in the audit team? \nIs the technical expert accompanied by an auditor?\n*The technical experts can provide advice to the audit team for the preparation, planning or audit."]
[]
[]
["9.2.2.2.3 Guides\nIs each auditor accompanied by a guide, unless otherwise agreed to by the audit team leader and the client?\nAre guide(s) assigned to the audit team to facilitate the audit?\nDoes the audit team ensure that guides do not influence or interfere in the audit process or outcome of the audit?\n*The responsibilities of a guide can include:\na) establishing contacts and timing for interviews;\nb) arranging visits to specific parts of the site or organization;\nc) ensuring that rules concerning site safety and security procedures are known and respected by the audit team members;\nd) witnessing the audit on behalf of the client;\ne) providing clarification or information as requested by an auditor.\n**Where appropriate, the auditee can also act as the guide."]
[]
[]
["9.2.3 Audit plan"]
["9.2.3.1 General\nDoes the certification body ensure that an audit plan is established prior to each audit identified in the audit programme to provide the basis for agreement regarding the conduct and scheduling of the audit activities?\n*It is not expected that a certification body will develop an audit plan for each at the time that the audit programme is developed"]
[]
[]
["9.2.3.2 Preparing the audit plan\nIs the audit plan appropriate to the objectives and the scope of the audit? \nDoes the audit plan include or refer to the following at least:\na) the audit objectives;\nb) the audit criteria;\nc) the audit scope, including identification of the organizational and functional units or processes to be audited;\nd) the dates and sites where the on-site audit activities are to be conducted, including visits to temporary sites, as appropriate;\ne) the expected time and duration of on-site audit activities;\nf) the roles and responsibilities of the audit team members and accompanying persons?\n*The audit plan information can be contained in more than one document."]
[]
[]
["9.2.3.3 Communication of audit team tasks\nAre the tasks given to the audit team defined?\nDoes the certification body require the audit team to:\na) Examine and verify the structure, policies, processes, procedures, records and related documents of the client relevant to the management system standard;\nb) Determine that these meet all the requirements relevant to the intended scope of certification;\nc) Determine that the processes and procedures are established, implemented and maintained effectively, to provide a basis for confidence in the client’s QMS/EMS management system; and\nd) Communicate to the client, for its action, any inconsistencies between the client’s policy, objectives and targets?"]
[]
[]
["9.2.3.4 Communication of audit plan\nIs the audit plan communicated and the dates of the audit agreed upon, in advance, with the client organization?"]
[]
[]
["9.2.3.5 Communication concerning audit team members\nDoes the certification body provide the name of and, when requested, make available background information on each member of the audit team, with sufficient time for the client organisation to object to the appointment of any particular auditor or technical expert and for the certification body to reconstitute the team in response to any valid objection?"]
[]
[]
["9.3 Initial certification\n"]
["9.3.1 Initial certification audit"]
["9.3.1.1 General\nIs the initial certification audit of a management system conducted in two stages: stage 1 and stage 2?"]
[]
[]
["9.3.1.2 Stage 1"]
["9.3.1.2.1\nDoes planning ensure that the objectives of stage 1 can be met and the client be informed of any “on site” activities during stage 1?\n• Stage 1 does not require a formal audit plan (see clause 9.2.3)"]
[]
[]
["9.3.1.2.2\nAre the objectives of stage 1 to:\na) Review the client’s management system documented information;\nb) Evaluate the client’s site-specific conditions and to undertake discussions with the client’s personnel to determine the preparedness for stage 2;\nc) Review the client’s status and understanding regarding requirements of the standard, in particular with respect to the identification of key performance or significant aspects, processes, objectives and operation of the management system;\nd) Obtain necessary information regarding the scope of the management system, including:\n- the client’s site(s);\n- processes and equipment used;\n- levels of controls established (particularly in case of multisite clients);\n- applicable statutory and regulatory requirements;\ne) Review the allocation of resources for stage 2 and agree the details of stage 2 with the client;\nf) Provide a focus for planning stage 2 by gaining a sufficient understanding of the client’s management system and site operations in the context of the management system standard or other normative document; and\ng) Evaluate if the internal audits and management reviews are being planned and performed, and that the level of implementation of the management system substantiates that the client is ready for stage 2?\n• If at least part of stage 1 is carried out at the client’s premises, this can help to achieve the objectives stated above."]
[]
[]
["9.3.1.2.3\n Are documented conclusions with regard to fulfilment of the stage 1 objectives and the readiness for stage 2 communicated to the client, including identification of any areas of concern that could be classified as nonconformity during stage 2?\n• The stage 1 output does not need to meet the full requirements of a report (see clause 9.4.8)"]
[]
[]
["9.3.1.2.4\nIn determining the interval between stage 1 and stage 2, does consideration given to the needs of the client to resolve areas of concern identified during stage 1? The certification body may also need to revise its arrangements for stage 2.\n\nIf any significant changes which would impact the management system occur, does the certification body consider the need to repeat all or part of stage 1?\n\nIs the client informed that the results of stage 1 may lead to postponement or cancellation of stage 2?"]
[]
[]
["9.3.1.3 Stage 2\nThe purpose of stage 2 is to evaluate the implementation, including effectiveness, of the client’s management system. Does the stage 2 stake place at the site(s) of the client?\nDoes it include the auditing of at least the following:\na) Information and evidence about conformity to all requirements of the applicable management system standard or other normative documents;\nb) Performance monitoring, measuring, reporting and reviewing against key performance objectives and targets (consistent with the expectations in the applicable management system standard or other normative document);\nc) The client’s management system ability and its performance regarding meeting of applicable statutory, regulatory and contractual requirements;\nd) Operational control of the client’s processes;\ne) Internal auditing and management review; and\nf) Management responsibility for the client’s policies?"]
[]
[]
["9.3.1.4 Initial certification audit conclusions\nDoes the audit team analyze all information and audit evidence gathered during stage 1 and stage 2 to review the audit findings and agree on audit conclusions?"]
[]
[]
["9.4 Conducting audits\n"]
["9.4.1 General\nDoes the certification body have a process for conducting on-site audits?\nDoes this process include an opening meeting at the start of the audit and a closing meeting at the conclusion of the audit?\nWhere any part of the audit is made by electronic means or where the site to be audited is virtual, does the certification body ensure that such activities are conducted by personnel with appropriate competence?\nIs the evidence obtained during such an audit sufficient to enable the auditor to take an informed decision on the conformity of the requirement in question?\n• “On-site” audits can include remote access to electronic site(s) that contain(s) information that is relevant to the audit of the management system. Consideration can also be given to the use of electronic means for conducting audits."]
[]
[]
["9.4.2 Conducting the opening meeting\nIs a formal opening meeting held with the client’s management and, where appropriate, those responsible for the functions or processes to be audited?\nIs the purpose of the opening meeting, which is usually conducted by the audit team leader, to provide a short explanation of how the audit activities will be undertaken?\nIs the degree of details consistent with the familiarity of the client with the audit process? \nDoes the opening meeting include the following:\na) Introduction of the participants, including an outline of their roles;\nb) Confirmation of the scope of certification;\nc) Confirmation of the audit plan (including type and scope of audit, objectives and criteria), any changes, and other relevant arrangements with the client, such as the date and time for the closing meeting, interim meeting between the audit team and the client’s management;\nd) Confirmation of formal communication channels between the audit team and the client;\ne) Confirmation that the resources and facilities needed by the audit team available;\nf) Confirmation of matters relating to confidentiality;\ng) Confirmation of relevant work safety, emergency and security procedures for the audit team;\nh) Confirmation of the availability, roles and identities of any guides and observers;\ni) The method of reporting, including any grading of audit findings;\nj) Information about the conditions under which the audit may be prematurely terminated;\nk) Confirmation that the audit team leader and audit team representing the certification body is responsible for the audit and be in control of executing the audit plan including audit activities and audit trails;\nl) Confirmation of the status of findings of the previous review or audit, if applicable;\nm) Methods and procedures to be used to conduct the audit based on sampling;\nn) Confirmation of the language to be used during the audit;\no) Confirmation that, during the audit, the client will be kept informed of audit progress and any concerns; and\np) Opportunity for the client to ask questions?"]
[]
[]
["9.4.3 Communication during the audit"]
["9.4.3.1\nDuring the audit, Does the audit team periodically assess audit progress and exchange information?\nDoes the audit team leader re assign work as needed between the audit team members and periodically communicate the progress of the audit and any concerns to the client?"]
[]
[]
["9.4.3.2\nWhere the available audit evidence indicates that the audit objectives are unattainable or suggests the presence of an immediate and significant risk (e.g. safety), Does the audit team \nleader report this to the client, if possible, to the certification body to determine appropriate action?\nDoes such action include reconfirmation or modification of the audit plan, changes to the audit objectives or audit scope, or termination of the audit?\nDoes the audit team leader report the outcome of the action taken to the certification body?"]
[]
[]
["9.4.3.3\n Does the audit team leader review with the client any need for changes to the audit scope which becomes apparent as on-site auditing activities progress and report this to the certification body?"]
[]
[]
["9.4.4 Obtaining and verifying information"]
["9.4.4.1\n During the audit, Does the auditor of the certification body collect information relevant to the audit objectives, scope and criteria (including information relating to interfaces between functions, activities and processes) by appropriate sampling and verified to become audit evidence?"]
[]
[]
["9.4.4.2\n Does the auditor of the certification body use methods to collect information include, but \\not limited to:\na) Interviews;\nb) Observation of processes and activities;\nc) Review of documentation and records?"]
[]
[]
["9.4.5 Identifying and recording audit findings"]
["9.4.5.1\n Are the audit findings summarizing conformity and detailing non-conformity identified, classified and recorded to enable an informed certification decision to be made or the certification to be maintained?"]
[]
[]
["9.4.5.2\nAre Opportunities for improvement identified and recorded, unless prohibited by the requirements of a management system certification scheme?\nDoes the auditor of the certification body not record nonconformities as opportunities improvement?"]
[]
[]
["9.4.5.3 \nAre nonconformities recorded against a specific requirement of the audit criteria, and do they contain a clear statement of the nonconformity and identify in detail the objective evidence on which the nonconformity is based?\nAre nonconformities discussed with the client to ensure that the evidence is accurate and that the nonconformities are understood?\nDoes the auditor refrain from suggesting the cause of nonconformities or their solution?"]
[]
[]
["9.4.5.4\n Does the audit team leader attempt to resolve any diverging opinions between the audit team and the client concerning audit evidence or findings?\nAre unresolved points recorded?"]
[]
[]
["9.4.6 Preparing audit conclusions\nUnder the responsibility of the audit team leader and prior to the closing meeting, does the audit team:\na) review the audit findings, and any other appropriate information collected during the audit, against the audit objective and audit criteria and classify nonconformities;\nb) agree upon the audit conclusions, taking into account the uncertainty inherent in the audit process; c. identify any necessary follow-up actions;\nc) confirm the appropriateness of the audit programme or identify any modification required (e.g. scope of certification, audit time or dates, surveillance frequency, audit team competence)?"]
[]
[]
["9.4.7 Conducting the closing meeting"]
["9.4.7.1\nDoes the audit team of the certification body hold a formal closing meeting with the client's management and, where appropriate, those responsible for the functions or processes audited?\nIs attendance of the closing meeting recorded?\nIs the purpose of the closing meeting, normally conducted by the audit team leader, to present the audit conclusions, including the recommendation regarding certification?\nAre all nonconformities presented in such a manner that they are understood, and the timeframe for responding agreed?\n• “Understood” does not necessarily mean that the nonconformities have been accepted by the clients"]
[]
[]
["9.4.7.2\n Does the closing meeting also include the following elements where the degree of detail consistent with the familiarity of the client with the audit process:\na) advising the client that the audit evidence collected was based on a sample of the information; thereby introducing an element of uncertainty;\nb) the method and timeframe of reporting, including any grading of audit findings;\nc) the certification body's process for handling nonconformities including any consequences relating to the status of the client's certification;\nd) the timeframe for the client to present a plan for correction and corrective action for any nonconformities identified during the audit;\ne) the certification body's post audit activities;\nf) information about the complaint handling and appeal processes."]
[]
[]
["9.4.7.3 \nDoes the audit team of the certification body give the client opportunity for questions? \nAre diverging opinions regarding the audit findings or conclusions between the audit team and the client discussed and resolved where possible?\nAre diverging opinions that are not resolved recorded and referred to the certification body?"]
[]
[]
["9.4.8 Audit report"]
["9.4.8.1\nDoes the certification body provide to the client a written report for each audit? \nDoes the audit team identify opportunities for improvement without recommending specific solutions?\nIs the ownership of the audit report maintained by the certification body?"]
[]
[]
["9.4.8.2\nDoes the audit team leader ensure that the audit report is prepared and is responsible for its content?\nDoes the audit report provide an accurate, concise and clear record of the audit to enable an informed certification decision to be made and include or refer to the following:\na) identification of the certification body;\nb) the name and address of the client and the client's representative;\nc) the type of audit (e.g. initial, surveillance or recertification audit or special audits);\nd) the audit criteria;\ne) the audit objectives;\nf) the audit scope, particularly identification of the organizational or functional units or processes audited and the time of the audit;\ng) any deviation from the audit plan and their reason;\nh) any significant issues impacting on the audit programme;\ni) identification of the audit team leader, audit team members and any accompanying persons;\nj) the dates and places where the audit activities (on site or offsite, permanent or temporary sites) were conducted;\nk) audit findings (see 9.4.5), reference to evidence and conclusions, consistent with the requirements of the type of audit;\nl) Significant changes, if any, that affect the management system of the client since last audit took place;\nm) any unresolved issues, if identified.\nn) where applicable, whether the audit is combined, joint or integrated;\no) a disclaimer statement indicating that auditing is based on a sampling process of the available information;\np) recommendation from the audit team\nq) the audited client is effectively controlling the use of the certification documents and marks, if applicable; and\nr) verification of effectiveness of taken corrective actions regarding previously identified nonconformities, if applicable?"]
[]
[]
["9.4.8.3\nDoes the report contain:\na) a statement on the conformity and the effectiveness of the management system together with a summary of the evidence relating to:\n- the capability of the management system to meet applicable requirements and expected outcomes;\n- the internal audit and management review process;\nb) a conclusion on the appropriateness of the certification scope; and\nc) confirmation that the audit objectives have been fulfilled?"]
[]
[]
["9.4.9 Cause analysis of nonconformities\nDoes the certification body require the client to analyse the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time?"]
[]
[]
["9.4.10 Effectiveness of corrections and corrective actions\nDoes the certification body review the corrections, identified causes and corrective actions submitted by the client to determine if these are acceptable?\nDoes the certification body verify the effectiveness of any correction and corrective actions taken?\nIs the evidence obtained to support the resolution of nonconformities recorded? \nIs the client informed of the result of the review and verification?\nIs the client informed if an additional full audit, an additional limited audit, or documented evidence (to be confirmed during future surveillance audits) will be needed to verify effective correction and corrective actions?\n• Verification of effectiveness of correction and corrective action can be carried out based on a review of documentation provided by the client, or where necessary, through verification on-site."]
[]
[]
["9.5 Certification decision\n"]
["9.5.1 General"]
["9.5.1.1\nDoes the certification body ensure that the persons or committees that make the decisions for granting certification, expanding or reducing the scope of certification, suspending or restoring certification, withdrawing certification or renewing certification are different from those who carried out the audits?\nDoes the individual(s) appointed to conduct the certification decision have appropriate competence?"]
[]
[]
["9.5.1.2\n Is the person(s) [excluding members of committees (see clause 6.1.4)] assigned by the certification body to make a certification decision employed by, or under legally enforceable arrangement with either the certification body or an entity under the organizational control of the certification body?\nDoes the certification body’s organizational control has one of the following:\na) Whole or majority ownership of another entity by the certification body;\nb) Majority participation by the certification body on the board of directors of another entity; and\nc) A documented authority by the certification body over another entity in a network of legal entities (in which the certification body resides), linked by ownership or board of director control?\n• For governmental certification bodies, other parts of the same government can be considered to be “linked by ownership” to the certification body"]
[]
[]
["9.5.1.3\nDoes the persons employed by, or under contract with, entities under organizational control fulfill the same requirements of this part of ISO/IEC 17021 as persons employed by, or under contract with, the certification body?"]
[]
[]
["9.5.1.4\nDoes the certification body record each certification decision including any additional information or clarification sought from the audit team or other source?"]
[]
[]
["9.5.2 Actions prior to making a decision\nDoes the certification body have a process to conduct an effective review prior to making a decision for granting certification, expanding or reducing the scope of certification, renewing, suspending or restoring, or withdrawing of certification, including that:\na) the information provided by the audit team is sufficient with respect to the certification requirements and the scope for certification; \nb) it has reviewed, accepted and verified the effectiveness of correction and corrective actions, for any major nonconformities: and \nc) It has reviewed and accepted the client’s plan for correction and corrective action for any minor nonconformities?"]
[]
[]
["9.5.3 Information for granting initial certification"]
["9.5.3.1\nDoes the information provided by the audit team to the certification body for the certification decision include, as a minimum,\na) the audit report;\nb) comments on the nonconformities and, where applicable, the correction and corrective actions taken by the client;\nc) confirmation of the information provided to the certification body used in the application review (see 9.1.2);\nd) Confirmation that the audit objectives have been achieved; and\ne) a recommendation whether or not to grant certification, together with any conditions or observations?"]
[]
[]
["9.5.3.2\nIf the certification body is not able to verify the implementation of corrections and corrective actions of any major nonconformity within 6 months after the last day of stage 2, does the certification body conduct another stage2 prior to recommending certification?"]
[]
[]
["9.5.3.3\nWhen a transfer of certification is envisaged from one certification body to another, does the accepting certification body have a process for obtaining sufficient information in order to take a decision on certification? \n•Certification schemes can have specific rules regarding the transfer of certification"]
[]
[]
["9.5.4 Information for granting recertification\nDoes the certification body make decisions on renewing certification based on the results of the recertification audit, as well as the results of the review of the system over the period of certification and complaints received from users of certification?"]
[]
[]
["9.6 Maintaining certification\n"]
["9.6.1 General\nDoes the certification body maintain certification based on demonstration that the client continues to satisfy the requirements of the management system standard?\nDoes the certification body maintain a client's certification based on a positive conclusion by the audit team leader without further independent review, provided that:\na) for any major nonconformity or other situation that may lead to suspension or withdrawal of certification, the certification body has a system that requires the audit team leader to report to the certification body the need to initiate a review by appropriately competent personnel (see 7.2.8), different from those who carried out the audit, to determine whether certification can be maintained, and\nb) competent personnel of the certification body monitor its surveillance activities, including monitoring the reporting by its auditors, to confirm that the certification activity is operating effectively?"]
[]
[]
["9.6.2 Surveillance activities"]
["9.6.2.1 General"]
["9.6.2.1.1\nDoes the certification body develop its surveillance activities so that representative areas and functions covered by the scope of the management system are monitored on a regular basis, and take into account changes to its certified client and its management system?"]
[]
[]
["9.6.2.1.2\nDo surveillance activities include on-site audits assessing the certified client's management system's fulfilment of specified requirements with respect to the standard to which the certification is granted? \nDo other surveillance activities include:\na) enquiries from the certification body to the certified client on aspects of certification,\nb) reviewing any client's statements with respect to its operations (e.g. promotional material, website),\nc) requests to the client to provide documents and records (on paper or electronic media), and\nd) other means of monitoring the certified client's performance."]
[]
[]
["9.6.2.2 Surveillance audit\nAre surveillance audits on-site audits which are planned together with the other surveillance activities so that the certification body can maintain confidence that the certified management system continues to fulfil requirements between recertification audits? \nDoes the surveillance audit for the relevant management system include:\na) internal audits and management review;\nb) a review of actions taken on nonconformities identified during the previous audit;\nc) complaints handling;\nd) effectiveness of the management system with regard to achieving the certified client's objectives and the intended results of the respective management system(s);\ne) progress of planned activities aimed at continual improvement,\nf) continuing operational control;\ng) review of any changes; and\nh) use of marks and/or any other reference to certification?"]
[]
[]
["9.6.3 Recertification"]
["9.6.3.1 Recertification audit planning"]
["9.6.3.1.1\nIs the purpose of the recertification audit to confirm the continued conformity and effectiveness of the management system as a whole, and its continued relevance and applicability for the scope of certification?\nAre recertification audits planned and conducted to evaluate the continued fulfilment of all of the requirements of the relevant management system standard or other normative document?\nIs this planned and conducted in due time to enable for timely renewal before the certificate expiry date?"]
[]
[]
["9.6.3.1.2\nDoes the recertification audit include the review of previous surveillance audit reports?\nDoes the recertification audit consider the performance of the management system over the most recent certification cycle?"]
[]
[]
["9.6.3.1.3\nDo recertification audit activities have a stage 1 audit in situations where there have been significant changes to the management system, the client, or the context in which the management system is operating (e.g. changes to legislation)? \n• Such changes can occur at any time during the certification cycle and the certification body might need to perform a special audit (see clause 9.6.4), which might or might not be a two-stage audit."]
[]
[]
["9.6.3.2 Recertification audit"]
["9.6.3.2.1\nDoes the recertification audit include an on-site audit that addresses the following:\na) the effectiveness of the management system in its entirety in the light of internal and external changes and its continued relevance and applicability to the scope of certification;\nb) demonstrated commitment to maintain the effectiveness and improvement of the management system in order to enhance overall performance;\nc) The effectiveness of the management system with regard to achieving the certified client’s objectives and the intended results of the respective management system(s)?"]
[]
[]
["9.6.3.2.2\nDoes the certification body define time limits for correction and corrective action for any major nonconformity?\nAre these actions implemented and verified prior to the expiration of certification?"]
[]
[]
["9.6.3.2.3\nWhen recertification activities are successfully completed prior to the expiry date of the existing certification, Is the expiry date of the new certification based on the expiry date of the existing certification? \nIs the issue date on a new certificate on or after the recertification decision?"]
[]
[]
["9.6.3.2.4\nIf the certification body has not completed the recertification audit or the certification body is unable to verify the implementation of corrections and corrective actions for any major nonconformity (see Clause 9.5.2.1) prior to the expiry date of the certification, is recertification not recommended and the validity of the certification not extended? \nIs the client informed and the consequences explained?"]
[]
[]
["9.6.3.2.5\nFollowing expiration of certification, can the certification body restore certification within 6 months provided that the outstanding recertification activities are completed; otherwise is stage 2 at least conducted?\nIs the effective date on the certificate on or after the recertification decision and the expiry date based on prior certification cycle?"]
[]
[]
["9.6.4 Special audits"]
["9.6.4.1 Expanding scope\nDoes the certification body, in response to an application for expanding the scope of a certification already granted, undertake a review of the application and determine any audit activities necessary to decide whether or not the extension may be granted? \nAre special audits conducted in conjunction with a surveillance audit?"]
[]
[]
["9.6.4.2 Short-notice audits\nDoes the certification body conduct audits of certified clients at short notice or unannounced top investigate complaints, or in response to changes, or as follow up on suspended clients? \nIn the case of short-notice audits does the certification body:\na) describe and make known in advance to the certified clients (e.g. in documents as described in 8.5.1) the conditions under which these short notice visits are to be conducted, and\nb) exercise additional care in the assignment of the audit team because of the lack of opportunity for the client to object to audit team members?"]
[]
[]
["9.6.5 Suspending, withdrawing or reducing the scope of certification"]
["9.6.5.1\nDoes the certification body have a policy and documented procedure(s) for suspension, withdrawal or reduction of the scope of certification, and subsequent actions by the certification body?"]
