GSO ISO/IEC 17021-1:2021

ISO/IEC 17021-1:2015

مواصفة قياسية خليجية

تقويم المطابقة -- متطلبات جهات تدقيق ومنح شهادات اعتماد نظم الإدارة -- الجزء 1: المتطلبات

Gulf Standard

Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements

ICS:

03.120.20

English Language – اللغةالإنجليزية Edition 1 – 01/07/2021 – 1 الطبعة

هذه الوثيقة محمية بالقانون COPYRIGHT PROTECTED DOCUMENT
جميع الحقوق محفوظة لهيئة لتقييس لدول مجلس التعاون لدول الخليج العربية. ما لم ينص على خلاف ذلك، لا يجوز إعادة إنتاج أي جزء من هذا المنشور أو استخدامه بأي شكل آخر أو بأي وسيلة، إلكترونية أو ميكانيكية، بما في ذلك التصوير، أو النشر على الإنترنت أو الإنترانت، دون إذن كتابي مسبق من هيئة التقييس لدول مجلس التعاون لدول الخليج العربية على العنوان أدناه أو الدول الأعضاء في الهيئة داخل بلدانهم.
All rights reserved to GCC Standardization Organization (GSO). Unless otherwise specified, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either GSO at the address below or GSO's member body in the country of the requester.
Outreach Dept, Knowledge Management Section GCC Standardization Organization (GSO) P.O.Box: 85245 Riyadh 12511 Kingdom of Saudi Arabia		إدارة التواصل، قسم إدارة المعرفة هيئة التقييس لدول مجلس التعاون لدول الخليج العربية (GSO) ص. ب: 85245 الرياض 12511 المملكة العربية السعودية
Tel:	+966115208000		هاتف:
Fax:	+966115208010		فاكس:
E-Mail:	csc@gso.org.sa		بريد إلكتروني:
Website:	www.gso.org.sa		موقع ويب:

تقديم خليجي

هيئة التقييس لدول مجلس التعاون لدول الخليج العربية هيئة إقليمية تضم في عضويتها أجهزة التقييس الوطنية في الدول الأعضاء ، ومن مهام الهيئة إعداد المواصفات القياسية واللوائح الفنية الخليجية بواسطة لجان فنية متخصصة.

قررت اللجنة الوزارية لهيئة التقييس لدول مجلس التعاون لدول الخليج العربية في الاجتماع الـ (2) بتاريخ 1443/09/11هـ ،الموافق 2021/07/01م اعتماد تحديث المواصفة القياسية الخليجية رقم GSO ISO/IEC 17021-1:2021 وعنوانها "تقويم المطابقة -- متطلبات جهات تدقيق ومنح شهادات اعتماد نظم الإدارة -- الجزء 1: المتطلبات" باللغة الانجليزية التي تم دراستها وتبنيها بالمصادقة عبر المسار السريع عن المنظمة الدولية للتقييس رقم ISO/IEC 17021-1:2015 . على أن تلغي وتحل محل المواصفة القياسية رقم GSO ISO/IEC 17021:2009 .

Gulf Foreword

GCC Standardization Organization (GSO) is a regional organization which consists of the national standardization bodies of GCC member states. One of GSO main functions is to issue gulf standards and technical regulations through specialized technical committees.

GSO Ministerial Committee in its meeting number (2) held on 11/09/1443H, which corresponds to 01/07/2021, has approved the update of Gulf Standard GSO ISO/IEC 17021-1:2021 titled "Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements" in English language which was studied and adopted by endorsement from International Organization for Standardization Standard ISO/IEC 17021-1:2015 through fast track . This document will cancel and replace the Gulf Standard GSO ISO/IEC 17021:2009.

		INTERNATIONAL STANDARD	ISO/IEC 17021-1 First edition 2015-06
		Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 1: Requirements Évaluation de la conformité — Exigences pour les organismes procédant à l'audit et à la certification des systèmes de management — Partie 1: Exigences

Reference number

ISO/IEC 17021-1:2015 (E)

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester.

