Specific Accreditation Protocol for Certification of Quality Management Systems in accordance with ISO 9001

Raad voor Accreditatie (Dutch Accreditation Council RvA) Specific Accreditation Protocol for Certification of Quality Management Systems in accordance with ISO 9001 Document code: RvA-SAP-C004-UK Version 1, 11 november 2013

A Specific Accreditation Protocol (SAP) describes the assessment service for a specific accreditation. It should be read in conjunction with the generic RvA regulations and policy documents. A current version of the SAP is available through the website of the RvA. (www.rva.nl).

Content 1 Relevant documents 4 1.1 Accreditation requirements 4 1.2 Additional documents 4 1.3 Certification documents 4 2 Scope of accreditation 5 3 Accreditation assessments 6 3.1 Initial assessments 6 3.2 Surveillance and reassessments 7 3.3 Scope extension 7 3.4 General remarks on witnessing 8 4 Specific assessment issues 9 5 Other information 9 6 Changes with regard to the previous version 9 Annex 1: Scope clusters 10 Annex 2: Answers on questions of stakeholders 12 Dutch Accreditation Council (RvA) page 3 of 13

1 Relevant documents 1.1 Accreditation requirements ISO/IEC 17021, Conformity assessment Requirements for bodies providing audit and certification of management systems 1.2 Additional documents IAF documents applicable for accreditation of ISO 9001 certification: IAF MD 1; Certification of Multiple Sites Based on Sampling IAF MD 2; Transfer of Accredited Certification of Management Systems IAF MD 3; Advanced Surveillance and Recertification Procedures (ASRP) IAF MD 4; Use of Computer Assisted Auditing Techniques ("CAAT") for accredited Certification of Management Systems IAF MD 5; Duration of QMS and EMS audits IAF MD 10:2013 Assessment of Certification Body Management of Competence in Accordance with ISO/IEC 17021: 2011 (verplicht per 11-02-2014) IAF MD 11; Mandatory Document for the application of ISO/IEC 17021 for audits of integrated management systems (IMS) (2013) IAF ID 1; QMS Scopes of Accreditation RvA documents applicable for accreditation of ISO 9001 certification: RvA-T007; Competence Requirements for Personnel involved in Management Systems Certification RvA-T033; Assessment of Schemes for Conformity Assessments The current versions of these document may be onbtained from the relevant website(s): IAF (www.iaf.nu), EA (www.european-accreditation.org), RvA (www.rva.nl). 1.3 Certification documents Certification bodies (CB) certify against: ISO 9001, Quality management systems - Requirements Dutch Accreditation Council (RvA) page 4 of 13

2 Scope of accreditation The scope of accreditation is defined based on the listing of 39 sectors in IAF-ID1. RvA may further restrict a scope to specific NACE codes within a sector mentioned in IAF-ID1 in case: the CB requests so; the assessment in the opinion of the RvA does not allow granting accreditation for a complete sector. This could be the case when the sector represents a large diversity of technical subareas and the CB did not manage to demonstrate competence in more than a specific sub-area or in the case the sector includes a sub-area which requires specific competence which could not be demonstrated by the CB. An accreditation for ASRP (see IAF-MD3) will be mentioned explicitly in the scope of accreditation. Under ISO 9001 certification, it is possible to include several co-notations in the scope (these require a specific extension of scope assessment): ISO 3834-2 Quality requirements for welding. Fusion welding of metallic materials. Comprehensive quality requirements ; AQAP 2110, Nato Quality Assurance requirements for design, development and production; AQAP 2120, Nato Quality Assurance requirements for production; AQAP 2130, Nato Quality Assurance requirements for inspection and test Certificatieschema Contractcatering; HKZ Certificatie, for various sectors in health care (a Dutch scheme, with additional guidance in SAP C009). An example of a scope description for ISO 9001: Standard / Normative document ISO 9001 Certification scheme Quality management system certification for the scopes (refer to IAF-codes and NACE Rev. 2 where relevant): 2 mining and quarrying 5 leather and leather products 12 chemicals, chemical products and fibres 14 rubber and plastic products 16 concrete, cement, lime, plaster, etc. 38 health and social work Co-notations: Dutch Accreditation Council (RvA) page 5 of 13