[]
[]
["9.6.5.2\nDoes the certification body suspend certification in cases when, for example, \n- the client's certified management system has persistently or seriously failed to meet certification requirements, including requirements for the effectiveness of the management system, \n- the certified client does not allow surveillance or recertification audits to be conducted at the required frequencies, or \n- the certified client has voluntarily requested a suspension?"]
[]
[]
["9.6.5.3\nIs the client’s management system certification temporarily invalid under suspension?"]
[]
[]
["9.6.5.4\nDoes the certification body restore the suspended certification if the issue that has resulted in the suspension has been resolved? \nDoes failure to resolve the issues that have resulted in the suspension in a time established by the certification body result in withdrawal or reduction of the scope of certification? \n• In most cases, the suspension would not exceed 6 months."]
[]
[]
["9.6.5.5\nDoes the certification body reduce the client's scope of certification to exclude the parts not meeting the requirements, when the client has persistently or seriously failed to meet the certification requirements for those parts of the scope of certification? \nIs any such reduction in line with the requirements of the management system standard used for certification?"]
[]
[]
["9.7 Appeals\n"]
["9.7.1\nDoes the certification body have a documented process to receive, evaluate and make decisions on appeals?"]
[]
[]
["9.7.2\nIs the certification body responsible for all decisions at all levels of the appeals-handling process? \nDoes your certification body ensure that the persons engaged in the appeals-handling process are different from those who carried out the audits and made the certification decisions?"]
[]
[]
["9.7.3\nDoes the certification body ensure submission, investigation and decision on appeals do not result in any discriminatory actions against the appellant?"]
[]
[]
["9.7.4\nDoes the appeals-handling process include at least the following elements and methods:\na) an outline of the process for receiving, validating and investigating the appeal, and for deciding what actions are to be taken in response to it, taking into account the results of previous similar appeals;\nb) tracking and recording appeals, including actions undertaken to resolve them;\nc) ensuring that any appropriate correction and corrective action are taken?"]
[]
[]
["9.7.5 \nIs the certification body receiving the appeal responsible for gathering and verifying all necessary information to validate the appeal?"]
[]
[]
["9.7.6\nDoes the certification body acknowledge receipt of the appeal?  \nDoes the certification body provide the appellant with progress reports and the result of the appeal?"]
[]
[]
["9.7.7\nIs the decision to be communicated to the appellant made by, or reviewed and approved by, individual(s) not previously involved in the subject of the appeal?"]
[]
[]
["9.7.8\nDoes the certification body give formal notice to the appellant of the end of the appeals-handling process?"]
[]
[]
["9.8 Complaints\n"]
["9.8.1\nIs the certification body responsible for all decisions at all levels of the complaints-handling process?"]
[]
[]
["9.8.2\nDoes submission, investigation and decision on complaints not result in any discriminatory actions against the complainant?"]
[]
[]
["9.8.3\nUpon receipt of a complaint, does the certification body confirm whether the complaint relates to certification activities that it is responsible for? \nIf so, does the certification body deal with it? \nIf the complaint relates to a certified client, does examination of the complaint consider the effectiveness of the certified management system?"]
[]
[]
["9.8.4\nIs any valid complaint about a certified client referred by the certification body to the certified client in question at an appropriate time?"]
[]
[]
["9.8.5\nDoes the certification body have a documented process to receive, evaluate and make decisions on complaints? \nIs this process subject to requirements for confidentiality, as it relates to the complainant and to the subject of the complaint?"]
[]
[]
["9.8.6\nDoes the complaints-handling process include at least the following elements and methods:\na) an outline of the process for receiving, validating, investigating the complaint, and for deciding what actions are to be taken in response to it;\nb) tracking and recording complaints, including actions undertaken in response to them;\nc) ensuring that any appropriate correction and corrective action are taken? \n• ISO 10002 provides guidance for complaints handling."]
[]
[]
["9.8.7\nIs the certification body receiving the complaint responsible for gathering and verifying all necessary information to validate the complaint?"]
[]
[]
["9.8.8\nWhenever possible, does the certification body acknowledge receipt of the complaint? \nDoes the certification body provide the complainant with progress reports and the outcome?"]
[]
[]
["9.8.9\nIs the decision to be communicated to the complainant made by, or reviewed and approved by, individual(s) not previously involved in the subject of the complaint?"]
[]
[]
["9.8.10\nWhenever possible, does the certification body give formal notice of the end of the complaints-handling process to the complainant?"]
[]
[]
["9.8.11\nDoes the certification body determine, together with the client and the complainant, whether and, if so to what extent, the subject of the complaint and its resolution made public?"]
[]
[]
["9.9 Clients records\n"]
["9.9.1\nDoes the certification body maintain records on the audit and other certification activities for all clients, including all organizations that submitted applications, and all organizations audited, certified, or with certification suspended or withdrawn?"]
[]
[]
["9.9.2\nDo records on certified clients include the following:\na) application information and initial, surveillance and recertification audit reports;\nb) certification agreement;\nc) justification of the methodology used for sampling of sites, as appropriate;\n• Methodology of sampling includes the sampling employed to audit the specific management system and/or to select sites in the context of multi-site audit.\nd) justification for auditor time determination (see Clause 9.1.4);\ne) verification of correction and corrective actions;\nf) records of complaints and appeals, and any subsequent correction or corrective actions;\ng) committee deliberations and decisions, if applicable;\nh) documentation of the certification decisions;\ni) certification documents, including the scope of certification with respect to product, process or service, as applicable;\nj) related records necessary to establish the credibility of the certification, such as evidence of the competence of auditors and technical experts; and\nk) audit programmes?"]
[]
[]
["9.9.3\nDoes the certification body keep the records on applicants and clients secure to ensure that the information is kept confidential? \nAre records transported, transmitted or transferred in a way that ensures that confidentiality is maintained?"]
[]
[]
["9.9.4\nDoes the certification body have a documented policy and documented procedures on the retention of records?\n Are records retained for the duration of the current cycle plus one full certification cycle? \n• In some jurisdictions, the law stipulates that records need to be maintained for a longer time period."]
[]
[]
["10 Management system requirements for certification bodies"]
["10.1 Options\nDoes the certification body maintain a management system that is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021?\nIn addition to meeting the requirements of clauses 5 to 9, Which of the following management system Option has the certification body implemented\na) general management system requirements (see Clause 10.2), or\nb) management system requirements in accordance with ISO 9001 (see Clause 10.3)?"]
[]
[]
["10.2 Option A: General Management system requirements\n"]
["10.2.1 General\nDoes the certification body establish, document, implement and maintain a management system that is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021-1? \nDoes the certification body’s top management establish and document policies and objectives for its activities? \nDoes the top management provide evidence of its commitment to the development and implementation of the management system in accordance with the requirements of ISO/IEC 17021-1? \nDoes the top management ensure that the policies are understood, implemented and maintained at all levels of the certification body’s organisation? \nDoes certification body’s top management appoint a member of management who, irrespective of other responsibilities, have responsibility and authority that include\na) ensuring that processes and procedures needed for the management system are established, implemented and maintained, and\nb) reporting to top management on the performance of the management system and any need for improvement?"]
[]
[]
["10.2.2 Management system manual\nHave all applicable requirements of this International Standard been addressed either in a manual or in associated documents? \nDoes the certification body ensure that the manual and relevant associated documents are accessible to all relevant personnel?"]
[]
[]
["10.2.3 Control of documents\nDoes the certification body establish procedures to control the documents (internal and external) that relate to the fulfilment of ISO/IEC 17021-1?\nDo the procedures define the controls needed to:\na) Approve documents for adequacy prior to issue; \nb) Review and update as necessary and re-approve documents; \nc) Ensure that changes and the current revision status of documents are identified;\nd) Ensure that relevant versions of applicable documents are available at points of use;\ne) Ensure that documents remain legible and readily identifiable;\nf) Ensure that documents of external origin are identified and their distribution controlled; and\ng) Prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose? \n• Documentation can be in any form or type of medium."]
[]
[]
["10.2.4 Control of records\nDoes the certification body establish procedures to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of its records related to the fulfilment of ISO/IEC 17021-1?\nIs access to these records consistent with the confidentiality arrangements?\nDoes the certification body establish procedures for retaining records for a period consistent with its contractual and legal obligations? \n• For requirements for records on certified clients, see also Clause 9.9"]
[]
[]
["10.2.5 Management review"]
["10.2.5.1 General\nDoes the certification body’s top management establish procedures to review its management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness, including the stated policies and objectives related to the fulfilment of ISO/IEC 17021-1? \nAre these reviews conducted at least once a year?"]
[]
[]
["10.2.5.2 Review inputs\nDoes the review input to the management review include information related to:\na) Results of internal and external audits;\nb) Feedback from clients and interested parties;\nc) Safeguarding impartiality;\nd) The status of corrective actions;\ne) The status of actions to address risks;\nf) Follow-up actions from previous management reviews;\ng) The fulfilment of objectives,\nh) Changes that could affect the management system, and\ni) Appeals and complaints?"]
[]
[]
["10.2.5.3 Review outputs\nDoes the outputs from the management review include decisions and actions related to\na) Improvement of effectiveness of the management system and its processes;\nb) Improvement of the certification services related to the fulfilment of ISO/IEC 17021-1;\nc) Resource needs; and\nd) Revision of the organisation’s policy and objectives?"]
[]
[]
["10.2.6 Internal audits"]
["10.2.6.1\nHas the certification body established procedures for internal audits to verify that it fulfils the requirements of ISO/IEC 17021-1, and that the management system is effectively implemented and maintained? \n• ISO 19011 provides guidelines for conducting internal audits"]
[]
[]
["10.2.6.2\nIs the audit programme planned, taking into consideration the importance of the processes and areas to be audited, as well as the results of previous audits?"]
[]
[]
["10.2.6.3\nAre internal audits performed at least once every 12 months? \nIs the frequency of internal audits reduced if the certification body can demonstrate that its management system continues to be effectively implemented according to ISO/IEC 17021-1 and has proven stability?"]
[]
[]
["10.2.6.4\nDoes the certification body ensure that\na) internal audits are conducted by qualified personnel knowledgeable in certification, auditing and the requirements of ISO/IEC 17021-1;\nb) auditors do not audit their own work;\nc) personnel responsible for the area audited are informed of the outcome of the audit;\nd) any actions resulting from internal audits are taken in a timely and appropriate manner; and\ne) any opportunities for improvement are identified?"]
[]
[]
["10.2.7 Corrective actions\nDoes the certification body establish procedures for identification and management of nonconformities in its operations?]\nDoes the certification body also, where necessary, take actions to eliminate the causes of nonconformities in order to prevent recurrence?\nAre corrective actions appropriate to the impact of the problems encountered? \nDo the procedures define requirements for\na) identifying nonconformities (e.g. from complaints and internal audits);\nb) determining the causes of nonconformity; \nc) correcting nonconformities;\nd) evaluating the need for actions to ensure that nonconformities do not recur;\ne) determining and implementing in a timely manner, the actions needed,\nf) recording the results of actions taken; and \ng) reviewing the effectiveness of corrective actions?"]
[]
[]
["10.3 Option B: Management system requirements in accordance with ISO 9001"]
["10.3.1 General\nDoes the certification body establish and maintain a management system, in accordance with the requirements of ISO 9001, which is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021-1, amplified by Clause 10.3.2 to 10.3.4?"]
[]
[]
["10.3.2 Scope\nDoes the scope of the management system include the design and development requirements for its certification service for application of the requirements of ISO 9001?"]
[]
[]
["10.3.3 Customer focus\nFor application of the requirements of ISO 9001, when developing its management system, Does the certification body consider the credibility of certification and address the needs of all parties (as set out in Clause 4.1.2) that reply upon its audit and certification services, not just its clients?"]
[]
[]
["10.3.4\nFor application of the requirements of ISO 9001, Does the certification body include as input for management review, information on relevant appeals and complaints from users of certification activities and a review of impartiality?"]
[]
[]
[]
["QMS"]
["ISO/IEC 17021-3:2017"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["4 Generic competence requirements\nDoes the certification body define the competence requirements for each certification function as reference in ISO/IEC 17021-1:2015, Table A.1? \nWhen defining these competence requirements, does the certification body take into account all the requirements specified in ISO/IEC 17021-1 as well as those specified in Clauses 5 and 6 of this ISO/IEC TS 17021-3 that are relevant for the QMS technical areas (see ISO/IEC 17021-1:2015, 7.1.2), as defined by the CB?"]
[]
[]
["5 Competence requirements for QMS auditors and audit teams\n5.1 General \nDoes the certification body ensure that personnel involved in QMS auditing have the collective competence to undertake the audit?\nDoes the certification body ensure that personnel involved in QMS auditing have the generic competence described in ISO/IEC 17021-1 and the QMS knowledge described in 5.2 to 5.4?\nNote: It is not necessary for each member of the audit team to have the same competence, however, the collective competence of the audit team needs to be sufficient to achieve the audit objectives."]
[]
[]
["5.2 Fundamental concepts and quality management principles \nDoes the certification body ensure that each personnel involved in QMS auditing have knowledge of:\na) fundamental concepts and quality management principles and their application;\nb) terms and definitions related to quality management;\nc) the process approach including related monitoring and measurement;\nd) the role of leadership in an organization and its impact on the QMS;\ne) application of risk-based thinking including the determination of risks and opportunities;\nf) application of the PDCA (plan, do, check, act) cycle;\ng) structures and interrelationships of documented information specific to quality management;\nh) quality management related tools, methods, techniques and their application?"]
[]
[]
["5.3 Context of the organization \nDoes the audit team have business sector knowledge to determine whether an organization has appropriately determined:\na) the external and internal issues, relevant to its purpose and its strategic direction and that affect its ability to achieve the intended result(s) of its QMS;\nb) the needs and expectations of interested parties relevant to the organization’s QMS including the requirements for the products and services of the organization;\nc) the boundaries and applicability of the QMS to establish its scope?\nNote: A business is understood to be the economic activities covering the broad range of related technical areas."]
[]
[]
["5.4 Client products, services, processes and organization\nDoes the certification body ensure that personnel involved in QMS auditing have knowledge of:\na) terminology and technology specific to the technical area;\nb) statutory and regulatory requirements applicable to the product or service specific to the technical area;\nNote: Statutory and regulatory requirements can be expressed as legal requirements.\nc) characteristics of products, services and processes specific to the technical area;\nd) the infrastructure and environment for operation of processes affecting product and service quality;\ne) the provision of externally provided processes, products and services;\nf) the impact of organization type, size, governance, structure, functions and relationships on development and implementation of the QMS, its documented information and certification activities?"]
[]
[]
["6 Competence requirements for other personnel\n6.1 General\nDoes the certification body ensure that the group or individual involved in other certification functions have the collective competence sufficient to undertake those functions and that includes the generic competencies described in ISO/IEC 17021-1 and the QMS knowledge described in 6.2?"]
[]
[]
["6.2 Competence of personnel reviewing audit reports and making certification decisions\nDoes the personnel reviewing audit reports and making certification decisions have knowledge of:\na) fundamental concepts and quality management principles;\nb) terms and definitions related to quality management;\nc) the process approach;\nd) the application of risk-based thinking including the determination of risks and opportunities;\ne) scopes and their applicability to an organization’s QMS?"]
[]
[]
[]
["EMS"]
["ISO/IEC 17021-2:2016"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["4 Generic competence requirements\nDoes the certification body define the competence requirements for each relevant EMS technical area and for each function in the certification activity?\nDoes the certification body take into account all the requirements specified in Clauses 5, 6 and 7 of ISO/IEC 17021-2 that are relevant for the EMS technical areas as defined by the CB?"]
[]
[]
["5 Competence requirements for QMS auditors and audit teams\n5.1 General \nDoes the certification body ensure that all personnel involve in EMS auditing have a level of competence that includes the generic competencies described in ISO/IEC 17021?\nDoes the certification body ensure that all personnel involved in EMS auditing have a level of competence that includes the EMS knowledge described in 5.2 to 5.15?"]
[]
[]
["5.2 Environmental terminology \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of environmental terms, definitions and concepts as used within an EMS?\n• Concepts include “intended outcomes”, “environmental sustainability” and “sustainable development” (see ISO 14001:2015, Clause 1 and Clause A.3)"]
[]
[]
["5.3 Environmental metrics\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the quantification of environmental outputs applicable to the EMS technical area and applicable compliance obligations?\n• Examples Direct, normalized, aggregated, indexed and weighted measurement, modelling, mass balance."]
[]
[]
["5.4 Environmental monitoring and measuring techniques\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of environmental monitoring and measuring techniques and analytical methods appropriate to the aspects and EMS technical area including calibration and equipment maintenance?\n• Examples Continuous, periodic and manual sampling, observations made during abnormal conditions."]
[]
[]
["5.5 Environmental aspects and impacts\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of techniques for the identification of environmental aspects and impacts and the determination of their environmental significance?"]
[]
[]
["5.6 Life cycle perspective\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of life cycle concepts and how an organization can apply a life cycle perspective to its products and services?\n• The term “life cycle” is defined in ISO 140001:2015, 3.3.3 See also ISO 14001:2015, A.6.1.2."]
[]
[]
["5.7 Environmental performance evaluation\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of environmental performance evaluation, including indicators, sufficient to determine whether an organization’s environmental performance is achieving the intended outcomes of an EMS?\n• ISO 14031 provides further information on environmental performance evaluation"]
[]
[]
["5.8 Compliance obligations\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine whether an organization has determined its EMS related compliance obligations, and evaluated fulfilment of its EMS related compliance obligations?\n• The term “compliance obligations” is defined in ISO 14001:2015, 3.2.9"]
[]
[]
["5.9 Emergency preparedness and response\n5.9.1\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge sufficient to determine whether an organization has identified potential emergency situations and planned relevant responses?"]
[]
[]
["5.9.2\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge sufficient to evaluate an organization’s effectiveness in testing its emergency responses and responses to actual emergencies if applicable?."]
[]
[]
["5.10 Operational Control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of processes used for operational planning and control, including management of change related to an EMS?"]
[]
[]
["5.11 Factors related to site\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of site-related factors that might influence the potential impacts of an organization’s aspects on the surrounding areas, ecosystems and communities?\n(Site factors include geography, climate, hydrogeology, topography, soil and other site-related physical conditions, as well as prior use of the site.)"]
[]
[]
["5.12 Scope\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine that the scope of an EMS is appropriate within the context of an organization and its activities, products and services?"]
[]
[]
["5.13 Communicated information\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge related to auditing of communicated information to enable the audit of the reliability of relevant environmental information related to the EMS?\n• This includes knowledge of factors impacting upon reliability, such as transparency, appropriateness, truthfulness, factuality/accuracy, completeness and intelligibility (see ISO 14001:2015, A.7.4)."]
[]
[]
["5.14 Context of the organization\n5.14.1\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine that an organization has identified the external and internal issues, including environmental conditions relevant to the context in which it operates that have the potential to affect the organization’s ability to achieve the intended outcomes of its EMS?"]
[]
[]
["5.14.2\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine that an organization has identified the needs and expectations of interested parties relevant to an organization’s EMS?"]
[]
[]
["5.15 Risks and opportunities\n5.15.1\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of methods for determining risks and opportunities and how these methods can be applied in an organizational context?\nNote 1 The term “risk and opportunities” is defined in ISO 14001:2015, 3.2.11\nNote 2 Examples of methods for determining risks and opportunities include SWOT (Strengths-Weaknesses-Opportunities-Threats), PESTLE (Political-Economic-Social-Technological-Legal-Environmental), Delphi technique, Probability and Impact matrix and risk facilitation workshops."]
[]
[]
["5.1.5.2\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine if an organization has appropriately identified and addressed the risks and opportunities related to its context, environmental aspects and compliance obligations?"]
[]
[]
["6 Aspect-specific competence requirements for EMS auditing\n6.1 General\nAre the audit team appointed composed of auditors (and technical experts, as necessary) have the collective competence to undertake the audit?\nDoes the certification body define specific competence criteria related to each aspect appropriate to the EMS technical area(s) in which it operates and consistent with the requirements specified in 6.2 to 6.8?\nNote: It is necessary for each auditor in the audit team to have the same competence; however, the collective competence of the audit team needs to be sufficient to achieve the audit objectives."]
[]
[]
["6.2 Emission to air\n6.2.1 General\nEmissions to air occur from activities such as performing mechanical, chemical or biological processes, generating or using energy or through the provision of services requiring the use of fossil fuelled vehicles. These emissions may include gases and particulate matter and be subject to control through mechanical, chemical or natural means to reduce them to an acceptable level in order to avoid air pollution."]
[]
[]
["6.2.2 Gases and particulate matter\nDoes the certification body ensure that all personnel involve in EMS auditing have  knowledge of type of emissions to air (fugitive, point or diffuse) of gases, aerosol or particulate matter? [e.g. Volatile Organic Compounds (VOC’s), odours, acids, bases and greenhouse gases]."]
[]
[]
["6.2.3 Operational control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques used to control emissions to air such as filtering techniques, scrubbers and thermal oxidizers?"]
[]
[]
["6.2.4 Monitoring and measurement\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques used to monitor emissions to air, e.g. observation of stack emissions, continuous or sample-based stack monitoring, air sampling and analysis and calculation-based mass balance, microorganism counts, and odour testing?"]
[]
[]
["6.3 Releases to land\n6.3.1 General\nReleases to land of solids or liquids may occur as waste from mechanical, chemical or biological processes, on the production or disposal of a product or the delivery of a service or as a result of a natural event or accidental situation."]
[]
[]
["6.3.2 Liquid or solid releases\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of releases to land including but not limited to heavy metals, polycyclic aromatic hydrocarbons (PAH), petroleum-based products, halogenated hydrocarbons, pesticides, herbicides and minimal waste?"]
[]
[]
["6.3.3 Operational control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques used to control releases to land such as primary or secondary containment (bunding) and dispersion (land application rates)?\n• These releases can be subject to control through physical means (e.g. silt trap, penstock), natural (e.g. composting) or chemical treatment (primary, secondary or tertiary) and biological remediation (phyto/anaerobic)."]
[]
[]
["6.3.4 Monitoring and measurement\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques used to monitor, measure and analyse soil associated with releases to land?"]
[]
[]
["6.4 Releases to water\n6.4.1 General\nReleases to water are discharges which include effluents, sewage and diffuse runoffs (e.g. fertilizers or pesticides transported by natural precipitation). This water may be discharged for treatment; or directly to surface or ground water before or after treatment."]
[]
[]
["6.4.2 Surface and ground water\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of surface and ground water flows and characteristics, including water columns, suspended and dissolved solids, sedimentation, effluent viscosity and density, evaporation, acidification and eutrophication?"]
[]
[]
["6.4.3 Operational control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the typical liquid waste streams for the EMS technical area (e.g. organic, inorganic) and the techniques used to treat liquid waste (e.g. aerobic and anaerobic treatment) \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques used to control surface water discharges (e.g. from weather) and to remediate surface and ground water."]
[]
[]
["6.4.4 Monitoring and measurement \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the parameters measured and the techniques used to monitor liquid waste treatment processes and/or other discharges, [e.g. indicators including Biological oxygen Demand or Chemical Oxygen Demand (BOD and COD), sampling and analysis, in-process monitoring devices and inspections]."]
[]
[]
["6.5 Uses of raw materials, energy and natural resources\n6.5.1 Upstream management – Use of natural resources\n6.5.1.1\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of resource depletion issues including sourcing renewable and non-renewable materials, water scarcity, forest loss and soil degradation?"]
