ISO/IEC 17029:2019 Conformity assessment — General principles and requirements for validation and verification bodies

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents) or the IEC list of patent declarations received (see http://patents.iec.ch).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT) see  www.iso.org/iso/foreword.html.

This document was prepared by the ISO Committee on Conformity Assessment (CASCO).

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

Validation and verification as conformity assessment are understood to be a confirmation of reliability of information declared in claims. Other terms in use for the object of assessment by validation and verification are “statement”, “declaration”, “assertion”, “prediction” or “report”.

Both activities are distinguished according to the timeline of the assessed claim. Validation is applied to claims regarding an intended future use or projected outcome (confirmation of plausibility), while verification is applied to claims regarding events that have already occurred or results that have already been obtained (confirmation of truthfulness).

Since the requirements in this document are generic in nature, a programme for the particular validation/verification needs to be operated. Such a programme further specifies definitions, principles, rules, processes and requirements for validation/verification process steps, as well as for the competence of validators/verifiers for a specific sector. Programmes can be legal frameworks, international, regional or national standards, global initiatives, sector applications as well as individual agreements with clients of the validation/verification body.

Assurance is provided by validation/verification and gives confidence to stakeholders and parties interested in the claim. The programme can define levels of assurance, e.g. a reasonable or limited level of assurance.

According to ISO/IEC 17000, the functional approach to the demonstration that specified requirements are fulfilled describes conformity assessment as a series of the three functions:

The relationship between the generic terms and concepts defined by ISO/IEC 17000 and the terms and concepts defined by this document is given in Table B.1.

According to this functional approach, validation and verification as conformity assessment include a decision on the confirmation of the claim. The decision as to whether (or not) the claim conforms with the initially specified requirements is then issued by the validation/verification body as the validation/verification statement. The specified requirements can be general or detailed, e.g. the claim being free from material misstatements. The applicable programme can define additional steps within the validation/verification process.

When determining whether the claim by a client can be confirmed, validation/verification bodies need to gather information and develop a complete understanding regarding fulfilment of the specified requirements. This can include an appropriate evaluation of data and plans, reviewing documentation, performing alternative calculations, visiting sites or interviewing people.

The requirements specified by this document are common to both activities, validation as well as verification. Wherever a requirement applies only to one activity it is identified.

Validation/verification bodies can be internal bodies of the organization that provides the claim (first party), bodies that have a user interest in the claim (second party) or bodies that are independent of the person or organization that provides the claim and have no user interests in that claim (third party).

By defining validation/verification as confirmation, these activities are differentiated from other conformity assessment tools as neither resulting in a characterization (testing) nor providing examination (inspection) or an attestation of conformity for a defined period (certification). However, validation/verification is intended to match applications of the conformity assessment system. Just as test reports from a laboratory can be included for inspection purposes, or auditing the producer’s management system can be used as an input for product certification, validation/verification statements can be used as an input for another conformity assessment activity. Likewise, results of other conformity assessment activities can be used as an input when performing validation/verification activities.

Statements of conformity themselves, issued as a result of another conformity assessment activity, are not considered to be objects of validation/verification according to this document. This includes, for example, a supplier’s declaration of conformity regarding product specifications according to ISO/IEC 17050, certificates according to ISO/IEC 17021-1 or design examination and verification in the context of inspection according to ISO/IEC 17020.

Furthermore, this document does not apply to situations where validation/verification activities are undertaken as steps within the process of testing (ISO/IEC 17025, ISO 15189), inspection (ISO/IEC 17020) or certification (ISO/IEC 17021-1, ISO/IEC 17065) and where specific requirements need to be applied for structuring and performing these processes. Examples are method validation as a step of a testing performed in accordance with ISO/IEC 17025 and design validation/verification in the context of implementing a management system according to ISO 9001.

Current examples for validation/verification as conformity assessment activities include claims related to greenhouse gas emissions (e.g. according to ISO 14064-3), environmental labelling, product declarations and footprints (e.g. according to ISO 14020 and ISO 14040, such as the environmental product declaration), sustainability or environmental reporting (e.g. according to ISO 14016). Potential new applications can include claims relating to construction technology, energy management, financial management, industrial automation systems, software and systems engineering, artificial intelligence, information technology, healthcare products and medical devices, machine safety, safety and design engineering, and social responsibility. However, in sector applications where validation/verification are not performed as conformity assessment activities as defined by this document, these activities are not within the scope of this document.

In this document, the following verbal forms are used:

Further details can be found in the ISO/IEC Directives, Part 2.

For the purposes of research, users are encouraged to share their views on this document and their priorities for changes to future editions. Click on the link below to take part in the online survey:

https://fr.surveymonkey.com/r/NG3LYKD

1 Scope

This document contains general principles and requirements for the competence, consistent operation and impartiality of bodies performing validation/verification as conformity assessment activities.

Bodies operating according to this document can provide validation/verification as a first-party, second-party or third-party activity. Bodies can be validation bodies only, verification bodies only, or provide both activities.

This document is applicable to validation/verification bodies in any sector, providing confirmation that claims are either plausible with regards to the intended future use (validation) or truthfully stated (verification). However, results of other conformity assessment activities (e.g. testing, inspection and certification) are not considered to be subject to validation/verification according to this document. Neither are situations where validation/verification activities are performed as steps within another conformity assessment process.

