Standard, initial certification:
If the certification body is not able to verify the implementation of corrections and corrective actions of any major nonconformity within 6 months after the last day of stage 2, the certification body shall conduct another stage 2 prior to recommending certification.
Re-certification:
Following expiration of certification, the certification body can restore certification within 6 months if the outstanding recertification activities are completed, otherwise at least a stage 2 shall be conducted. The effective date on the certificate shall be on or after the recertification decision and the expiry-date shall be based on prior certification cycle.
Question:
A1: What is the maximum time of the duration of an initial audit, if it has not been conducted in consecutive days?
A2: Example: A CB starts a “stage 2” audit with some time lags, that the whole audit will be conducted in a period of more than 6 months (e.g. a gap of 9 months between two parts of the stage 2 audit). Is the result of the first part of this audit still valid at the end of the second part of this stretched “stage 2” audit?
NOTE: Many references in the standard limit time of corrective action implementation to 6 months, but for the duration of an (interrupted) stage 2 audit there is no limit.
September 2018
The risk-based approach comes into play here.
As indicated in the question, there are no requirements or guidance for an interrupted stage 2 audit.
A certification body will need to take a number of factors into account when determining the audit time for the second part of an interrupted stage 2 audit, for example:
- the requirements of IAF MD 5;
- the reason for the delay – was it due to major nonconformities being identified?
- have there been any changes in top management since the first part of the stage 2 audit?
- have there been any other significant changes in the client’s organization?
- are the results of the first part of the stage two audit still valid?
The real question that must be asked is why is it necessary for the stage 2 audit to be interrupted for a period of nine months? That suggests that there were some serious issues (major nonconformities) that delayed completion of the stage 2 audit, in which case the requirement of clause 9.5.3.2 of ISO/IEC 17021-1 would be applicable. If there is a delay of nine months between two parts of a stage 2 audit, it is difficult to see that the audit time could be less than if it were a new stage 2 audit. The underlying requirement of ISO/IEC 17021-1 (clause 9.1.4.1) is that ‘for each client the certification body shall determine the time needed to plan and accomplish a complete and effective audit of the client’s management system’. Therefore, irrespective of the requirements of IAF MD5, the certification body must be able to demonstrate that the audit duration is sufficient to meet this underlying requirement and the accreditation body must evaluate the output from the audit to satisfy itself that the audit duration was sufficient to do so.