[]
[]
["6.5.1.2 \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of renewable and non-renewable sources of energy, the techniques for converting them to useful energy and their environmental impacts, including climate change, impact on biodiversity and limitations in their application?"]
[]
[]
["6.5.2 Downstream management\n6.5.2.1 \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of technology and techniques related to source reduction, consumption, minimization, resource recovery and treatment practices and processes?"]
[]
[]
["6.5.2.2 \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the impact that the activities of an organisation have on the environment including biodiversity and ecosystems?"]
[]
[]
["6.5.3 Operational control \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the techniques to control efficient use of resources?"]
[]
[]
["6.5.4 Monitoring and measurement \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of monitoring and measuring techniques related to the use of resources?"]
[]
[]
["6.6 Energy emitted\n6.6.1 Sources of energy emissions\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of sources of emissions of heat, light, electromagnetic and ionising radiation, noise and vibration, and their potential environmental impacts?"]
[]
[]
["6.6.2 Operational control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of emissions management and control methods, including process management, and emissions reduction and abatement?"]
[]
[]
["6.6.3 Monitoring and measurement\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of monitoring and measuring techniques related to the energy emissions, such as thermal imaging (heat), light metering (light), gauss meter (electromagnetic force), radiation counters and film badges (ionising radiation), metering (noise and vibration)?"]
[]
[]
["6.7 Waste\n6.7.1 Sources of waste \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of wastes generated by an organization’s activities, including the characteristics of wastes and their potential environment impacts?"]
[]
[]
["6.7.2 Operational control\n6.7.2.1 \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of methodologies for the elimination, source reduction and waste minimization appropriate to the EMS technical area, including reuse, segregation and recycling?"]
[]
[]
["6.7.2.2 \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of handling, storage, transportation, treatment and disposal of waste?"]
[]
[]
["6.7.3 Monitoring and measurement\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of waste monitoring and measurements techniques, such as mass balance calculations, weighing, volumetric measurement, and waste storage criteria (e.eg temperature for flammable materials, storage time)?"]
[]
[]
["6.8 Use of space\n6.8.1 Physical attributes\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the interactions of the physical attributes (size, shape and colour) of buildings, structures and equipment with the local environment?"]
[]
[]
["6.8.2 Operational control\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of techniques to manage physical attributes, such as planning and design, landscaping, use of colour to reduce intrusive impact on the environment?"]
[]
[]
["6.8.3 monitoring and measurement\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of the monitoring of spatial planning, building equipment requirements as well as maintenance systems and landscaping?"]
[]
[]
["7 Competence requirements for other personnel\n7.1 General \nDoes the certification body define competence requirements for other personnel involved in the certification functions as given in 7.2 and 7.3? (These functions can be fulfilled by one or more persons)"]
[]
[]
["7.2 Competence of personnel conducting the application review to determine the audit team competence required, to select the audit team members and to determine the audit time.\n7.2.1 Environmental terminology \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of environmental terms and definitions as appropriate for their function?"]
[]
[]
["7.2.2 Environmental aspects and impacts \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of environmental aspects and associated impacts as appropriate for their function?"]
[]
[]
["7.2.3 Factors related to site \nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge of site-related factors, including proximity to sensitive environments (e.g. wetland, flora, fauna and human communities) that may be impacted by the organisation’s activities, sufficient to select a competent audit team?"]
[]
[]
["7.2.4 Scope\nDoes the certification body ensure that all personnel involve in EMS auditing have knowledge to determine that the proposed scope of certification is appropriate to achieve the intended results of the application review as appropriate for their function?"]
[]
[]
["7.3 Competence of personnel reviewing audit reports and making certification decisions \n7.3.1 Environmental terminology \nDoes the certification body ensure that all personnel reviewing audit reports and making certification decisions involve in EMS auditing have knowledge of environmental terms and definitions within the EMS technical areas?"]
[]
[]
["7.3.2 Environmental aspects and impacts \nDoes the certification body ensure that all personnel reviewing audit reports and making certification decisions involve in EMS auditing have knowledge of environmental aspects and impacts and processes for determining significance?"]
[]
[]
["7.3.3 Environmental performance evaluation \nDoes the certification body ensure that all personnel reviewing audit reports and making certification decisions involve in EMS auditing have knowledge of environmental performance evaluation?\n• Note ISO 14031 provides further information on environmental performance evaluation"]
[]
[]
["7.3.4 Compliance obligation\nDoes the certification body ensure that all personnel reviewing audit reports and making certification decisions involve in EMS auditing have knowledge of applicable compliance obligations sufficient to make a decision on the basis of a certification audit report?"]
[]
[]
["7.3.5 Scope\nDoes the certification body ensure that all personnel reviewing audit reports and making certification decisions involve in EMS auditing have knowledge to determine that the scope of certification is appropriate?"]
[]
[]
[]
["OHSMS"]
["ISO/IEC 17021-10:2018"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["4 Competence requirements\nDoes the certification body define the competence requirements for each certification function as referenced in ISO/IEC 17021-1:2015, Table A.1?\nDoes the certification body take into account all the requirements specified in ISO/IEC 17021-1 as well as those specified in Clauses 5, 6, and 7 of ISO/IEC 17021-10:2018 that are relevant for the OH&S technical areas as defined by the CB?"]
[]
[]
["5 Competence requirements for OH&S management system auditors \n5.1 General\nDoes the certification body ensure that all personnel involved in OHSMS auditing have knowledge of the synergy within an OHSMS and how its processes interact to meet its intended outcomes of providing a safe and healthy workplace and the prevention of injury and ill health?"]
[]
[]
["5.2 Terminology, principles, processes and concepts of OH&S  \nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of terminology, principles and concepts of OHSMS?\n• Terminology, principles, processes and concepts of OHSMS includes, but are not limited to:\n- intended outcome(s) of the OHSMS;\n- hazards and OH&S risks:\n- minimizing or reducing risks;\n- hierarchy of controls;\n- procurement (including outsourcing and contractors);\n- shared control over work performed."]
[]
[]
["5.3 Context of the organization\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge to determine whether an organization has appropriately determined:\n- potential issues relevant to the context of an organization, in order to determine whether the organization has identified external and internal issues that can affect the organization’s ability to achieve the intended outcome(s) of its OHSMS;\n- potential other interested parties in addition to workers, in order to determine if an organization has identified the relevant needs and expectations of the workers and other interested parties."]
[]
[]
["5.4 Leadership, consultation and participation of workers\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of the role and impact of leadership and culture on an organization.\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of methodologies for consultation and participation, including obstacles and barriers, in order to determine whether an organization has effective processes for consultation and participation of workers and, when they exist, workers’ representatives."]
[]
[]
["5.5 Legal requirements and other requirements\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of legal requirements and other requirements in the field of health and safety at work, including those relevant to the OH&S technical area, in order to evaluate whether an organization has a process to determine, apply and periodically review its legal requirements and other requirements, including those related to:\n- consultation and participation of workers and workers’ representatives, where they exist;\n- the privacy of personal medical information\n- establishment of health and safety committees."]
[]
[]
["5.6 OH&S risks, OH&S opportunities and other risks and other opportunities\n5.6.1 Risks and opportunities\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of risks and opportunities, including those relevant to the OH&S technical area?\n•\tExamples of relevant methods and criteria for determining risks and opportunities can include qualitative and quantitative analysis such as task analysis, hazard and operability studies (HAZOPS) and failure mode and effects analysis (FMEA)."]
[]
[]
["5.6.2 Hazard identification \nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of hazards, including those relevant to the OH&S technical area?\nKnowledge of hazards shall include, but not be limited to, those in the following categories:\n- physical;\n- chemical;\n- biological;\n- physiological;\n- mechanical;\n- electrical;\n- psychosocial;\n- based on movement and energy.\n\nKnowledge of hazards and their sources shall include, but not limited to:\n- internal or external sources or situations;\n- potential emergency situations;\n- multi-employer workplaces;\n- workplace and facility;\n- product and service design, research, development, testing, production, assembly, construction, service delivery, maintenance and disposal;\n- procurement, contractors and outsourcing;\n- planned or unintended changes;\n- work organization, human and social factors."]
[]
[]
["5.6.3 Assessment of OH&S risks\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of the methodologies and criteria for the identification of hazards and the assessment of OH&S risks, including those relevant to the OH&S technical area?"]
[]
[]
["5.6.4 OH&S opportunities\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of the type of processes that can lead to improvement of OH&S performance?"]
[]
[]
["5.7 Emergency preparedness and response\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of potential emergency situations and their usual responses, including those relevant to the OH&S technical area in an organization context, in order to evaluate whether an organization has appropriately?\n- Identified its potential emergency situations;\n- Planned and tested its emergency responses, including with respect to external responders;\n- Evaluated its effectiveness in testing its planned emergency responses and responses given to actual emergencies, if applicable."]
[]
[]
["5.8 Performance evaluation \nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of performance evaluation in order to evaluate whether an organization has applied appropriate OH&S performance evaluation method, including proactive and reactive, qualitative and quantitative indicators, and to determine whether it is achieving the intended outcome(s) of its OHSMS?"]
[]
[]
["5.9 Eliminating hazards and reducing OH&S risks \nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of control measures or control methods used to eliminate hazards and reduce OH&S risks, including those relevant to the OH&S technical area, in order to evaluate whether an organization has applied?\n- the concept of the hierarchy of control, including adapting work to workers and its appropriate application;\n- the appropriate and effective control measures, including the identification of any potential adverse effects, that have been selected by the organization, including those applied to the external providers"]
[]
[]
["5.10 Incident investigation\nDoes the certification body ensure that all personnel involve in OHSMS auditing have knowledge of incident investigation methods, including those relevant to the OH&S technical area?\nThis includes:\n- the relevant methods and practices for incident investigations, such as root cause analysis, fault tree analysis;\n- the identification of actions to eliminate the cause(s)"]
[]
[]
["6 Competence requirements for personnel reviewing audit reports and making certification decisions\n6.1 Terminology, principles, processes and concepts of OH&S\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making decisions have up-to-date knowledge of terminology, principles, processes and concepts of OH&S and OH&S management?\n\nTerminology, principles and concepts of OH&S and OH&S management include, but are not limited to:\n- intended outcome(s) of the OHSMS;\n- hazards and OH&S risks;\n- minimizing or reducing risks;\n- hierarchy of control;\n- procurement (including outsourcing and contractors);\n- shared control over work performed."]
[]
[]
["6.2 Context of the organization\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have sufficient knowledge to determine if the audit team has appropriately confirmed the scope, including boundaries and applicability of its OHSMS, within the organization’s context and its work-related activities?\n- potential issues relevant to the context of the organization;\n- potential other interested parties."]
[]
[]
["6.3 Leadership, consultation and participation of workers\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of the role and impact of leadership, culture, consultation and participation of workers and, when they exist, workers’ representatives?"]
[]
[]
["6.4 Legal requirements and other requirements\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions are aware of legal requirements and other requirements in the field of health and safety at work. "]
[]
[]
["6.5 OH&S risks, OH&S opportunities and other risks and other opportunities\n6.5.1 Hazard identification \nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of hazards and methods for identifying them, including those relevant to the OH&S technical area?\n\nPersonnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of the following categories of hazards?\nIncluding but not limited to, those in the following categories:\n-\tphysical;\n-\tchemical;\n-\tbiological;\n-\tphysiological;\n-\tmechanical;\n-\telectrical;\n-\tpsychosocial;\n-\tbased on movement and energy."]
[]
[]
["6.5.2 Assessment of OH&S risks\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of the type of methodologies and criteria for the assessment of OH&S risks, including those relevant to the OH&S technical area?"]
[]
[]
["6.5.3 OH&S opportunities\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions are aware of concepts of the OH&S opportunities?"]
[]
[]
["6.6 Performance evaluation\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of OH&S performance evaluation methods?"]
[]
[]
["6.7 Eliminating hazards and reducing OH&S risks\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of the concept of the hierarchy of control?"]
[]
[]
["6.8 Incident Investigation\nDoes the certification body ensure that all personnel involve in OHSMS reviewing audit reports and making certification decisions have knowledge of incident investigation methods?"]
[]
[]
["7 Competence requirements for other certification personnel\n7.1 Terminology, principles, processes and concepts of OH&S\nDoes the certification body ensure that all personnel involve in OHSMS application review that determine the audit team competence required, to select audit team members, and to determine the audit time have knowledge of up-to-date OH&S terminology, principles, processes and concepts.\nTerminology, principles, processes and concepts of OH&S and OH&S management include, but are not limited to:\n- intended outcome(s) of the OHSMS;\n- hazards and OH&S risks;\n- minimizing or reducing risks;\n- hierarchy of control;\n- procurement (including outsourcing and contractors);\n- shared control over work performed."]
[]
[]
["7.2 Context of the organization\nDoes the certification body ensure that all personnel involve in OHSMS application review that determine the audit team competence required, to select audit team members, and to determine the audit time have knowledge:\n- knowledge of site-related factors, and risks and complexity related to the site and the organization’s activities, to determine the audit time and to select a competent audit team;\n- knowledge to determine that the proposed scope of certification is appropriate with the organization’s context and its work related activities."]
[]
[]
[]
["ISMS"]
["ISO/IEC 27006:2020"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["5.2.1 IS 5.2 Conflicts of interests \nDoes the certification body carry out the following duties without them being considered as consultancy or having potential conflict of interest:\na)\tarranging and participating as a lecturer in training courses, provided that, where these courses relate to information security management, related management systems or auditing, certification bodies shall confine themselves to the provision of generic information and advice which is publicly available, i.e. they shall not provide company-specific advice which contravenes the requirements of b) below;\nb)\tmaking available or publishing on request information describing the certification body’s interpretation of the requirements of the certification audit standards (see 9.1.3.6)\nc)\tactivities prior to audit, solely aimed at determining readiness for certification audit; however, such activities shall not result in the provision of recommendations or advice that would contravene this clause and the certification body shall be able to confirm that such activities do not contravene these requirements and that they are not used to justify a reduction in the eventual certification audit duration;\nd)\tperforming second and third-party audits according to standards or regulations other than those being part of the scope of accreditation;\ne)\tadding value during certification audits and surveillance visits, e.g. by identifying opportunities for improvement, as they become evident during the audit, without recommending specific solutions?\nDoes the certification body provide internal information security reviews of the client’s ISMS subject to certification?\nFurthermore, is the certification body independent from the body or bodies (including any individuals) which provide internal ISMS audit?"]
[]
[]
["7 Resource requirements\n7.1.1 IS 7.1.1 General considerations\n7.1.1.1 Generic competence requirements\nDoes the certification body ensure that it has knowledge of the technological, legal and regulatory developments relevant to the ISMS of the client which it assesses?\nDoes the certification body define the competence requirements for each certification functions as referenced in Table A.1 of ISO/IEC 17021-1?\nDoes the certification body take into account all the requirements specified in ISO/IEC 17021-1 and 7.1.2 and 7.2.1 of this International Standard that are relevant for the ISMS technical areas as determined by the certification body?\nNOTE: Annex A provides a summary of the competence requirements for personnel involved in specific certification functions."]
[]
[]
["7.1.2 IS 7.1.2 Determination of Competence Criteria \n7.1.2.1 Competence requirements for ISMS auditing\n7.1.2.1.1 General requirements\nDoes the certification body have criteria for verifying the background experience, specific training or briefing of audit team members that ensures at least:\na)\tKnowledge of information security;\nb)\tTechnical knowledge of the activity to be audited;\nc)\tKnowledge of management systems;\nd)\tKnowledge of the principles of auditing\nNOTE: Further information on the principles of auditing can be found in ISO 19011.\ne)\tKnowledge of ISMS monitoring, measurement, analysis and evaluation\n(These above requirements a) to e) apply to all auditors being part of the audit team, with the exception of b), which can be shared among auditors being part of the audit team)\nIs the audit team competent to trace indications of information security incidents in the client’s ISMS back to the appropriate elements of the ISMS?\nDoes the audit team have appropriate work experience of the items above and practical application of these items (this does not mean that an audit team as a whole shall have enough appreciation and experience to cover the ISMS scope being audited)?"]
[]
[]
["7.1.2.1.2 Information security management terminology, principles, practices and techniques\nDoes all members of the audit team have the knowledge of:\na)\tISMS specific documentation structure, hierarchy and interrelationships;\nb)\tInformation security management related tools, methods, techniques and their application;\nc)\tInformation security risk assessment and risk management;\nd)\tProcesses applicable to ISMS;\ne)\tThe current technology where information security may be relevant or an issue.\nNOTE: Every auditor shall fulfil a), c) and d)."]
[]
[]
["7.1.2.1.3 Information security management system standards and normative documents\nDoes auditors involved in ISMS auditing have knowledge of:\na)\tAll requirements contained in ISO/IEC 27001.\nDoes all members of the audit team have the knowledge of:\nb)\tAll controls contained in ISO/IEC 27002 (if determined as necessary also from sector specific standards) and their implementation, categorized as:\n1)\tinformation security policies;\n2)\torganization of information security;\n3)\thuman resource security;\n4)\tasset management;\n5)\taccess control, including authorization;\n6)\tcryptography;\n7)\tphysical and environmental security;\n8)\toperations security, including IT-services;\n9)\tcommunications security, including network security management and information transfer;\n10)\tsystem acquisition, development and maintenance;\n11)\tsupplier relationships, including outsourced services;\n12)\tinformation security incident management;\n13)\tinformation security aspects of business continuity management, including redundancies;\n14)\tcompliance, including information security reviews?"]
[]
[]
["7.1.2.1.4 Business management practices\nDoes auditors involved in ISMS auditing have knowledge of:\na)\tindustry information security good practices and information security procedures;\nb)\tpolicies and business requirements for information security;\nc)\tgeneral business management concepts, practices and the inter-relationship between policy, objectives and result;\nd)\tmanagement processes and related terminology?\nNOTE: These processes also include human resources management, internal and external communication and other relevant support processes."]
[]
[]
["7.1.2.1.5 Client business sector\nDoes auditor involved in ISMS auditing have the knowledge of:\na)\tthe legal and regulatory requirements in the particular information security field, geography and jurisdiction(s);\nNOTE: Knowledge of legal and regulatory requirements does not imply a profound legal background.\nb)\tinformation security risks related to business sector;\nc)\tgeneric terminology, processes and technologies related to the client business sector;\nd)\tthe relevant business sector practices?\n(The criteria a) may be shared amongst the audit team.)"]
[]
[]
["7.1.2.1.6 Client products, processes and organization\nDo auditors involved in ISMS auditing have knowledge of:\na)\tthe impact of organization type, size, governance, structure, functions, and relationships on development and implementation of the ISMS and certification activities, including outsourcing;\nb)\tcomplex operations in a broad perspective;\nc)\tlegal and regulatory requirements applicable to the product or service?"]
[]
[]
["7.1.2.2 Competence requirements for leading the ISMS audit team\nDoes audit team leaders fulfil the following requirements, which are demonstrated in audits under guidance and supervision;\na)\tknowledge and skills to manage the certification audit process and the audit team;\nb)\tdemonstration of the capability to communicate effectively, both orally and in writing?"]
[]
[]
["7.1.2.3 Competence requirements for conducting the application review\n7.1.2.3.1 Information security management system standards and normative documents\nDoes the personnel conducting the application review to determine audit team competence required, to select the audit team members and to determine the audit time have knowledge of:\na)\trelevant ISMS standards and other normative documents used in the certification process?"]
[]
[]
["7.1.2.3.2 Client business sector\nDoes the personnel conducting the application review to determine the audit team competence required, to select the audit team members and to determine the audit time have knowledge of:\na)\tgeneric terminology, processes, technologies and risks related to the client business sector?"]
[]
[]
["7.1.2.3.3 Client products, processes and organization\nDoes personnel conducting the application review to determine audit team competence required, to select the audit team members and to determine the audit time have knowledge of:\na)\tclient products, processes, organization types, size, governance, structure, functions and relationships on development and implementation of the ISMS and certification activities, including outsourcing functions?"]
[]
[]
["7.1.2.4 Competence requirements for reviewing audit reports and making certification decisions \n7.1.2.4.1 General\nDo the personnel reviewing audit reports and making certification decisions have knowledge that enables them to verify the appropriateness of the scope of certification as well as changes to the scope and their impact on the effectiveness of the audit, in particular the continuing validity of the identification of interfaces and dependencies and the associated risks?\nDoes the personnel reviewing audit reports and making the certification decisions have knowledge of:\na)\tmanagement system in general;\nb)\taudit processes and procedures;\nc)\taudit principles, practices and techniques?"]
[]
[]
["7.1.2.4.2 Information security management terminology, principles, practices and techniques\nDoes the personnel reviewing audit reports and making the certification decisions have knowledge of:\na)\tthe items listed in 7.1.2.1.2 a), c) and d);\nb)\tlegal regulatory requirements relevant to information security?"]
[]
[]
["7.1.2.4.3 Information security management system standards and normative documents\nDoes the personnel reviewing audit reports and making certification decisions have the knowledge of:\na)\trelevant ISMS standards and other normative documents used in the certification process?"]
[]
[]
["7.1.2.4.4 Client business sector\nDoes personnel reviewing audit reports and making certification decisions have knowledge of:\na)\tgeneric terminology and risks related to the relevant business sector practices?"]
[]
[]
["7.1.2.4.5 Client products, processes and organization\nDoes personnel reviewing audit reports and making certification decisions have knowledge of:\na)\tclient products, processes, organization types, size, governance, structure, functions and relationships?"]
[]
[]
["7.2.1 IS 7.2 Demonstration of auditor knowledge and experience\nDoes the certification body demonstrate that the auditors have knowledge and experience through:\na)\tRecognized ISMS-specific qualification;\nb)\tRegistration as auditor where applicable;\nc)\tParticipation in ISMS training courses and attainment of relevant personal credentials;\nd)\tUp to date professional development records;\ne)\tISMS audit witnessed by another ISMS auditor."]
[]
[]
["7.2.1.1 Selecting auditors\nIn addition to 7.1.2.1, does the criteria for selecting auditors ensure that each auditor:\na)\thas professional education or training to an equivalent level of university education;\nb)\thas at least four years full time practical workplace experience in information technology, of which at least two years are in role or function relating to information security;\nc)\thas successfully completed at least five days of training, the scope which covers ISMS audits and audit management;\nd)\thas gained experience of auditing ISMS prior to acting as an auditor performing ISMS audits. This experience shall be gained by performing as an auditor-in-training monitored by an ISMS evaluator (see ISO/IEC 17021-1:2015, 9.2.2.1.4) in at least one ISMS initial certification audit (stage 1 and stage 2) or re-certification and at least one surveillance audit. This experience shall be gained in at least 10 ISMS on-site audit days and performed in the last 5 years. The participation shall include review of documentation and risk assessment, implementation assessment and audit reporting;\ne)\tkeeps current knowledge and skills in information security and auditing up to date through continual professional development;\nf)\tkeeps current knowledge and skills in information security and auditing up to date through continual professional development;\ng)\thas competence in auditing an ISMS in accordance with ISO/IEC 27001?\nDo technical experts comply with criteria a), b) and e)?"]
[]
[]
["7.2.1.2 Selecting auditors for leading the team\nIn addition to 7.1.2.2 and 7.2.1.1, does the criteria for selecting an auditor for leading the team ensure that this auditor:\na)\thas actively participated in all stages of at least three ISMS audits. The participation shall include initial scoping and planning, review of documentation and risk assessment, implementation assessment and formal audit reporting?"]
[]
[]
["7.2.8 Does the group or individual that takes the decision on granting, maintaining, renewing, extending, reducing, suspending or withdrawing certification understand the applicable standard and ISMS certification requirements, and have demonstrated competence to evaluate the audit processes and related recommendations of the audit team?"]