This document is applicable to any sector, in conjunction with sector specific programmes that contain requirements for validation/verification processes and procedures.

This document can be used as a basis for accreditation by accreditation bodies, peer assessment within peer assessment groups, or other forms of recognition of validation/verification bodies by international or regional organizations, governments, regulatory authorities, programme owners, industry bodies, companies, clients or consumers.

NOTE

This document contains generic requirements and is neutral with regard to the validation/verification programme in operation. Requirements of the applicable programmes are additional to the requirements of this document.

2 Normative references

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• ISO/IEC 17000 Conformity assessment — Vocabulary and general principles

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 17000 and the following apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

3.1 claim

3.2 validation

3.3 verification

3.4 validation body

3.5 verification body

3.6 validation statement

3.7 verification statement

3.8 validation programme

3.9 verification programme

3.10 programme owner

3.11 scope of validation/verification

3.12 impartiality

3.13 client

3.14 consultancy

3.15 level of assurance

3.16 material

4.1.1

The principles described in this clause provide the basis for the requirements specified in this document. These principles should be applied as guidance for decisions that sometimes need to be made for unanticipated situations. Principles are not requirements.

4.1.2

The overall aim of validation/verification is to give confidence to all parties that a validated/verified claim fulfils the specified requirements. The value of validation/verification is the confidence that is established by an impartial evaluation by a competent validation/verification body.

4.1.3

Parties that have an interest in validation/verification include, but are not limited to:

1. a) clients of the validation/verification bodies;
2. b) programme owners;
3. c) users of the validated/verified claims;
4. d) regulatory authorities.

4.2.1 Evidence-based approach to decision making

The process deploys a method for reaching reliable and reproducible validation/verification conclusions and is based on sufficient and appropriate objective evidence. The validation/verification statement is based on evidence collected through an objective validation/verification of the claim.

4.2.2 Documentation

The validation/verification process is documented and establishes the basis for the conclusion and decision regarding conformity of the claim with the specified requirements.

4.2.3 Fair presentation

Validation/verification activities, findings, conclusions and statements, including significant obstacles encountered during the process, as well as unresolved, diverging views between the validation/verification body and the client are truthfully and accurately reflected.

4.3.1 Impartiality

Decisions are based on objective evidence obtained through the validation/verification process and are not influenced by other interests or parties.

Threats to impartiality can include but are not limited to the following.

1. a) Self-interest: threats that arise from a person or body acting in their own interest. A concern related to validation/verification, as a threat to impartiality, is financial self-interest.
2. b) Self-review: threats that arise from a person or body reviewing the work done by themselves.
3. c) Familiarity (or trust): threats that arise from a person or body being too familiar with or trusting of another person instead of seeking evidence for validation/verification.
4. d) Intimidation: threats that arise from a person or body having a perception of being coerced openly or secretively, such as a threat to be replaced or reported to a supervisor.

4.3.2 Competence

Personnel have the necessary knowledge, skills, experience, training, supporting infrastructure and capacity to effectively perform validation/verification activities.

4.3.3 Confidentiality

Confidential information obtained or created during validation/verification activities is safeguarded and not inappropriately disclosed.

4.3.4 Openness

A validation/verification body needs to provide public access to, or disclosure of, appropriate information about its validation/verification process.

4.3.5 Responsibility

The client of the validation/verification body, and not the validation/verification body, has the responsibility for the claim and its conformity with the applicable specified requirements.

The validation/verification body has the responsibility to base a validation/verification statement upon sufficient and appropriate objective evidence.

4.3.6 Responsiveness to complaints

Parties that have an interest in validation/verification have the opportunity to make complaints. These complaints are appropriately managed and resolved. Responsiveness to complaints is necessary in order to demonstrate integrity and credibility to all users of validation/verification outcomes.

4.3.7 Risk-based approach

Validation/verification bodies need to take into account the risks associated with providing competent, consistent and impartial validation/verification. Risks can include, but are not limited to, those associated with:

1. a) the objectives of the validation/verification and the programme requirements;
2. b) competence, consistency and real as well as perceived impartiality;
3. c) legal, regulatory and liability issues;
4. d) the client organization, where validation/verification is being carried out, and its management system, operating environment, geographic location, etc.;
5. e) the susceptibility of any parameter included in the claim to generate a material misstatement, even if there is a control system implemented;
6. f) the level of assurance to be achieved and the corresponding evidence-gathering used in the validation/verification process;
7. g) perception of interested parties;
8. h) misleading claims or misuse of marks by the client;
9. i) risk control and opportunities for improvement.

5.1 Legal entity

The validation/verification body shall be a legal entity, or a defined part of a legal entity, that can be held legally responsible for all its validation/verification activities.

NOTE

A governmental validation/verification body is a legal entity on the basis of its governmental status.

5.2 Responsibility for validation/verification statements

The validation/verification body shall be responsible for, and shall retain authority for, its validation/verification statements.

5.3.1

Validation/verification activities shall be undertaken impartially.

5.3.2

The validation/verification body shall be responsible for the impartiality of its validation/verification activities and shall not allow commercial, financial or other pressures to compromise impartiality.

