MANAGEMENT SYSTEMS CERTIFICATION

AYUSH QUALITY MARK PROGRAMME

ADDITIONAL REQUIREMENTS FOR CERTIFICATION BODIES
OPERATING MANAGEMENT SYSTEMS CERTIFICATION AS PER ISO 17021-1

1. Introduction

1.1 This document prescribes the additional requirements to be followed by the certification bodies undertaking Management Systems Certification, in addition to compliance to ISO 17021-1, for the purpose of obtaining recognition by the Programme Owner (PO) under the Ayush Quality Mark Programme of the Ministry of Ayush.

2. Additional requirements

The additional requirements are indicated by prefix A with the clause number of ISO 17021-1 for ease of understanding. All provisions of ISO 17021-1:2015 shall apply in addition to those given in this document.

A1. Purpose

A1.1 This document specifies additional requirements for certification bodies involved in Management Systems certification under the Ayush Quality Mark Programme. These requirements are additional to the requirements specified vide ISO 17021-1 “Conformity assessment — Requirements for bodies providing audit and certification of management systems Part 1: Requirements” and the relevant certification scheme, in order to be recognized by the PO under the provisions of Ayush Quality Mark Programme.

A2. Scope

A2.1 This document specifies additional criteria for the Certification Bodies operating under the Ayush Quality Mark Programme for management systems certification related to Ayush products/services as per applicable criteria.

NOTE: The term “shall” used throughout this document indicates those provisions which are mandatory in nature. The term “should” is used to indicate guidance which, although not mandatory, is provided as a means of meeting the requirements of the approval criteria. In case the certification body uses an alternative means of meeting the requirements, they would have to provide suitable and adequate justification.

A2.2 It is also intended that these additional criteria shall be used by the accreditation bodies operating under the programme for assessment of certification bodies engaged in certification of Ayush products/services, for the purpose of recognition by PO under the scheme.

A2.3 For the sake of ease of usage, the structure of this document has been aligned with the structure of ISO 17021-1:2015. Against each requirement in the standard (ISO 17021-1:2015), additional requirements have been described, where applicable. These requirements shall be in addition to those specified in ISO 17021-1:2015. In respect of all other elements the existing provisions shall apply.

A5. General Requirements

A5.01 Integrity

The certification body, also known as CB, shall maintain integrity. It shall implement measures to require all its personnel and subcontractors to maintain integrity. The certification body’s system for maintaining integrity shall include measures like having a Code of Integrity and Conduct, which is required to be signed by all individuals (internal and external) involved in its activities, policy on gifts, guidelines for handling situations when offered inducement etc.

Note 1: Integrity is defined as the quality of being honest and having a consistent and uncompromising adherence to strong moral and ethical principles and values.

A5.02 Independence

The certification body shall be an independent body, neither owned by nor linked to any entity which is engaged in prohibited activities as detailed in ISO 17021-1 or this document.

A5.1 Legal and contractual matters

A5.1.1 Legal responsibility

The CB shall be a legal entity in the economy in which it is located or shall be a defined part of a legal entity, such that it can be held legally responsible for all its Certification activities. It shall be registered under the applicable national law so that it can function legally, make decisions independently and may sue and be sued in its own name. A governmental certification body is deemed to be a legal entity on the basis of its governmental status. A CB, that is part of an organization involved in functions other than certification, shall be separate and identifiable within that organization structure.

The certification body shall be responsible for meeting national or other legal requirements in the countries where it operates, with specific reference to the product certification activities being undertaken.

The certification body shall meet or fulfill the requirements of the certification scheme, the referenced documents, and any further requirement specified by the scheme owner(s) under which it operates.

A5.1.2 Certification agreement

The requirements of ISO/IEC 17021-1:2015, 5.1.2 apply. The certification agreement shall also include the following:

  1. allow the certification body to exchange information with other accredited certification bodies, authorized accreditation bodies as per the specific certification scheme requirements, as part of its ongoing evaluations.
  2. inform the certification body about any other certifications and certification body relationships that share the same scope – situation of 2 different scopes from two different CBs.
  3. make all necessary arrangements for:
    1. the conduct of evaluation/audits, including providing documentation and records, and access to relevant facilities, equipment, location(s), area(s), personnel, and client’s subcontractors and all other specific scheme requirements; and
    2. the investigation of complaints or other stakeholder comments.
  4. only make claims regarding certification consistent with the certification scheme requirements and scope of certification and following the issuance of the scope certificate.
  5. discontinue its use of all advertising material that contains any reference to or claims regarding certification and the standard upon suspension, withdrawal, or expiry of certification.
  6. conform with the applicable rules for use of logo/symbol/mark and any other requirements specified by the scheme owner when referencing the scheme owner for its certification or using marks of conformity in communication media such as documents, brochures, or advertising.
  7. allow Scheme owner and AB for any audits either as observers during CB’s audits or directly as part of their own surveillance.
  8. accept that the certification body may conduct short notice audits, unannounced audits, and/or confirmation visits, for the purpose of monitoring the organization’s conformity with applicable requirements of this standard and the AYUSH Quality Mark programme requirements.
  9. accept that the accreditation body also has the right to conduct audits of the client, including short notice audits, unannounced audits, and confirmation visits, for the purpose of monitoring certification body conformity with AYUSH Quality Mark programme requirements.

