Should you ask your critical suppliers to have ISO Certification?

What is the benefit?

A common requirement for many organisation’s customers is for their suppliers to have certification to standards such as ISO 9001 (Quality), ISO 14001 (Environment), ISO 27001 (Information Security) and/or ISO 45001 (Health & Safety). This may be in tenders, pre-qualification questionnaires or as part of a supplier approval process.

This requirement is set for good reason, it gives a business assurance that its suppliers, contractors, and subcontractors meet a specified level of control, risk management, established processes, commitment to improvement and protection of people, data, or the environment as required by the relevant standard.

So if you have certification in your business, why not ask the same from your supply chain? At least from the critical suppliers, such as those impacting on your products, services or carrying out high risk activities.

You may already ask this of your suppliers, which is great - but does your business check that the supplier has certification from a reputable source?

What is the risk?

You will want to have a level of assurance that the awarding certification body has applied some rigour to the audit(s) or it de-values the process.

These are some things to consider; 

• Is the certification body accredited?

• Did the certification body even visit them at all? 

• Did they see their management system and all the processes? 

• Was the auditor competent? 

• Did they spend an appropriate amount of time auditing them? E.g. 2 days every year vs 1 day every 3 years?

• Were any issues identified?

Whilst choosing a certification body (CB) can include price, some organisations do not realise the difference or significance of which CB they have chosen.

We have personally witnessed fictitious or fraudulent certificates, inadequate audit time considering the risks and activity of the organisation, and even certification bodies that have accredited themselves!

Okay, so what is the fuss really? Well, in your personal life;

• Would you buy a family car that was not NCAP tested and rated? 

• Would you be happy to use a bank that had no customer service processes?

• Would you allow an un-trained, non-Corgi-reigstered gas engineer to service your domestic boiler?

Assurance is important.

The solution

In the UK, Certification bodies that are accredited through UKAS - United Kingdom Accreditation Service (or equivalent outside the UK) are commonly considered the safe choice and are often a strict requirement in the public sector when selecting suppliers.

Certification bodies accredited by UKAS have to comply with International Standards - usually ISO 17021 conformity assessment; which sets out requirements for management of the certification process, impartiality, competence of auditors and required certification audit time.

It is usually quite easy to check on the suppliers certificate whether the certification body is UKAS accredited, or you can search the UKAS certification directory on their website.

If you or any of your suppliers need any help or advice please feel free to contact us.