5.3.3

The validation/verification body shall monitor its activities and its relationships to identify threats to its impartiality. This monitoring shall include the relationships of its personnel.

NOTE 1

While the requirements for impartiality in this document are the same for first-, second- and third-party bodies, the relevant inputs and outcome of the respective risk assessment can differ.

NOTE 2

The identification of threats to impartiality can include balanced consultation with appropriate interested parties, with no single interest predominating, to advise on matters affecting impartiality including openness and public perception. One way of consultation is by the use of a committee of these interested parties.

NOTE 3

The programme can make the requirement for consultation with appropriate interested parties to advise on matters affecting impartiality mandatory.

NOTE 4

A relationship can be based on ownership, governance, management, personnel, shared resources, finances, contracts, marketing (including branding). Such relationships do not necessarily present a validation/verification body with a threat to impartiality.

5.3.4

If a threat to impartiality is identified, its effect shall be eliminated or minimized so that the impartiality is not compromised.

5.3.5

The validation/verification body shall have top management commitment to impartiality.

5.3.6

The validation/verification body shall have a publicly available commitment that it understands the importance of impartiality in carrying out its validation/verification activities and manages conflicts of interest and ensures objectivity.

5.3.7

Review (9.6) and decision (9.7) shall be made by personnel different from those who carried out the validation/verification execution (9.5).

5.3.8

When providing both validation and verification to the same client, the validation/verification body shall consider the potential threat to impartiality (e.g. self-review and familiarity) and shall manage this risk accordingly.

5.3.9

The validation/verification body shall not offer or provide both consultancy and validation/verification for the same claim from the same client.

5.3.10

Where the relationship between a body that provides consultancy and the validation/verification body poses an unacceptable threat to the impartiality of the validation/verification body, the validation/verification body shall not provide validation/verification activities to clients who have received consultancy relating to the same claim. This includes potential clients with which the validation/verification body is pre-engaged.

5.3.11

The validation/verification body’s activities shall not be marketed or offered as linked with the activities of any organization that provides consultancy.

5.3.12

The validation/verification body shall take action when it is made aware of (e.g. via a complaint) inappropriate links with or announcements by any consultancy organization stating or implying that validation/verification would be simpler, easier, faster or less expensive if the validation/verification body were used. A validation/verification body shall not state or imply that validation/verification would be simpler, easier, faster or less expensive if a specified consultancy organization were used.

5.3.13

The validation/verification body shall take action to respond to any threats to its impartiality arising from the actions of other persons, bodies or organizations. This includes the actions of those bodies to which validation/verification activities have been outsourced.

5.4 Liability

The validation/verification body shall be able to demonstrate that it has evaluated the risks arising from its validation/verification activities and that it has adequate arrangements (e.g. insurance or reserves) to cover liabilities arising from its activities in each validation/verification programme and the geographic areas it operates.

6.1.1

The validation/verification body shall be organized and managed so as to enable it to maintain the capability to perform its validation/verification activities.

6.1.2

Validation/verification activities shall be structured and managed so as to safeguard impartiality.

6.1.3

The validation/verification body shall document its organizational structure, duties, responsibilities and authorities of management and other personnel involved in the validation/verification activities and any committees. If the validation/verification body is a defined part of a legal entity, the structure shall include the line of authority and the relationship to other parts within the same legal entity.

6.1.4

The validation/verification body shall identify the top management (board, group of persons, or person) having overall authority and responsibility for each of the following:

1. a) development of policies and establishment of processes relating to its operations;
2. b) supervision of the implementation of the policies and processes;
3. c) ensuring impartiality;
4. d) supervision of its finances;
5. e) development of validation/verification activities and requirements;
6. f) performance of validation/verification activities;
7. g) decisions and issue of validation/verification statements;
8. h) delegation of authority to committees or individuals, as required, to undertake defined activities on its behalf;
9. i) contractual arrangements;
10. j) personnel competence requirements;
11. k) responsiveness to complaints and appeals;
12. l) management system of the validation/verification body;
13. m) provision of adequate resources for validation/verification activities.

6.2.1

The validation/verification body shall have a process for the effective control of validation/verification activities delivered by entities under its operational control, branch offices, partnerships, agents, franchisees, etc., irrespective of their legal status, relationship or geographical location.

6.2.2

The validation/verification body shall determine and establish the appropriate level and method of control of activities undertaken. This includes its processes, sectors of validation/verification activities, competence of personnel, lines of management control, reporting and remote access to operations, and records.

6.2.3

The validation/verification body shall consider the risk that these activities pose to the competence, consistency and impartiality of the validation/verification body.

7.1 General

The validation/verification body shall have access to personnel, facilities, equipment, systems and support services that are necessary to perform its validation/verification activities.

NOTE

Requirements for personnel, facilities, equipment, systems and support services can be contained in the validation/verification programme.

7.2.1

The validation/verification body shall have access to a sufficient number of competent persons to perform its validation/verification activities.

NOTE

Personnel include those persons that are employees, directors and committee members of the body, and any contracted persons that are used by the body to undertake validation/verification activities.