[]
[]
["7.3.1 IS 7.3 Using external auditors or external technical experts as part of the audit team\nDo technical experts work under the supervision of an auditor?\n*The minimum requirements for technical experts are listed in 7.2.1.1."]
[]
[]
["8.2 Certification Documents\n8.2.1 IS 8.2 ISMS Certification Documents\nAre certification documents signed by an officer who has been assigned such responsibility?\nIs the version of the Statement of Applicability included in the certification documents?\nNOTE: A change to the Statement of Applicability which does not change the coverage of the controls of the scope of certification need not require an update of certification document.\n\nDoes the certification documents reference national and international standards as source(s) of control set for controls that are determined as necessary in the organization’s Statement of Applicability in accordance with ISO/IEC 27001:2013, 6.1.3 d)?\nIs the reference on the certification documents clearly stated as being only a control set source for controls applied in the Statement of Applicability and not a certification thereof?"]
[]
[]
["8.3.3 Does certification body have rules governing the use of any statement on product packaging or in accompanying information that the certified client has a certified management system?\n(Product packaging is considered as that which can be removed without the product disintegrating or being damaged. Accompanying information is considered as separately available or easily detachable. Type labels or identification plates are considered as part of the product.)\nDoes the statement in no way imply that the products, process or service is certified by this means?\nDoes the statement include reference to:\n-\tidentification (e.g. brand or name) of the certified client\n-\tthe type of management system (e.g. quality, environment) and the applicable standard;\n-\tthe certification body issuing the certificate?"]
[]
[]
["8.4.1 IS 8.4 Access to organizational records\nBefore the certification audit, does the certification body ask the client to report if any ISMS related information (such as ISMS records or information about design and effectiveness of controls) cannot be made available for review by the audit team because it contains confidential or sensitive information?\nDoes the certification body determine whether the ISMS can be adequately audited in the absence of such information?\nIf the certification body concludes that it is not possible to adequately audit the ISMS without reviewing the identified confidential or sensitive information, does it advise the client that the certification audit cannot take place until appropriate access arrangements are granted?"]
[]
[]
["9 Process requirements\n9.1 Pre-certification activities\n9.1.1.1 IS 9.1.1 Application readiness\nDoes the certification body require the client to have a documented and implemented ISMS which conforms to ISO/IEC 27001 and other documents required for certification?"]
[]
[]
["9.1.3 Audit programme\n9.1.3.1 IS 9.1.3 General\nDoes the audit programme for ISMS audits take the determined information security controls into account?"]
[]
[]
["9.1.3.2 IS 9.1.3 Audit Methodology\nAre the certification body’s procedures not presuppose a particular manner of implementation of an ISMS or a particular format for documentation and records?\nDo the certification procedures focus on establishing that a client’s ISMS meets the requirements specified in ISO/IEC 27001 and the policies and objectives of the client?\nNOTE: Further guidance on auditing is given in ISO/IEC 27007."]
[]
[]
["9.1.3.3 IS 9.1.3 General preparations for the initial audit\nDoes the certification body require that a client makes all necessary arrangements for the access to internal audit reports and reports of independent reviews of information security?\nDoes the following information at least provided by the client during stage 1 of the certification audit:\na)\tgeneral information concerning the ISMS and the activities it covers;\nb)\ta copy of the required ISMS documentation specified in ISO/IEC 27001 and, where required, associated documentation?"]
[]
[]
["9.1.3.4 IS 9.1.3 Review periods\nDoes the certification body not certify an ISMS unless it has been operated through at least one management review and one internal ISMS audit covering the scope of certification?"]
[]
[]
["9.1.3.5 IS 9.1.3 Scope of certification\nDoes the audit team audit the ISMS of the client covered by the defined scope against all applicable certification requirements?\nDoes the certification body confirm, in the scope of the client ISMS, that clients address the requirements stated in ISO/IEC 27001, 4.3?\nDo certification bodies ensure that the client’s information security risk assessment and risk treatment properly reflects its activities and extends to the boundaries of its activities as defined in the scope of certification?\nDo certification bodies confirm that this is reflected in the client’s scope of their ISMS and Statement of Applicability?\nDoes certification body verify that there is at least one Statement of Applicability per scope of certification?\nDo certification bodies ensure that interfaces with services or activities that are not completely within the scope of the ISMS are addressed within the ISMS subject to certification and are included in the client’s information security risk assessment?\n(An example of such a situation is the sharing of facilities (e.g. IT systems, databases and telecommunication systems or the outsourcing of a business function) with other organizations.)"]
[]
[]
["9.1.3.6 IS 9.1.3 Certification audit criteria\nDo the criteria against which the ISMS of a client is audited be the ISMS standard ISO/IEC 27001?\n(Other documents may be required for certification relevant to the function performed.)"]
[]
[]
["9.1.4 Determining the audit time\n9.1.4.1 IS 9.4.1 Audit time\nDo certification bodies allow auditors sufficient time to undertake all activities relating to an initial audit, surveillance audit or re-certification audit?\nDoes the calculation of overall audit time include sufficient time for audit reporting?\nDoes the certification body use Annex B to determine audit time?\nNOTE: Further guidance and examples on audit time calculation are provided in Annex C."]
[]
[]
["9.1.5 Multi-site sampling\n9.1.5.1 IS 9.1.5 Multiple sites\n9.1.5.1.1 Where a client organization has a number of sites meeting the criteria from a.) to c.) below, does the certification body consider using a sample-based approach to multiple-site certification audit?\na)\tAll sites are operating under the same ISMS, which is centrally administered and audited and subject to central management review;\nb)\tAll sites are included within the client organization’s internal ISMS audit programme;\nc)\tAll sites are included within the client organization’s ISMS management review programme."]
[]
[]
["9.1.5.1.2 Does the certification body that uses a sample-based approach have procedures in place to ensure the following:\na)\tthe initial contract review identifies to the greatest extent possible, the difference between sites such that an adequate level of sampling is determined;\nb)\ta representative number of sites have been sampled by the certification body, taking into account:\n1)\tthe results of the internal audit of the head office and the sites;\n2)\tthe results of the management review;\n3)\tvariations in the size of the sites;\n4)\tvariations in the business purpose of the sites;\n5)\tcomplexity of the information systems at the different sites;\n6)\tvariations in working practices;\n7)\tvariations in activities undertaken;\n8)\tvariations of designs and operation of controls;\n9)\tpotential interaction with critical information systems or information systems processing sensitive information;\n10)\tany differing legal requirements.\n11)\tGeographical and cultural aspects;\n12)\tRisk situation of the sites;\n13)\tInformation security incidents at the specific sites.\nc)\ta representative sample is selected from all sites within the scope of the client organization’s ISMS’ this selection shall be based upon judgmental choice to reflect the factors presented in item b/above as well as a random element;\nd)\tevery site included in the ISMS which is subject to significant risks is audited by the certification body prior to certification;\ne)\tthe audit programme has been designed in the light of the above requirements and covers representative samples of the organization scope of the ISMS certification within the three (3) years period;\nf)\tin the case of a nonconformity being observed, either at the head office or at a single site, the corrective action procedure applies to the head office and all sites covered by the certificate;\nDoes the audit described in IS 9.1.5 address the client organization’s head office activities to ensure that a single ISMS applies to all sites and delivers central management at the operational level? \nDoes the audit address all the issues outlined above?"]
[]
[]
["9.1.6 Multiple management systems standards\n9.1.6.1 IS 9.1.6 Integration of ISMS documentation with that for other management systems\nThe certification body may accept documentation that is combined (e.g. for information security, quality, health and safety and environment) as long as the ISMS can be clearly identified together with the appropriate interfaces to the other systems."]
[]
[]
["9.1.6.2 IS 9.1.6 Combining management system audits\nThe ISMS audit may be combined with audits of other management systems, provided that it can be demonstrated that the audit satisfies all requirements for certification of the ISMS.\nDo all the elements important to an ISMS appear clearly and be readily identifiable in the audit reports? \nIs the quality of the audit not adversely affected by the combination of the audits?"]
[]
[]
["9.2 Planning audits\n9.2.1.1 IS 9.2.1 Audit objectives\nDo the objectives include the determination of the effectiveness of the management system to ensure that the client, based on the risk assessment, has implemented applicable controls and achieved the established information security objectives?"]
[]
[]
["9.2.2 Audit team selection and assignments\n9.2.2.1 IS 9.2.2 Audit team\nIs the audit team formally appointed and provided with the appropriate working documents? \nIs the mandate given to the audit team clearly defined and made known to the client? \n(An audit team may consist of one person provided that the person meets all the criteria set out in 7.1.2.1.)"]
[]
[]
["9.2.2.2 Observers, technical experts and guides\n9.2.2.2 IS 9.2.2 Audit team competence\nThe requirements listed in Clause 7.1.2 apply. For Surveillance and special audit activities, only those requirements which are relevant to the scheduled surveillance activity and special audit activity apply.\nWhen selecting and managing the audit team to be appointed for a specific certification audit, does the certification body ensure that the competences brought to each assignment are appropriate?\nDoes the team:\na)\thave appropriate technical knowledge of the specific activities within the scope of the ISMS for which certification is sought and, where relevant, with associated procedures and their potential information security risks (technical experts may fulfil this function);\nb)\thave understanding of the client sufficient to conduct a reliable certification audit of its ISMS given the ISMS’ scope and context within the organization in managing the information security aspects of its activities, products and services;\nc)\thave appropriate understanding of the legal and regulatory requirements applicable to the client’s ISMS\nNOTE:  Appropriate understanding does not imply a profound legal background."]
[]
[]
["9.2.3 Audit plan\n9.2.3.1 IS 9.2.3 General\nDoes the audit plan for ISMS audits take the determined security controls into account?"]
[]
[]
["9.2.3.2 IS 9.2.3 Network-assisted audit techniques\nDoes the audit plan identify the network-assisted auditing techniques that will be utilized during the audit, as appropriate?\n*Network assisted auditing techniques may include, for example, teleconferencing, web meeting, interactive web-based communications and remote electronic access to the ISMS documentation and/or ISMS processes. The focus of such techniques should be to enhance audit effectiveness and efficiency, and should support the integrity of the audit process."]
[]
[]
["9.2.3.3 IS 9.2.3 Timing of audit\nA certification body should agree with the organization to be audited the timing of the audit which will best demonstrate the full scope of the organization. The consideration could include season, month, day/dates and shift as appropriate."]
[]
[]
["9.3 Initial certification\n9.3.1 IS 9.3.1 Initial certification audit\n9.3.1.1 IS 9.3.1.1 Stage 1\nIn this stage of audit, does the certification body obtain documentation on the design of the ISMS covering the documentation required in ISO/IEC 27001?\nDoes the certification body obtain a sufficient understanding of the design of the ISMS in the context of the client’s organization, risk assessment and treatment (including the controls determined), information security policy and objectives and, in particular, of the client’s preparedness for the audit?\nDoes this allow planning for stage 2?\nIs the results of stage 1 documented in a written report?\nDoes the certification body review the stage 1 audit report before deciding on proceeding with stage 2?\nDoes the certification body confirm if the stage 2 and audit team members have the necessary competence?\nIs it done by the auditor leading the team that conducted the stage 1 audit if deemed competent  and appropriate?\nNOTE: Independent review (i.e. by a person from the certification body not involved in the audit) is one measure to mitigate the risk involved when deciding if and with whom to proceed to stage 2. However, other risk mitigation  measures can already be in place achieving the same goal.\nDoes the certification body make the client aware of the further types of information and records that may be required for detailed examination during stage 2?"]
[]
[]
["9.3.1.2 IS 9.3.1.2 Stage 2\n9.3.1.2.1 On the basis of findings documented in the stage 1 audit report, does the certification body develops an audit plan for the conduct of stage 2?\nIn addition to evaluating the effective implementation of the ISMS, are the objectives of stage 2:\na)\tto confirm that the client adheres to its own policies, objectives and procedures."]
[]
[]
["9.3.1.2.2\tTo do this, does the audit focus on the client’s:\na)\ttop management leadership and commitment to information security policy and the information security objectives;\nb)\tdocumentation requirements listed in ISO/IEC 27001;\nc)\tassessment of information security related risks and that the assessments produce consistent, valid and comparable results if repeated;\nd)\tdetermination of control objectives and controls based on the information security risk assessment and risk treatment processes;\ne)\tinformation security performance and the effectiveness of the ISMS, evaluating against the information security objectives;\nf)\tcorrespondence between the determined controls, the Statement of Applicability and the results of the information security risk assessment and risk treatment process and the information security policy and objectives;\ng)\timplementation of controls, taking into account the external and internal context and related risk, the organization’s monitoring measurement and analysis of information security processes and controls, to determine whether controls are implemented and effective and meet their stated information security objectives;\nh)\tprogrammes, processes, procedures, records, internal audits and reviews of the ISMS effectiveness to ensure that these are traceable to top management decisions and information security policy and objectives?"]
[]
[]
["9.4 Conducting audits\n9.4.1 IS 9.4 General\nDoes the certification body have documented procedures for:\na)\tthe initial certification audit of a client’s ISMS, in accordance with the provisions of ISO/IEC 17021-1;\nb)\tsurveillance and re-certification audits of a client’s ISMS in accordance with ISO/IEC 17021-1 on a periodic basis for continuing conformity with relevant requirements and for verifying and recording that a client takes corrective action on a timely basis to correct all conformities?"]
[]
[]
["9.4.2 IS 9.4 Specific elements of the ISMS audit\nDoes the certification body, represented by the audit team:\na)\trequire the client to demonstrate that the assessment of information security related risks is relevant and adequate for the ISMS operation within the ISMS scope;\nb)\testablish whether the client’s procedures for the identification, examination and evaluation of information security related risks and results of their implementation are consistent with the client’s policy, objectives and targets?\nDoes the certification body also establish whether the procedures employed in risk assessment are sound and properly implemented?"]
[]
[]
["9.4.3 IS 9.4 Audit report\n9.4.3.1 In addition to the requirements for reporting in ISO/IEC 17021-1, 9.4.8, does the audit report provide the following information or a reference to it:\na)\tan account of audit including a summary of the document review;\nb)\tan account of the certification audit of the client’s information security risk analysis;\nc)\tdeviations from the audit plan (e.g. more or less time spent on certain scheduled activities);\nthe ISMS’ scope."]
[]
[]
["9.4.3.2 Does the audit report have sufficient detail to facilitate and support the certification decision?\nDoes it contain:\na)\tsignificant audit trails followed and audit methodologies utilized (see 9.1.3.2);\nb)\tobservations made, both positive (e.g. noteworthy features) and negative (e.g. potential nonconformities);\nc)\tcomments on the conformity of the client’s ISMS with the certification requirements with a clear statement of nonconformity, a reference to the version of the Statement of Applicability and, where applicable, any useful comparison with the results of previous certification audits of the clients.\nCompleted questionnaires, checklists, observations, logs, or auditor notes may form an integral part of the audit report.\nIf these methods are used, are these documents submitted to the certification body as evidence to support the certification decision?\nDoes information about the samples evaluated during the audit included in the audit report, or in other certification documentation?\nDoes the report consider the adequacy of the internal organization and procedures adopted by the client to give confidence in the ISMS?\nIn addition to the requirements for reporting in ISO/IEC 17021-1, 9.4.8, does the report cover:\n-\tsummary of the most important observations, positive as well as negative, regarding the implementation and effectiveness of the ISMS requirements and IS controls;\n-\tthe audit team’s recommendation as to whether the client’s ISMS should be certified or not, with information to substantiate this recommendation."]
[]
[]
["9.5 Certification decision\n9.5.1 IS 9.5 Certification decision\nIs the certification decision based, additionally to the requirements of ISO/IEC 17021-1, on the certification recommendation of the audit team as provided in their certification audit report (see 9.4.3)?\nThe persons or committees that take the decision on granting certification should not normally overturn a negative recommendation of the audit team.\nIf such a situation arises, does the certification body document and justify the basis for the decision to overturn the recommendation?\nIs the certification not granted to the client until there is sufficient evidence to demonstrate that arrangements for management reviews and internal ISMS audits have been implemented, are effective and will be maintained?"]
[]
[]
["9.6.2.1 IS 9.2 Surveillance Activities\n9.6.2.1.1 Are surveillance audit procedures consistent with those concerning the certification audit of the client organization’s ISMS as described in this international standard?\nThe purpose of surveillance is to verify that the approved ISMS continues to be implemented, to consider the implications of changes to that system initiated as a result of changes in the client organization’s operation and to confirm continued compliance with certification requirements. Does the certification body’s surveillance audit programme cover the following:\na)\tthe system maintenance elements which are internal ISMS audit, management review and preventive and corrective action; \nb)\tcommunications from external parties as required by the ISMS standard ISO/IEC 27001 and other documents required for certification;\nc)\tchanges to the documented system;\nd)\tareas subject to change;\ne)\tselected elements of ISO/IEC 27001;\nf)\tother selected areas as appropriate?"]
[]
[]
["9.6.2.1.2 As a minimum, does the certification body review the following as part of surveillance:\na)\tthe effectiveness of the ISMS with regard to achieving the objectives of the client organization’s information security policy,\nb)\t the functioning of procedures for the periodic evaluation and review of compliance with relevant information security policy;\nc)\tchanges to the controls determined, and resulting changes to the SoA;\nd)\timplementation and effectiveness of controls according to the audit programme?"]
[]
[]
["9.6.2.1.3 Does the certification body able to adapt its surveillance programme to the information security issues related to risks and impacts on the client and justify this programme?\nDuring surveillance audits, does the certification body check the records of appeal and complaints brought before the certification body and where any nonconformity or failure to meet the requirements of certification is revealed, that the client organization has investigated its own ISMS and procedures and taken appropriate corrective action?\nDoes a surveillance report contain in particular, any information on clearing of nonconformities revealed previously?\nAs a minimum, do the reports arising from surveillance build up to cover in totality the requirements of 9.6.2.1.1 and 9.6.2.1.2 above?"]
[]
[]
["9.6.3.1 IS 9.6.3 Re-certification Audits\nAre recertification audit procedures consistent with those concerning the certification audit of the client organization’s ISMS as described in this International Standard?\nIs the time allowed to implement corrective action consistent with the severity of the nonconformity and the risk to the assurance of products or services of the client organization meeting specified requirements?"]
[]
[]
["9.6.4 Special audits\n9.6.4.1 IS 9.6.4 Special cases\nAre the activities necessary to perform special audits subject to special provision if a client organization with a certified ISMS makes major modifications to its system or if other changes take place which could affect the basis of its certification?"]
[]
[]
["9.8.1 IS 9.8 Complaints\nComplains represent a potential incident and an indication to possible nonconformity."]
[]
[]
["10 Management system requirements for certification bodies\n10.1 Options\n10.1.1 IS 10.1 ISMS implementation\nIt is recommended that certification bodies implement an ISMS in accordance with ISO/IEC 27001. Has the certification body implemented an ISMS in accordance with ISO/IEC 27001?"]
[]
[]
[]
["EnMS"]
["ISO/IEC 50003:2021"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["5 General requirements\nDoes the requirements defined in ISO 50003:2021 applied to the EnMS auditing process?\nISO 50003:2021 defines the requirements for the determination of audit time for an EnMS in Annex A and multi-site sampling of a client organization's EnMS in Annex B."]
[]
[]
["6 Structural requirements \nWhen safeguarding impartiality, does the certification body manage, as a potential conflict of interest, energy audits and/or other energy related services conducted by the auditor or the certification body within the last two years?"]
[]
[]
["7.2 Personnel involved in the certification activities\n7.2.1 Does the competencies include a level of generic competence described in ISO/IEC 17021-1:2015 as well as the EnMS technical knowledge described in Table 1, where \"X\" indicates that the certification body shall define the criteria and depth of knowledge? \nDoes the certification body personnel have the competencies defined in Table 1?\nIn addition to the technical knowledge requirements specified in Table 1, does the certification body define criteria, including the knowledge and skills of the audit team that is necessary for the client?"]
[]
[]
["7.2.2 Energy specific terminology\n7.2.2.1 Auditing\nDoes the certification body auditors have knowledge of the terminology from ISO 50001? \nCertification bodies may include terminology from ISO 50002, ISO 50006, ISO 50015 or ISO 50047 for their auditors, as determined appropriate."]
[]
[]
["7.2.2.2 Reviewing audit reports and making certification decisions\nDoes the personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of the terminology from ISO 50001?\nCertification bodies may include additional terminology as determined appropriate for those reviewing audit reports and making certification decisions."]
[]
[]
["7.2.2.3 Conducting the application review to determine the required audit team competence, to select the audit team members and to determine the audit time\nDoes the personnel responsible for conducting the application review, selecting the audit team, determining the needed audit competence and determining the audit time have knowledge of the terms and definitions from ISO 50001?"]
[]
[]
["7.2.3 Energy principles\n7.2.3.1 Auditing \nDoes the certification body auditor have knowledge of energy principles? Does energy principles include at a minimum: types of energy, energy uses, energy conversion, calculation of energy in different units (e.g. kWh to TJ) and power?\nDoes the certification body audit team have knowledge of the following principles:\n- fuel combustion;\n- energy flow;\n- energy losses;\n- energy efficiency;\n- energy balance."]
[]
[]
["7.2.3.2 Reviewing audit reports and making certification decisions\nDoes the personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of the energy principles, including types of energy, energy uses and energy conversion?"]
[]
[]
["7.2.3.3 Conducting the application review to determine the required audit team competence, to select the audit team members and to determine the audit time\nDoes the personnel responsible for conducting the application review, selecting the audit team, determining the needed audit competence and determining the audit time have knowledge of the energy principles, including types of energy, energy-uses, energy conversion and calculation of energy in different units (e.g. kWh to TJ)?"]
[]
[]
["7.2.4 Energy related legal requirements\n7.2.4.1 Auditing \nDoes the certification body audit team have knowledge of the basic legal structure related to energy and energy consumption?"]
[]
[]
["7.2.4.2 Reviewing audit reports and making certification decisions \nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of the basic legal structure related to energy and energy consumption?"]
[]
[]
["7.2.5 Knowledge of ISO 50001 requirements\n7.2.5.1 Auditing\nDoes the certification body auditor have knowledge of ISO 50001 requirements?"]
[]
[]
["7.2.5.2 Reviewing audit reports and making certification decisions \nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of ISO 50001 requirements?"]
[]
[]
["7.2.5.3 Conducting the application review to determine the required audit team competence, to select the audit team members and to determine the audit time \nDoes the team of personnel responsible for conducting the application review, selecting the audit team, determining the needed audit competence and determining the audit time have knowledge of ISO 50001 requirements?"]
[]
[]
["7.2.6 Energy performance indicators, energy baseline, relevant variables and static factors\n7.2.6.1 Auditing\nDoes the certification body auditor have knowledge of EnPIs, EnPI value, EnB, relevant variables, static factors, and their use in an EnMS and in demonstrating energy performance improvement including normalization techniques?\nDoes the certification body audit team have knowledge of the use of models such as ratios and simple linear regression to carry out normalization of EnPI value(s) and their corresponding EnB(s)?\nNOTE: See ISO 50006 and ISO 50047 for more details."]
[]
[]
["7.2.6.2 Reviewing audit reports and making certification decisions\nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of EnPIs, EnPI value, EnB, relevant variables, static factors and their use in demonstrating energy performance improvement in an EnMS?"]