ISO copyright office

CP 401 • Ch. de Blandonnet 8

CH-1214 Vernier, Geneva

Tel. + 41 22 749 01 11

Fax + 41 22 749 09 47

E-mail copyright@iso.ch

Website www.iso.ch

Published in Switzerland

Contents Page

ISO/IEC 17021-1:2015 (E)

Foreword

Introduction

1 Scope

2 Normative references

3 Terms and definitions

4 Principles

4.1 General

4.2 Impartiality

4.3 Competence

4.4 Responsibility

4.5 Openness

4.6 Confidentiality

4.7 Responsiveness to complaints

4.8 Risk-based approach

5 General requirements

5.1 Legal and contractual matters

5.1.1 Legal responsibility

5.1.2 Certification agreement

5.1.3 Responsibility for certification decisions

5.2 Management of impartiality

5.3 Liability and financing

6 Structural requirements

6.1 Organizational structure and top management

6.2 Operational control

7 Resource requirements

7.1 Competence of personnel

7.1.1 General considerations

7.1.2 Determination of competence criteria

7.1.3 Evaluation processes

7.1.4 Other considerations

7.2 Personnel involved in the certification activities

7.3 Use of individual external auditors and external technical experts

7.4 Personnel records

7.5 Outsourcing

8 Information requirements

8.1 Public information

8.2 Certification documents

8.3 Reference to certification and use of marks

8.4 Confidentiality

8.5 Information exchange between a certification body and its clients

8.5.1 Information on the certification activity and requirements

8.5.2 Notice of changes by a certification body

8.5.3 Notice of changes by a certified client

9 Process requirements

9.1 Pre-certification activities

9.1.1 Application

9.1.2 Application review

9.1.3 Audit programme

9.1.4 Determining audit time

9.1.5 Multi-site sampling

9.1.6 Multiple management systems standards

9.2 Planning audits

9.2.1 Determining audit objectives, scope and criteria

9.2.2 Audit team selection and assignments

9.2.3 Audit plan

9.3 Initial certification

9.3.1 Initial certification audit

9.4 Conducting audits

9.4.1 General

9.4.2 Conducting the opening meeting

9.4.3 Communication during the audit

9.4.4 Obtaining and verifying information

9.4.5 Identifying and recording audit findings

9.4.6 Preparing audit conclusions

9.4.7 Conducting the closing meeting

9.4.8 Audit report

9.4.9 Cause analysis of nonconformities

9.4.10 Effectiveness of corrections and corrective actions

9.5 Certification decision

9.5.1 General

9.5.2 Actions prior to making a decision

9.5.3 Information for granting initial certification

9.5.4 Information for granting recertification

9.6 Maintaining certification

9.6.1 General

9.6.2 Surveillance activities

9.6.3 Recertification

9.6.4 Special audits

9.6.5 Suspending, withdrawing or reducing the scope of certification

9.7 Appeals

9.8 Complaints

9.9 Client records

10 Management system requirements for certification bodies

10.1 Options

10.2 Option A: General management system requirements

10.2.1 General

10.2.2 Management system manual

10.2.3 Control of documents

10.2.4 Control of records

10.2.5 Management review

10.2.6 Internal audits

10.2.7 Corrective actions

10.3 Option B: Management system requirements in accordance with ISO 9001

10.3.1 General

10.3.2 Scope

10.3.3 Customer focus

10.3.4 Management review

Annex A (normative) Required knowledge and skills

Annex B (informative) Possible evaluation methods

Annex C (informative) Example of a process flow for determining and maintaining competence

Annex D (informative) Desired personal behaviour

Annex E (informative) Audit and certification process

Bibliography

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of conformity assessment, ISO and IEC develop joint ISO/IEC documents under the management of the ISO Committee on Conformity assessment (ISO/CASCO).

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation on the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the WTO principles in the Technical Barriers to Trade (TBT) see the following URL: Foreword - Supplementary information

ISO/IEC 17021-1 was prepared by the ISO Committee on Conformity Assessment (CASCO). It was circulated for voting to the national bodies of both ISO and IEC, and was approved by both organizations.

This first edition of ISO/IEC 17021-1 cancels and replaces ISO/IEC 17021:2011, which has been technically revised.

ISO/IEC 17021 consists of the following parts, under the general title Conformity assessment — Requirements for bodies providing audit and certification of management systems:

—

Part 1: Requirements

—

Part 2: Competence requirements for auditing and certification of environmental management systems [Technical Specification]

—

Part 3: Competence requirements for auditing and certification of quality management systems [Technical Specification]

—

Part 4: Competence requirements for auditing and certification of event sustainability management systems [Technical Specification]

—

Part 5: Competence requirements for auditing and certification of asset management systems [Technical Specification]

—

Part 6: Competence requirements for auditing and certification of business continuity management systems [Technical Specification]

—

Part 7: Competence requirements for auditing and certification of road traffic safety management systems [Technical Specification]

Introduction

Certification of a management system, such as the environmental management system, quality management system or information security management system of an organization, is one means of providing assurance that the organization has implemented a system for the management of the relevant aspects of its activities, products and services, in line with the organization’s policy and the requirements of the respective international management system standard.