7.2.2

The validation/verification body shall require all personnel involved in validation/verification activities to enter into a legally enforceable agreement by which the personnel commit themselves to the following:

1. a) to comply with the processes and instructions of the validation/verification body, including those relating to impartiality and confidentiality;
2. b) to declare any prior and/or present association on their own part, or on the part of another person or organization with which they have a relationship (e.g. a family member or their employer), with a client of the validation/verification body;
3. c) to reveal any situation known to them that can present them or the validation/verification body with a perceived or actual conflict of interest.

7.2.3

The validation/verification body shall use this information as input into identifying threats to impartiality raised by the activities of such personnel, or by the persons or organizations related to them (see 5.3.3).

7.2.4

All personnel of the validation/verification body, either internal or external, that could influence the validation/verification activities, shall act impartially.

7.2.5

Within a period specified by the validation/verification body, personnel who have provided consultancy on the claim to be the object of validation/verification shall not perform validation/verification activities in relation to their previous involvement. The period shall be long enough to ensure that the threats to impartiality are minimized or eliminated.

NOTE

The period can be specified in the programme.

7.2.6

Personnel, including any committee members, contractors, personnel of external bodies, or individuals acting on the validation/verification body's behalf, shall keep confidential all information obtained or created during the performance of the body's validation/verification activities.

7.2.7

The validation/verification body shall communicate to personnel their duties, responsibilities and authorities.

7.3.1

The validation/verification body shall have a process for managing competence of its personnel involved in the validation/verification activities.

7.3.2

The processes shall require the validation/verification body:

1. a) to determine the criteria for the competence of personnel for each function in the validation/verification process, including at least:

   — the ability to apply generic validation/verification concepts (e.g. evidence gathering, risk, misstatements, level of assurance, materiality);

   — knowledge about the type and typical content of the client’s claim;

   — knowledge of the programme requirements (e.g. competence required for specific validation/verification process);

2. b) to identify training needs and provide, as necessary, training on validation/verification processes, requirements, methodologies, activities and other relevant validation/verification programme requirements;
3. c) to demonstrate that the personnel have the required competence for the duties and responsibilities they undertake;
4. d) to formally authorize personnel for functions in the validation/verification process;
5. e) to monitor the performance of the personnel.

NOTE

Further requirements for competence of personnel can be contained in the validation/verification programme.

7.3.3

The validation/verification body shall have documented information demonstrating competence of its personnel involved in the validation/verification activities. This includes relevant education, training, experience, performance monitoring, affiliations, and professional status.

7.4 Outsourcing

In the absence of applicable programme prohibitions on outsourcing, the validation/verification body may outsource validation /verification activities and shall:

1. a) retain full responsibility for the validation/verification;
2. b) not outsource the engagement activities (9.3), the decision on the confirmation of the claim and the issue of the statement (9.7);
3. c) have a legally enforceable agreement, including confidentiality and management of impartiality requirements, with each body that provides outsourced activities;
4. d) have ensured that the body that provides outsourced activities conforms with the applicable requirements of this document, including competence, impartiality and confidentiality and to any applicable programme requirements;
5. e) obtain consent from the client to use the organization that provides the outsourced activities.

NOTE 1

Outsourcing refers to contract arrangements with another organization, including other validation/verification bodies, to provide validation/verification activities to the validation/verification body.

NOTE 2

Where the validation/verification body engages individuals or employees of other organizations to provide additional resources or expertise, these individuals or employees do not constitute outsourcing provided they are individually contracted to operate under the validation/verification body’s management system.

8 Validation/verification programme

The validation/verification body shall apply one or more validation/verification programme(s) that are consistent with, and do not exclude the requirements of this document.

NOTE 1

A validation/verification programme is a set of rules, procedures and management for carrying out validation/verification activities in a specific sector containing the following elements:

NOTE 2

Annex A specifies the elements than can be included in a validation/verification programme.

9.1 General

The validation/verification body shall complete the following process steps as validation/verification activities:

9.2.1

The validation/verification body shall require the client to submit information sufficient to carry out a pre-engagement review, including at least the following:

1. a) client name and the proposed claim to be validated/verified;
2. b) locations where the client’s activities are undertaken;
3. c) the validation/verification programme and associated specified requirements for the validation/verification;
4. d) the objectives and scope of the validation/verification;
5. e) reports, data and any other relevant information;
6. f) where known at this stage and where applicable, the materiality and the level of assurance;
7. g) any other information as required by the validation/verification programme.

9.2.2

The validation/verification body shall conduct a pre-engagement review of the information received from the client to ensure that:

1. a) an applicable programme exists or a programme is to be established;
2. b) the claim is understood (e.g. context, content and complexity);
3. c) the objectives and scope of the validation/verification have been agreed with the client;
4. d) the specified requirements against which the claim will be validated/verified have been identified and are suitable;
5. e) where applicable, the materiality and level of assurance have been agreed;
6. f) the process for validation/verification activities can be achieved (e.g. evidence gathering activities, evaluation of gathered evidences);
7. g) the validation/verification duration can be estimated;
8. h) the validation/verification body has identified and has access to the resources and competences that are required to undertake the validation/verification;
9. i) the time frame for the planned validation/verification can be proposed.

9.2.3

Following the pre-engagement review of the submitted information by the client the validation/verification body shall either accept or decline to perform validation/verification.

