ISO/IEC 17021-1:2015 § 9.5.1.1, ISO/IEC 17021-2:2016 § 7.3.4, ISO/IEC 17021-10 Table A.1
According to the standard ISO/IEC 17021-1:2015 § 9.5.1.1 it is required that “The individual(s) appointed to conduct the certification decision shall have appropriate competence”, moreover in ISO/IEC 17021-2:2016 in § 7.3.4 it’s requested that “Personnel reviewing audit reports and making certification decisions shall have knowledge of applicable compliance obligations sufficient to make a decision on the basis of a certification audit report”.
Taking into consideration all these factors:
Question 1: Is it acceptable for a legally established CAB (Conformity Assessment Body) in one country (Italy) to establish a hub in another country (such as India) where certification decisions are made for all the certificates issued worldwide, while the responsible personnel do not demonstrate knowledge of the relevant compliance obligations?
Question 2: How can the CAB demonstrate this? For instance, by ensuring that the decision-making staff is supported by technical experts on the local issues where the audit took place.
Question 3: In a similar vein, could the same situation apply to the FSMS (Food Safety Management System) scheme, where Table C.1 requires knowledge of the applicable food safety regulations in both the country of production and the country of destination?
In ISO/IEC 17021-10, it is also stated that personnel responsible for making decisions must possess knowledge of legal and other requirements. However, personnel operating in a different country may not be aware of these specific requirements.
March 2024
Answer 1: No, because the responsible personnel could not demonstrate sufficient knowledge.
Answer 2: As the decision can be taken by a team, support by experts with sufficient knowledge on local compliance issues might be a solution to demonstrate the competence to take the decision.
Answer 3: If the knowledge is required for both countries (production and destination) the knowledge of the decision maker must fulfil these requirements.
For OHSMS the requirements are similar, the knowledge of the decision maker (team) shall cover the local requirements where the audit took place.