3 Accreditation assessments The assessment extent and content depend on the requested scope of accreditation, the other activities for which the body is accredited or requests accreditation and the performance of the body at previous assessments. The assessment strategy (see 3.1 until 3.3) shall be determined by the RvA Account Manager, where relevant after consultation of the Expertise Holder or the Team Leader, unless otherwise indicated. Only any deviations from the guidelines below shall be justified towards the CB and recorded in the overall assessment program for the cycle. 3.1 Initial assessments During the initial assessment the implementation of policies and procedures is assessed at the office(s) of the body. The content and extent of the assessment shall at least ensure that: During the office assessment the team samples the files of clients and personnel to cover the scope for which accreditation is sought. At least 1 client and 1 auditor file per IAF sector requested shall be reviewed completely, unless more than 10 IAF sectors have been requested, in which case sectors may be omitted in the sample. This is to be determined by the Team Leader, who should apply the following guidelines: o Only the less complex sectors should be omitted (so in principle not the so-called witness obligatory sectors, ref. appendix 1); o Dossiers from each of the clusters (see appendix 1) should have been assessed (i.e. the sample should be representative for the scope requested); o In total, more than 10 certification dossiers shall be assessed. The application of the IAF-MD documents shall be verified as applicable. The chair of the impartiality committee of the body is interviewed or a committee meeting is witnessed. This happens in consultation between the RvA Teamleader and the CB. For the selection of audits to be witnessed the following rules apply: 1. In case accreditation is requested for a so called obligatory witnessing sector (indicated grey in annex 1), these sectors will be witnessed in any case. 2. For each of the clusters indicated in annex 1, one audit shall at least be witnessed. 3. During an initial accreditation, at least 2 audits shall be witnessed (unless only 1 audit is available), even when only 1 cluster has been requested. 4. Depending on the already accredited scope the RvA may decide to omit witness assessments (in comparison to rules 1 and 2). RvA will motivate these deviations. 5. At least 1 of the audits should include both a stage I and a stage II audit. If for scheduling reasons it is not possible to perform these with the same client, the RvA may consider to perform these at separate clients. The auditee for the audit, which will be observed, should be a reasonable representation of the requested scope of accreditation (e.g. not a Chemicals re- Dutch Accreditation Council (RvA) page 6 of 13

packer and re-seller for the entire IAF sector 12, or a small machine shop for the entire IAF sector 17). 3.2 Surveillance and reassessments The implementation of the ISO 9001 certification system shall be verified during each surveillance assessment of the RvA. The files reviewed during the subsequent surveillances and the reassessment in a four years period (accreditation cycle) shall cover all the clusters mentioned in annex 1 for which the CB is accredited. The number of files to be reviewed for each assessment is calculated from the number of valid certificates under accreditation (approximately one fifth of the square root of the number of certificates with a maximum of 15 files). The application of IAF-MD1 (multisite), IAF-MD3 (ASRP) and IAF-MD4 (CAAT) shall be verified at least once during the accreditation cycle, when applicable. The functioning of the impartiality committee of the body is reviewed in-depth at least once during the accreditation cycle. The RvA Team Leader may determine the method, which may include an interview (face-to-face, or telephone conversation) with a representative (non-cab) of the Committee, or the attendance to (part of) one of their meetings. For each accreditation cycle (surveillances and reassessment), the number of witnesses will be determined based on the following factors: 1 for each cluster of sectors included in the scope of the CB; or 1 per (number of auditors qualified for QMS certification); (which ever gives the higher number, with a maximum of 10). When the second factor gives the higher number of witness assessments, the witness assessments should also be spread over all clusters. This formula ensures that both a higher diversity in technical areas as well as a higher number of auditors will increase the number of witness assessments. In the application of the above guidelines, it shall be considered whether witness assessments may serve for multiple schemes (e.g. by witnessing combined audits) and how may witness assessments are performed in other schemes. 3.3 Scope extension The assessment by RvA in case of an application for an additional scope sector (application with RvA- F105) consists of one or more of the following assessment methods: 1. A review of documents and records; 2. A visit to the office of the CB, to verify documents and records and to interview relevant staff; 3. A witness assessment. At least the defined requirements for competence in that sector, records of the qualification process of auditors for that sector, and a complete certification dossier in that sector will be verified in a scope extension assessment. Dutch Accreditation Council (RvA) page 7 of 13