9.3.1

The validation/verification body shall have an agreement with each client for the provision of validation/verification activities in accordance with the relevant requirements of this document and the requirements specified in the applicable validation/verification programme:

1. a) for second- and third-party validation/verification activities, a legally enforceable agreement (e.g. a contract);
2. b) for first party validation/verification activities, an internal agreement such as service level agreement, internal contract, statement of work, or other enforceable internal agreement.

9.3.2

The validation/verification body shall ensure its agreement requires that the client complies at least with the following:

1. a) validation/verification requirements;
2. b) making all necessary arrangements for the conduct of the validation/verification, including provisions for examining documentation and access to all relevant processes, areas, records, and personnel;
3. c) where applicable, making provisions to accommodate observers;
4. d) complying with the rules of the validation/verification body for reference to validation/verification or use of marks (10.3).

9.3.3

The agreement shall confirm that the client engages the validation/verification body to undertake validation/verification activities, including the specification of:

1. a) the items listed in 9.2.2;
2. b) the specific requirements for the validation/verification activity, including any additional relevant requirements set by a programme or standard.

9.3.4

The validation/verification body shall take responsibility for any inputs that it accepts to take into account as part of its validation/verification activities, including those that have been generated by the client or other external parties.

9.4.1

The validation/verification body shall undertake the following planning activities taking into account the requirements specified in the applicable validation/verification programme before undertaking the validation/verification activities:

1. a) assign competent resources to undertake the activities;
2. b) determine the validation/verification activities based on the understanding of the claim;
3. c) assess the risk of a material misstatement regarding the claim;
4. d) confirm the timing and access arrangements with the client;
5. e) determine evidence-gathering activities needed to complete the validation/verification in accordance with the specified requirements and consistent with the results of b) and c);
6. f) prepare an evidence-gathering plan, taking into account c) and any measures that the client has in place to control sources of potential errors, omissions and misrepresentations;
7. g) prepare a validation/verification plan (9.4.2) considering the evidence-gathering plan as an input.

NOTE 1

Preparation of an evidence-gathering plan and a validation/verification plan can be an iterative process.

NOTE 2

In some programmes, the evidence-gathering plan is called “sampling plan”.

NOTE 3

Other parameters that can be specified by programmes to be considered during planning are materiality or level of assurance.

NOTE 4

The level of assurance is used to determine the depth of detail that a validation/verification body designs into their validation/verification plan and evidence-gathering plan to determine if there are any material errors, omissions, or misrepresentations.

9.4.2

The validation/verification body shall develop a validation/verification plan that describes activities and schedules, and that includes the following:

1. a) objectives and scope of validation/verification;
2. b) identification of the validation/verification team members and their roles and responsibilities in the team (e.g. team leader, observer);
3. c) time frame and duration of validation/verification activities;
4. d) specified requirements.

9.4.3

The validation/verification body shall inform the client of the names and roles of the team members with sufficient notice for any objection to the appointment of a team member to be made.

9.4.4

The validation/verification body shall communicate to the client the validation/verification plan.

9.5.1

The validation/verification body shall perform the validation/verification execution activities in accordance with the validation/verification plan.

9.5.2

The validation/verification plan shall be revised as necessary during the validation/verification execution activities.

9.5.3

Any revisions to the validation/verification plan shall be internally documented, including the reasons, and communicated to the client.

9.5.4

The body shall undertake the following activities:

1. a) collection of sufficient objective evidence on original data/information, ensuring its traceability through the data/information management process, any further analysis and calculation;
2. b) identification of misstatements and consideration of their materiality;
3. c) assessment of conformity with specified requirements, taking into account the validation/verification programme.

9.5.5

The validation/verification body shall prepare the following:

1. a) a conclusion on the outcome of the activities in 9.5.4;
2. b) a draft validation/verification statement;
3. c) a report, if applicable.

NOTE

The report can be a separate document or can be included in a document containing the draft validation/verification statement.

9.6.1

The validation/verification body shall undertake review activities.

9.6.2

The review shall be carried out by persons who have not been involved in the validation/verification execution.

NOTE

A programme can specify further limitations, e.g. requiring the review to be made by persons who have not been involved in particular validation/verification planning activities.

9.6.3

The review shall confirm:

1. a) that all validation/verification activities have been completed in accordance with the agreement and the programme;
2. b) sufficiency and appropriateness of evidence to support the decision;
3. c) whether significant findings have been identified, resolved, and documented.

9.6.4

The reviewer shall communicate with the validation/verification team when the need for clarification arises. The validation/verification team shall address concerns raised by the reviewer.

9.6.5

The review shall have available all records of the validation/verification activities as specified in 9.11.

9.7.1.1

Upon completion of the validation/verification review, the validation/verification body shall make the decision on whether or not to confirm the claim.

9.7.1.2

The decision shall be made by persons who have not been involved in the validation/verification execution.

NOTE

A programme can specify further limitations, e.g. requiring the decision to be made by persons who have not been involved in particular validation/verification planning activities.

9.7.1.3

Based on this decision, a validation/verification statement is issued or not issued according to the programme requirements.

9.7.1.4

When the validation/verification body is not issuing a validation/verification statement, the validation/verification body shall inform the client.