[]
[]
["7.2.7 Common energy using systems\n7.2.7.1 Auditing\nDoes the certification body audit team have knowledge of energy using systems, for example:\n- boiler and thermal fluid systems;\n- refrigeration, heating, ventilation and air conditioning;\n- mechanical systems (e.g. motors, fans, pumps);\n- thermal, not building envelope (e.g. furnace);\n- compressed air;\n- lighting;\n- additional systems may be included as determined appropriate by the certification body."]
[]
[]
["7.2.7.2 Reviewing audit reports and making certification decisions\nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of energy using systems, for example:\n- boiler and thermal fluid systems;\n- refrigeration, heating, ventilation and air conditioning;\n- mechanical systems (e.g. motors, fans, pumps);\n- thermal, not building envelope (e.g. furnace);\n- compressed air;\n- lighting;\n- additional systems may be included as determined appropriate by the certification body."]
[]
[]
["7.2.8 Energy performance improvement\n7.2.8.1 Auditing\nDoes the certification body auditor have knowledge of potential energy performance improvements in energy using systems?\nDoes the certification body audit team have knowledge of the application of current technology used to achieve energy performance improvement?"]
[]
[]
["7.2.8.2 Reviewing audit reports and making certification decisions \nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of potential energy performance improvements in energy using systems and the application of current technology used to achieve energy performance improvements?"]
[]
[]
["7.2.9 Principles of data collection, monitoring, measurement, analysis and evaluation\n7.2.9.1 Auditing\nDoes the certification body auditor have knowledge of the types of data that are typically included in the EnMS?\nDoes the certification body auditor have knowledge of the typical monitoring, measurement and evaluation used in an EnMS?\nDoes the certification body auditor have knowledge of the use of evaluation of improvement in energy performance by comparing EnPI(s) values against their corresponding normalized EnB(s)?\nNOTE See ISO 50006 and ISO 50015 for additional details."]
[]
[]
["7.2.9.2 Reviewing audit reports and making certification decisions\nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of the types of data that are typically included in the EnMS?\nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of the typical monitoring, measurement and evaluation used in an EnMS?\nDoes the team of personnel responsible for reviewing audit reports and making certification decisions within the certification body have knowledge of evaluation of improvement in energy performance by comparing EnPI(s) values against their corresponding normalized EnB(s)?"]
[]
[]
["8.2 Certification documents\nDoes the certification document(s) identify the scope and boundary(ies) of the EnMS, which may include activities, facilities and processes related to the EnMS?\nThe scope and boundary(les) can include an entire entity with multi-sites, a site, or a subset or subsets within a site such as a building, a facility or a process.\nDoes the scope of the certification statement not be misleading or include any claims (e.g. 3.5 % improvement in electricity consumption)?\nNOTE: ISO/IEC 17029 contains the requirements for verification and/or validation bodies."]
[]
[]
["9.1.4.1 General \nIn determining the audit time, does the certification body include the following factors:\na) the number of EnMS effective personnel (see A.2);\nb) the number of energy types (see A.3);\nc) the annual energy consumption (TJ);\nd) the number of significant energy uses (SEUs).\nDoes the audit time determined by using Table A.3 for the initial audit and Table A.4 for surveillance and recertification? The calculation method is described in Annex A.\nDoes the audit time includes the time spent on-site at a client's site (permanent or temporary) and time spent off-site carrying out planning, document review, interacting with client personnel and report writing?\nDoes the travel (en route or between sites) and any breaks not be included in the on-site duration of the audits?\nDoes the justification and calculations for the determination of the audit time, including duration of the audit recorded, retained as documented information and be available to the client?\nNOTE An audit conducted by use of remote auditing techniques is considered on-site."]
[]
[]
["9.1.4.2 Duration of the audit\nDoes the duration of the audit a minimum of 80 % of the audit time? \nDoes time for audit reporting, planning or communication with the client not more than 20 % of the audit time?"]
[]
[]
["9.1.4.3 Audit days\nThe audit days are based on eight hours per day. Adjustments can be required based on local, regional or national legal requirements (eg. inclusion of lunch breaks). \nDoes the number of audit days not be reduced by using longer hours per working day?\nNOTE: The certification body can agree with the client the way in which the audit time is allocated. For example, if the audit time is four davs:\n- the audit can be performed during four consecutive or non-consecutive calendar days;\n- the four calendar audit days can be spread over eight calendar half days;\n- the audit team can be:\n     - one auditor auditing during four calendar days; or\n     - two auditors auditing individually during two calendar days each or any other similar combination.\nIf, after the calculation, the result is a decimal number, does the number of days adjusted either up or down to the nearest half day (e.g. 5,3 audit days becomes 5,5 audit days; 5,2 audit days becomes 5 audit days)?"]
[]
[]
["9.1.4.4 EnMS effective personnel \nDoes the number of EnMS effective personnel and the level of EnMS complexity, as defined in Annex A, used as the basis for the determination of audit time as shown in Annex D?\nDoes the certification body define and maintain documented information on a process for determining the number of EnMS effective personnel for the scope of the certification and for each audit in the audit programme?\nDoes the process for determining the number of EnMS effective personnel ensure that the persons who materially contribute to meeting the requirements of the EnMS are included?"]
[]
[]
["9.1.5 Multi-site sampling\nDoes the certification of a multi-site organization based on sampling allowed? Does the requirements of multi-site sampling as defined in ISO 50003:2021 Annex B followed?\nDoes the certification body retain documented information on the decision criteria for sampling of the permanent sites and temporary sites? Does the criteria for determining the sample of the sites available to the client organization upon request?"]
[]
[]
["9.3.1 Stage 1\nDoes the Stage 1 include the following\na) a review of documented information on the scope and boundary (ies);\nb) a confirmation of the scope and boundary (ies) of the EnMS for certification;\nc) a confirmation of the number of EnMS effective personnel, energy types, SEUs and annual energy consumption, in order to review and confirm the audit time;\nd) a review of the documented information from the EnMS planning process;\ne) a review to confirm that EnPI(s) and corresponding EnB(s) are used by the client organization to determine energy performance;\nf) a review of documented information regarding determined and prioritized energy performance improvement opportunities as well as the objectives, energy targets and action plans.\nBased on the outputs of Stage 1, does the certification body confirm the competence needed for Stage 2?"]
[]
[]
["9.3.2 Stage 2\n9.3.2.1 During Stage 2 audits, does the audit team review the necessary audit evidence to determine whether or not continual energy performance improvement has been demonstrated prior to making a recommendation?"]
[]
[]
["9.3.2.2 Does the certification body analyse the necessary audit evidence to determine whether or not continual energy performance improvement has been demonstrated prior to making a certification decision? \nDoes the confirmation of continual energy performance improvement required for granting the initial certification?\nNOTE: Examples of how a client organization can demonstrate energy performance improvement are\nprovided in ISO 50001:2018, A.10. Additional information on energy performance improvement is provided in Annex C."]
[]
[]
["9.4 Conducting audits\n9.4.1 General \nEnergy performance improvement can be demonstrated at the equipment, process, system or facility level.\nDuring each audit within the audit programme, does the certification body confirm the suitability of the EnMS scope and boundary (ies) as defined by the client?"]
[]
[]
["9.4.8 Audit report\nDoes an audit report include:\na) the scope and boundary (ies) of the EnMS being audited;\nb) at certification decisions:\n1) a statement of the achievement of continual improvement of the EnMS with a record of  audit evidence to support the statement;\nNOTE 1 At the initial audit, the implementation of the svstem can be considered as continual improvement of the EnMS.\n2) a statement of the achievement of continual energy performance improvement with a record of audit evidence to support the statement\nNOTE 2 At the initial audit, the demonstration of energy performance improvement can be considered as continual energy performance improvement.\nNOTE 3 See Annex C for additional information on energy performance improvement.\nc) at surveillance audits, a statement confirming that the client organization has demonstrated implementation of actions for energy performance improvement (see 9.6.2)"]
[]
[]
["9.5.3 Information for granting initial certification\nDoes the certification body review the necessary audit evidence to determine whether or not a continual energy performance improvement has been demonstrated prior to making an initial certification decision?"]
[]
[]
["9.5.4 Information for granting recertification\nDoes the certification body m review the necessary audit evidence to determine whether or not a continual energy performance improvement has been demonstrated prior to making a recertification decision?\nDoes confirmation of continual energy performance improvement required for granting the recertification?"]
[]
[]
["9.6 Maintaining certification\n9.6.1 General \nIn addition, when conducting EnMS audits, does the certification body ensure that, across the certification cycle, evidence related to the whole of the EnMS, including energy performance and energy performance improvement, is collected, evaluated and recorded as evidence in the audit reports?\nNOTE: See ISO 50003:2021, clause 9.3.2, 9.6.2 and 9.6.3 for evidence related to energy performance improvement."]
[]
[]
["9.6.2 Surveillance audit \nDoes the client organization able to demonstrate implementation of actions for energy performance improvement at the time of a surveillance audit? During the surveillance audits, does demonstration of the achievement of energy performance improvement not be required (see ISO 50003:2021, clause 9.4.8)?"]
[]
[]
["9.6.2 Surveillance audit \nDoes the client organization able to demonstrate implementation of actions for energy performance improvement at the time of a surveillance audit? During the surveillance audits, does demonstration of the achievement of energy performance improvement not be required (see ISO 50003:2021, clause 9.4.8)?"]
[]
[]
[]
["FSMS & HACCP"]
["FSMS"]
["HACCP"]
["Food Safety Management System ISO 22003-1:2022 + ISO/IEC 17021-1:2015"]
["Clause/s","Applicant Body's description of its established policies and procedures","PAB Findings/Comments","Applicant Body’s Action","PAB 2nd Evaluation","Applicant Body’s Action","PAB 3rd Evaluation","Applicant Body’s Action"]
["5 General Requirements"]
["5.1 Legal and contractual matters\n5.1.1 Legal responsibility\nIs the certification body a legal entity, or a defined part of a legal entity, such that it can be held legally responsible for all its certification activities?\n*A governmental certification body is deemed to be a legal entity on the basis of its governmental status."]
[]
[]
["5.1.2 Certification agreement\nDoes the certification body have a legally enforceable agreement for the provision of certification service in accordance with the relevant requirements of this part of ISO/IEC 17021 to its client? \nWhere there are multiple offices of a certification body or multiple sites of a client, does the certification body ensure that there is a legally enforceable agreement between the certification body granting certification and issuing a certificate, and all the sites covered by the scope of the certification?\n*An agreement can be achieved through multiple agreements that reference or otherwise link to one aother."]
[]
[]
["5.1.3 Responsibility for certification decisions\nIs the certification body responsible for, and does it retain authority for, its decisions relating to certification, including the granting, refusing, maintaining of certification, expanding or reducing the scope of certification, renewing, suspending or restoring following suspension, or withdrawing of certification?"]
[]
[]
["5.2 Management of impartiality\n"]
["5.2.1\n Does the certification body undertake conformity assessment activities impartially? \nDoes the certification body allow commercial, financial or other pressures to compromise impartiality? Is the certification body responsible for the impartiality of its conformity assessment activities?"]
[]
[]
["5.2.2\n Does the certification body have top management commitment to impartiality in management system certification activities?\nDoes the certification body have a policy that it understands the importance of impartiality in carrying out its management system certification activities, manages conflict of interest and ensures the objectivity of its management system certification activities?"]
[]
[]
["5.2.3\n Does the certification body have a process to identify, analyze, evaluate, treat, monitor and document the risks related to conflict of interests arising from provision of certification including any conflicts arising from its relationship on an ongoing basis?\nWhere there are any threats to impartiality, does the certification body document and demonstrate how to eliminate or minimize such threats and document any residual risk?\nDoes the demonstration cover all potential threats that are identified, whether they arise from within the certification body or from the activities of other persons, bodies or organizations?\nDoes the top management review any residual risk to determine if it is within the level of acceptable risk?\nDoes the risk assessment process include identification of and consultation with appropriate interested parties advising on matters affecting impartiality including openness and public  perception?\n• Sources of threats to impartiality of the certification body can be based on ownership, governance, management, personnel, shared resources, finances, contracts, training, marketing and payment of a sales commission or other inducement for the referral of new clients, etc.\n• Interested parties can include personnel and clients of the certification body, customers of organizations whose management systems are certified, representatives of industry trade associations, representatives of governmental regulatory bodies or other governmental services or representatives of \nnon-governmental organizations, including consumer organizations.\n• One way of fulfilling the consultation requirement of this clause is by the use of a committee of these interested parties"]
[]
[]
["5.2.4\nDoes the certification body certify another certification body for its management system certification activities?"]
[]
[]
["5.2.5\n Does the certification body or any part of the same legal entity under the organizational control of the certification body offer or provide management system consultancy?\nThis also applies to that part of government identified as the certification body.\n• This does not preclude the possibility of exchange of information (e.g. explanation of findings or clarification of requirements) between the certification body and its clients."]
[]
[]
["5.2.6\nDoes the certification body or any part of the same legal entity and any entity under the organizational control of the certification body offer or provide internal audits to its certified clients? \nIs carrying out of internal audits by the certification body and any part of the same legal entity to its certified clients is a significant threat to impartiality.\n• See Note 1 to Clause 5.2.3"]
[]
[]
["5.2.7\n Does the certification body certify the management system for a minimum of two years following the end of the consultancy?\nWhen a client has received management systems consultancy from a body that has a relationship with a certification body, this is a significant threat to impartiality.\n• See Note to 5.2.3."]
[]
[]
["5.2.8\n Does the certification body outsource audits to a management system consultancy organization, as this poses an unacceptable threat to the impartiality of the certification body (see Clause 7.5)?\nThis does not apply to individuals contracted as auditors covered in Clause 7.3."]
[]
[]
["5.2.9\nAre the certification body’s activities marketed or offered as linked with the activities of an organization that provides management system consultancy?\nDoes the certification body take action to correct inappropriate links or statements by any consultancy organization stating or implying that certification would be simpler, easier, faster or less expensive if the certification body were used?\nDoes the certification body not state or imply that certification would be simpler, easier, faster or less expensive if a specified consultancy organization were used?"]
[]
[]
["5.2.10\n Does the certification body ensure that personnel who have provided management system consultancy, including those acting in a managerial capacity, do not take part in an audit or other certification activities if they have been involved in management system consultancy towards the client in question within two years following the end of the consultancy?"]
[]
[]
["5.2.11\nDoes the certification body take action to respond to any threats to its impartiality arising from the actions of other persons, bodies or organizations?"]
[]
[]
["5.2.12\nDo all certification body personnel, either internal or external, or committees, who could influence the certification activities, act impartially and not allow commercial, financial or other pressures to compromise impartiality?"]
[]
[]
["5.2.13\nDoes the certification body require personnel, both internal and external, to reveal any situation known to them that may present them or the certification body with a conflict of interests? Does the certification body record and use this information as input to identifying threats to impartiality raised by the activities of such personnel or by the organizations that employ them?\nDoes the certification body use personnel, either internal or external, unless they can demonstrate that there is no conflict of interests?"]
[]
[]
["5.3 Liability and financing\n"]
["5.3.1\nCan the certification body demonstrate that it has evaluated the risks arising from its certification activities and that it has adequate arrangements (e.g. insurance or reserves) to cover liabilities arising from its operations in each of its fields of activities and the geographic areas in which it operates?"]
[]
[]
["5.3.2\nDoes the certification body evaluate its finances and sources of income and demonstrate to the committee specified in 6.2 that initially, and on an ongoing basis, commercial, financial or other pressures do not compromise its impartiality?"]
[]
[]
["6 Structural requirements\n6.1 Organizational structure and top management\n"]
["6.1.1\n Has the certification body documented its organizational structure, showing duties, responsibilities and authorities of management and other certification personnel and any committees?\nWhen the certification body is a defined part of a legal entity, does the structure include the line of authority and the relationship to other parts within the same legal entity?"]
[]
[]
["6.1.2\n Are the certification activities structured and managed to safeguard impartiality?"]
[]
[]
["6.1.3\n Has the certification body identified the top management (board, group of persons, or person) having overall authority and responsibility for each of the following:\na) development of policies and establishment of processes and procedures relating to its operations;\nb) supervision of the implementation of the policies and procedures;\nc) ensuring impartiality;\nd) supervision of its finances;\ne) development of management system certification services and schemes;\nf) performance of audits and certification, and responsiveness to complaints;\ng) decisions on certification; delegation of authority to committees or individuals, as required, to undertake defined activities on its behalf;\nh) contractual arrangements;\ni) provision of adequate resources for certification activities?"]
[]
[]
["6.1.4\n Does the certification body have formal rules for the appointment, terms of reference and operation of any committees involved in the certification activities?"]
[]
[]
["6.2 Operational Control \n"]
["6.2.1\n Does the certification body have a process for the effective control of certification activities delivered by branch offices, partnerships, agents, franchisees, etc. irrespective of their legal status, relationship or geographical location?\nHave the certification body considered the risk that these activities pose to the competence, consistency and impartiality of the certification body?"]
[]
[]
["6.2.2\nHas the certification body considered the appropriate level and method of control of activities undertaken including its processes, technical areas of certification bodies’ operations, competence of personnel, lines of management control, reporting and remote access to operations including records?"]
[]
[]
["7 Resource requirements\n"]
["7.1 Competence of personnel\n"]
["7.1.1 General considerations\nDoes the certification body have processes to ensure that personnel have appropriate knowledge and skills relevant to the certification standard and geographic areas in which it operates?\n\nISO 22003-1\n7.1.1\nDoes certification functions for which competence be identified are those given in the Annex C of ISO 22003-1? "]
[]
[]
["7.1.2 Determination of competence criteria\nDoes the certification body have a documented process for determining the competence criteria for personnel involved in the management and performance of audits and certification activities?\nAre competence criteria determined with regard to the requirements of the certification standard for each technical area, and for each function in the certification process?\nThe output of the process shall be the documented criteria of required knowledge and skills necessary to effectively perform audit and certification tasks to be fulfilled to achieve the intended results. Annex A specifies the knowledge and skills that a certification body shall define for specific functions.\n• The term “technical areas” is applied differently on the management system standard being considered.For any management system, the term is related to products, processes and services in the context of the scope of the management system standard. The technical area can be defined by a specific certification scheme (e.g. ISO/TS 22003) or can be determined by the certification body. It is used to cover a number of other terms such as “scopes”, “categories”, “sectors”, etc., which are traditionally used \nin different management system disciplines.\n\nISO 22003-1\n7.1.2\nDoes technical areas defined using Annex A of ISO 22003-1?\nDoes the competence criteria, specifying required knowledge and skills, in the Annex C of ISO 22003-1 apply?\nNote 1: Annex D of ISO 22003-1 provides guidance to the certification body on many of the generic certification functions identified in ISO/IEC 17021-1:2015, Annex A, for which competence criteria need to be determined for personnel involved in the audit and certification of an FSMS.\nNote 2: Qualification(s) and experience can be used as part of the criteria; however, competence is not based on these alone, as it is important to ensure that a person can demonstrate the ability to apply the specific knowledge and skills that one would expect a person to have after completing a qualification or having a certain amount of industry experience."]
[]
[]
["7.1.3 Evaluation process\nDoes the certification body have documented processes for the initial competence evaluation, and on-going monitoring of competence and performance of all personnel involved in the management and performance of audits and other certification activities, applying the determined competence criteria?\nDoes the certification body able to demonstrate that its evaluation methods are effective? \nThe output from these processes shall be to identify personnel who have demonstrated the level of competence required for the different functions of the audit and certification process? \n• A number of evaluation methods that can be used to evaluate knowledge and skills are described in Annex B of IS/IEC 17021-1.\n• Annex C of ISO/IEC 17021-1:2015 shows an example of process flow for determining and maintaining competence\nISO 22003-1\n7.1.3\nDoes the certification body able to evaluate, in particular, the individual's knowledge relating to food safety, including knowledge of specific prerequisite programmes (PRPs), food safety hazards and control measures related to the categories within which the certification body personne operate. These shall be have been identified for these categories under the requirements of 7.1.2.\nNote: ISO/IEC 17021-1:2015, 7.1.3, requires the certification body to demonstrate the effectiveness of the evaluation methods used to evaluate personnel against identified competence criteria.\n\n"]
[]
[]
["7.1.4 Other considerations\nDoes the certification body have access to the necessary technical expertise for advice on matters directly relating to certification activities for all technical areas, types of management systems and geographic areas in which the certification body operates?\nSuch advice may be provided externally or by certification body personnel."]
[]
[]
["7.2 Personnel involved in the certification activities\n"]
["7.2.1\n Does the certification body have sufficient, competent personnel for managing and supporting the type and range of audit programmes and other certification work performed?"]
[]
[]
["7.2.2\n Does the certification body employ, or have access to, a sufficient number of auditors,including audit team leaders, and technical experts to cover all of its activities and to handle the volume of audit work performed?"]
[]
[]
["7.2.3\n Does the certification body make clear to each person concerned their duties, responsibilities and authorities?"]
[]
[]
["7.2.4\nDoes the certification body have processes for selecting, training, formally authorizing auditors and for selecting and familiarizing technical experts used in the certification activity? \nDoes the initial competence evaluation of an auditor include ability to apply required knowledge and skills during audits, as determined by a competent evaluator observing the auditor \nconducting an audit?\n• During the selection and training process described above, desired personal behaviours can be considered. These are characteristics that affect an individual's ability to perform specific functions. Therefore, knowledge about the behaviours of individuals enables a certification body to take advantage of their strengths and to minimize the impact of their weaknesses."]
[]
[]
["7.2.5\nDoes the certification body have a process to achieve and demonstrate effective auditing, including the use of auditors and audit team leaders possessing generic auditing skills and \nknowledge, as well as skills and knowledge appropriate for auditing in specific technical areas?"]
[]
[]
["7.2.6\nDoes the certification body ensure that auditors (and, where needed, technical experts) are knowledgeable of its audit processes, certification requirements and other relevant requirements? Does the certification body give auditors and technical expert’s access to an up\u0002to-date set of documented procedures giving audit instructions and all relevant information on the certification activities?"]
[]
[]
["7.2.7\n Does the certification body identify training needs and offer or provide access to specific training to ensure its auditors, technical experts and other personnel involved in certification activities are competent for the functions they perform?"]
[]
[]
["7.2.8\nDoes the group or individual that takes the decision on granting, refusing, maintaining, renewing, suspending, restoring or withdrawing certification, or on expanding or reducing the  scope of certification, understand the applicable standard and certification requirements, and have demonstrated competence to evaluate the outcomes of the audit processes including related recommendations of the audit team?"]
[]
[]
["7.2.9\n Does the certification body ensure the satisfactory performance of all personnel involved in the audit and certification activities?\nAre there documented process for monitoring competence and performance of all persons involved, based on the frequency of their usage and the level of risk linked to their activities? \nDoes the certification body review and record the competence of its personnel in the light of their performance in order to identify training needs?"]
[]
[]
["7.2.10\n Does the certification body monitor each auditor considering each type of management system to which the auditor is deemed competent?\nDo the documented monitoring procedures for auditors include combination of on-site observation, review of audit reports and feedback from clients or from the market?\nIs the monitoring designed in such a way as to minimize disturbance to the normal processes of certification, especially from the client's viewpoint?"]
[]
[]
["7.2.11\nDoes the certification body periodically evaluate the performance of each auditor on-site?\nIs the frequency of on-site evaluations based on the need determined from all monitoring information available?"]
[]
[]
["7.3 Use of individual external auditors and external technical experts\nDoes the certification body require external auditors and external technical experts to have a written agreement by which they commit themselves to comply with applicable policies and \nimplemented processes as defined by the certification body?\nDo the agreement address aspects relating to confidentiality and impartiality and require the external auditors and external technical experts to notify the certification body of any existing or \nprior relationship with any organization they may be assigned to audit?\n• Use of an individual or employee of another organization individually contracted to serve as an external auditor or technical expert does not constitute outsourcing."]
