ISO/IEC 17067:2013 Conformity assessment — Fundamentals of product certification and guidelines for product certification schemes

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of conformity assessment, the ISO Committee on conformity assessment (CASCO) is responsible for the development of International Standards and Guides.

International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2.

Draft International Standards are circulated to the member bodies for voting. Publication as an International Standard requires approval by at least 75 % of the member bodies casting a vote.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights.

ISO/IEC 17067 was prepared by the ISO Committee on conformity assessment (CASCO).

It was circulated for voting to the national bodies of both ISO and IEC, and was approved by both organizations.

This first edition of ISO/IEC 17067 cancels and replaces ISO/IEC Guide 67:2004, which has been technically revised.

The following major changes have been made compared with ISO/IEC Guide 67:2004:

Introduction

This International Standard describes the fundamentals of product certification and provides guidelines for product certification schemes. In this International Standard references to the term “product” can also be read to mean “services” or “processes”.

As products are designed, produced, distributed, used and ultimately disposed of, they can give rise to concerns with purchasers, users and society in general. Such concerns could relate to safety, health or environmental impacts, durability, compatibility, suitability for intended purposes or for stated conditions.

Generally, these concerns are addressed by specifying the required product attributes in a normative document such as a standard.

The supplier of the product then has the task of demonstrating that the product conforms to the requirements of the normative document.

It might be sufficient for the supplier to assess and declare its product's conformity, but in other cases the user or a regulatory authority might require that conformity be assessed by a competent and impartial third party.

Assessment and impartial third party attestation that fulfilment of specified requirements has been demonstrated for the product is referred to as product certification.

This International Standard outlines how schemes for product certification can be structured and managed. It identifies common assessment techniques that are used as a basis for product certification, such as product testing, inspection and auditing.

This International Standard is intended for use by those involved with product certification, particularly those who are, or who are considering becoming, product certification scheme owners. Product certification scheme owners can include:

1. a) product certification bodies;
2. b) government and regulators;
3. c) purchasing agencies;
4. d) non-government organizations;
5. e) industry and retail associations; and
6. f) consumer organizations.

This International Standard provides only guidance and does not contain requirements. It is compatible with ISO/IEC 17065, which specifies requirements for product certification bodies.

In this International Standard, the following verbal forms are used:

The modal verb "shall", which indicates a requirement, is not used because this International Standard only provides guidelines.

Further details can be found in the ISO/IEC Directives, Part 2.

1 Scope

This International Standard describes the fundamentals of product certification and provides guidelines for understanding, developing, operating or maintaining certification schemes for products, processes and services.

It is intended for use by all with an interest in product certification, and especially by certification scheme owners.

NOTE 1

In this International Standard the term “product” can also be read as “process” or “service”, except in those instances where separate provisions are stated for “processes” or “services”. Definitions of product, process and service are given in ISO/IEC 17065.

NOTE 2

The certification of products, processes and services is a third-party conformity assessment activity (see ISO/IEC 17000) carried out by product certification bodies. The requirements for product certification bodies are specified in ISO/IEC 17065.

2 Normative references

The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

• ISO/IEC 17000:2004 Conformity assessment — Vocabulary and general principles
• ISO/IEC 17065:2012 Conformity assessment — Requirements for bodies certifying products, processes and services

3 Terms and definitions

For the purposes of this document, the terms and definitions given in ISO/IEC 17000, ISO/IEC 17065 and the following apply.

3.1 certification system

3.2 certification scheme

3.3 scheme owner

4.1.1

Product certification is the provision of assessment and impartial third-party attestation that fulfilment of specified requirements has been demonstrated. Product certification is carried out by product certification bodies which should conform to ISO/IEC 17065. Specified requirements for products are generally contained in standards or other normative documents.

4.1.2

Product certification is an established conformity assessment activity that provides confidence to consumers, regulators, industry and other interested parties that products conform to specified requirements, including for example product performance, safety, interoperability and sustainability.

4.1.3

Product certification can facilitate trade, market access, fair competition and consumer acceptance of products on a national, regional and international level.