9.7.2 Issue of the validation/verification statement

When the validation/verification body issues a validation/verification statement, (9.7.1) the statement shall:

1. a) state the client’s name;
2. b) identify whether it is a validation statement or a verification statement;
3. c) refer to the claim, including date or period which the claim covers;
4. d) include the type of the validation/verification body in relation to the statement in question (i.e. first party, second party or third party);
5. e) include the name and address of the validation/verification body (if symbols, e.g. accreditation symbol, are included, they shall not be misleading or ambiguous);
6. f) describe the objectives and scope of the validation/verification;
7. g) describe whether the data and information supporting the claim were hypothetical, projected and/or historical in nature;
8. h) include a reference to the validation/verification programme and associated specified requirements;
9. i) include the decision made about the claim, including the fulfilment of any programme related requirements (e.g. materiality or level of assurance);
10. j) indicate the date and the unique identification of the statement;
11. k) include any findings, that have not been addressed prior to the issue of the validation/verification statement, if required by the programme.

9.8.1

If new facts or information that could materially affect the validation/verification statement are discovered after the issue date, the validation/verification body shall:

1. a) communicate the matter as soon as practicable to the client and, if required, the programme owner;
2. b) take appropriate action, including the following:
   1. 1) discuss the matter with the client;
   2. 2) consider if the validation/verification statement requires revision or withdrawal.

9.8.2

If the validation/verification statement requires revision, the validation/verification body shall implement processes to issue a new statement including specification of the reasons for the revision. These can include repeating relevant steps of the validation/verification process.

9.8.3

The validation/verification body may also communicate to other interested parties the fact that reliance of the original statement can now be compromised given the new facts or information.

9.9.1

The validation/verification body shall have a documented process to receive, evaluate and make decisions on appeals.

9.9.2

The process for handling appeals shall include at least the following:

1. a) a description of the process for receiving, investigating, substantiating the appeal, and deciding what actions are to be taken in response;
2. b) tracking and recording the appeal, including the actions to resolve it;
3. c) ensure appropriate action is taken.

9.9.3

The validation/verification body receiving the appeal shall be responsible for gathering all necessary information to determine whether the appeal is substantiated.

9.9.4

The validation/verification body shall acknowledge receipt of the appeal, and provide the appellant with the outcome and, if applicable, progress reports.

9.9.5

A description of the process for handling appeals shall be available to any interested party.

9.9.6

The body shall be responsible for all decisions during the process for handling appeals.

9.9.7

Investigation and decision on appeals shall not result in any discriminatory actions.

9.9.8

The decision on the appeal shall be made by, or reviewed and approved by, individuals not involved in the decision which is the subject of the appeal in question.

9.10.1

The validation/verification body shall have a documented process to receive, evaluate and resolve complaints.

9.10.2

The process for handling complaints shall include at least the following:

1. a) a description of the process for receiving, substantiating, investigating the complaint, and deciding what actions are to be taken in response;
2. b) tracking and recording the complaint, including the actions undertaken to resolve it;
3. c) ensuring appropriate action is taken.

9.10.3

The validation/verification body receiving the complaint shall be responsible for gathering all necessary information to determine whether the complaint is substantiated.

9.10.4

Whenever possible, the validation/verification body shall acknowledge receipt of the complaint, and provide the complainant with the outcome and, if applicable, progress reports.

9.10.5

A description of the process for handling complaints shall be available to any interested party.

9.10.6

Upon receipt of a complaint, the body shall confirm whether the complaint relates to its validation/verification activities and, if so, shall resolve the complaint.

9.10.7

Investigation and resolution of complaints shall not result in any discriminatory actions.

9.10.8

The resolution of complaints shall be made by, or reviewed and approved by, individuals not involved in the complaint in question. Where resources do not permit this, any alternative approach shall not compromise impartiality.

9.11.1

The validation/verification body shall maintain and manage records of its validation/verification activities including:

1. a) information submitted during pre-engagement and scopes of validation/verification;
2. b) justification for how validation/verification duration is determined;
3. c) any revisions to the validation/verification planning activities;
4. d) demonstration that the validation/verification activities have been carried out in accordance with the requirements of this document and the validation/verification programme including findings and information on material or non-material misstatements;
5. e) evaluation, selection and monitoring of performance of bodies providing outsourced activities;
6. f) evidence to support conclusions and the decisions;
7. g) validation/verification statements;
8. h) complaints and appeals, and any subsequent correction or corrective actions.

9.11.2

The validation/verification body shall maintain validation/verification records securely and confidentially, including during their transport, transmission, or transfer.

9.11.3

The validation/verification body shall retain validation/verification records in accordance with the programme, contractual, and other management system requirements.

NOTE

ISO 15489-1 defines the concepts and principles from which approaches to the creation, capture and management of records are developed.

10.1.1

The validation/verification body shall ensure the following information is made publicly available:

1. a) information about the validation/verification process;
2. b) commitment to impartiality;
3. c) list of validation/verification activities the validation/verification body provides, including reference to applicable programmes;
4. d) complaints and appeals process.

10.2.1

The validation/verification body shall maintain and, upon request, provide clear, traceable, and accurate information about its activities and the sectors in which it operates.

10.2.2

Unless otherwise specified in the programme, the validation/verification body shall provide, upon request, the status of a given validation/verification statement.

