Anil Jauhri, Ex-CEO, National Accreditation Board for Certification Bodies, writes a guidance column on the ways of ascertaining the authenticity of certifications.
The advent of ISO 9001 in 1987 was a historic event – it revolutionized the approach to quality and brought in the concept of the systems approach. It inspired the same management systems approach to the environment (ISO 14001), food safety (ISO 22000), information security (ISO 27001), and this tribe continues to grow into several other fields.
Not long after ISO 9001 was launched, ISO 9001 certification became an elitist tag – despite a visible loss of reputation over the years, it still remains the most popular and certified standard globally.
While the standard itself, and other management systems standards too, maybe magnificent, the problem is in certification. Their popularity has led to mushrooming of certification bodies globally, more so in India, and therefore the question arises – what is an authentic certificate?
Unlike many services, the first thing to be clear about is that there is no regulation of certification bodies – no licensing or registration. Anyone can set up a certification body – as a proprietorship or partnership or private limited or LLP or Society or Trust under relevant laws – and start issuing certificates. If such certificates are accepted in the market, it is perfectly legal and no one can stop it.
However, the risk is one does not know whether the certification body is competent and whether it follows a robust process or even actually does an audit. There is a number of what can be called ‘unethical’ certification bodies in India and even globally and several examples of certificates being issued without any audit to organizations who would actually have no system in place. Thus this entire business of certification becomes a sham exploiting the absence of regulatory oversight. This is rampant in the Indian market today and many parts of the globe are afflicted by a similar malady.
Therefore, those who rely on such certificates could literally be cheated with what can be called ‘unauthentic certificates because there is no way to verify if the certification body is competent or if it has done a proper audit or the organization which holds the certificate has implemented the ISO standard of which it holds a certificate. How does one then establish a certification body is authentic or the certificate is authentic?
Fortunately for us, ISO not only issued standards like ISO 9001 or ISO 14001 or ISO 13485, etc, it also issued standards for the process of certification along with competence of certification bodies – the ISO 17021 series of standards. Even better is that an international body, International Accreditation Forum (IAF), which now has an MoU with ISO, came up in 1993 to supervise certification to such standards through accreditation bodies in various countries – some like the EU have a single national accreditation body in each country by law, some have national accreditation bodies even though not by law but accreditation not being such a lucrative business, they remain the only ones like NABCB in India, and some like USA have multiple private accreditation bodies.
These accreditation bodies commit to operate as per applicable international standard, ISO 17011, for them and accredit certification bodies as per international standards applicable to them e.g. ISO 17021 series for management systems certification. These accreditation bodies are evaluated by the regional bodies, Asia Pacific Accreditation Cooperation in the case of India, who in turn are evaluated by IAF and once an accreditation body demonstrates it meets ISO 17011, it becomes a signatory to IAF’s mutual recognition arrangement which means it is now internationally equivalent. The peer evaluation of individual accreditation bodies by a regional body as well as IAF evaluation of regional bodies follows a 4-year cycle. As would be observed, the entire system is under evaluation following the dictum – in God we trust, rest all have to show evidence!
The certification bodies accredited by such accreditation bodies can also claim they are internationally equivalent and the certificates they issue, typically carrying the logo of the accreditation body and at times even of IAF are called accredited certificates which are also internationally acceptable.
Therefore, one can say that accreditation under the IAF system is arguably the only means of identifying an authentic certification body or certificate. The problem is that this entire system is voluntary – there is no legal binding for a certification body to get accredited or an accreditation body to become part of the IAF system.
There are indeed certification bodies in the market that are either unaccredited or claim accreditation from some unknown accreditation bodies typically based in USA or Europe but which are not part of the IAF system and hence it is not possible to vouch for their authenticity or even existence in some cases. Unlike the IAF system, these certification and accreditation bodies are under no oversight and not obliged to follow the international norms. One can term these certification bodies (and accreditation bodies) as unauthentic and certificates issued by them as inauthentic. It is therefore necessary for all the stakeholders, particularly those who rely on ISO certificates, to be aware of the risks of unauthentic certificates in the market and verify that they are receiving a credible, authentic certificate under the IAF system unless there is an alternate system of authenticating certificates available.
An authentic certificate should contain the following:
- Name and address of the organization certified
- Scope of certification describing its activities under certification. For example production, packing and sale of dairy products like (broad list of products)
- Standard (or sometimes scheme or regulation) against which certification is granted, for example, ISO 9001 or ISO 13485 (standard) or AS 9100 or FSSC 22000 (scheme) – in general, guidance standards (like ISO 31000) are not amenable to certification – these have to be formal, requirement standards or specifications
- Date of issue and expiry of certificate observing a 3-year cycle
- Unique identification number of the certificate
- Name and address of the certification body (CB)
- Logo of the certification body
- Accreditation symbol indicating the name of the accreditation body (AB) which has accredited the certification body (in most countries, in the absence of any law requiring certification bodies to register, accreditation is the only way of recognizing a competent, authentic certification body)
- IAF Mark – indicating that the certificate is covered under the Multilateral Mutual Recognition Arrangement (MLA) of the International Accreditation Forum (IAF) and hence is internationally equivalent and acceptable in the market.
In order to judge the authenticity of the certificates, the names of member ABs of IAF can be seen on its website www.iaf.nu – it also gives information on which accreditation bodies are signatories to IAF MLAs for specific schemes – QMS or EMS or FSMS. Once you locate the AB in a country, you can go to its website from the link given on the IAF website and then on AB’s website to verify if the CB is accredited. Then from the CB or even the AB, you can verify the certificate because, under international norms, CBs are obliged to help verify certificates issued by them. In case the certificate is issued under a scheme like IATF 16949 or AS 9100, it is possible to verify the certificate through the scheme owners also.
The safest course is to rely on the national body, the National Accreditation Board for Certification Bodies (NABCB), which is a member of IAF and internationally equivalent, and insist on the NABCB logo on the certificates. In case of any other certificate, it would be best to verify the certificate from the AB concerned or even take the help of NABCB to verify the certificate. The list of certification bodies accredited by NABCB is publicly available at the website nabcb.qci.org.in.
The Indian market unfortunately is hugely risky in this regard and therefore all stakeholders, especially the industry as well as purchasers/buyers, need to be aware of the IAF system to ensure they receive authentic certificates in the first place.