TheRevisionofISO/IEC17021fromISO/IEC17021:2011toISO/IEC170211:2015

WrittenbyRandyDoughertyfortheIAAR

IamwritingthisarticleattherequestoftheIndependentAssociationofAccreditedRegistrars(IAAR)in
theUStoinformitsmembersoftheimportantchangestoISO/IEC17021.

IamthevicepresidentofthemanagementsystemsaccreditationprogramsatANSIASQNational
AccreditationBoard(ANAB),aswellasthechairofIAFandcoconvenerforISO/CASCOWG21.

History
Asabriefhistory,ISO/CASCOWG21wasformedin2000todevelopwhatbecameISO/IEC17021.
AmongthegoalsofWG21wasforthisnewdocumenttoreplaceISO/IECGuide62forQMSCBsand
ISO/IECGuide66forEMSCBs,andtobeapplicabletoalltypesofmanagementsystems.Thestandard
waspublishedsixyearslaterasISO/IEC17021:2006.Allmanagementsystemcertificationbodies(CBs)
accreditedbyIAFMLAsignatorieswererequiredtoconformtothisstandard2yearsafterpublication.
However,inresponsetoconcernsbyseveralstakeholdergroups,WG21initiatedarevisionfocusedon
competence.ThiswasaccomplishedwiththepublicationofISO/IEC17021:2011.Again,allCBs
accreditedbyIAFMLAsignatorieswererequiredtoconformtotherevisedstandard2yearsafter
publication.Sincethen,ahostofnewstandards,consideredpartsofISO/IEC17021,havenowbeen
publishedwhichaddtothegenericcompetencerequirementsinISO/IEC17021:2011forspecifictypes
ofmanagementsystems,asfollows:
ISO/IECTS170212forenvironmentalmanagementsystems
ISO/IECTS170213forqualitymanagementsystems
ISO/IECTS170214foreventsustainabilitymanagementsystems
ISO/IECTS170215forassetmanagementsystems
ISO/IECTS170216forbusinesscontinuitymanagementsystems
ISO/IECTS170217forroadtrafficsafetymanagementsystems.
Therearealsosomeadditionalstandardsthatincludeadditionalcompetencerequirements:
ISOTS22003forfoodsafetymanagementsystems
ISO/IEC27006forinformationsecuritymanagementsystems
ISO28003forsupplychainmanagementsystems
ISO50003forenergymanagementsystems.

ThereviewandrevisionofISO/IEC17021:2011wasinitiatedin2012.Inputsfortherevisionincluded:
Outofscopecommentsonrevisionof2006
CASCOinterpretationrequests
IAFapplicationdocuments
APGandAAPGpapers
OutcomeofWG33ISO/IECTS17022
OutcomeofWG37ISO/IECTS17023
CASCOPASdocuments1700117005
OtherCASCOdocuments17020,17024,17065

Whatarethechanges?
TothosefamiliarwithISO/IEC17021:2011,themostobviouschangewillbetoSection9whichhasbeen
restructured.ItnowreadsmoreinorderofhowcertificationservicesaredeliveredbyaCB.

ThefollowingarewhatIconsidertobethreemostimportantchanges.Thisismypersonalopinion.
1. ImprovingeffectivenessofoperationalandorganizationalcontrolbyCBsofremoteoffices
regardlessoftheirorganizationalstructure
2. Allowingastatement,butnomark,onproductpackaging(notonproduct)andaccompanying
literaturethatacompanyhasacertifiedmanagementsystem
a. cannotimplytheproductiscertifiedbythismeans
b. toincludethenameoftheCB
3. Definingaudittimeandauditduration,andthenfocusingrequirementsforjustificationonaudit
duration,whichisthetimefromtheopeningtotheclosingmeeting.(Ourgoalistohave
ISO/IEC170211:2015consistentandharmoniouswithISO/IEC17023andIAFMD5.)

Otherchangesareasfollows:
Addingonenewprincipleforariskbasedapproach
AdopttheapproachinISO/IEC17065andnotrequire,butstillallow,acommitteefor
safeguardingimpartiality
AdopttheapproachinISO/IEC17024regardingpublicinformationwith,orwithout,request
Defining/classifyingnonconformitiesasmajorandminor
Nolongerrequiringapublicdirectoryofcertifications
AllowingaCBtocertifyanotherCBtoamanagementsystemstandard,exceptforaQMS
IfaCBisunabletoverifyeffectivecorrectionandcorrectiveaction6monthsafteraninitial
audit,anotherStage2shallbeconducted
Sixmonthsallowedforrecertificationfollowingexpirationofcertification;otherwise,aStage2
shallbeconducted.Whenthereisagapincertification(uptosixmonths),makingsurethe
certificationdocumentsclearlyidentifythegap.
Whenrecertificationiscompletedpriortoexpiration,theexpirationdatecanbebasedonthe
existingcertification(socertificationmaybelongerthan3years)
Iftherecertificationauditisnotcompleted,oranymajornonconformitynotverifiedbythe
expirationdate,thenrecertificationcannotberecommendedandthevalidityofthecertification
cannotbeextended
Newrequirementforconsiderationofshiftsintheauditprogram
Newrequirementwhencertifyingtomultiplemanagementsystemsstandards
NewrequirementontransfersrequiringtheacceptingCBtoobtainsufficientinformationfor
makingacertificationdecision
Newrequirementfortheauditreportrequiringastatementoftheconformityandeffectiveness
oftheMS
NormativeAnnexArevisedtoincludeexpandedstatementsexplainingcompetence
requirements,similartotheapproachinISO/IECTS170212or3.Doingthisallowedusto
eliminatetheXandX+inthetable.

WG21alsoexpandedtherequirementsfortheauditreporttakingintoconsiderationtherequirements
ofISO/IECTS17022:2012ConformityassessmentRequirementsandrecommendationsforcontentofa
thirdpartyauditreportonmanagementsystems,andonthisbasisisrecommendingthatISO/IEC17022
bewithdrawn.

Forthosethatliketonumericallycharacterizechanges,RobDyewhoisanANABaccreditationassessor
andinstructor,madethefollowingsummaryanalysisofchanges:
7Newdefinitions

 1Modifieddefinition
1RemovedDefinition
1Newprincipal
4Modifiedprincipals
54Newrequirements*
85Modifiedrequirements*
27Removedrequirements*
*Thisisclauses,subclausesandnotes

Sowhat?
SowhatdoesthismeantoaCBcurrentlyaccreditedtoISO/IEC17021:2011?Inmyopinionitwillbe
easyforanycurrentCBtoconformtothechanges.VeryfewCBswillneedtomakeanysignificant
changestotheirprocesses.ButIalsothinknearlyallofthechangesareimprovementsandwilladdto
thecredibilityandintegrityofcertification.

ThelastfacetofacemeetingofWG21wasinJanuary2015.Atthismeeting,therewasalsoconsensus
amongWG21memberstosupporttheIAFResolutionthatthetransitionperiodbe2yearsfrom
publication.ItisanticipatednowthatanFDIS(FinalDraftInternationalStandard)willbeballotedin
MarchandAprilandthatISO/IEC170211:2015willbepublishedinMayorJuneof2015.

Onceissued,theFDISwillbeavailableforpurchasethroughASQ,ANSIorISO.