10.2.3

The validation/verification body shall provide information and update clients on the following:

1. a) the applicable validation/verification programmes and any changes;
2. b) the fees for the validation/verification activity;
3. c) the validation/verification body’s requirements for the client to:
   1. 1) comply with the validation/verification programme;
   2. 2) make all necessary arrangements for the conduct of the validation/verification activities;
   3. 3) make provisions, where applicable, to accommodate the presence of observers (e.g. accreditation assessors or trainee validator/verifier);
4. d) its policy governing any statement that the client is authorized to use when making reference to its validation/verification statement in communication of any kind in line with the requirements in 10.3.

10.3.1

A validation/verification body shall have rules governing any reference to validation/verification or use of its marks that it authorizes its clients to use. These rules shall ensure, among other things, traceability back to the validation/verification body and to the validation/verification statement issued.

10.3.2

This reference or marks shall be used only in relation to the claim which has been validated/verified and shall not be misleading with regards to product certification.

10.4.1

The validation/verification body shall be responsible, through legally enforceable agreements, for the management of all information obtained or created during the performance of validation/verification activities.

10.4.2

The validation/verification body shall inform the client, in advance, of the information it intends to place in the public domain.

10.4.3

Except for information that the client makes publicly available, or when agreed between the validation/verification body and the client, all other information is considered proprietary information and shall be regarded as confidential.

10.4.4

When the validation/verification body is required by law or authorized by contractual arrangements to release confidential information, the client or individual concerned shall, unless prohibited by law, be notified of the information released.

10.4.5

Information about the client obtained from sources other than the client (e.g. complainant, regulatory authority) shall be confidential between the client and the validation/verification body. The provider (source) of this information shall be confidential to the body and shall not be shared with the client, unless agreed by the source.

11.1.1

The validation/verification body shall establish, document, implement and maintain a management system to support and demonstrate the consistent achievement of the requirements of this document.

11.1.2

The management system of the validation/verification body shall include at least the following:

11.1.3

A validation/verification body can meet 11.1.2 by establishing and maintaining a quality management system, in accordance with the requirements of ISO 9001. This quality management system shall support and demonstrate the consistent fulfilment of the requirements of this document.

11.2.1

The validation/verification body's management shall review its management system at planned intervals, in order to ensure its continuing suitability, adequacy and effectiveness, including the stated policies and objectives related to the fulfilment of this document.

11.2.2

The inputs to management review shall be recorded and shall include information related to the following:

1. a) changes in internal and external issues that are relevant to the validation/verification body;
2. b) fulfilment of objectives;
3. c) suitability of policies and procedures;
4. d) status of actions from previous management reviews;
5. e) outcome of recent internal audits;
6. f) corrective actions;
7. g) assessments by external bodies;
8. h) changes in the volume and type of the work or in the range of validation/verification body's activities;
9. i) client and personnel feedback;
10. j) complaints and appeals;
11. k) effectiveness of any implemented improvements;
12. l) adequacy of resources;
13. m) results of risk analysis;
14. n) other relevant factors, such as monitoring activities and training.

11.2.3

The outputs from the management review shall record all decisions and actions related to at least:

1. a) the effectiveness of the management system and its processes;
2. b) improvement of the validation/verification body's activities related to the fulfilment of the requirements of this document;
3. c) provision of required resources;
4. d) any need for change.

11.3.1

The validation/verification body shall conduct internal audits at planned intervals to provide information on whether the management system:

1. a) conforms to:

   — the validation/verification body’s own requirements for its management system, including the validation/verification activities;

   — the requirements of this document;

2. b) is effectively implemented and maintained.

11.3.2

The validation/verification body shall:

1. a) plan, establish, implement and maintain an audit programme including the frequency, methods, responsibilities, planning requirements and reporting, which shall take into consideration the importance of the validation/verification body's activities concerned, changes affecting the validation/verification body and the results of previous audits;
2. b) define the audit criteria and scope for each audit;
3. c) ensure that the results of the audits are reported to relevant personnel;
4. d) implement appropriate correction and corrective actions without undue delay;
5. e) retain records as evidence of the implementation of the audit programme and the audit results.

NOTE

ISO 19011 provides guidance for internal audits.

11.3.3

The validation/verification body shall ensure that its internal auditors do not audit their own work.

11.4 Corrective action

The validation/verification body shall establish processes for identification and management of nonconformities in its activities. The validation/verification body shall also, where necessary, take actions to eliminate the causes of nonconformities in order to prevent recurrence. Corrective actions shall be appropriate to the impact of the problems encountered. The processes shall define requirements for:

1. a) identifying nonconformities (e.g. from valid complaints and internal audits);
2. b) determining the causes of nonconformity;
3. c) correcting nonconformities;
4. d) evaluating the need for actions to ensure that nonconformities do not recur;
5. e) determining and implementing in a timely manner, the actions needed;
6. f) recording the results of actions taken;
7. g) reviewing the effectiveness of corrective actions.

11.5.1

The validation/verification body shall consider the risks and opportunities associated with the validation/verification activities in order to:

1. a) give assurance that the management system achieves its intended results;
2. b) enhance opportunities to achieve the programme and objectives of the validation/verification body;
3. c) prevent, or reduce, undesired impacts and potential failures in the validation/verification body's activities;
4. d) achieve improvement.

11.5.2

The validation/verification body shall plan:

1. a) actions to address these risks and opportunities;
2. b) how to integrate and implement these actions into its management system;
3. c) how to evaluate the effectiveness of these actions.