This part of ISO/IEC 17021 specifies requirements for bodies providing audit and certification of management systems. It gives generic requirements for such bodies performing audit and certification in the field of quality, the environment and other types of management systems. Such bodies are referred to as certification bodies. Observance of these requirements is intended to ensure that certification bodies operate management system certification in a competent, consistent and impartial manner, thereby facilitating the recognition of such bodies and the acceptance of their certifications on a national and international basis. This part of ISO/IEC 17021 serves as a foundation for facilitating the recognition of management system certification in the interests of international trade.

Certification of a management system provides independent demonstration that the management system of the organization:

conforms to specified requirements;

is capable of consistently achieving its stated policy and objectives;

is effectively implemented.

Conformity assessment, such as the certification of a management system, thereby provides value to the organization, its customers and interested parties.

Clause 4 describes the principles on which credible certification is based. These principles help the user to understand the essential nature of certification and they are a necessary prelude to Clauses 5 to 10. These principles underpin the requirements in this part of ISO/IEC 17021, but such principles are not auditable requirements in their own right. Clause 10 describes two alternative ways of supporting and demonstrating the consistent achievement of the requirements in this part of ISO/IEC 17021 through the establishment of a management system by the certification body.

Certification activities are the individual activities that make up the entire certification process, from application review to termination of certification. Annex E provides an illustration of the way in which many of these activities can interact.

Certification activities involve the audit of an organization's management system. The form of attestation of conformity of an organization's management system to a specific management system standard or other normative requirements is usually a certification document or a certificate.

This part of ISO/IEC 17021 is applicable to the auditing and certification of any type of management system. It is recognized that some of the requirements, in particular those related to auditor competence, can be supplemented with additional criteria in order to achieve the expectations of the interested parties.

In this part of ISO/IEC 17021, the following verbal forms are used:

—

“shall” indicates a requirement;

—

“should” indicates a recommendation;

—

“may” indicates a permission;

—

“can” indicates a possibility or a capability.

Further details can be found in the ISO/IEC Directives, Part 2.

INTERNATIONAL STANDARD ISO/IEC 17021-1:2015 (E)

Conformity assessment — Requirements for bodies providing audit and certification of management systems —

Part 1:

Requirements

1 Scope

This part of ISO/IEC 17021 contains principles and requirements for the competence, consistency and impartiality of bodies providing audit and certification of all types of management systems.

Certification bodies operating to this part of ISO/IEC 17021 do not need to offer all types of management system certification.

Certification of management systems is a third-party conformity assessment activity (see ISO/IEC 17000:2004, 5.5) and bodies performing this activity are therefore third-party conformity assessment bodies.

NOTE 1 Examples of management systems include environmental management systems, quality management systems and information security management systems.

NOTE 2 In this part of ISO/IEC 17021, certification of management systems is referred to as “certification” and third-party conformity assessment bodies are referred to as “certification bodies”.

NOTE 3 A certification body can be non-governmental or governmental, with or without regulatory authority.

NOTE 4 This part of ISO/IEC 17021 can be used as a criteria document for accreditation, peer assessment or other audit processes.

2 Normative references

The following documents, in whole or in part, are normatively referenced in this document and are indispensable for its application. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

ISO 9000, Quality management systems — Fundamentals and vocabulary

ISO/IEC 17000, Conformity assessment — Vocabulary and general principles

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO 9000, ISO/IEC 17000 and the following apply.

3.1

certified client

organization whose management system has been certified

3.2

impartiality

presence of objectivity

Note 1 to entry: Objectivity means that conflicts of interest do not exist, or are resolved so as not to adversely influence subsequent activities of the certification body.

Note 2 to entry: Other terms that are useful in conveying the element of impartiality include “independence”, “freedom from conflict of interests”, “freedom from bias”, “lack of prejudice”, “neutrality”, “fairness”, “open-mindedness”, “even-handedness”, “detachment”, “balance”.

3.3

management system consultancy

participation in establishing, implementing or maintaining a management system

EXAMPLE

Preparing or producing manuals or procedures.

EXAMPLE

Giving specific advice, instructions or solutions towards the development and implementation of a management system.

Note 1 to entry: Arranging training and participating as a trainer is not considered consultancy, provided that, where the course relates to management systems or auditing, it is confined to the provision of generic information; i.e. the trainer should not provide client-specific solutions.

Note 2 to entry: The provision of generic information, but not client specific solutions for the improvement of processes or systems, is not considered to be consultancy. Such information may include: — explaining the meaning and intention of certification criteria; — identifying improvement opportunities; — explaining associated theories, methodologies, techniques or tools; — sharing non-confidential information on related best practices; — other management aspects that are not covered by the management system being audited.