4.2.1

The fundamental objectives of product certification are:

1. a) to address the needs of consumers, users and, more generally, all interested parties by giving confidence regarding fulfilment of specified requirements;
2. b) to allow suppliers to demonstrate to the market that their product has been attested to fulfil specified requirements by an impartial third party body.

4.2.2

Product certification should provide the following:

5.1.1

Product certification schemes should implement the functional approach as described in ISO/IEC 17000:2004, Annex A. The functions are:

NOTE 1

Further information about the functions is given in ISO/IEC 17000.

NOTE 2

In ISO/IEC 17065, the functions of “selection” and “determination” have been combined and are referred to as “evaluation”.

NOTE 3

In ISO/IEC 17065, the function of “attestation” is related to the subclause on “certification documentation” (see ISO/IEC 17065:2012, 7.7).

5.1.2

Whenever product certification is performed, a certification scheme (see 3.2) is in place.

5.2.1

Product certification schemes are developed by defining specific activities for each of the applicable functions described in 5.1.1. Table 1 shows how to build a product certification scheme by using these functions, and outlines some of the combinations of activities in use in the wide range of fields where product certification is employed. The types of product certification schemes in Table 1 are further described in 5.3.

5.2.2

Clause 6 describes the process for deciding which activities to use for a given situation and the factors to be taken into account in making the decision.

5.3.1 General

The examples given in 5.3.2 to 5.3.8 do not represent all possible types of product certification schemes. They may be used with many types of requirements and may use a wide variety of statements of conformity (see ISO/IEC 17000:2004, 5.2, Note 1). All types of product certification schemes involve selection, determination, review, decision and attestation. One or more determination activities should be selected from among those in Table 1, taking into account the product and the specified requirements. The types of schemes referred to in Table 1 differ according to which surveillance activities (if applicable) are carried out. For scheme types 1a and 1b, no surveillance is required since the attestation relates only to the product items which have been subjected to the determination activities. For the other scheme types, 5.3.4 to 5.3.8 outline the way in which the different surveillance activities can be used and the circumstances to which they could be applicable.

5.3.2 Scheme type 1a

In this scheme, one or more samples of the product are subjected to the determination activities. A certificate of conformity or other statement of conformity (e.g. a letter) is issued for the product type, the characteristics of which are detailed in the certificate or a document referred to in the certificate. Subsequent production items are not covered by the certification body's attestation of conformity.

The samples are representative of subsequent production items which could be referred to by the manufacturer as being manufactured in accordance with the certified type.

The certification body may grant to the manufacturer the right to use the type certificate or other statement of conformity (e.g. letter) as a basis for the manufacturer to declare that subsequent production items conform to the specified requirements.

5.3.3 Scheme type 1b

This scheme type involves the certification of a whole batch of products, following selection and determination as specified in the scheme. The proportion to be tested, which can include testing of all the units in the batch (100% testing), would be based, for example, on the homogeneity of the items in the batch and the application of a sampling plan, where appropriate. If the outcome of the determination, review and decision is positive, all items in the batch may be described as certified and may have a mark of conformity affixed, if that is included in the scheme.

5.3.4 Scheme type 2

The surveillance part of this scheme involves periodically taking samples of the product from the market and subjecting them to determination activities to check that items produced subsequent to the initial attestation fulfil the specified requirements.

While this scheme may identify the impact of the distribution channel on conformity, the resources it requires can be extensive. Also, when significant nonconformities are found, effective corrective measures may be limited since the product has already been distributed to the market.

5.3.5 Scheme type 3

The surveillance part of this scheme involves periodically taking samples of the product from the point of production and subjecting them to determination activities to check that items produced subsequent to the initial attestation fulfil the specified requirements. The surveillance includes periodic assessment of the production process.

This scheme does not provide any indication of the impact the distribution channel plays on conformity. When serious nonconformities are found, the opportunity may exist to resolve them before widespread market distribution occurs.

5.3.6 Scheme type 4

The surveillance part of this scheme allows for the choice between periodically taking samples of the product from the point of production, or from the market, or from both, and subjecting them to determination activities to check that items produced subsequent to the initial attestation fulfil the specified requirements. The surveillance includes periodic assessment of the production process.