A5.1.3 Responsibility for certification decisions

The requirements of ISO/IEC 17021-1:2015, 5.1.3 shall apply.

A5.2 Management of impartiality

The requirements of ISO/IEC 17021-1:2015, 5.2 shall apply.

A5.2.01 The CB shall be, and perceived to be, impartial in relation to its applicants and certified entities.

A5.2.5 In addition, the certification body, or any part of the same legal entity, or its personnel, shall not provide any Ayush related consultancy. Nor shall it be linked to any entity which provides management systems or Ayush related consultancy.

The Certification Body shall collect information related to the provider (name of the organization and name of the individual consultant) of the consultancy services to their client. This information shall be documented in the application or audit report and available upon request to the Scheme owner or an Accreditation Body.

The CB and its personnel shall not engage in any activities that may present an unacceptable risk to its impartiality.

The certification body shall establish rules and procedures to prevent or minimize threats of conflict of interest. Any actual or perceived interest in an action that results in or has the appearance of resulting in personal, organizational, or professional gain is considered to be a conflict of interest. In particular, and decisions at all stages of the certification process related to the potential conflict of interest:

  1. if a conflict of interest between certification personnel and an organization is found after an audit has occurred, another unbiased person shall be assigned to determine if it has affected the certification process and to complete the remainder of the process if applicable.
  2. an individual auditor shall not audit the same organization in more than three consecutive years.
  3. personnel shall not be allowed to assess their own work.

A5.2.14 The CB shall not impart education and/or training in area related to this programme within the same legal entity.

A5.2.15 Normally there shall be rotation of auditors. In any case, the CB shall not assign the same auditor to the same client for more than three (3) consecutive years. After this period, the auditor can only perform an audit of that client after a three (3) year break away.

An exemption to the above can be given, where the auditor is part of an audit team, and this is well justified. An impartiality assessment shall be performed prior to the release of the auditor in question. This impartiality assessment shall be per audit and a confirmation of the Impartiality Committee is required.

A6. Structural requirements

The requirements of ISO/IEC 17021-1:2015, 6 shall apply.

A7. Resource requirements

A7.1 Competence of personnel

The requirements of ISO/IEC 17021-1:2015, 7.1 shall apply. In addition, the following apply:

A7.1.2 Auditors/inspectors/evaluators and other personnel including application reviewer, technical reviewer and/or decision maker shall meet the minimum qualifications as prescribed by the Scheme owner(s) subject to the following for the auditors/inspectors/evaluators (howsoever named):

The auditors shall have a bachelor’s degree in relevant stream of Ayush (Ayurveda or Unani or Yoga etc.) and minimum work experience of 5 year including 2 years relevant experience of the domain to be audited within the Ayush stream e.g. industry experience for manufacturing, education/training experience for education/training, healthcare management experience for hospitals etc.

A7.1.3 The CB shall take responsibility for ensuring that training and qualification requirements are met with for all empanelled personnel (auditors/inspectors) and the personnel of outsourced entity unless it is an accredited CAB.

A7.1.3 Evaluation processes

The requirements of ISO/IEC 17021-1:2015, 7.1.3 shall apply.

A7.1.4 Other considerations

The requirements of ISO/IEC 17021-1:2015, 7.1.4 shall apply.

A7.2 Personnel involved in the certification activities

The requirements of ISO/IEC 17021-1:2015, 7.2 shall apply.

A7.3 Use of individual external auditors and external technical advisors

The requirements of ISO/IEC 17021-1:2015, 7.3 shall apply.

A7.4 Personnel records

The requirements of ISO/IEC 17021-1:2015, 7.4 shall apply.

A7.5 Outsourcing

The requirements of ISO/IEC 17021-1:2015, 7.5 shall apply.

A8. Information requirements

A8.1 Public information

The requirements of ISO/IEC 17021-1:2015, 8.1 shall apply. In addition, the following shall apply:

  1. The CB shall maintain a website for providing information about the Ayush Quality Mark Programme and its certification activities under the Programme including the following.
  2. The CB shall maintain and make publicly available information describing its certification processes for granting, maintaining, extending, renewing, reducing, suspending or withdrawing certification, and about the certification activities and geographical areas in which it operates.
  3. The CB shall make publicly available detailed information about applications registered and certifications granted, suspended or withdrawn under the Scheme.
  4. The CB shall make publicly available on its website its processes for handling appeals and complaints.
  5. The CB shall publicly display its code of integrity and conduct applicable to its personnel.

A8.2 Certification documents

The requirements of ISO/IEC 17021-1:2015, 8.2 shall apply. In addition, the following shall apply:

A8.2.2 (g) The Ayush Quality Mark may be used on the certificates.

A8.3 Reference to certification and use of marks

The requirements of ISO/IEC 17021-1:2015, 8.3 shall apply.

A8.4 Confidentiality

The requirements of ISO/IEC 17021-1:2015, 8.4 shall apply.