[]
[]
["7.4 Personnel records \nDoes the certification body maintain up-to-date personnel records, including relevant qualifications, training, experience, affiliations, professional status and competence? \nDoes the record include management and administrative personnel in addition to those performing certification activities?"]
[]
[]
["7.5 Outsourcing"]
["7.5.1\nDoes the certification body have a process in which it describes the conditions under which outsourcing (which is subcontracting to another organization to provide part of the certification activities on behalf of the certification body) may take place?\nDoes the certification body have a legally enforceable agreement covering the arrangements, including confidentiality and conflict of interests, with each body that provides outsourced services?"]
[]
[]
["7.5.2\n Are decisions for granting, refusing maintaining of certification, expanding or reducing the scope of certification, renewing, suspending or restoring, or withdrawing of certification are not outsourced?"]
[]
[]
["7.5.3\nDoes the certification body:\na) take responsibility for all activities outsourced to another body,\nb) ensure that the body that provides outsourced services, and the individuals that it uses, conform to requirements of the certification body and also to the applicable provisions of \nISO/IEC 17021-1, including competence, impartiality and confidentiality, and\nc) Ensure that the body that provides outsourced services, and the individuals that it uses, are not involved, either directly or through any other employer, with an organization to be audited, in such a way that impartiality could be compromised?"]
[]
[]
["7.5.4\n Does the certification body have a process for the approval and monitoring of all bodies \nthat provide outsourced services used for certification activities?\nDoes the certification body ensure that records of the competence of all personnel involved in certification activities are maintained?\n• For Clauses 7.5.1 to 7.5.4, where the certification body engages individuals or employees of other organizations to provide additional resources or expertise, these individuals do not constitute outsourcing \nprovided they are individually contracted to operate under the certification body’s management system (see Clause 7.3)\n• *For Clauses 7.5.1 to 7.5.4, the terms “outsourcing” and “subcontracting” are considered to be synonyms."]
[]
[]
["8 Information requirements\n"]
["8.1 Publicly accessible information\n"]
["8.1.1\n Does the certification body maintain (through publications, electronic media or other means), and make public, without request, in all the geographical areas in which it operates, information about:\na) Audit processes;\nb) Processes for granting, refusing, maintaining, renewing, suspending, restoring or withdrawing certification or expanding or reducing the scope of certification;\nc) Types of management systems and certification schemes in which it operates;\nd) The use of the certification body’s name and certification mark or logo;\ne) Processes for handling requests for information, complaints and appeals;\nf) Policy on impartiality?"]
[]
[]
["8.1.2\nDoes the certification body provide upon request about:\na) geographical areas in which it operates;\nb) the status of a given certification; and\nc) the name, related normative document, scope and geographical location (city and country) for a specific certified client?\n• In exceptional cases, access to certain information can be limited on the request of the client (e.g. for security reasons).\n• The certification body can also make the information in 8.1.2 public by any means it chooses without request, e.g. on its internet website."]
[]
[]
["8.1.3\n Does the certification body ensure that information provided to any client or to the marketplace, including advertising, is accurate and not misleading?"]
[]
[]
["8.2 Certification documents\n"]
["8.2.1\n How does the certification body provide certification documents to the certified client?"]
[]
[]
["8.2.2\n Does the certification document(s) identify the following:\na) the name and geographic location of each client whose management system is certified (or the geographic location of the headquarters and any sites within the scope of a multi-site \ncertification);\nb) the effective date of granting, expanding or reducing the scope of certification or renewing certification which shall not be before the date of the relevant certification decision;\n• The certification body can keep the original certification date on the certificate when a certificate lapses for a period of time provided that:\n- the current certification cycle start and expiry date are clearly indicated;\n- the last certification cycle expiry date be indicated along with the date of recertification audit\nc) the expiry date or recertification due date consistent with the recertification cycle;\nd) a unique identification code;\ne) the management system standard and/or other normative document, including indication of issue status (e.g. revision date or number) used for audit of the certified client;\nf) the scope of certification with respect to types of activities, products and services as applicable at each site without being misleading or ambiguous;\ng) the name, address and certification mark of the certification body; other marks (e.g. accreditation symbol, client’s logo) may be used provided they are not misleading or ambiguous;\nh) any other information required by the standard and/or other normative document used for certification;\ni) in the event of issuing any revised certification documents, a means to distinguish the revised documents from any prior obsolete documents?\n• ISO/IEC 17030 provides requirements for use of third-party marks.\n\nISO 22003-1\n8.2\nDoes the certification documents identify in details the categories and subcategories in Table A.1. of ISO 22003-1 to which the FSMS applies?"]
[]
[]
["8.3 Reference to certification and use of marks\n"]
["8.3.1\nDoes the certification body have rules governing any management system’s third-party mark that it authorizes certified clients to use?\nDo these rules ensure, among other things, traceability back to the certification body?\nIs there any ambiguity, in the mark or accompanying text, as to what has been certified and which certification body has granted the certification?\nIs the mark used on a product or product packaging seen by the consumer or in any other way that may be interpreted as denoting product conformity?\n• ISO/IEC 17030 provides additional information for use of third-party marks."]
[]
[]
["8.3.2\nHow does the certification body ensure that its marks are not applied to laboratory test, calibration or inspection reports or certificates? Such reports are deemed to be products in this context."]
[]
[]
["8.3.3\n Does the certification body have rules governing the use of any statement on product packaging or in accompanying information that the certified client has a certified management system?\n\nISO 22003-1\n8.3\nDoes the certification body not authorize the use of the FSMS certification mark on the product nor the product packaging?\nIn the context of this document, product packaging referred t in ISO/IEC 17021-1:2015, 8.3, shall cover all product packaging, both primary packaging (which contains the product) and any outer or secondary packaging.\n\n8.4\nDoes the certification body not permit the use of any statement on product packaging that the client has a certified FSMS. This includes all product packaging, both primary packaging (which contains the product) and any outer or secondary packaging."]
[]
[]
["8.3.4 \nDoes the certification body through legally enforceable arrangements require that the certified client:\na) conforms to the requirements of the certification body when making reference to its certification status in communication media such as the internet, brochures or advertising, or other documents;\nb) does not make or permit any misleading statement regarding its certification;\nc) does not use or permit the use of a certification document or any part thereof in a misleading manner;\nd) upon withdrawal of its certification, discontinues its use of all advertising matter that contains a reference to certification, as directed by the certification body (see 9.6.5);\ne) amends all advertising matter when the scope of certification has been reduced,\nf) does not allow reference to its management system certification to be used in such a way as to imply that the certification body certifies a product (including service) or process;\ng) does not imply that the certification applies to activities and sites that are outside the scope of certification; and\nh) does not use its certification in such a manner that would bring the certification body and/or certification system into disrepute and lose public trust?\n"]
[]
[]
["8.3.5\n Does the certification body exercise proper control of ownership and take action to deal with incorrect references to certification status or misleading use of certification documents, marks or audit reports?\n*Such action could include requests for correction and corrective action, suspension, withdrawal of certification, publication of the transgression and, if necessary, legal action."]
[]
[]
["8.4 Confidentiality\n"]
["8.4.1\n Does the certification body, through legally enforceable agreements, have the responsibility for the management of all information obtained or created during the performance\nof certification activities at all levels of its structure, including committees and external bodies or individuals acting on its behalf?"]
[]
[]
["8.4.2\nDoes the certification body inform the client, in advance, of the information it intends to place in the public domain?\nIs all other information, except for information that is made publicly accessible by the client, considered confidential?"]
[]
[]
["8.4.3\n Except as required in ISO/IEC 17021, is information about a particular certified client or individual not disclosed to a third party without the written consent of the certified client or individual concerned?"]
[]
[]
["8.4.4\nWhen the certification body is required by law or authorized by contractual arrangements (such as with the accreditation body) to release confidential information, are the client or individual concerned, unless prohibited by law, notified of the information provided?"]
[]
[]
["8.4.5\n Is information about the client from sources other than the client (e.g. complainant, regulators) treated as confidential, consistent with the certification body’s policy?"]
[]
[]
["8.4.6\nDo personnel, including any committee members, contractors, personnel of external bodies or individuals acting on the certification body's behalf, keep all information obtained or  created during the performance of the certification body's activities, except as required by law, confidential?"]
[]
[]
["8.4.7\n Does the certification body have processes and where applicable equipment and facilities that ensure the secure handling of confidential information?"]
[]
[]
["8.5 Information exchange between a certification body and its clients"]
["8.5.1 Information on the certification activity and requirements\nDoes the certification body provide and update clients on the following:\na) detailed description of the initial and continuing certification activity, including the application, initial audits, surveillance audits, and the process for granting, refusing, maintaining of certification, expanding or reducing the scope of certification, renewing, suspending, or restoring, or withdrawing of certification;\nb) the normative requirements for certification;\nc) information about the fees for application, initial certification and continuing certification;\nd) the certification body's requirements for clients to:\n1. comply with certification requirements,\n2. make all necessary arrangements for the conduct of the audits, including provision for examining documentation and the access to all processes and areas, records and personnel for the purposes of initial certification, surveillance, recertification and \nresolution of complaints, and\n3. make provisions, where applicable, to accommodate the presence of observers (e.g. accreditation assessors or trainee auditors);\ne) documents describing the rights and duties of certified clients, including requirements, when making reference to its certification in communication of any kind in line with the requirements in 8.3; and\nf) information on procedures for handling complaints and appeals?"]
[]
[]
["8.5.2 Notice of changes by a certification body \nDoes the certification body give its certified clients due notice of any changes to its requirements for certification?\nDoes the certification body verify that each certified client complies with the new requirements?"]
[]
[]
["8.5.3 Notice of changes by a certified client \nDoes the certification body have legally enforceable arrangements to ensure that the certified client informs the certification body, without delay, of matters that may affect the capability of the management system to continue to fulfil the requirements of the standard used for certification?\nDo these include, for example, changes relating to:\na) the legal, commercial, organizational status or ownership;\nb) organization and management (e.g. key managerial, decision-making or technical staff);\nc) contact address and sites;\nd) scope of operations under the certified management system; and\ne) major changes to the management system and processes? \nDoes the certification body take action as appropriate?\n"]
[]
[]
["9 Process requirements"]
["9.1 Pre-certification activities\n"]
["9.1.1 Application\nDoes your certification body require an authorized representative of the applicant organisation to provide the necessary information to enable it to establish the following:\na) the desired scope of the certification;\nb) relevant details of the applicant organisation as required by the specific certification scheme, including its name and the address(es) of its site(s), its processes and operations, human and technical resources, functions, relationships and any relevant legal obligation;\nc) identification of outsourced processes used by the organisation that will affect conformity to requirements;\nd) the standards or other requirements for which the applicant organisation is seeking certification; and\ne) whether consultancy relating to the management system to be certified has been provided and, if so, by whom?\n\nISO 22003-1\n9.1.1\nDoes the certification body require the applicant organization to provide the information concerning products and processes relevant to determination of the audit duration, as per Annexex A and B?"]
[]
[]
["9.1.2 Application Review"]
["9.1.2.1\n Does your certification body conduct a review of the application and supplementary information for certification to ensure that:\na) the information about the applicant organisation and its management system is sufficient to develop an audit programme (see Clause 9.1.3)\nb) any known difference in understanding between the certification body and the application organisation is resolved;\nc) the certification body has the competence and ability to perform the certification activity; and\nd) the scope of certification sought, the site(s) of the applicant organisation’s operations, time required to complete audits and any other points influencing the certification activity are taken into account (language, safety conditions, threats to impartiality, etc.)?"]
[]
[]
["9.1.2.2\nFollowing the review of the application, the certification body shall either accept or decline an application for certification. When the certification body declines an application for certification as a result of the review of application, are the reasons for declining an application documented and made clear to the client?\n\nISO 22003-1\n9.1.2.2\nDoes the certification body use Annex A to define the relevant scope for the organization applying for certification?\nScope statement shall:\n-identify the category(s) or subcategory(s) in scope of certification for each site or sites;\n-briefly describe the main types of activities/ processes for the products and/ or services that audited by the certifying body.\n\nISO 22003-1\n9.1.2.3\nDoes the defined scope of certification not?:\n-be misleading;\n-exclude activities, processes, products or services from the scope of certification when those activities, processes, products or services can have an influence o the food safety of the end products as defined by the legal responsibility of the organisations' activities;\n-include any promotional statements, brands or claims."]
[]
[]
["9.1.2.3\n Based on this review, does the certification body determine the competences it needs to include in its audit team and for the certification decision?"]
[]
[]
["9.1.3 Audit programme"]
["9.1.3.1\n Is an audit programme for the full certification cycle developed to clearly identify the audit activity/activities required to demonstrate that the client’s management system fulfils the requirements for certification to the selected standard(s) or other normative document(s)? \nDoes the audit programme for the certification cycle cover the complete management system requirements?"]
[]
[]
["9.1.3.2\n Does the audit programme for the initial certification include a two-stage initial audit, surveillance audits in the first and second years following the certification decision, and a recertification audit in the third year prior to expiration of certification?\nDoes the first three-year certification cycle begin with the certification decision?\nDo subsequent cycles begin with the recertification decision (See Clause 9.6.3.2.3)?\nDoes the determination of the audit programme and any subsequent adjustments consider the size of the client, the scope and complexity of its management system, products and processes as well as demonstrated level of management system effectiveness and the results of any previous audits?\n• Annex E of ISO/IEC 17021-1 is a flowchart of a typical audit and certification process.\n• The following list contains additional items that can be considered when developing or revising an audit programme, they might also need to be addressed when determining the audit scope and developing the audit plan:\n- Complaints received by the certification body about the client;\n- Combined integrated or joint audit;\n- Changes to certification requirements;\n- Changes to legal requirements;\n- Changes to accreditation requirements;\n- Organisational performance data (e.g. defect levels, key performance indicators data)\n• If specified by the industry specific certification scheme, the certification cycle can be different from three years.\n\nISO 22003-1\n9.1.3.2\nDoes the certification body have a process for choosing the audit timing and season, so that the audit team has the opportunity of auditing the organization operating on a representative number of product lines and/ or services covered by the scope of certification?"]
[]
[]
["9.1.3.3\nAre surveillance audits conducted at least once a calendar year, except in recertification years?\nIs the date of the first surveillance audit following initial certification not more than 12 months from the certification decision date?\n• It can be necessary to adjust the frequency of surveillance audits to accommodate factors such as seasons or management systems certification of a limited duration (e.g. temporary construction site)"]
[]
[]
["9.1.3.4\nWhere the certification body is taking account of certification already granted to the client and to audits performed by another certification body, does the certification body obtain and retain sufficient evidence, such as reports and documentation on corrective actions, to any nonconformity?\nDoes the documentation support the fulfilling of the requirements in this part of ISO/IEC 17021? \nDoes the certification body, based on the information obtained, justify and record any adjustments to the existing audit programme and follow up the implementation of corrective actions concerning previous nonconformities?\n"]
[]
[]
["9.1.3.5\n Where the client operates shifts, are the activities that take place during shift working considered when developing the audit programme and audit plans?"]
[]
[]
["9.1.4 Determining audit time"]
["9.1.4.1\nDoes the certification body have documented procedures for determining audit time?\nDoes the certification body determine the time needed to plan and accomplish a complete and effective audit of the client’s FSMS?"]
[]
[]
["9.1.4.2\n In determining the audit time, does the certification body consider, among other things, the following aspects:\na) the requirement of the relevant management system standards;\nb) complexity of the client and its management system;\nc) technological and regulatory context;\nd) Any outsourcing of any activities included in the scope of the applied management system;\ne) results of any prior audits;\nf) size and number of sites, their geographical locations and multi-site considerations;\ng) the risks associated with the products, processes or activities of the organisation;\nh) when audits are combined, joint or integrated?\n• Time spent travelling to and from audited sites is not included in the calculation of the duration of the management system audit days.\n• The certification body can use the guidance established in ISO/IEC TS 17023 for determining the duration of management system audit when documenting these procedures. \n"]
[]
[]
["ISO 22003-1\n9.1.4.2\nDoes the certification body have documented procedures for determining audit time, and for each client, does the certification body determine the time needed to plan and accomplish a complete and effective audit of the client's FSMS. \nDoes the certification body use the methodology describe in Annex B. \nDoes the audit time determined by the certification body, and  the justification for the determination, be recorded including justification for any reductions or additions?"]
[]
[]
["\nISO 22003-1\n9.1.4.3\nIn determining and documenting audit time needed, does the certification body determine:\na) the time for audit preparation\nb) the minimum duration for auditing for each site for on-site or remote auditing, as specified in Clauses B.1, B.2, and Table B.1;\nc) the time for reporting and, if applicable, conducting post-audit activities;\nd) where additional meetings are necessary (e.g. review meetings, coordination, audit team briefing), an increase in audit time can be required;\ne) where applicable and agreed, the time needed to ensure effective remote auditing or use of information and communication technology (ICT)."]
[]
[]
["9.1.4.3\n Are the duration of the management system audit and its justification recorded?"]
[]
[]
["9.1.4.4\nDoes the time spent by any team member that is not assigned as an auditor (i.e. technical experts, translators, interpreters, observers and auditors-in-training) not count in the above established duration of the management system audit?\n• The use of translators can necessitate additional audit time."]
[]
[]
["9.1.5 Multi-site sampling\nWhere multi-site sampling is used for the audit of a client’s management system covering the same activity in various geographical locations, does the certification body develop a sampling programme to ensure proper audit of the management system?\nIs rationale for the sampling plan documented for each client? Sampling is not allowed for some specific certification schemes, and where specific criteria have been established for a specific certification scheme, e.g. ISO 22003, these shall be applied.\n• Where there are multiple sites not covering the same activity sampling is not appropriate.\n\nISO 22003-1\n9.1.5.1\nNote: The whole subclause 9.1.5 is intended to apply only to operations where activities present in the scope statement are performed."]
[]
[]
["ISO 22003-1\n9.1.5.2\nDoes the certification body certify a multi-site organization with an identified central function at which certain FSMS activities are planned, controlled, or managed, and a network of sites at which such activities are fully or partially carried out. \nExamples of possible multi-site organizations are:\n- organizations operating with franchises;\n- procedure groups (for categories A and B);\n- a manufacturing company with one or more production sites and a network of sales offices;\n- service organizations with multiple sites offering similar service;\n-organizations with multiple branches \nDoes sampling of multi-site organizations cover all activities? (see the criteria given in the 9.1.5.3)."]
[]
[]
["ISO 22003-1\n9.1.5.3\nDoes the certification body demonstrate that the sampling of sites does not undermine effective auditing. When multi-site sampling is undertaken, does the certification body justify and document the rationale based on the following conditions:\na) sites are operating under one centrally controlled and administered FSMS;\nb) sites subject to sampling are similar (food chain subcategory, geographical, customer requirements, food safety hazards and control measures);\nc)  the central function is part of the organization, clearly identified and not subcontracted to an external organization;\nd) all sites have a legal or contractual link with the central function;\ne) the central function has organizational authority to define, establish and maintain the FSMS;\nf) all sites are subject to the organization's internal audit programme and have been audited;\ng) audit findings at a site are considered indicative of the entire FSMS and corrective actions are implemented accordingly;\nh) the central function is responsible for ensuring that outcomes of performance evaluation and customer complaints from all sites are collected and analysed;\ni) the organization's FSMS is subject to central management review;\nj) the central function has authority to initiate continual improvement of the FSMS.\nNote: The central function is where operational control and authority from the top management of theorganization is exerted over every site. There is no requirement for the central function to be located in a single site."]
[]
[]
["ISO 22003-1\n9.1.5.5\nWhere multi-site sampling is permitted, does the certification body ensure (e.g. via contractual arrangements) that the organization has conducted an internal audit for each site within one year prior to certification and when applicable the effectiveness of corrective actions shall be available. Following cettification, does the annual internal audit cover all sites of the organization included in the certification scope of the multi-site organization and ongoing effectiveness of corrective actions be demonstrated."]
[]
[]
["ISO 22003-1\n9.1.5.6\nWhere multi-site sampling is permitted, does the certification body define and utilize a sampling programme to ensure an effective audit of the FSMS where the following conditions apply?\na) At least annually, an audit of the central function for the FSMS shall be performed by the certification body prior to the sampled site audits.\nb) At least annually, audits shall be performed by the certification body on the required number of sampled sites\nc) Audit findings of the sampled sites shall be assessed to ascertain if these indicate an overall FSMS deficiency and therefore can be applicable to some or all other sites.\nd) Where audit findings of the sampled sites are considered indicative of the entire FSMS, corrective actions shall be implemented accordingly.\ne) For organizations with 20 sites or fewer, all sites shall be audited.\n\nDoes the certification body increase the size of sample or terminate the site sampling where the FSMS subject to certification does not indicate the ability to achieve the intended results?"]
[]
[]
["ISO 22003-1\n9.1.5.7\nDoes the sample partly selective and partly random and result in a representative range of different sites being selected, ensuring all processes covered by the scope of certification will be audited?\nAt least 25% of the sample was selected at random?\nDoes the remainder was selected so that the differences among the sites selected over the period of validity of the certification are as large as possible?\nDoes site selection consider, among others, the following aspects:\na) results of internal audits, management reviews or previous audits:\nb) records of complaints, product withdrawals/ recalls, and other relevant aspects of corrective action;\nc) variations in the site characteristics;\nd) other relevant changes since the last audit. "]
[]
[]
["ISO 22003-1\n9.1.5.8\nIf any site has a major nonconformity and satisfactory corrective action have not been implemented in the agreed time frame, does the certification not be granted or maintained for the whole multi-site organization pending satisfactory corrective action?"]
[]
[]
["ISO 22003-1\n9.1.5.9\nDoes the certification body identify and include in the scope of certification the processes of the FSMS implemented at each sample site?\n"]
[]
[]
["9.1.6 Multiple management systems standards\nWhen certification to multiple management system standards is being provided by the certification body, does the planning for the audit ensure adequate on-site auditing to provide confidence in the certification?\n"]
[]
[]
["9.2 Planning Audits\n"]
["9.2.1 Determining Audit objectives scope and criteria"]
["9.2.1.1\nDoes the certification body determine the audit objectives?\nDoes the certification body establish the audit scope and criteria, including any changes, after discussion with the client?"]
[]
[]
["9.2.1.2\n Do the audit objectives describe what is to be accomplished by the audit and include the following:\na) determination of the conformity of the client's management system, or parts of it, with audit criteria;\nb) evaluation of the ability of the management system to ensure the client organization meets applicable statutory, regulatory and contractual requirements;\n• A management system certification audit is not a legal compliance audit.\nc) determination of the effectiveness of the management system to ensure the client organization can reasonably expect to achieving its specified objectives; and\nd) as applicable, identification of areas for potential improvement of the management system?"]
[]
[]
["9.2.1.3 \nDoes the audit scope describe the extent and boundaries of the audit, such as physical locations, organizational units, activities and processes to be audited?\nWhere the initial or re-certification process consists of more than one audit (e.g. covering different locations), does the scope of an individual audit not cover the full certification scope, but the totality of audits is consistent with the scope in the certification document?\n"]
[]
[]
["9.2.1.4\nIs the audit criteria used as a reference against which conformity is determined, and does it include:\n- the requirements of a defined normative document on management systems;\n- the defined processes and documentation of the management system developed by the client?"]