The strategy for the assessment depends on the requested sector and the already accredited scope: normally, the methods 1 or 1 and 3 are selected, but in case of a wide scope of extension or a very new scope, it may be decided to replace method 1 by method 2. In case accreditation is requested for a so called obligatory witnessing sector (indicated grey in annex 1) these sectors will be witnessed in any case. In case the requested sector is for a cluster the CB is not yet accredited for, a witness shall also be conducted. 3.4 General remarks on witnessing At least two weeks before the witnessing the RvA team shall be provided with: The quality manual of the organization to be audited, and an extended description of the organization, specifying its activities, structure and top level procedures (i.e. it is not necessary to submit the entire documented system, but the procedures on a higher level so that the RvA assessor can obtain a reasonable picture of the audit client and its system); A description of the most critical quality aspects of the products of the client (e.g. the output (records/procedures) of the organization to be audited related to their determination of requirements related to the product as required by ISO 9001 clause 7.2.1); The records of the CB s contract review for this organization (including qualification records for the auditors used); In case a surveillance or recertification audit is witnessed, a copy of the ISO 9001 certificate issued by the CB; The report of the CB s pre-assessment or stage 1 assessment of the organization s QMS (or other latest report) and an audit plan. Besides the abovementioned considerations for selection of audits to be witnessed, RvA will consider the following: The RvA will normally not witness the same auditors that have been witnessed in the same scheme before; The RvA will normally not witness an audit at the same organization; In an accreditation cycle at least one third (with a minimum of 1) of the audits to be witnessed should be initial or recertification audits; In an accreditation cycle at least a quarter (with a minimum of 1) of the audits to be witnessed should include design control (clause 7.3 of ISO 9001). Witnessing of audits includes the review of the audit report. To be able to select the audits to be witnessed, the CB shall on request of the RvA provide a planning for the audits to be conducted in a certain period. The information on these audits shall include as a minimum: type of audit (initial, recertification or surveillance); Dutch Accreditation Council (RvA) page 8 of 13

name and address of auditee; audit standard(s); scope of certification; name(s) of auditors(s) and expert(s); date(s) of the audit. 4 Specific assessment issues The RvA shall in particular focus on the following issues during the assessment of CB s for ISO 9001 certification: Calculation of man days for audits following the principles described in IAF-MD5. For each calculation the rationale shall be recorded in the file. Impartiality committee: composition and operations Managing threats to impartiality as explained in cl. 5 of ISO/IEC 17021. In case the CB has a relation with a consultancy body, the RvA may decide to verify files of this consultancy body to verify the effectiveness of measures taken to prevent linkage between the two activities. Management of competence as explained in ISO/IEC 17021, cl. 7 and RvA-T007. 5 Other information In case accreditation is requested for specific schemes related to ISO 9001, RvA may have published specific accreditation protocols. This may be verified at the RvA website. 6 Changes with regard to the previous version None, this is the first version of this document. Dutch Accreditation Council (RvA) page 9 of 13

