This relates to clause 5.2.7 of ISO 17021-1:
5.2.7 Where a client has received management systems consultancy from a body that has a relationship with a certification body, this is a significant threat to impartiality. A recognized mitigation of this threat is that the certification body shall not certify the management system for a minimum of two years following the end of the consultancy.
Several CBs accredited by a particular NAB use contracted auditors (not ‘subcontractors,’ but individuals contracted to work for the CB, under the CB’s management system). Most of these auditors also provide consultancy. The NAB has, in the past, accepted that CBs could certify the management systems of clients who received consultancy from one of these contractors, as long as it was demonstrated that satisfactory controls were in place – transparency, different auditors, informing the impartiality committee, etc.
Clause 5.2.7 could be understood to mean that this practice can no longer continue.
However, it is proposed that this clause does not apply in the scenarios described above, because
a) Clause 5.2.7 refers to ‘a body,’ and the consultancy here is provided by individuals; and
b) Furthermore, clause 5.2.7 states that “A recognized mitigation of this threat is…” Because the word recognized is used, it means that there may be other ways of mitigating the threat; it is not mandated that the CB shall not certify the management system for two years.
Does the CC agree with the NAB’s position?
March 2017
An individual that has his/her own consultancy company would be considered as a body in terms of ISO/IEC 17021-1 and in this case clause 5.2.7 should be invoked and the “2 year” rule should be invoked, or a similar mitigation.