[]
[]
["9.2.2 Audit Team selection and assignments"]
["9.2.2.1.1 General\nDoes the certification body have a process for selecting and appointing the audit team, including the audit team leader and technical experts as necessary, taking into account the competence needed to achieve the objectives of the audit and requirements for impartiality? \nIf there is only one auditor, Does the auditor have the competence to perform the duties of an audit team leader applicable for that audit?\nDoes the audit team have the totality of the competencies identified by the certification body as set out in Clause 9.1.2.3 for the audit?"]
[]
[]
["9.2.2.1.2\n In deciding the size and composition of the audit team, is consideration given to the following:\na) audit objectives, scope, criteria and estimated audit time;\nb) whether the audit is combined, joint or integrated;\nc) the overall competence of the audit team needed to achieve the objective of the audit (See Table A.1 of ISO/IEC 17021-1)\nd) certification requirements (including any applicable statutory, regulatory or contractual requirements);\ne) language and culture?\n• The team leader of a combined or integrated audit is expected to have in-depth knowledge of at least one of the standards and an awareness of the other standards used for that particular audit."]
[]
[]
["9.2.2.1.3\n Is the knowledge and skills of the audit team leader and auditors supplemented by technical experts, translators and interpreters, and operate under the direction of an auditor? \nAre translators or interpreters selected such that they do not unduly influence the audit?\n• The criteria for the selection of technical experts are determined on a case-by-case basis by the needs of the audit team and the scope of the audit."]
[]
[]
["9.2.2.1.4\n Are auditors-in-training included in the audit team as participants, provided an auditor is appointed as an evaluator?\nIs the evaluator competent to take over the duties and have final responsibility for the activities and findings of the auditor-in-training?"]
[]
[]
["9.2.2.1.5\nDoes the audit team leader, in consultation with the audit team, assign to each team member responsibility for auditing specific processes, functions, sites, areas or activities?\nDo these assignments take into account the need for competence, and the effective and efficient use of the audit team, as well as different roles and responsibilities of auditors, auditors-in-training and technical experts?\nAre changes to the work assignments made as the audit progresses to ensure achievement of the audit objectives?"]
[]
[]
["9.2.2.2 Observers, technical experts and guides"]
["9.2.2.2.1 Observers\nIs the presence and justification of observers during an audit activity agreed to by the certification body and client prior to the conduct of the audit?\nDoes the audit team ensure that observers do not unduly influence or interfere in the audit process or outcome of the audit?\n• Observers can be members of the client’s organisation, consultants, witnessing accreditation body personnel, regulators or other justified persons."]
[]
[]
["9.2.2.2.2 Technical experts\nIs the role of technical experts during an audit activity agreed to by the certification body and client prior to the conduct of the audit?\nDoes a technical expert not act as an auditor in the audit team? \nIs the technical expert accompanied by an auditor?\n*The technical experts can provide advice to the audit team for the preparation, planning or audit."]
[]
[]
["9.2.2.2.3 Guides\nIs each auditor accompanied by a guide, unless otherwise agreed to by the audit team leader and the client?\nAre guide(s) assigned to the audit team to facilitate the audit?\nDoes the audit team ensure that guides do not influence or interfere in the audit process or outcome of the audit?\n*The responsibilities of a guide can include:\na) establishing contacts and timing for interviews;\nb) arranging visits to specific parts of the site or organization;\nc) ensuring that rules concerning site safety and security procedures are known and respected by the audit team members;\nd) witnessing the audit on behalf of the client;\ne) providing clarification or information as requested by an auditor.\n**Where appropriate, the auditee can also act as the guide."]
[]
[]
["9.2.3 Audit plan"]
["9.2.3.1 General\nDoes the certification body ensure that an audit plan is established prior to each audit identified in the audit programme to provide the basis for agreement regarding the conduct and scheduling of the audit activities?\n*It is not expected that a certification body will develop an audit plan for each at the time that the audit programme is developed"]
[]
[]
["9.2.3.2 Preparing the audit plan\nIs the audit plan appropriate to the objectives and the scope of the audit? \nDoes the audit plan include or refer to the following at least:\na) the audit objectives;\nb) the audit criteria;\nc) the audit scope, including identification of the organizational and functional units or processes to be audited;\nd) the dates and sites where the on-site audit activities are to be conducted, including visits to temporary sites, as appropriate;\ne) the expected time and duration of on-site audit activities;\nf) the roles and responsibilities of the audit team members and accompanying persons?\n*The audit plan information can be contained in more than one document."]
[]
[]
["9.2.3.3 Communication of audit team tasks\nAre the tasks given to the audit team defined?\nDoes the certification body require the audit team to:\na) Examine and verify the structure, policies, processes, procedures, records and related documents of the client relevant to the management system standard;\nb) Determine that these meet all the requirements relevant to the intended scope of certification;\nc) Determine that the processes and procedures are established, implemented and maintained effectively, to provide a basis for confidence in the client’s QMS/EMS management system; and\nd) Communicate to the client, for its action, any inconsistencies between the client’s policy, objectives and targets?"]
[]
[]
["9.2.3.4 Communication of audit plan\nIs the audit plan communicated and the dates of the audit agreed upon, in advance, with the client organization?"]
[]
[]
["9.2.3.5 Communication concerning audit team members\nDoes the certification body provide the name of and, when requested, make available background information on each member of the audit team, with sufficient time for the client organisation to object to the appointment of any particular auditor or technical expert and for the certification body to reconstitute the team in response to any valid objection?"]
[]
[]
["9.3 Initial certification\n"]
["9.3.1 Initial certification audit"]
["9.3.1.1 General\nIs the initial certification audit of a management system conducted in two stages: stage 1 and stage 2?"]
[]
[]
["9.3.1.2 Stage 1"]
["9.3.1.2.1\nDoes planning ensure that the objectives of stage 1 can be met and the client be informed of any “on site” activities during stage 1?\n• Stage 1 does not require a formal audit plan (see clause 9.2.3)"]
[]
[]
["9.3.1.2.2\nAre the objectives of stage 1 to:\na) Review the client’s management system documented information;\nb) Evaluate the client’s site-specific conditions and to undertake discussions with the client’s personnel to determine the preparedness for stage 2;\nc) Review the client’s status and understanding regarding requirements of the standard, in particular with respect to the identification of key performance or significant aspects, processes, objectives and operation of the management system;\nd) Obtain necessary information regarding the scope of the management system, including:\n- the client’s site(s);\n- processes and equipment used;\n- levels of controls established (particularly in case of multisite clients);\n- applicable statutory and regulatory requirements;\ne) Review the allocation of resources for stage 2 and agree the details of stage 2 with the client;\nf) Provide a focus for planning stage 2 by gaining a sufficient understanding of the client’s management system and site operations in the context of the management system standard or other normative document; and\ng) Evaluate if the internal audits and management reviews are being planned and performed, and that the level of implementation of the management system substantiates that the client is ready for stage 2?\n• If at least part of stage 1 is carried out at the client’s premises, this can help to achieve the objectives stated above."]
[]
[]
["ISO 22003-1\n9.3.2\nAre the objectives of the stage 1 review to the extent to which:\na) the organization has identified PRPs that are appropriate to the business (e.g. regulatory, statutory, customer and certification scheme requirements);\nb) the FSMS includes adequate processes and methods for the identification and assessment of the organization's food safety hazards, and subsequent selection and categorization of control measures (combinations);\nc) the FSMS includes adequate processes and methods for the identification and implementation of relevant food safety legislation;\nd) the FSMS is designed to achieve the organization's food safety policy;\ne) the FSMS implementation programme justifies proceeding to stage 2;\nf) the validation of control measures, verification of activities and improvement programmes conform to the requirements of the FSMS standard;\ng) the FSMS documents and arrangements are in place to communicate internally and with relevant supplier, customers and interested parties;\nh) there is any additional documentation which needs to be reviewed and/ or information whcich needs to be obtained in advance."]
[]
[]
["ISO 22003-1\n9.3.3\nWhere an organization has implemented externally developed elements of a FSMS, does the certification body stage 1 revie the documentation included in the FSMS to determine if the combination of control measures:\n- is suitable for the organization;\n- was developed in conformity to the requirements of ISO 22000 or other sets of specified FSMS requirements;\n-is kept up to date."]
[]
[]
["ISO 22003-1\n9.3.4\nDoes the availability of relevant authorizations be checked when collecting the information regarding the compliance to regulatory aspecrts?"]
[]
[]
["ISO 22003-1\n9.3.5\nFor FSMS, does the stage 1 be carried out at the client's premises in order to achieve the objectives stated above. \nIn exception circumstances or events, all or part of stage 1 can take place off-site or remotely through the use of ICT and shall be fully justified. \nDoes the evidence demonstrating that stage 1 objectives are fully achieved were provided?\nNote 1: Exceptional circumstances or events can include a very remote location, a natural disaster, a pandemic, a short seasonal production and other special situations.\nNote 2: Any part of the FSMS that is audited during the stage 1 audit, and determined to be fully implemented, effective and in conformity with requirements, does not necessarily need to be re-audited during stage 2. In this case, the audit report includes these findings and clearly states that conformity has been established during the stage 1 of the audit."]
[]
[]
["9.3.1.2.3\n Are documented conclusions with regard to fulfilment of the stage 1 objectives and the readiness for stage 2 communicated to the client, including identification of any areas of concern that could be classified as nonconformity during stage 2?\n• The stage 1 output does not need to meet the full requirements of a report (see clause 9.4.8)"]
[]
[]
["9.3.1.2.4\nIn determining the interval between stage 1 and stage 2, does consideration given to the needs of the client to resolve areas of concern identified during stage 1? The certification body may also need to revise its arrangements for stage 2.\n\nIf any significant changes which would impact the management system occur, does the certification body consider the need to repeat all or part of stage 1?\n\nIs the client informed that the results of stage 1 may lead to postponement or cancellation of stage 2?"]
[]
[]
["ISO 22003-1\n9.3.6\nDoes the interval between stage 1 and stage 2 not be longer than six months?\nStage 1 shall be repeated if a longer interval is needed. "]
[]
[]
["9.3.1.3 Stage 2\nThe purpose of stage 2 is to evaluate the implementation, including effectiveness, of the client’s management system. Does the stage 2 stake place at the site(s) of the client?\nDoes it include the auditing of at least the following:\na) Information and evidence about conformity to all requirements of the applicable management system standard or other normative documents;\nb) Performance monitoring, measuring, reporting and reviewing against key performance objectives and targets (consistent with the expectations in the applicable management system standard or other normative document);\nc) The client’s management system ability and its performance regarding meeting of applicable statutory, regulatory and contractual requirements;\nd) Operational control of the client’s processes;\ne) Internal auditing and management review; and\nf) Management responsibility for the client’s policies?"]
[]
[]
["9.3.1.4 Initial certification audit conclusions\nDoes the audit team analyze all information and audit evidence gathered during stage 1 and stage 2 to review the audit findings and agree on audit conclusions?"]
[]
[]
["9.4 Conducting audits\n"]
["9.4.1 General\nDoes the certification body have a process for conducting on-site audits?\nDoes this process include an opening meeting at the start of the audit and a closing meeting at the conclusion of the audit?\nWhere any part of the audit is made by electronic means or where the site to be audited is virtual, does the certification body ensure that such activities are conducted by personnel with appropriate competence?\nIs the evidence obtained during such an audit sufficient to enable the auditor to take an informed decision on the conformity of the requirement in question?\n• “On-site” audits can include remote access to electronic site(s) that contain(s) information that is relevant to the audit of the management system. Consideration can also be given to the use of electronic means for conducting audits."]
[]
[]
["9.4.2 Conducting the opening meeting\nIs a formal opening meeting held with the client’s management and, where appropriate, those responsible for the functions or processes to be audited?\nIs the purpose of the opening meeting, which is usually conducted by the audit team leader, to provide a short explanation of how the audit activities will be undertaken?\nIs the degree of details consistent with the familiarity of the client with the audit process? \nDoes the opening meeting include the following:\na) Introduction of the participants, including an outline of their roles;\nb) Confirmation of the scope of certification;\nc) Confirmation of the audit plan (including type and scope of audit, objectives and criteria), any changes, and other relevant arrangements with the client, such as the date and time for the closing meeting, interim meeting between the audit team and the client’s management;\nd) Confirmation of formal communication channels between the audit team and the client;\ne) Confirmation that the resources and facilities needed by the audit team available;\nf) Confirmation of matters relating to confidentiality;\ng) Confirmation of relevant work safety, emergency and security procedures for the audit team;\nh) Confirmation of the availability, roles and identities of any guides and observers;\ni) The method of reporting, including any grading of audit findings;\nj) Information about the conditions under which the audit may be prematurely terminated;\nk) Confirmation that the audit team leader and audit team representing the certification body is responsible for the audit and be in control of executing the audit plan including audit activities and audit trails;\nl) Confirmation of the status of findings of the previous review or audit, if applicable;\nm) Methods and procedures to be used to conduct the audit based on sampling;\nn) Confirmation of the language to be used during the audit;\no) Confirmation that, during the audit, the client will be kept informed of audit progress and any concerns; and\np) Opportunity for the client to ask questions?"]
[]
[]
["9.4.3.1\nDuring the audit, Does the audit team periodically assess audit progress and exchange information?\nDoes the audit team leader re assign work as needed between the audit team members and periodically communicate the progress of the audit and any concerns to the client?"]
[]
[]
["9.4.3.2\nWhere the available audit evidence indicates that the audit objectives are unattainable or suggests the presence of an immediate and significant risk (e.g. safety), Does the audit team \nleader report this to the client, if possible, to the certification body to determine appropriate action?\nDoes such action include reconfirmation or modification of the audit plan, changes to the audit objectives or audit scope, or termination of the audit?\nDoes the audit team leader report the outcome of the action taken to the certification body?"]
[]
[]
["9.4.3.3\n Does the audit team leader review with the client any need for changes to the audit scope which becomes apparent as on-site auditing activities progress and report this to the certification body?"]
[]
[]
["9.4.4 Obtaining and verifying information"]
["9.4.4.1\n During the audit, Does the auditor of the certification body collect information relevant to the audit objectives, scope and criteria (including information relating to interfaces between functions, activities and processes) by appropriate sampling and verified to become audit evidence?"]
[]
[]
["9.4.4.2\n Does the auditor of the certification body use methods to collect information include, but \\not limited to:\na) Interviews;\nb) Observation of processes and activities;\nc) Review of documentation and records?"]
[]
[]
["9.4.5 Identifying and recording audit findings"]
["9.4.5.1\n Are the audit findings summarizing conformity and detailing non-conformity identified, classified and recorded to enable an informed certification decision to be made or the certification to be maintained?"]
[]
[]
["9.4.5.2\nAre Opportunities for improvement identified and recorded, unless prohibited by the requirements of a management system certification scheme?\nDoes the auditor of the certification body not record nonconformities as opportunities improvement?"]
[]
[]
["9.4.5.3 \nAre nonconformities recorded against a specific requirement of the audit criteria, and do they contain a clear statement of the nonconformity and identify in detail the objective evidence on which the nonconformity is based?\nAre nonconformities discussed with the client to ensure that the evidence is accurate and that the nonconformities are understood?\nDoes the auditor refrain from suggesting the cause of nonconformities or their solution?"]
[]
[]
["9.4.5.4\n Does the audit team leader attempt to resolve any diverging opinions between the audit team and the client concerning audit evidence or findings?\nAre unresolved points recorded?"]
[]
[]
["9.4.6 Preparing audit conclusions\nUnder the responsibility of the audit team leader and prior to the closing meeting, does the audit team:\na) review the audit findings, and any other appropriate information collected during the audit, against the audit objective and audit criteria and classify nonconformities;\nb) agree upon the audit conclusions, taking into account the uncertainty inherent in the audit process; c. identify any necessary follow-up actions;\nc) confirm the appropriateness of the audit programme or identify any modification required (e.g. scope of certification, audit time or dates, surveillance frequency, audit team competence)?"]
[]
[]
["9.4.7 Conducting the closing meeting"]
["9.4.7.1\nDoes the audit team of the certification body hold a formal closing meeting with the client's management and, where appropriate, those responsible for the functions or processes audited?\nIs attendance of the closing meeting recorded?\nIs the purpose of the closing meeting, normally conducted by the audit team leader, to present the audit conclusions, including the recommendation regarding certification?\nAre all nonconformities presented in such a manner that they are understood, and the timeframe for responding agreed?\n• “Understood” does not necessarily mean that the nonconformities have been accepted by the clients"]
[]
[]
["9.4.7.2\n Does the closing meeting also include the following elements where the degree of detail consistent with the familiarity of the client with the audit process:\na) advising the client that the audit evidence collected was based on a sample of the information; thereby introducing an element of uncertainty;\nb) the method and timeframe of reporting, including any grading of audit findings;\nc) the certification body's process for handling nonconformities including any consequences relating to the status of the client's certification;\nd) the timeframe for the client to present a plan for correction and corrective action for any nonconformities identified during the audit;\ne) the certification body's post audit activities;\nf) information about the complaint handling and appeal processes."]
[]
[]
["9.4.7.3 \nDoes the audit team of the certification body give the client opportunity for questions? \nAre diverging opinions regarding the audit findings or conclusions between the audit team and the client discussed and resolved where possible?\nAre diverging opinions that are not resolved recorded and referred to the certification body?"]
[]
[]
["9.4.8 Audit report"]
["9.4.8.1\nDoes the certification body provide to the client a written report for each audit? \nDoes the audit team identify opportunities for improvement without recommending specific solutions?\nIs the ownership of the audit report maintained by the certification body?"]
[]
[]
["9.4.8.2\nDoes the audit team leader ensure that the audit report is prepared and is responsible for its content?\nDoes the audit report provide an accurate, concise and clear record of the audit to enable an informed certification decision to be made and include or refer to the following:\na) identification of the certification body;\nb) the name and address of the client and the client's representative;\nc) the type of audit (e.g. initial, surveillance or recertification audit or special audits);\nd) the audit criteria;\ne) the audit objectives;\nf) the audit scope, particularly identification of the organizational or functional units or processes audited and the time of the audit;\ng) any deviation from the audit plan and their reason;\nh) any significant issues impacting on the audit programme;\ni) identification of the audit team leader, audit team members and any accompanying persons;\nj) the dates and places where the audit activities (on site or offsite, permanent or temporary sites) were conducted;\nk) audit findings (see 9.4.5), reference to evidence and conclusions, consistent with the requirements of the type of audit;\nl) Significant changes, if any, that affect the management system of the client since last audit took place;\nm) any unresolved issues, if identified.\nn) where applicable, whether the audit is combined, joint or integrated;\no) a disclaimer statement indicating that auditing is based on a sampling process of the available information;\np) recommendation from the audit team\nq) the audited client is effectively controlling the use of the certification documents and marks, if applicable; and\nr) verification of effectiveness of taken corrective actions regarding previously identified nonconformities, if applicable?"]
[]
[]
["9.4.8.3\nDoes the report contain:\na) a statement on the conformity and the effectiveness of the management system together with a summary of the evidence relating to:\n- the capability of the management system to meet applicable requirements and expected outcomes;\n- the internal audit and management review process;\nb) a conclusion on the appropriateness of the certification scope; and\nc) confirmation that the audit objectives have been fulfilled?"]
[]
[]
["9.4.9 Cause analysis of nonconformities\nDoes the certification body require the client to analyse the cause and describe the specific correction and corrective actions taken, or planned to be taken, to eliminate detected nonconformities, within a defined time?"]
[]
[]
["9.4.10 Effectiveness of corrections and corrective actions\nDoes the certification body review the corrections, identified causes and corrective actions submitted by the client to determine if these are acceptable?\nDoes the certification body verify the effectiveness of any correction and corrective actions taken?\nIs the evidence obtained to support the resolution of nonconformities recorded? \nIs the client informed of the result of the review and verification?\nIs the client informed if an additional full audit, an additional limited audit, or documented evidence (to be confirmed during future surveillance audits) will be needed to verify effective correction and corrective actions?\n• Verification of effectiveness of correction and corrective action can be carried out based on a review of documentation provided by the client, or where necessary, through verification on-site."]
[]
[]
["9.5 Certification decision\n"]
["9.5.1 General"]
["9.5.1.1\nDoes the certification body ensure that the persons or committees that make the decisions for granting certification, expanding or reducing the scope of certification, suspending or restoring certification, withdrawing certification or renewing certification are different from those who carried out the audits?\nDoes the individual(s) appointed to conduct the certification decision have appropriate competence?"]
[]
[]
["9.5.1.2\n Is the person(s) [excluding members of committees (see clause 6.1.4)] assigned by the certification body to make a certification decision employed by, or under legally enforceable arrangement with either the certification body or an entity under the organizational control of the certification body?\nDoes the certification body’s organizational control has one of the following:\na) Whole or majority ownership of another entity by the certification body;\nb) Majority participation by the certification body on the board of directors of another entity; and\nc) A documented authority by the certification body over another entity in a network of legal entities (in which the certification body resides), linked by ownership or board of director control?\n• For governmental certification bodies, other parts of the same government can be considered to be “linked by ownership” to the certification body"]
[]
[]
["9.5.1.3\nDoes the persons employed by, or under contract with, entities under organizational control fulfill the same requirements of this part of ISO/IEC 17021 as persons employed by, or under contract with, the certification body?"]
[]
[]
["9.5.1.4\nDoes the certification body record each certification decision including any additional information or clarification sought from the audit team or other source?"]
[]
[]
["9.5.2 Actions prior to making a decision\nDoes the certification body have a process to conduct an effective review prior to making a decision for granting certification, expanding or reducing the scope of certification, renewing, suspending or restoring, or withdrawing of certification, including that:\na) the information provided by the audit team is sufficient with respect to the certification requirements and the scope for certification; \nb) it has reviewed, accepted and verified the effectiveness of correction and corrective actions, for any major nonconformities: and \nc) It has reviewed and accepted the client’s plan for correction and corrective action for any minor nonconformities?"]
[]
[]
["9.5.3 Information for granting initial certification"]
["9.5.3.1\nDoes the information provided by the audit team to the certification body for the certification decision include, as a minimum,\na) the audit report;\nb) comments on the nonconformities and, where applicable, the correction and corrective actions taken by the client;\nc) confirmation of the information provided to the certification body used in the application review (see 9.1.2);\nd) Confirmation that the audit objectives have been achieved; and\ne) a recommendation whether or not to grant certification, together with any conditions or observations?"]
[]
[]
["9.5.3.2\nIf the certification body is not able to verify the implementation of corrections and corrective actions of any major nonconformity within 6 months after the last day of stage 2, does the certification body conduct another stage2 prior to recommending certification?"]
[]
[]
["9.5.3.3\nWhen a transfer of certification is envisaged from one certification body to another, does the accepting certification body have a process for obtaining sufficient information in order to take a decision on certification? \n•Certification schemes can have specific rules regarding the transfer of certification"]
[]
[]
["9.5.4 Information for granting recertification\nDoes the certification body make decisions on renewing certification based on the results of the recertification audit, as well as the results of the review of the system over the period of certification and complaints received from users of certification?"]
[]
[]
["9.6 Maintaining certification\n"]
["9.6.1 General\nDoes the certification body maintain certification based on demonstration that the client continues to satisfy the requirements of the management system standard?\nDoes the certification body maintain a client's certification based on a positive conclusion by the audit team leader without further independent review, provided that:\na) for any major nonconformity or other situation that may lead to suspension or withdrawal of certification, the certification body has a system that requires the audit team leader to report to the certification body the need to initiate a review by appropriately competent personnel (see 7.2.8), different from those who carried out the audit, to determine whether certification can be maintained, and\nb) competent personnel of the certification body monitor its surveillance activities, including monitoring the reporting by its auditors, to confirm that the certification activity is operating effectively?"]