This scheme can both indicate the impact of the distribution channel on conformity and provide a pre-market mechanism to identify and resolve serious nonconformities. Significant duplication of effort may take place for those products whose conformity is not affected during the distribution process.

5.3.7 Scheme type 5

The surveillance part of this scheme allows for the choice between periodically taking samples of the product either from the point of production, or from the market, or from both, and subjecting them to determination activities to check that items produced subsequent to the initial attestation fulfil the specified requirements. The surveillance includes periodic assessment of the production process, or audit of the management system, or both. The extent to which the four surveillance activities are conducted may be varied for a given situation, as defined in the scheme. If the surveillance includes audit of the management system, an initial audit of the management system will be needed.

5.3.8 Scheme type 6

This scheme is mainly applicable to certification of services and processes.

Although services are considered as being generally intangible, the determination activities are not limited to the evaluation of intangible elements (e.g. effectiveness of an organization's procedures, delays and responsiveness of the management). In some situations, the tangible elements of a service can support the evidence of conformity indicated by the assessment of processes, resources and controls involved. For example, inspection of the cleanliness of vehicles for the quality of public transportation.

As far as processes are concerned, the situation is very similar. For example, the determination activities for welding processes can include testing and inspection of samples of the resultant welds, if applicable.

For both services and processes, the surveillance part of this scheme should include periodic audits of the management system and periodic assessment of the service or process.

6.1 General

This clause provides guidelines on how to develop and operate a product certification scheme. It is particularly relevant to those persons and organizations that are considering the establishment of a scheme or acting as a stakeholder (e.g. manufacturer, service provider, certification body, customer or public authority).

6.2 Relationship between product certification scheme and product certification system

The product certification scheme will use defined rules, procedures and management, which could be unique to the scheme or could be defined in a product certification system applicable to a number of schemes. It is always necessary to have a product certification scheme, but only necessary to separately define a product certification system if the same rules, procedures and management are to be used for more than one scheme. Figure 1 illustrates the relationship between a product certification scheme and a product certification system.

Figure 1

a)  Unique product certification scheme	b)  Product certification system relating to several schemes

6.3.1

The following main types of scheme owners can be identified:

1. a) certification bodies which develop a product certification scheme for the sole use of their clients;
2. b) organizations such as a regulatory body or a trade association not being a certification body, which develop a product certification scheme in which one or more certification bodies participate.

NOTE

A group of certification bodies, perhaps in different countries, can together set up a certification scheme. In that case, it would be necessary for the certification bodies, as joint owners of the scheme, to create a management structure so that the scheme could be operated effectively by all participating certification bodies.

6.3.2

If a scheme owner operates several schemes, the scheme owner may combine common procedures and management into a product certification system. In that case, the scheme owner would become the system owner and would be responsible for the management of the system and the schemes operating within it.

6.3.3

The scheme owner should be a legal entity.

NOTE

A governmental scheme owner is deemed to be a legal entity on the basis of its governmental status.

6.3.4

The scheme owner should be able to take on full responsibility for the objectives, the content and the integrity of the scheme.

6.3.5

The scheme owner should maintain the scheme and provide guidance when required.

6.3.6

The scheme owner should set up a structure for the operation and management of the scheme.

6.3.7

The scheme owner should document the content of the scheme.

6.3.8

The scheme owner should ensure that the scheme is developed by persons competent in both technical and conformity assessment aspects.

6.3.9

The scheme owner should make arrangements to protect the confidentiality of information provided by the parties involved in the scheme.

6.3.10

The scheme owner should evaluate and manage the risks/liabilities arising from its activities.

NOTE

Evaluating risks does not imply risk assessments in accordance with ISO 31000.

6.3.11

The scheme owner should have adequate arrangements (e.g. insurance or reserves) to cover liabilities arising from its activities. Arrangements should be appropriate e.g. for the range of activities and schemes undertaken and in the geographic regions in which the scheme operates.

6.3.12

The scheme owner should have the financial stability and resources required for it to fulfil its role in the operation of the scheme.

6.4.1

Product certification schemes can be developed for different purposes. Such purposes may include schemes established by regulators to achieve health, safety or environmental outcomes. Other schemes may have the purpose of assisting clients and consumers to differentiate products in the market place and make informed purchasing decisions.

