AYUSH PRODUCT/PROCESS/SERVICE CERTIFICATION

AYUSH STEWARDSHIP PROGRAMME

Additional Requirements for Certification Bodies undertaking Ayush Product/Process/Service Certification as per ISO 17065

1.Introduction

1.1 This document prescribes the additional requirements to be followed by the certification bodies undertaking Product/Process/Service Certification, in additional to compliance to ISO 17065 for the purpose of obtaining recognition by the PO under the Ayush Stewardship Programme of the Ministry of Ayush.

2.Additional requirements

The additional requirements are indicated by prefix A with the clause number of ISO 17065 for ease of understanding. All provisions of ISO 17065: 2012 shall apply in addition to those given in this document.

A1 Purpose

A1.1 This document specifies additional requirements for certification bodies involved in Product/Process/Service certification under the Ayush Stewardship Programme. These requirements are additional to the requirements specified vide ISO 17065 "Requirements for bodies certifying products, processes and services" and the relevant certification scheme, in order to be recognized by the PO under the provisions of Ayush Stewardship Programme.

A2 Scope

A2.1 This document specifies additional criteria for the certification bodies operating under the programme.

NOTE: The term "shall" used throughout this document indicates those provisions which are mandatory in nature. The term "should" is used to indicate guidance which, although not mandatory, is provided as a means of meeting the requirements of the approval criteria. In case the certification body uses an alternative means of meeting the requirements, they would have to provide suitable and adequate justification.

A2.2 It is also intended that these additional criteria shall be used by the accreditation bodies operating under the programme for assessment of certification bodies engaged in certification of Ayush products for the purpose of recognition by PO under the scheme.

A2.3 For the sake of ease of usage, the structure of this document has been aligned with the structure of ISO 17065: 2012. Against each requirement in the standard (ISO 17065: 2012), additional requirements have been described, where applicable. These requirements shall be in addition to those specified in ISO 17065: 2012. In respect of all other elements the existing provisions shall apply.

A4. General Requirements

A4.01 Integrity

The certification body (also known as CB) shall maintain integrity at all times. It shall implement systems and measures to require all its personnel, internal and external, to maintain integrity. The certification body's system for maintaining integrity shall include measures like having a Code of Integrity and Conduct, which is required to be signed by all individuals (internal and external) involved in CB's activities, policy on gifts, guidelines for handling situations when offered inducement, etc.

Note 1 Integrity is defined as the quality of being honest and having a consistent and uncompromising adherence to strong moral and ethical principles and values.

A4.02 Independence

The certification body shall be independent, body neither owned by nor linked to any entity which is engaged in prohibited activities as detailed in clause 4.2.6 and 4.2.7 of ISO 17065.

4.1 Legal and contractual matters

A4.1.1 Legal responsibility

  1. The CB shall be a legal entity in the economy in which it is located or shall be a defined part of a legal entity, such that it can be held legally responsible for all its Certification activities. It shall be registered under the applicable national law so that it can function legally, make decisions independently and may sue and be sued in its own name. A governmental certification body is deemed to be a legal entity on the basis of its governmental status. A CB, that is part of an organization involved in functions other than certification, shall be separate and identifiable within that organization's structure.

  2. The certification body shall be responsible for meeting national or other legal requirements in the countries where it operates, with specific reference to the certification activities being undertaken.

A4.1.2 Certification agreement

A4.1.2.1 Certification agreements between a certification body and its clients shall be in the form of legally enforceable written contracts and shall be signed either at the time of registration of application, or on grant of certification, if signed declaration is taken in application.

A4.1.2.2 The certification body shall ensure its certification agreement requires that the client comply at least, with the following:

  1. A4.1.2.2 a) These requirements shall be complied with at all times during the validity of certification and also beyond as applicable;

  2. A4.1.2.2 c)1) It shall include making all necessary arrangements for the conduct of evaluation/audits/inspections, including providing documentation and records, and access to relevant facilities, equipment, location(s), area(s), personnel, and client's subcontractors and all other specific scheme requirements;

  3. A4.1.2.2 c)2) The investigation of complaints or other stakeholder comments;

  4. A4.1.2.2 c)3) Allow Scheme owner/PO and AB for any audits/inspections either as observers during CB's audits or directly as part of their own surveillance;

  5. A4.1.2.2 d) Only make claims regarding certification consistent with the certification scheme requirements and scope of certification and following the issue of the scope certificate;