A8.5 Information exchange between the Certification Body and its clients

The requirements of ISO/IEC 17021-1:2015, 8.5 shall apply.

A8.6 Information exchange with PO

A8.6.1 The CB shall provide audit documentation (including documentation related to unannounced audits) to the PO on conclusion of each audit.

A8.6.2 The Certification Body shall provide an annual report to the PO in the prescribed format.

A9. Process requirements

A9.1 Pre-certification activities

The requirements of ISO/IEC 17021-1:2015, 9.1 shall apply.

A9.2 Planning audits

The requirements of ISO/IEC 17021-1:2015, 9.2 shall apply except the following change:

A9.2.2.1.3 The interpreter, if used, shall be independent of client.

A9.3 Initial certification

The requirements of ISO/IEC 17021-1:2015, 9.3 shall apply.

A9.4 Conducting audits

The requirements of ISO/IEC 17021-1:2015, 9.4 shall apply.

A9.4.1 General

The requirements of ISO/IEC 17021-1:2015, 9.4.1 shall apply.

A9.4.2 Conducting the opening meeting

The requirements of ISO/IEC 17021-1:2015, 9.4.2 shall apply.

A9.4.3 Communication during the audit

The requirements of ISO/IEC 17021-1:2015, 9.4.3 shall apply.

A9.4.4 Obtaining and verifying information

The requirements of ISO/IEC 17021-1:2015, 9.4.4 shall apply.

In addition, where an organization is subject to regulation of product/service, the certification body shall verify the regulator’s permission/licence issued to the manufacturer to manufacture the products for which it has made an application. Further it shall ensure that the organization has a system in place to comply with applicable regulatory requirements and shall audit a sample of regulatory requirements based on risk to verify that the system is effective.

A9.4.5 Identifying and recording audit findings

The requirements of ISO/IEC 17021-1:2015, 9.4.5 shall apply.

A9.4.6 Preparing audit conclusions

The requirements of ISO/IEC 17021-1:2015, 9.4.6 shall apply.

A9.4.7 Conducting the closing meeting

The requirements of ISO/IEC 17021-1:2015, 9.4.7 shall apply.

A9.4.8 Audit report

The requirements of ISO/IEC 17021-1:2015, 9.4.8 shall apply read with the following:

A9.4.8.3 (b) The scope of certification shall not exceed the scope of products/services for which licence is granted, if the product/service is regulated and licence is essential.

A9.4.8.3 (d) The audit report shall contain information on the manufacturer’s system for ensuring compliance to regulatory requirements and details of audit of regulatory requirements to provide reasonable assurance that the organization complies with applicable regulatory requirements.

A9.4.9 Cause analysis of nonconformities

The requirements of ISO/IEC 17021-1:2015, 9.4.9 shall apply.

A9.4.10 Effectiveness of corrections and corrective actions

The requirements of ISO/IEC 17021-1:2015, 9.4.10 shall apply.

A9.5 Certification decision

The requirements of ISO/IEC 17021-1:2015, 9.5 shall apply.

A9.6 Maintaining certification

A9.6.1 General

The requirements of ISO/IEC 17021-1:2015, 9.6.1 shall apply.

A9.6.2 Surveillance activities

The requirements of ISO/IEC 17021-1:2015, 9.6.2 shall apply.

A9.6.2.2 Surveillance audit

The requirements of ISO/IEC 17021-1:2015, 9.6.2.2 shall apply.

A9.6.3 Recertification

The requirements of ISO/IEC 17021-1:2011, 9.6.3 shall apply, with the following modifications.

The Certification Body shall conduct a recertification audit at least thirty (30) days prior to the expiry date of the certificate to allow time for the certification decision prior to the expiry of the certificate.

A failure to perform the recertification audit before the expiration of the certificate results in the interruption of the certification cycle.

A9.6.4 Special audits

The requirements of ISO/IEC 17021-1:2015, 9.6.4 shall apply with the following additions:

A9.6.4.3 Unannounced audits

The Certification Body shall include an unannounced audit in its audit programme in addition to the prescribed surveillances once in a cycle.

In case of no notice, there is risk of non-operational factory or closed organization – in such cases, the visit is to be termed ‘infructuous’ and repeated.

A9.6.5 Suspending, withdrawing or reducing the scope of certification

The suspension or the withdrawal of a certificate remains the responsibility of the Certification Body. The maximum period of the suspension shall not exceed 6 months.

Once a withdrawal is confirmed, the certification body shall immediately inform the concerned scheme owner(s) about the status change, the reason for withdrawal and submit the certificate under “withdrawn” status.

A9.7 Appeals

The requirements of ISO/IEC 17021-1:2015, 9.7 shall apply.

A9.8 Complaints

The requirements of ISO/IEC 17021-1:2015, 9.8 shall apply.

A9.9 Client records

The requirements of ISO/IEC 17021-1:2015, 9.9 shall apply.

A10. Management system requirements for certification bodies

The requirements of ISO/IEC 17021-1:2015, 10.0 shall apply read with the following:

A10.2.6.4 (a) The internal audit team shall have competence in the Ayush stream and certification scheme for which CB provides certification.