6.4.2

Irrespective of the purpose, scheme owners should understand the assumptions, influences and consequences involved in establishing, operating and maintaining a scheme on an ongoing basis.

6.4.3

In developing a scheme, the scheme owner should have a clear understanding of the objectives of the scheme and the assumptions that underlie the need for, and the acceptance of, the scheme. To assist in this, the scheme owner should identify stakeholders and seek their opinions and participation in scheme development.

6.4.4

Before developing the specific content of the scheme (see 6.5), fundamental scheme principles should be agreed among the stakeholders. Such principles may include:

6.4.5

Once developed, the scheme owner should ensure that information about the scheme is made publicly available to ensure transparency, understanding and acceptance. The scheme owner should ensure that the scheme is regularly reviewed, including confirmation that it is fulfilling its objectives, in accordance with a process that includes stakeholders.

6.5.1 General

A product certification scheme should specify the following elements:

1. a) the scope of the scheme, including the type of products covered;
2. b) the requirements against which the products are evaluated, by reference to standards or other normative documents; where it is necessary to elaborate upon the requirements to remove ambiguity, the explanations should be formulated by competent people and should be made available to all interested parties;

   NOTE

   Further guidance on how to formulate specified requirements is provided in ISO/IEC 17007.

3. c) the selection of the activities (see Table 1) appropriate to the purpose and the scope of the scheme; as a minimum, a certification scheme should include the functions and activities I, II, III, IV and V a);
4. d) other requirements to be met by the client, e.g. the operation of a management system or process control activities to assure the demonstration of fulfilment of specified requirements is valid for the ongoing production of certified products;
5. e) the requirements for certification bodies and other conformity assessment bodies involved in the certification process; these requirements should not be in contradiction to the requirements of the applicable standards for conformity assessment bodies;
6. f) whether conformity assessment bodies involved in the scheme (e.g. testing laboratories, inspection bodies, product certification bodies, bodies auditing manufacturers' management systems) are to be accredited, participate in peer assessment or qualified in another manner; if the scheme is to require that conformity assessment bodies are accredited, the appropriate references should be specified, e.g. that the accreditation body is a member of a mutual recognition arrangement between accreditation bodies;
7. g) the methods and procedures to be used by the conformity assessment bodies and other organizations involved in the certification process, so as to assure the integrity and consistency of the outcome of the conformity assessment process;
8. h) the information to be supplied to the certification body by an applicant for certification;
9. i) the content of the statement of conformity (e.g. certificate) which unambiguously identifies the product to which it applies;
10. j) the conditions under which the client may use the statement of conformity or marks of conformity;
11. k) where marks of conformity may be used, the ownership, use and control of the marks; the requirements of ISO/IEC 17030 should be applied;
12. l) the resources required for the operation of the scheme, including impartiality and competence of the personnel (internal and external), the evaluation resources, and the use of subcontractors;
13. m) how the results of the determination (evaluation) and surveillance stages are to be reported and used by the certification body and the scheme owner;
14. n) the question of how non-conformities with the certification requirements, which include product requirements, are to be dealt with and resolved;
15. o) surveillance procedures, where surveillance is part of the scheme;
16. p) the criteria for access of conformity assessment bodies to the scheme and for the access of clients to the scheme;
17. q) content, conditions and responsibility for publication of the directory of certified products by the certification body or the scheme owner;
18. r) the need for, and content of, contracts, e.g. between scheme owner and certification body, scheme owner and clients, certification body and clients: the rights, responsibilities and liabilities of the various parties should be defined in contracts;

    NOTE

    An example contract between a certification body and its clients can be found in ISO/IEC Guide 28:2004, Annex B.

19. s) general conditions for granting, maintaining, continuing, extending the scope of, reducing the scope of, suspending and withdrawing certification: this includes requirements for discontinuation of advertising and return of certification documents and any other action if the certification is suspended, withdrawn or terminated;
20. t) the way in which the clients' complaints records are to be verified if such verification is part of the scheme;
21. u) the way in which the clients make reference to the scheme in their publicity material;
22. v) retention of records by scheme owner and certification bodies.

