Frequently Asked Questions
The questions and answers provided normally apply to any management system, the most
popular being ISO 9001, ISO 14001 and OHSAS 18001. If you would like to discuss any issues relating to your circumstances which are not mentioned below please contact one of our technical staff.
Questions Relating to Registration
 What is the difference between Accreditation, Registration & Certification?
 Organisations
which are accredited to issue certificates to ISO 9001, ISO 14001 etc. are referred to as 'certification bodies'. Any organisation which is assessed by a certification body and meets the relevant standard gains a certificate and is placed on a register, and is therefore referred to as a 'registered' organisation. 
What does UKAS Accredited mean?
The organisation which assesses you against ISO 9001, ISO 14001 etc. , provides you with a certificate and places you on register showing that you have achieved the standard is called a certification body. Certification bodies are given the right to issue certificates by an accreditation body. In the UK an organisation called UKAS (United Kingdom Accreditation Service) accredits certification bodies by assessing their competence against an international standard. The full range of UKAS services can be seen on their web site.
Are all certification bodies accredited by UKAS?
No. Any organisation can issue a certificate that says you meet standards such as ISO 9001, ISO 14001 etc. In fact there is a significant increase in organisations issuing certificates, many of whom are not accredited by UKAS. Most of these organisations offer to design and audit your system within an impossibly short time, usually 30 days, with a certificate guaranteed! Some of these organisations issuing certificates do not even visit your site, the whole process being conducted over the internet! Many of your customers, existing and potential, particularly if they are large companies or the public sector, will not accept certificates from any other source than a UKAS accredited certification body (or IAF member). The UKAS web site (www.ukas.org) provides lists of accredited certification bodies.
How long does it take to gain an ISO 9001, ISO 14001 certificate?
Typically between 6-12 months, although this depends on many factors, but the overriding issue is that you must demonstrate that your management systems is fully implemented and meets all the requirements of the appropriate standard. Normally, a certification body will expect to see evidence that the system has been in place for 3 months. You can use a consultant to help you develop your system, but it is important that your staff have a significant input and hence commitment to the end result.
What does the certification process involve?
The process is common to all UKAS accredited certification bodies so you will be able to compare their services on a like for like basis. You will need to select a certification body (ask 2 or 3 to provide quotes). Your certification body will conduct a first stage audit to ensure that you meet the key requirements of the appropriate standard; this is normally a desktop exercise. They will provide you with a list of issues which will need to be addressed before they conduct the second stage of the audit, this being to ascertain whether your actual working practices meet the requirements of the standard. The 2 stage approach to the audit should maximise your chances of gaining your certificate at the first attempt.
Will we need to be perfect before we are given a certificate?
No organisation is perfect and certification bodies recognise this, their aim being to provide a certificate when there is no major nonconformity against the appropriate standard. A major nonconformity usually means that you have failed to address or implement a key element of the standard. An example of a major nonconformance would be the failure to conduct internal audits or management reviews. Minor nonconformities would include temporary lapses in an implemented procedure e.g. updating competency records. At the initial assessment stage most organisations will obtain a certificate even though they have a number of minor nonconformities.
How do you select the right certification body?
The most important first step is to see which certification body is the most prominent in your industry. Find out who your key customers and competitors use; it will improve your credibility if you use a certification which has a high profile in your market. If you have, or plan to have, an international presence, choose a certification body which has offices in your key markets.
Will the certification body help me implement the system?
No. UKAS accredited certification bodies are not allowed to provide consultancy and auditing for the same organisation. If you need assistance we suggest that you seek recommendations from your contacts, customers, suppliers etc., or you can ask a reputable company like Batalas to provide a proposal.
How long does a certificate last?
Your certificate will remain valid as long your management system meets the requirements of the appropriate standard. Your certification body will conduct surveillance visits comprising partial audits of your system, normally at 6 monthly intervals. Every 3 years they will conduct an audit of the entire system. Providing that you address the issues raised by the auditors you will continue to retain your registration status.
If we have a certificate is it possible to move to a different certification body?
There are a number of reasons why you might want to change to a different certification body, some within your control and others outwith your control. One of the most common reasons why you would want to change would be through company acquisition, with the parent company probably dictating your use of a certain certification body. Another reason why you might wish to change is if you feel that your current certification body is adding little value to your business, the relationship is not working. or your allocated auditor does not meet your expectations. We suggest that you discuss these issues with a senior member of the certification body team before taking the step to change to another body. If you do decide to change there is unlikely to be a penalty for doing so.
How can I find out if an organisation is registered?
You could ask the organisation for a copy of their certificate, but if you feel you need confirmation you can check the web site of the certification body which issued the certificate. Most UKAS accredited certification bodies have a web site which will provide details of their registered organisations. You will need to know the organisation's name and/or registration number to be able to access the details. Alternatively, you could contact the certification body by telephone. Another source of information is the TSO (The Stationery Office), but they charge an annual fee for the service and, as their register is populated on a voluntary basis, there is no guarantee of its accuracy. Do not contact UKAS or ISO as they do not have this information.