NOTE

Although this document specifies that the validation/verification body plans actions to address risks, there is no requirement for formal methods for risk management or a documented risk management process. Validation/verification bodies can decide whether or not to develop a more extensive risk management methodology than is required by this document (e.g. through the application of other guidance or standards).

11.5.3

Actions taken to address risks and opportunities shall be proportional to the potential impact on the validation/verification statement.

NOTE 1

Options to address risks can include identifying and avoiding threats, taking risk in order to pursue an opportunity, eliminating the risk source, changing the likelihood or consequences, sharing the risk, or retaining risk by informed decision.

NOTE 2

Opportunities can lead to expanding the scope of the validation/verification body's activities, addressing new clients, using new technology and other possibilities to address clients' needs.

11.6.1

The validation/verification body shall control documented information required by the management system and by this document to ensure that it is:

1. a) available and suitable for use, where and when it is needed, and
2. b) adequately protected (e.g. from loss of confidentiality, improper use, or loss of integrity).

11.6.2

For the control of documented information, the validation/verification body shall address the following activities, as applicable:

1. a) distribution, access, retrieval and use;
2. b) storage and preservation, including preservation of legibility;
3. c) control of changes (e.g. version control);
4. d) retention and disposition.

11.6.3

Documented information of external origin determined by the validation/verification body to be necessary for the planning and operation of the management system shall be identified as appropriate and shall be controlled.

11.6.4

Documented information retained as evidence of conformity shall be protected from unintended alterations.

NOTE 1

Access can imply a decision regarding the permission to view the documented information only, or the permission and authority to view and change the documented information.

NOTE 2

Documented information refers to processes, procedures, records, data, statements and other information required by this document.

A.1

The programme owner is responsible for defining the level of detail included in the validation/verification programme beyond the minimum requirements of this document.

A.2

The validation/verification programme should specify:

1. a) type of claims to be the object of validation/verification and the requirements against which the claim is to be assessed;
2. b) the criteria for competence of personnel (7.2, 7.3) for the validation/verification team and body;
3. c) the process steps to be undertaken as a minimum in conducting the validation/verification activities (9.1) to achieve the intended results;
4. d) the level of assurance, if required, and the materiality (9.2.2);
5. e) the evidence gathering activities of validation/verification (9.5.4);
6. f) the reporting requirements (9.5.5);
7. g) the review activities including the confirmation that all activities have been completed in accordance with the programme requirements (9.6);
8. h) the way in which the results of the validation/verification are to be interpreted and what the consequences are of the results — this also means that it should be laid down which findings prevent the issuance of a validation/verification statement (9.7.2);
9. i) the wording used for validation/verification statements, because sector specific terminology can be used;
10. j) requirements regarding what records the validation/verification body should retain as an evidence of conducting validation/verification (9.11.3);
11. k) the validation/verification statement (9.7) issued on the basis of the evaluation of the claim (9.5) in order to be in accordance with the validation/verification carried out.

A.3

The following elements can be considered by the programme owner, when developing the programme:

1. a) the necessity of an impartiality monitoring function (5.3.3, Note 2);
2. b) the period within which personnel who has provided consultancy on the object of validation/verification should not perform validation/verification activities in relation to their previous involvement (7.2.5);
3. c) the training needs for personnel on validation/verification processes, requirements, methodologies, activities and other relevant validation/verification programme requirements — the programme owner might consider providing training programmes (7.3.2);
4. d) requirements for monitoring of personnel (7.3.2);
5. e) requirements on personnel, facilities, equipment, systems and support services (7.1);
6. f) if, and under which conditions, the validation/verification body may outsource validation/verification activities (7.4);
7. g) additional parameters for the pre-engagement phase, including but not limited to sampling, materiality criteria, quality parameters, timeframes, fees (9.2);
8. h) requirements for the validation/verification agreement (9.3);
9. i) the planning and preparation activities that the body shall undertake before undertaking the actual validation/verification activity (9.4.);
10. j) arrangements to be made if there are facts discovered after issue of the validation/verification statement that could materially affect the validation/verification statement (9.6.3);
11. k) specific confidentiality requirements (7.2.6);
12. l) rules governing any reference to validation/verification, including the use of marks by the validation/verification body or its clients;
13. m) rules governing the responsibility for acceptance of inputs taken into account as part of validation/verification activities, e.g. conformity assessment results which are generated prior to the engagement or are provided by the client.

Annex B Terms and concepts defined by ISO/IEC 17029

The terms and concepts defined by this document correspond to the generic terminology and concepts of conformity assessment as defined by ISO/IEC 17000. See Table B.1.

Figure B.1 illustrates the functional approach to conformity assessment, as described in ISO/IEC 17000, adapted to the terms and concepts defined by this document.

Figure B.1

NOTE

A validation/verification statement is issued or not issued according to the programme requirements.

Annex C Illustration of validation/verification application

Figure C.1 illustrates the application of validation.

Figure C.1

NOTE

Validation bodies provide assurance by confirming the plausibility of claims regarding information on intended future use.

Figure C.2 illustrates the application of verification.

Figure C.2

NOTE

Verification bodies provide assurance by confirming the truthfulness of claims regarding historic information.

Bibliography