6.5.2 Sampling

Where applicable, the scheme should define the extent to which sampling of the product to be certified is required, and on what basis such sampling should be undertaken both at the selection and surveillance stages. The scheme should define when sampling is required and who is permitted to undertake it.

NOTE

Useful information on this topic is given in ISO 10576-1, ISO 2859-10, ISO 3951-1 and ISO 22514-1.

6.5.3 Acceptance of conformity assessment results

In some cases, clients might have obtained the results of determination activities, such as testing, inspection or auditing, prior to making an application for certification. In such a situation, the conformity assessment result may be from a source not within the contractual control of the certification body. The scheme should define whether and under what conditions such conformity assessment results can be considered in the certification process.

6.5.4 Outsourcing of the conformity assessment activities

If the scheme permits outsourcing (subcontracting) of conformity assessment activities such as testing, inspection or auditing, then the scheme should require these bodies to meet the applicable requirements of the relevant International Standards. For testing, it should meet the applicable requirements of ISO/IEC 17025; for inspection, it should meet the applicable requirements of ISO/IEC 17020; and for management system auditing, it should meet the applicable requirements of ISO/IEC 17021. The scheme should state the degree to which prior agreement to outsourcing needs to be obtained from the scheme owner or the client whose products are being certified under the scheme.

6.5.5 Complaints and appeals to the scheme owner

The scheme owner should define the complaints and appeals process and who is responsible for undertaking this process.

Appeals against the decision of the certification body and complaints about the certification body should be addressed to the certification body in the first instance.

Appeals and complaints that have not been, or cannot be, resolved by the certification body can be addressed to the scheme owner.

6.5.6 Licensing and control of the mark

Where the scheme provides for the use of certificates, marks or other statements of conformity, there should be a license or other form of enforceable agreement to control such use. Licenses can include provisions related to use of the certificate, mark or other statement of conformity in communications about the certified product, and requirements to be fulfilled when certification is no longer valid. Such licenses may be between two or more of the following:

6.5.7 Surveillance

If surveillance is included, the scheme should define the set of activities (see function 6 in Table 1) that make up the surveillance functions. When deciding upon the appropriate surveillance activities, the scheme owner should consider the nature of the product, the consequences and probability of non-conforming products and the frequency of the activities.

6.5.8 Non-conforming products

The scheme should define requirements that apply when a product no longer fulfils certification requirements, such as product recall or providing information to the market.

NOTE

See also ISO Guide 27.

6.5.9 Reporting to the scheme owner

When reporting to the scheme owner is required, the content and frequency of reporting should be defined. Such reporting may be for the purpose of scheme improvement, for control purposes and for monitoring the extent of conformity by clients.

6.5.10 Subcontracting of the operation of the scheme

If the scheme owner subcontracts all or part of the operation of the scheme to another party, it should have a legally binding contract defining the duties and responsibilities of both parties. A governmental scheme owner can subcontract operation of the scheme by regulatory provisions.

6.5.11 Marketing

The scheme should define the policies and procedures related to marketing, including the extent to which certification bodies and clients can make reference to the scheme.

6.5.12 Fraudulent claim of certification

Actions and responsibilities for situations where certification under the scheme is being claimed fraudulently should be described.

6.6.1 Review of scheme operation

The scheme owner should define a process for reviewing the operation of the scheme on a periodic basis in order to confirm its validity and to identify aspects requiring improvement, taking into account feedback from stakeholders. The review should include provisions for ensuring that the scheme requirements are being applied in a consistent manner.

6.6.2 Changes in specified requirements

The scheme owner should monitor the development of the standards and other normative documents which define the specified requirements used in the scheme. Where changes in these documents occur, the scheme owner should have a process for making the necessary changes in the scheme, and for managing the implementation of the changes (e.g. transition period) by the certification bodies, clients and, where necessary, other stakeholders.

6.6.3 Other changes to the scheme

The scheme owner should define a process for managing the implementation of other changes to the rules, procedures and management of the scheme.

6.7 Scheme documentation

The scheme owner should create, control and maintain adequate documentation for the operation, maintenance and improvement of the scheme. The documentation should specify the rules and the operating procedures of the scheme, and in particular the responsibilities for governance of the scheme.

Bibliography