Questions relating to Designing a Management System
Should we develop our systems manual around the clauses of the standard?
Definitely not. The standards are not an easy read, and they contain terminology which you would not expect everyone to be familiar with. Consequently, constructing your manual in line with the clauses is unlikely to make your documentation user friendly. The simple rule is to construct your system in your organisation's style and using the language your organisation feels comfortable with.
Do we need to quote clause numbers in our management system manual?
With the exception of the aerospace standard, AS 9100, there is not requirement to refer to clause numbers in your documented systems.
Do we need to document everything we do?
Each standard requires you to create documentation, but this is far short of having to document every aspect of your management system. Beyond the minimum requirements, and legal/regulatory and contractual requirements, it is up to each organisation to decide the documentation it needs. Significant importance in all standards is the competence of personnel and therefore you will need to provide evidence that, in the absence of documented procedures, personnel have the competence to conduct their duties effectively.
How do we get senior managers involved in designing a management system?
It is rare to find a senior manager who is interested in the detail design of a management system, and rightly so, they should be dedicating their time to directing and managing the organisation. However, all senior managers are interested in results and therefore they can provide valuable input to 'what' a management system is to achieve, the performance measures and targets which demonstrate that the management system is effective and efficient. If you are designing a quality management system then senior managers can be involved in defining the processes and the process measures and targets. For environmental and occupational health and safety systems they can set the targets for the improvement in environmental and H&S performance.
Should we use a consultant to design our system?
Using a consultant may could mean that you gain your certificate in a shorter time. However, too much reliance on a consultant to document all aspects of your management system will result in a lack of ownership. Also, be careful in selecting a consultant as there are many unqualified people assisting companies in achieving registration to the international standards. If the consultant's approach is to take on all aspects of designing a system then be wary, particularly if he/she suggests that you design your system in line with the clauses of the standard.
What is the difference between a process and procedure?
ISO 9001: 2000 requires organisations to define processes and procedures. In simple terms the difference between process and a procedure in this context is that a process is what you do and a procedure is how you do it. By introducing the process approach it is possible to link quality objectives with the overall objectives of the organisation. An example would be delivery performance, this being the measure of the performance of the delivery process, an important measure for most businesses. Many organisations interpreted the process approach as requiring a process map, and they have used computer software to define all the activities (procedures) of the organisation. There is no need to do this, although some companies may find benefit from doing so. It can be a time consuming task with limited benefits for many organisations. A simple explanation of what the organisation does and how various elements of the organisation interact with one another is all that is needed.
Questions relating to Auditing a Management System
Do we need to train our internal auditors?
Most standards do not specifically require training as an internal auditors but they do require people to be competent. Whilst training does not guarantee competence it is an important first step to developing knowledge and skills.
How many auditors do we need?
If you are using your own staff to conduct internal audits you will need at least 2 auditors, as a person can not audit his/her own work. It is better to have a large pool of internal auditors to take account of leavers, sickness, promotions etc.
How do you choose the right people to conduct internal audits?
Auditing can be seen as a fairly negative process, with the emphasis being on digging into the detail and raising what is seen to many as trivial issues. Consequently, when selecting internal auditors it is normal to add more junior staff to complement the small team of quality, environmental and health & safety professionals. Internal auditing should be focused on improving the management system, and hence business performance, and therefore more senior managers should be involved in internal auditing. One of the ways to get them involved is to allocate to them the task of auditing for improvement, with more junior staff involved in the more time consuming tasks of conformance auditing.
Can we use a contractor to conduct our internal audits?
Yes. The advantage is that a good auditor may be able to use his/her experience to identify opportunities for improvement which would not have been possible by using your own staff. The downside is that the use of external auditors tends to lead to a lack of ownership of the management system.
Do we need to audit against ISO 9001 when conducting an internal audit?
Yes, the requirement in all standards is to conduct internal audits to the appropriate standard, and with conformity to regulatory and your own management system requirements. Obviously, if your management system documented every requirement of the standard then you could conceivably audit for conformance against your own system only. From our experience those organisations which have documented every aspect of an international standard within their own management system have created an overly bureaucratic system.
How do we make sure senior managers see some value to the audit process?
Managers are measured on results and therefore results orientated information is of prime concern to them. If the internal audit process includes the identification of process effectiveness and opportunities for improvement then you will grab their attention.
How do we stop the same trivial issues arising every time we conduct an audit?
One of the main reasons why internal audits raise trivial, and in some cases repeating, nonconformities is that audit reports are not 'closed out' correctly. It is important that actions taken to address nonconformities are corrective action (correcting the root cause of the issue) and not correction (purely a short term fix).
What do I do if my certification body auditor raises issues which do not appear in the standard?
Most international management system standards require a certain amount of interpretation and judgment as to whether your systems meet each individual requirement. Your external auditor should have enough experience to make these judgments, however, should you not agree make sure you ask the auditor to explain. The explanation should be by referral to the requirements of the standard and not to the opinion of the auditor. If, after discussing the issue, you are still not satisfied, do not be afraid to escalate the matter. All certification bodies have a system for dealing with any disagreements between auditor and auditee.
|
