There are many registration bodies offering certifcation services so the question often asked is which is the best one to use? This is, of course, a matter of
judgement. From 2012, the registration body should be UKAS accredited (in the UK) or another national accreditation body if you are building a management system in another country. The registration body’s accreditation documentation describes the scope of operation that they are approved to operate within (which standards and which sectors) and the geographical locations. So, assuming the registration body has the correct approvals, how do you select the right one to use?
They obviously all offer apparently similar products and services, so the question is what could these be?
A basic registration service
• Certifcation services where the registration body sends an auditor, or more than one if you are a larger organization, to look at the management system.
• Sometimes if you are registered to more than one Standard, for example ISO 9001 and ISO 14001, then they will carry out an integrated audit that should reduce the amount of audit time, as there is some overlap between the Standards.
• You will receive a Yes/No answer to your suitability for certifcation and a report showing which clauses, if any, have nonconformances and some observations where necessary.
Key characteristics – Normally man-day driven. The registration body competes on price – no matter what they say on their marketing material! ! !
An enhanced registration service
There are a range of options that you could use to help improve the value of your investment in certifcation, and some registration bodies are beginning to offer these. These could include:
• Using a range of auditing methods including online that reduce the impact on your organization and disruption to management and staff activities.
• Auditing the real world of what is actually happening, not just the paper one that has been documented, which means having the ability to audit what people actually do, i.e. their behaviour, not just what they say they do or write down.
• Reducing man-day auditing by using other methods.
• Providing benchmarked and scored information as a routine part of their reporting, so that you, and more importantly your managers, can see where business risks and improvements are needed. This benchmarked data could be shown by department, by site, etc., as required to help you understand the risks.
• Like the basic service, you will receive a Yes/No answer to certifcation with any nonconformances. However, reports should also show both tactical and strategic risks/improvement areas to help you target change, benchmarked as required.
• Reporting in the format of executive summaries, reporting against business objectives and using business language that your senior management team can relate to.
• Reporting against clauses and quality principles as a matter of routine, clearly separating this from the business element of the report.
• Focusing on risk management, both in compliance and effectiveness issues.
• Using a sample size that is wide and includes people from outside the scope who are impacted by what the organization does – the ultimate measurers of effectiveness.
Important – the extended role of the registration body
Experience has shown that when implementing and using a management system, management often become disengaged with the system over time if the information presented to them is perceived as being of low value. The registration body therefore has a key role in helping you to show management where their management system can mature to better support the delivery of business objectives.
It therefore follows that some registration bodies as a matter of routine help by providing information that you can use to drive change well beyond compliance.
Selecting an appropriate registration body
85
You need to decide which type of registration body meets your needs and choose one that provides the best ft.
Key characteristics – Normally uses a range of techniques to best suit your needs. Often the price is close to or the same as the basic service and competes by offering more value.
An audit programme service
There is a movement to audit programmes that are more rounded solutions than those provided in the past. Although these are evolving, some examples of the types of services these could include are:
• Using internal audit results as an information feed into certifcation audits, whilst maintaining independence.
• 24/7 auditing, turning auditing from a ‘snap shot picture’ to a ‘movie’ of performance.
• Reporting compliance and business risks to the delivery of the organizational and departmental objectives in real time, not just at an annual visit.
• Taking other performance information feeds into the decision making process, not just their own audit evidence.
• Not issuing reports but feeding data in real time directly to your management using benchmarking sites and dashboards, email alerts, etc.
Key characteristics – Heavily focused on reducing audit impact whilst at the same time increasing value in the performance based information provided to management. The standard(s) they register against are clearly seen as being in the background to focus management. Competes on value and often cheaper overall than the previous two services due to effciencies of the processes and methods they use.
What skills should the auditor be displaying?
There is a standard defning auditor competence, ISO 19011, but in selecting a registration body we would suggest that you should also test them and their auditors’ understanding of the following:
• Do they understand system thinking?
• Do they really understand how a business works? Have they been business managers? It is not enough just to be an expert in the sector you operate in, any auditor needs to know how businesses operate overall.
• Can they show you and explain a process-based management system similar to the one described in this book?
• Can they audit the real world or are they focused on paper?
• Do they use standards jargon or business language?
• Do they expect you to use standard jargon and impose this on you, your organization and how you describe the management system?
• Do they use graphs, scores, values and benchmarks in their audit fndings, or do they just use lots of words?
• Are they focused on looking at what has happened or are they interested in what is likely to or will happen? The past has already happened, whereas management are paid to manage the future.
Above all, is the registration body prepared to create solutions that match what you really need, or is it a case of they only tell you what you will get?
Where to get help and more information
There are a range of sources of help available from individuals, organizations and on the web, but if you have any questions then please feel free to contact the authors and we will be glad to help.
87