3.4

certification audit

audit carried out by an auditing organization independent of the client and the parties that rely on certification, for the purpose of certifying the client's management system

Note 1 to entry: In the definitions which follow, the term “audit” has been used for simplicity to refer to third-party certification audit.

Note 2 to entry: Certification audits include initial, surveillance, re-certification audits, and can also include special audits.

Note 3 to entry: Certification audits are typically conducted by audit teams of those bodies providing certification of conformity to the requirements of management system standards.

Note 4 to entry: A joint audit is when two or more auditing organizations cooperate to audit a single client.

Note 5 to entry: A combined audit is when a client is being audited against the requirements of two or more management systems standards together.

Note 6 to entry: An integrated audit is when a client has integrated the application of requirements of two or more management systems standards into a single management system and is being audited against more than one standard.

3.5

client

organization whose management system is being audited for certification purposes

3.6

auditor

person who conducts an audit

3.7

competence

ability to apply knowledge and skills to achieve intended results

3.8

guide

person appointed by the client to assist the audit team

3.9

observer

person who accompanies the audit team but does not audit

3.10

technical area

area characterized by commonalities of processes relevant to a specific type of management system and its intended results

Note 1 to entry: See Note to 7.1.2.

3.11

nonconformity

non-fulfilment of a requirement

3.12

major nonconformity

nonconformity (3.11) that affects the capability of the management system to achieve the intended results

Note 1 to entry: Nonconformities could be classified as major in the following circumstances: — if there is a significant doubt that effective process control is in place, or that products or services will meet specified requirements; — a number of minor nonconformities associated with the same requirement or issue could demonstrate a systemic failure and thus constitute a major nonconformity.

3.13

minor nonconformity

nonconformity (3.11) that does not affect the capability of the management system to achieve the intended results

3.14

technical expert

person who provides specific knowledge or expertise to the audit team

Note 1 to entry: Specific knowledge or expertise is that which relates to the organization, the process or activity to be audited.

3.15

certification scheme

conformity assessment system related to management systems to which the same specified requirements, specific rules and procedures apply

3.16

audit time

time needed to plan and accomplish a complete and effective audit of the client organization’s management system

3.17

duration of management system certification audits

part of audit time (3.16) spent conducting audit activities from the opening meeting to the closing meeting, inclusive

Note 1 to entry: Audit activities normally include: — conducting the opening meeting; — performing document review while conducting the audit; — communicating during the audit; — assigning roles and responsibilities of guides and observers; — collecting and verifying information; — generating audit findings; — preparing audit conclusions; — conducting the closing meeting.

Bibliography

[1]		ISO 9001, Quality management systems — Requirements
[2]		ISO 10002, Quality management — Customer satisfaction — Guidelines for complaints handling in organizations
[3]		ISO 14001, Environmental management systems — Requirements with guidance for use
[4]		ISO/IEC TS 17021-2, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 2: Competence requirements for auditing and certification of environmental management systems
[5]		ISO/IEC TS 17021-3, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 3: Competence requirements for auditing and certification of quality management systems
[6]		ISO/IEC TS 17021-4, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 4: Competence requirements for auditing and certification of event sustainability management systems
[7]		ISO/IEC TS 17021-5, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 5: Competence requirements for auditing and certification of asset management systems
[8]		ISO/IEC TS 17021-6, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 6: Competence requirements for auditing and certification of business continuity management systems
[9]		ISO/IEC TS 17021-7, Conformity assessment — Requirements for bodies providing audit and certification of management systems — Part 7: Competence requirements for auditing and certification of road traffic safety management systems
[10]		ISO/IEC TS 17023, Conformity assessment — Guidelines for determining the duration of management system certification audits
[11]		ISO/IEC 17030, Conformity assessment — General requirements for third-party marks of conformity
[12]		ISO 19011:2011, Guidelines for auditing management systems
[13]		ISO 20121, Event sustainability management systems — Requirements with guidance for use
[14]		ISO/TS 22003, Food safety management systems — Requirements for bodies providing audit and certification of food safety management systems
[15]		ISO 22301, Societal security — Business continuity management systems --- Requirements
[16]		ISO/IEC 27006, Information technology — Security techniques — Requirements for bodies providing audit and certification of information security management systems
[17]		ISO 31000, Risk management — Principles and guidelines
[18]		IEC 31010, Risk management — Risk assessment techniques
[19]		ISO 39001, Road traffic safety (RTS) management systems - Requirements with guidance for use
[20]		ISO 50003, Energy management systems — Requirements for bodies providing audit and certification of energy management systems
[21]		ISO 55001, Asset management — Management systems — Requirements

ICS 03.120.20

Price based on 49 pages