Annex 1: Scope clusters IAF-sector number Ref. IAF-ID1 NACE Division.group Ref. (EC Regulation 1893/2006 NACE Rev. 2 Description RvA-cluster 1 01, 02, 03 Agriculture, forestry and fishing 1 2 05, 06, 07, 08, 09 Mining and quarrying 1 3 10, 11, 12 Food products, beverages and tobaccos P 4 13, 14 Textiles and textile products F 5 15 Leather and leather products F 6 16 Wood and wood products F 7 (part) 17.1 Pulp and paper P 7 (part) 17.2 Paper products F 8 58.1, 59.2 Publishing of books, periodicals and other publishing activities, Sound recording and music publishing activities 9 18 Printing companies F 10 19 Manufacture of coke and refined petroleum products P 11 24.46 Nuclear fuel N 12 20 Chemicals, chemical products and fibres P 13 21 Pharmaceuticals P 14 22 Rubber and plastic products F 15 23, except 23.5 and 23.6 Non metallic mineral products P 16 23.5, 23.6 Concrete, cement, lime, plaster, etc P 17 (part) 24 except 24.46 Manufacture of basic metals 1 17 (part) 25 except 25.4, 33.11 Manufacture of fabricated metal products, except machinery and equipment 18 25.4, 28, 30.4, 33.12, 33.2 Machinery and equipment F 19 26, 27, 33.13, 33.14, 95.1 Electrical and optical equipment F 20 30.1, 33.15 Shipbuilding F 21 30.3, 33.16 Aerospace F 22 29, 30.2, 30.9, 33.17 Other transport equipment F 23 31, 32, 33.19 Manufacturing not elsewhere classified F 24 38.3 Recycling P 25 35.1 Electricity supply P 26 35.2 Gas supply P 27 35.3, 36 Water supply P 28 41, 42, 43 Construction F 29 45, 46, 47, 95.2 Wholesale and retail trade; Repair of motor vehicles, motor cycles and personal and household goods 30 55, 56 Hotels and restaurants D F F D Dutch Accreditation Council (RvA) page 10 of 13

IAF-sector number Ref. IAF-ID1 NACE Division.group Ref. (EC Regulation 1893/2006 NACE Rev. 2 Description RvA-cluster 31 49, 50, 51, 52, 53, 61 Transport, storage and communication D 32 64, 65, 66, 68, 77 Financial mediation; real estate; renting D 33 58.2, 62, 63.1 Information technology D 34 35 71, 72, 74 except 74.2 and 74.3 69, 70, 73, 74.2, 74.3, 78, 80, 81, 82 Engineering services; research and development; other professional, scientific and technical activities Other professional services 36 84 Public administration D 37 85 Education D 38 75, 86, 87, 88 Health and social work D 39 (part) 37, 38.1, 38.2, 39 Sewerage and waste collection treatment and disposal P 39 (part) 59.1, 60, 63.9, 79, 90, 91, 92, 93, 94, 96 Other social services D D D Explanation: Column 1: Column 2: Column 3: Column 4: Code for a sector as used by IAF in IAF-ID1 Specification of the NACE division number for the activities in the sector and where applicable the group number within this division. General description of the economic activities within the sector. Indication of the RvA cluster for the activity based on de following codes: 1 Primary sector D Service delivery companies F Production/manufacturing companies P Process industry N Nuclear The sector indicated in grey are the sector that the RvA will witness always at initial and scope extension assessment (so called obligatory witness sectors). Dutch Accreditation Council (RvA) page 11 of 13