[]
[]
["9.6.2 Surveillance activities"]
["9.6.2.1 General"]
["9.6.2.1.1\nDoes the certification body develop its surveillance activities so that representative areas and functions covered by the scope of the management system are monitored on a regular basis, and take into account changes to its certified client and its management system?"]
[]
[]
["9.6.2.1.2\nDo surveillance activities include on-site audits assessing the certified client's management system's fulfilment of specified requirements with respect to the standard to which the certification is granted? \nDo other surveillance activities include:\na) enquiries from the certification body to the certified client on aspects of certification,\nb) reviewing any client's statements with respect to its operations (e.g. promotional material, website),\nc) requests to the client to provide documents and records (on paper or electronic media), and\nd) other means of monitoring the certified client's performance."]
[]
[]
["9.6.2.2 Surveillance audit\nAre surveillance audits on-site audits which are planned together with the other surveillance activities so that the certification body can maintain confidence that the certified management system continues to fulfil requirements between recertification audits? \nDoes the surveillance audit for the relevant management system include:\na) internal audits and management review;\nb) a review of actions taken on nonconformities identified during the previous audit;\nc) complaints handling;\nd) effectiveness of the management system with regard to achieving the certified client's objectives and the intended results of the respective management system(s);\ne) progress of planned activities aimed at continual improvement,\nf) continuing operational control;\ng) review of any changes; and\nh) use of marks and/or any other reference to certification?"]
[]
[]
["9.6.3 Recertification"]
["9.6.3.1 Recertification audit planning"]
["9.6.3.1.1\nIs the purpose of the recertification audit to confirm the continued conformity and effectiveness of the management system as a whole, and its continued relevance and applicability for the scope of certification?\nAre recertification audits planned and conducted to evaluate the continued fulfilment of all of the requirements of the relevant management system standard or other normative document?\nIs this planned and conducted in due time to enable for timely renewal before the certificate expiry date?"]
[]
[]
["9.6.3.1.2\nDoes the recertification audit include the review of previous surveillance audit reports?\nDoes the recertification audit consider the performance of the management system over the most recent certification cycle?"]
[]
[]
["9.6.3.1.3\nDo recertification audit activities have a stage 1 audit in situations where there have been significant changes to the management system, the client, or the context in which the management system is operating (e.g. changes to legislation)? \n• Such changes can occur at any time during the certification cycle and the certification body might need to perform a special audit (see clause 9.6.4), which might or might not be a two-stage audit."]
[]
[]
["9.6.3.2 Recertification audit"]
["9.6.3.2.1\nDoes the recertification audit include an on-site audit that addresses the following:\na) the effectiveness of the management system in its entirety in the light of internal and external changes and its continued relevance and applicability to the scope of certification;\nb) demonstrated commitment to maintain the effectiveness and improvement of the management system in order to enhance overall performance;\nc) The effectiveness of the management system with regard to achieving the certified client’s objectives and the intended results of the respective management system(s)?"]
[]
[]
["9.6.3.2.2\nDoes the certification body define time limits for correction and corrective action for any major nonconformity?\nAre these actions implemented and verified prior to the expiration of certification?"]
[]
[]
["9.6.3.2.3\nWhen recertification activities are successfully completed prior to the expiry date of the existing certification, Is the expiry date of the new certification based on the expiry date of the existing certification? \nIs the issue date on a new certificate on or after the recertification decision?"]
[]
[]
["9.6.3.2.4\nIf the certification body has not completed the recertification audit or the certification body is unable to verify the implementation of corrections and corrective actions for any major nonconformity (see Clause 9.5.2.1) prior to the expiry date of the certification, is recertification not recommended and the validity of the certification not extended? \nIs the client informed and the consequences explained?"]
[]
[]
["9.6.3.2.5\nFollowing expiration of certification, can the certification body restore certification within 6 months provided that the outstanding recertification activities are completed; otherwise is stage 2 at least conducted?\nIs the effective date on the certificate on or after the recertification decision and the expiry date based on prior certification cycle?"]
[]
[]
["9.6.4 Special audits"]
["9.6.4.1 Expanding scope\nDoes the certification body, in response to an application for expanding the scope of a certification already granted, undertake a review of the application and determine any audit activities necessary to decide whether or not the extension may be granted? \nAre special audits conducted in conjunction with a surveillance audit?"]
[]
[]
["9.6.4.2 Short-notice audits\nDoes the certification body conduct audits of certified clients at short notice or unannounced top investigate complaints, or in response to changes, or as follow up on suspended clients? \nIn the case of short-notice audits does the certification body:\na) describe and make known in advance to the certified clients (e.g. in documents as described in 8.5.1) the conditions under which these short notice visits are to be conducted, and\nb) exercise additional care in the assignment of the audit team because of the lack of opportunity for the client to object to audit team members?"]
[]
[]
["ISO 22003-1\n9.6.2\nWhere the certification body conducts unnannounced audit as part of surveillance activities, does the certification body describe and make known in advance to the certified clients the conditions under which such audits will be organized and conducted?"]
[]
[]
["9.6.5 Suspending, withdrawing or reducing the scope of certification"]
["9.6.5.1\nDoes the certification body have a policy and documented procedure(s) for suspension, withdrawal or reduction of the scope of certification, and subsequent actions by the certification body?"]
[]
[]
["9.6.5.2\nDoes the certification body suspend certification in cases when, for example, \n- the client's certified management system has persistently or seriously failed to meet certification requirements, including requirements for the effectiveness of the management system, \n- the certified client does not allow surveillance or recertification audits to be conducted at the required frequencies, or \n- the certified client has voluntarily requested a suspension?"]
[]
[]
["9.6.5.3\nIs the client’s management system certification temporarily invalid under suspension?"]
[]
[]
["9.6.5.4\nDoes the certification body restore the suspended certification if the issue that has resulted in the suspension has been resolved? \nDoes failure to resolve the issues that have resulted in the suspension in a time established by the certification body result in withdrawal or reduction of the scope of certification? \n• In most cases, the suspension would not exceed 6 months."]
[]
[]
["9.6.5.5\nDoes the certification body reduce the client's scope of certification to exclude the parts not meeting the requirements, when the client has persistently or seriously failed to meet the certification requirements for those parts of the scope of certification? \nIs any such reduction in line with the requirements of the management system standard used for certification?"]
[]
[]
["9.7 Appeals\n"]
["9.7.1\nDoes the certification body have a documented process to receive, evaluate and make decisions on appeals?"]
[]
[]
["9.7.2\nIs the certification body responsible for all decisions at all levels of the appeals-handling process? \nDoes your certification body ensure that the persons engaged in the appeals-handling process are different from those who carried out the audits and made the certification decisions?"]
[]
[]
["9.7.3\nDoes the certification body ensure submission, investigation and decision on appeals do not result in any discriminatory actions against the appellant?"]
[]
[]
["9.7.4\nDoes the appeals-handling process include at least the following elements and methods:\na) an outline of the process for receiving, validating and investigating the appeal, and for deciding what actions are to be taken in response to it, taking into account the results of previous similar appeals;\nb) tracking and recording appeals, including actions undertaken to resolve them;\nc) ensuring that any appropriate correction and corrective action are taken?"]
[]
[]
["9.7.5 \nIs the certification body receiving the appeal responsible for gathering and verifying all necessary information to validate the appeal?"]
[]
[]
["9.7.6\nDoes the certification body acknowledge receipt of the appeal?  \nDoes the certification body provide the appellant with progress reports and the result of the appeal?"]
[]
[]
["9.7.7\nIs the decision to be communicated to the appellant made by, or reviewed and approved by, individual(s) not previously involved in the subject of the appeal?"]
[]
[]
["9.7.8\nDoes the certification body give formal notice to the appellant of the end of the appeals-handling process?"]
[]
[]
["9.8 Complaints\n"]
["9.8.1\nIs the certification body responsible for all decisions at all levels of the complaints-handling process?"]
[]
[]
["9.8.2\nDoes submission, investigation and decision on complaints not result in any discriminatory actions against the complainant?"]
[]
[]
["9.8.3\nUpon receipt of a complaint, does the certification body confirm whether the complaint relates to certification activities that it is responsible for? \nIf so, does the certification body deal with it? \nIf the complaint relates to a certified client, does examination of the complaint consider the effectiveness of the certified management system?"]
[]
[]
["9.8.4\nIs any valid complaint about a certified client referred by the certification body to the certified client in question at an appropriate time?"]
[]
[]
["9.8.5\nDoes the certification body have a documented process to receive, evaluate and make decisions on complaints? \nIs this process subject to requirements for confidentiality, as it relates to the complainant and to the subject of the complaint?"]
[]
[]
["9.8.6\nDoes the complaints-handling process include at least the following elements and methods:\na) an outline of the process for receiving, validating, investigating the complaint, and for deciding what actions are to be taken in response to it;\nb) tracking and recording complaints, including actions undertaken in response to them;\nc) ensuring that any appropriate correction and corrective action are taken? \n• ISO 10002 provides guidance for complaints handling."]
[]
[]
["9.8.7\nIs the certification body receiving the complaint responsible for gathering and verifying all necessary information to validate the complaint?"]
[]
[]
["9.8.8\nWhenever possible, does the certification body acknowledge receipt of the complaint? \nDoes the certification body provide the complainant with progress reports and the outcome?"]
[]
[]
["9.8.9\nIs the decision to be communicated to the complainant made by, or reviewed and approved by, individual(s) not previously involved in the subject of the complaint?"]
[]
[]
["9.8.10\nWhenever possible, does the certification body give formal notice of the end of the complaints-handling process to the complainant?"]
[]
[]
["9.8.11\nDoes the certification body determine, together with the client and the complainant, whether and, if so to what extent, the subject of the complaint and its resolution made public?"]
[]
[]
["9.9 Clients records\n"]
["9.9.1\nDoes the certification body maintain records on the audit and other certification activities for all clients, including all organizations that submitted applications, and all organizations audited, certified, or with certification suspended or withdrawn?"]
[]
[]
["9.9.2\nDo records on certified clients include the following:\na) application information and initial, surveillance and recertification audit reports;\nb) certification agreement;\nc) justification of the methodology used for sampling of sites, as appropriate;\n• Methodology of sampling includes the sampling employed to audit the specific management system and/or to select sites in the context of multi-site audit.\nd) justification for auditor time determination (see Clause 9.1.4);\ne) verification of correction and corrective actions;\nf) records of complaints and appeals, and any subsequent correction or corrective actions;\ng) committee deliberations and decisions, if applicable;\nh) documentation of the certification decisions;\ni) certification documents, including the scope of certification with respect to product, process or service, as applicable;\nj) related records necessary to establish the credibility of the certification, such as evidence of the competence of auditors and technical experts; and\nk) audit programmes?"]
[]
[]
["9.9.3\nDoes the certification body keep the records on applicants and clients secure to ensure that the information is kept confidential? \nAre records transported, transmitted or transferred in a way that ensures that confidentiality is maintained?",null,"h"]
[]
[]
["9.9.4\nDoes the certification body have a documented policy and documented procedures on the retention of records?\n Are records retained for the duration of the current cycle plus one full certification cycle? \n• In some jurisdictions, the law stipulates that records need to be maintained for a longer time period."]
[]
[]
["10 Management system requirements for certification bodies"]
["10.1 Options\nDoes the certification body maintain a management system that is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021?\nIn addition to meeting the requirements of clauses 5 to 9, Which of the following management system Option has the certification body implemented\na) general management system requirements (see Clause 10.2), or\nb) management system requirements in accordance with ISO 9001 (see Clause 10.3)?"]
[]
[]
["10.2 Option A: General Management system requirements\n"]
["10.2.1 General\nDoes the certification body establish, document, implement and maintain a management system that is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021-1? \nDoes the certification body’s top management establish and document policies and objectives for its activities? \nDoes the top management provide evidence of its commitment to the development and implementation of the management system in accordance with the requirements of ISO/IEC 17021-1? \nDoes the top management ensure that the policies are understood, implemented and maintained at all levels of the certification body’s organisation? \nDoes certification body’s top management appoint a member of management who, irrespective of other responsibilities, have responsibility and authority that include\na) ensuring that processes and procedures needed for the management system are established, implemented and maintained, and\nb) reporting to top management on the performance of the management system and any need for improvement?"]
[]
[]
["10.2.2 Management system manual\nHave all applicable requirements of this International Standard been addressed either in a manual or in associated documents? \nDoes the certification body ensure that the manual and relevant associated documents are accessible to all relevant personnel?"]
[]
[]
["10.2.3 Control of documents\nDoes the certification body establish procedures to control the documents (internal and external) that relate to the fulfilment of ISO/IEC 17021-1?\nDo the procedures define the controls needed to:\na) Approve documents for adequacy prior to issue; \nb) Review and update as necessary and re-approve documents; \nc) Ensure that changes and the current revision status of documents are identified;\nd) Ensure that relevant versions of applicable documents are available at points of use;\ne) Ensure that documents remain legible and readily identifiable;\nf) Ensure that documents of external origin are identified and their distribution controlled; and\ng) Prevent the unintended use of obsolete documents, and to apply suitable identification to them if they are retained for any purpose? \n• Documentation can be in any form or type of medium."]
[]
[]
["10.2.4 Control of records\nDoes the certification body establish procedures to define the controls needed for the identification, storage, protection, retrieval, retention time and disposition of its records related to the fulfilment of ISO/IEC 17021-1?\nIs access to these records consistent with the confidentiality arrangements?\nDoes the certification body establish procedures for retaining records for a period consistent with its contractual and legal obligations? \n• For requirements for records on certified clients, see also Clause 9.9"]
[]
[]
["10.2.5 Management review"]
["10.2.5.1 General\nDoes the certification body’s top management establish procedures to review its management system at planned intervals to ensure its continuing suitability, adequacy and effectiveness, including the stated policies and objectives related to the fulfilment of ISO/IEC 17021-1? \nAre these reviews conducted at least once a year?"]
[]
[]
["10.2.5.2 Review inputs\nDoes the review input to the management review include information related to:\na) Results of internal and external audits;\nb) Feedback from clients and interested parties;\nc) Safeguarding impartiality;\nd) The status of corrective actions;\ne) The status of actions to address risks;\nf) Follow-up actions from previous management reviews;\ng) The fulfilment of objectives,\nh) Changes that could affect the management system, and\ni) Appeals and complaints?"]
[]
[]
["10.2.5.3 Review outputs\nDoes the outputs from the management review include decisions and actions related to\na) Improvement of effectiveness of the management system and its processes;\nb) Improvement of the certification services related to the fulfilment of ISO/IEC 17021-1;\nc) Resource needs; and\nd) Revision of the organisation’s policy and objectives?"]
[]
[]
["10.2.6 Internal audits"]
["10.2.6.1\nHas the certification body established procedures for internal audits to verify that it fulfils the requirements of ISO/IEC 17021-1, and that the management system is effectively implemented and maintained? \n• ISO 19011 provides guidelines for conducting internal audits"]
[]
[]
["10.2.6.2\nIs the audit programme planned, taking into consideration the importance of the processes and areas to be audited, as well as the results of previous audits?"]
[]
[]
["10.2.6.3\nAre internal audits performed at least once every 12 months? \nIs the frequency of internal audits reduced if the certification body can demonstrate that its management system continues to be effectively implemented according to ISO/IEC 17021-1 and has proven stability?"]
[]
[]
["10.2.6.4\nDoes the certification body ensure that\na) internal audits are conducted by qualified personnel knowledgeable in certification, auditing and the requirements of ISO/IEC 17021-1;\nb) auditors do not audit their own work;\nc) personnel responsible for the area audited are informed of the outcome of the audit;\nd) any actions resulting from internal audits are taken in a timely and appropriate manner; and\ne) any opportunities for improvement are identified?"]
[]
[]
["10.2.7 Corrective actions\nDoes the certification body establish procedures for identification and management of nonconformities in its operations?]\nDoes the certification body also, where necessary, take actions to eliminate the causes of nonconformities in order to prevent recurrence?\nAre corrective actions appropriate to the impact of the problems encountered? \nDo the procedures define requirements for\na) identifying nonconformities (e.g. from complaints and internal audits);\nb) determining the causes of nonconformity; \nc) correcting nonconformities;\nd) evaluating the need for actions to ensure that nonconformities do not recur;\ne) determining and implementing in a timely manner, the actions needed,\nf) recording the results of actions taken; and \ng) reviewing the effectiveness of corrective actions?"]
[]
[]
["10.3 Option B: Management system requirements in accordance with ISO 9001"]
["10.3.1 General\nDoes the certification body establish and maintain a management system, in accordance with the requirements of ISO 9001, which is capable of supporting and demonstrating the consistent achievement of the requirements of ISO/IEC 17021-1, amplified by Clause 10.3.2 to 10.3.4?"]
[]
[]
["10.3.2 Scope\nDoes the scope of the management system include the design and development requirements for its certification service for application of the requirements of ISO 9001?"]
[]
[]
["10.3.3 Customer focus\nFor application of the requirements of ISO 9001, when developing its management system, Does the certification body consider the credibility of certification and address the needs of all parties (as set out in Clause 4.1.2) that reply upon its audit and certification services, not just its clients?"]
[]
[]
["10.3.4\nFor application of the requirements of ISO 9001, Does the certification body include as input for management review, information on relevant appeals and complaints from users of certification activities and a review of impartiality?"]
[]
[]
[]
[]
[null,"Other Comments:"]
[]
[null,null,"PAB Initial Evaluation",null,"PAB 2nd Evaluation",null,"PAB 3rd Evaluation"]
[null,"Prepared by:"]
[null,null,"Program Manager/ Assessor",null,"Program Manager/ Assessor",null,"Program Manager/ Assessor"]
[null,"Date"]
[null,"Reviewed by:"]
[null,null,"Division Head",null,"Division Head",null,"Division Head"]
[null,"Date"]
[null,"Acknowledged by:"]
[null,null,"CAB AUTHORIZED REPRESENTATIVE - Designation",null,"CAB AUTHORIZED REPRESENTATIVE - Designation",null,"CAB AUTHORIZED REPRESENTATIVE - Designation"]
[null,"Date"]
[null,"IMPORTANT: In the event that the applicant body has not acted satisfactorily within 6 months from the date of the communication of the deficiencies noted during the initial evaluation of the document review, the processing of the application shall be terminated. Only when all the issues raised from the documentation review have been addressed, shall the office and witness assessment proceed. \nPAB may also ask for a copy of documents/ records in preparation for the stage 1 initial assessment."]
[]
["CLICK HERE To know more and see the latest version of the IAF Mandatory Documents (IAF website > Publication > IAF Documents > Mandatory Documents)"]
["IAF MD 1 IAF Mandatory Document for the Audit and Certification of a Management System Operated by a Multi-Site Organization"]
["IAF MD 2 IAF Mandatory Document for the Transfer of Accredited Certification of Management Systems"]
["IAF MD 4 IAF Mandatory Document for the Use of Information and Communication Technology (ICT) for Auditing/Assessment Purposes"]
["IAF MD 5 Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems"]
["IAF MD 6 Application of ISO 14065:2020"]
["IAF MD 7 IAF Mandatory Document for the Harmonization of Sanctions and Dealing with Fraudulent Behaviour"]
["IAF MD 8 Application of ISO/IEC 17011:2017 in the Field of Medical Device Quality Management Systems (ISO 13485)"]
["IAF MD 9 Application of ISO/IEC 17021-1 in the Field of Medical Device Quality Management Systems (ISO 13485)"]
["IAF MD 11 IAF Mandatory Document for Application of ISO/IEC 17021 for Audits of Integrated Management Systems (IMS)"]
["IAF MD 12 Accreditation Assessment of Conformity Assessment Bodies with Activities in Multiple Countries"]
["IAF MD 13 Knowledge Requirements for Accreditation Body Personnel for Information Security Management Systems (ISO/IEC 27001)"]
["IAF MD 14Application of ISO/IEC 17011 in Greenhouse Gas Validation and Verification (ISO 14065:2013)"]
["IAF MD 15 IAF Mandatory Document for the Collection of Data to Provide Indicators of Management System Certification Bodies' Performance"]
["IAF MD 16 Application of ISO/IEC 17011 for the Accreditation of Food Safety Management Systems (FSMS) Certification Bodies"]
["IAF MD 17 Witnessing Activities for the Accreditation of Management Systems Certification Bodies"]
["IAF MD 20 Generic Competence for AB Assessors: Application to ISO/IEC 17011"]
["IAF MD 22 Application of ISO/IEC 17021-1 for the Certification of Occupational Health and Safety Management Systems (OH&SMS)"]
["IAF MD 23 Control of Entities Operating on Behalf of Accredited Management Systems Certification Bodies"]
["IAF MD 24 Transition Requirements for ISO 50003:2021"]
["IAF MD 25 Criteria for Evaluation of Conformity Assessment Schemes"]
["IAF MD 26 Transition Requirements for ISO/IEC 27001:2022"]
["IAF MD 27 Transition Requirements for ISO 22003-1:2022"]

{"sheet":"Sheet1","index":1,"n_rows":14,"n_cols":4,"rows_kept":14,"cut":false,"hidden":true,"merged":[]}
[]
[1,null,"PLEASE SELECT","N/A"]
[2,"IMS","INTEGRATED MANAGEMENT SYSTEM: Quality Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-3:2017, Environmental Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-2:2016, Occupational Health and Safety Management System: ISO/IEC 17021-1:2015; ISO/IEC TS 17021-10:2018 and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, 22, & 23"]
[3,"QMS","Quality Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-3:2017 and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, & 23"]
[4,"EMS","Environmental Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-2:2016 and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, & 23"]
[5,"OHSMS","Occupational Health and Safety Management System: ISO/IEC 17021-1:2015; ISO/IEC TS 17021-10:2018 and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, 22, & 23"]
[6,"QMS & EMS","QMS & EMS: Quality Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-3:2017, Environmental Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-2:2016, and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, & 23"]
[7,"QMS & OHSMS","QMS & OHSMS: Quality Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-3:2017, Occupational Health and Safety Management System: ISO/IEC 17021-1:2015; ISO/IEC TS 17021-10:2018, and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, 22, & 23"]
[8,"EMS & OHSMS","EMS & OHSMS: Environmental Management System: ISO/IEC 17021-1:2015; ISO/IEC 17021-2:2016, Occupational Health and Safety Management System: ISO/IEC 17021-1:2015; ISO/IEC TS  17021-10:2018, and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 5, 11, 12, 17, 22, & 23"]
[9,"ISMS","Information Security Management System: ISO/IEC 17021-1:2015; ISO/IEC 27006:2020 and applicable IAF Mandatory Documents","IAF Mandatory Documents1, 2, 4, 11, 12, 13, 17, & 23"]
[10,"EnMS","Energy Management System: ISO/IEC 17021-1:2015; ISO/IEC 50003:2021 and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 11, 12, 17, & 23"]
[11,"FSMS","Food Safety Management System ISO 22003-1:2022 + ISO/IEC 17021-1:2015  and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 11, 12, 16, 23, & 27"]
[12,"HACCP","Hazard Analysis Critical Control Point ISO 22003-01:2022 + ISO/IEC 17021-1:2015  and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 11, 12, 16, 23, & 27"]
[13,"FSMS & HACCP","FSMS & HACCP: Food Safety Management System & Hazard Analysis Critical Control Point ISO 22003-1:2022 + ISO/IEC 17021-1:2015  and applicable IAF Mandatory Documents","IAF Mandatory Documents 1, 2, 4, 11, 12, 16, 23, & 27"]