Applicable framework
The assessment hierarchy begins with the primary standard and includes applicable normative, regulatory, scheme-owner and ISCB documents. When requirements conflict, ISCB will identify the controlling criterion before assessment.
- ISO/IEC 17065:2012 remains the published primary standard at this issue date; a replacement is under development and transition requirements will be communicated after publication.
- ISO/IEC 17011:2017 governs ISCB's accreditation process and decisions.
- Certification scheme requirements, ISO/IEC 17067 concepts and applicable regulatory rules form part of the assessment criteria.
Core organisational requirements
Legal status and responsibility
The applicant must be a legally identifiable entity, or a defined part of one, that can be held responsible for its conformity-assessment activities, contractual obligations and decisions.
Impartiality and independence
Identify, analyse, evaluate, treat, monitor and record risks to impartiality. Commercial, financial, ownership, relationship, consultancy and self-review threats must be controlled continuously.
Confidentiality and information security
Protect confidential information, personal data, intellectual property, examination or scheme security and electronic records. Disclosures must be legally authorised and appropriately communicated.
Organisation and governance
Define authority, responsibilities, reporting lines, committees and safeguards. Technical work, review and decisions must be assigned to competent and appropriately independent functions.
Competence and resources
Set competence criteria for every role affecting accredited activities; evaluate, authorise, monitor and periodically re-evaluate personnel. Control facilities, equipment, software and externally provided resources.
Controlled operations
Accept work only after confirming capability and scope. Use controlled methods and records, handle deviations, review outputs and ensure decisions are traceable to adequate objective evidence.
Management system
Maintain document and record control, risk and opportunity processes, complaints, appeals, nonconforming work, corrective action, internal audit, management review and continual improvement.
Accreditation claims
Claims, certificates, symbols and references to accreditation must be accurate, limited to the granted scope and changed immediately when accreditation is suspended, reduced, withdrawn or expires.
Service-specific technical requirements
- Document each certification scheme, including specified requirements, evaluation activities, surveillance model, decision rules, licensing and control of marks.
- Protect impartiality through risk analysis and controls over ownership, finance, consultancy, design, manufacture, supply, installation and related bodies.
- Demonstrate competence for application review, evaluation, testing or inspection, technical review, certification decision and surveillance.
- Control outsourced evaluation while retaining responsibility, confidentiality, competence evaluation and contractual access to records.
- Separate review and decision from evaluation as required and control granting, maintaining, extending, reducing, suspending, withdrawing and terminating certification.
- Maintain accurate public information, certification documentation and enforceable agreements governing claims and marks.
Minimum application and readiness evidence
Submit current, approved documents and representative implementation records. Templates without operational evidence are not sufficient.
Assessment, decision and continued accreditation
Application and scope review
ISCB reviews legal identity, requested scope, locations, resources, readiness and applicable criteria before quotation and assessment planning. Acceptance of an application is not a promise of accreditation.
Assessment
Assessment may include document review, office or remote assessment, on-site technical assessment, witnessing, interviews, vertical and horizontal record tracing, and evaluation of representative activities. The mix depends on scope and risk.
Nonconformities and decision
The applicant must determine causes, correct the specific issue, implement proportionate corrective action and provide evidence of effectiveness within the notified period. Accreditation decisions are made independently from assessment and only for demonstrated competence.
Maintenance
Accredited bodies must remain competent, comply with surveillance and reassessment, notify significant changes without delay, cooperate with witnessing and record access, address complaints and nonconformities, and control all accreditation claims.
Principal references
- ISO/IEC 17065:2012
- ISO/IEC 17011:2017
- ISO/IEC 17067 and ISO/IEC TR 17026, as relevant
- Applicable scheme-owner, regulatory and IAF documents
Document editions and external publications can change. The edition stated in the accreditation agreement, transition notice or other formal ISCB communication controls the assessment. Applicants should verify current editions before use.