Annex 2: Answers on questions of stakeholders Throughout the development process of this Specific Accreditation Protocol (SAP), several questions were raised that could not be properly addressed in the revised text of the SAP. Some of these have been included in this Annex. Why this SAP? During the EA peer evaluations, it was found that the RvA is not as transparent as it would like to be with respect to indicating the documents, which are relevant for a particular accreditation. In response to these findings, RvA made an inventory for which schemes and activities this is applicable. Thus, it appeared that for a CB, it was not clearly traceable with help of the publicly available documents, which documents are applicable for ISO 9001 certification; this in contrast for instance with EMS, VCA and OHSAS, which schemes all have a SAP document. With this SAP, RvA intends to provide more transparency regarding its operating methods. Does it change the current operating procedures? No, this SAP does not introduce any significant changes with respect to the current operating methods, although through the harmonisation of indicating the number of files to be reviewed, sometimes a few more dossiers will require reviewing, and sometimes a few less. Why does the SAP introduce a link between the number of certificates and the number of files reviewed? One of the criticisms that RvA has received over the years, relates to the representativeness of the number of certification dossiers reviewed. By more standardising this, RvA intends to prevent some CAB s having almost all of their files reviewed, whereas others only an insignificant number. It should be noted that the prime criterium is still the number of technical areas, i.e. the file review should provide for a reasonable spread over the (clustered) areas as included in the accredited scope. It is added, that RvA has used the number of certificates for a long time to determine the assessment effort that is required in order to obtain a fair impression of the activities of the CAB. With this SAP, RvA intends to make this effort more transparent and open. How do the numbers (with respect to witness assessments and file reviews) compare with other AB s? With the notable exception of a few schemes (e.g. food safety management system certification through the use of EA-3/11), this is a topic, which has not yet been standardised or harmonised within IAF or even EA. Each AB is required to develop its own strategy; some will put more emphasis on witnessed assessment, others more on documentation review, others will focus on reviewing certification files at the offices of the CB. It is our impression, that RvA has a fair regime in this respect, which is not stricter or more lenient than that of our colleagues. Off course, when further international guidelines (EA or IAF) become available, RvA will adapt this SAP to reflect those guidelines, as we have done with the SAP for FSMS certification. Dutch Accreditation Council (RvA) page 12 of 13

Does this SAP indicate a change of operation with respect to the assessment of technical areas? No, the RvA has changed its way of assessing technical areas with the introduction of this term in the ISO/IEC 17021 (both in 2006 with further refinement in 2011). This means that RvA reviews how the CB has defined its technical areas, and how it has defined competence criteria for that. Of course, the outcomes of those processes, i.e. the criteria themselves, are reviewed as well (mainly in assessments for extension of scope or initial assessments). Subsequently, RvA reviews whether the CB can demonstrate an effective evaluation process of the competence of the auditors, using the determined competence criteria. Why does RvA wish to interview a representative of the Committee supervising impartiality? RvA has started this way of gathering information on the functioning of the Committee about 4 years ago and we have received positive feedback from this approach. The interviews do give more depth to the assessment of impartiality and give an opportunity to give direct feedback to this Committee. The assessments in the interim years (of the meeting minutes) serve to support these interviews. In case of a witness audit, why does RvA wish to have information about the QMS (e.g. Quality Manual, output from processes of clause 7.2.1) prior to the assessment? The RvA witnesses an audit to assess the auditor s performance, not to assess the client s MS. Thus, an audit at a client with a poorly functioning MS may result in a good audit (when the client s weaknesses are appropriately identified and consistent findings and audit conclusions are drawn) and vice versa, an audit at a client with a well implemented MS may be a lesser audit (when the auditors omits obligatory audit items, verifies issues superficially, or does not further investigate apparent weaknesses or is being persuaded of conformity without verifying audit evidence). To enable an auditor to draw these type of conclusions, the RvA assessors is required to have a reasonable insight in the structure of the system and in the most important quality aspects of the client. The time allocated on-site for a certification audit, is just enough to actually perform the audit, and does not allow for preparation on-site (unless this has been planned additionally, i.e. time allocated over and above the guidelines of IAF MD5). The RvA expects its assessors to be able to follow the entire audit and to be able to pinpoint to omissions of the auditors (e.g. by not verifying weaknesses or unclarities). On the other hand, in witness audits, RvA does not wish to interfere by interacting with the client, so a review of the documentation on-site is generally not feasible. For witnessed surveillance or re-certification audits, this is equally important, because the CB is already familiar with the client and the RvA assessor is not. Therefore, the CB should enable the RvA assessor to prepare properly by ensuring that (the most important parts of) the QMS is available to the RvA 2 weeks prior to the witness. In order to know, which are the most critical requirements that the CB client s products have to comply with, RvA expects that the information submitted beforehand also includes the client s information on this, with at least their evaluation as required by ISO 9001, clause 7.2.1. Dutch Accreditation Council (RvA) page 13 of 13