  6. A4.1.2.2 i) Conform with the requirements of applicable rules and any other requirements specified by any scheme owner when referencing its certification or using marks of conformity in communication media such as documents, brochures, or advertising;

  7. A4.1.2.2 l) accept that the certification body may conduct semi-announced audits, unannounced audits, and/or confirmation visits, for the purpose of monitoring the organization's conformity with applicable requirements of this standard and the certification scheme requirements;

  8. A4.1.2.2 m) accept that the accreditation body or any other entity which has recognized its certification also has the right to conduct audits of the client, including semi-announced audits, unannounced audits, and confirmation visits, for the purpose of monitoring certification body conformity with certification scheme requirements;

  9. A4.1.2.2 n) allow the certification body to exchange information with other accredited certification bodies, authorized accreditation bodies as per the specific certification scheme requirements, as part of its ongoing evaluations;

  10. A4.1.2.2 o) inform the certification body about any other certifications and certification body relationships that share the same scope;

A4.2 Management of Impartiality

A4.2.1.1 The CB shall be, and perceived to be, impartial in relation to its applicants and certified entities.

A4.2.3.1 The CB shall document any residual risk. The demonstration shall cover all potential threats that are identified, whether they arise from within the CB or from the activities of other persons, bodies or organizations.

A4.2.3.2 The CB shall have a process to eliminate or minimize risk to impartiality if internal audits / in house training of any entity/client is carried out in a related body which is linked to the CB by common ownership etc.

A4.2.3.3 The CB shall have a process to identify, analyze, evaluate, monitor, and document the threats to impartiality (actual and perceived) arising from its activities including any conflicts arising from its relationships, activities or relationships of its personnel on an ongoing basis.

A4.2.3.4 The certification body shall establish rules and procedures to prevent or minimize threats of conflict of interest. Any actual or perceived interest in an action that results in or has the appearance of resulting in personal, organizational, or professional gain is considered to be a conflict of interest.

A4.2.4.1 The CB and its personnel shall not engage in any activities that may present an unacceptable risk to its Impartiality.

A4.2.4.2 Top management shall review any residual risk to determine if it is within the level of acceptable risk. When a relationship poses an unacceptable threat to impartiality, then certification shall not be provided.

A4.2.4.3 The risk assessment process shall include identification of and consultation with appropriate interested parties to advice on matters affecting impartiality including openness and public perception.

A4.2.4.4 if a conflict of interest between certification personnel and an organization is found after an audit has occurred, another unbiased person shall be assigned to determine if it has affected the certification process and to complete the remainder of the process if applicable.

A4.2.6 h) The CB and its personnel shall not provide consulting, education and/or training in the area related to the conformity assessment scheme or this programme within the same legal entity.

A4.2.7.1 Please also refer clause A4.02 of the additional requirements.

A4.2.12 a) the certification body shall require personnel, committee, and board members to declare existing or prior association with an organization subject to certification. Where such an association threatens impartiality, the certification body shall exclude the person concerned from work, discussion;

A4.2.12 b) an individual auditor shall not audit the same organization in more than three consecutive years;

A4.2.12 c) personnel shall not be allowed to assess their own work.

4.3 Liability and Financing

A4.3.2.1 The certification body shall evaluate its finances and sources of income and demonstrate that on an ongoing basis, commercial, financial or other pressures do not compromise its impartiality.

4.5 Confidentiality

A4.5.1.1 If asked for, the certification body shall share the information about its erstwhile client with another CB. This is specifically applicable, in case a CB's client applies to another CB post suspension or withdrawal or otherwise wishes to transfer certificate.

4.6 Publicly available information

A4.6.1 Information provided by the certification body to any client or to the marketplace, including advertising, shall be accurate and not misleading.

A4.6.2 The CB shall maintain a website for providing information about the Scheme(s) and its certification activities under the Scheme(s) including the following;

  1. The CB shall make publicly available detailed information about applications registered and certifications granted, suspended or withdrawn under the Scheme.
  2. The certification body shall ensure that the applicants and certified organizations are aware of the relevant documents and shall provide any of its public documents on request.

A4.6.3 The information as specified in 4.6 a) above shall also available on its website.

A4.6.4 Any additional requirements as specified in the certification scheme shall be complied with.

5 Structural requirements

5.2 Mechanism for Safeguarding Impartiality

A5.2.1.1 The mechanism for safeguarding impartiality shall be a formally appointed committee. The committee shall not have any operation related responsibilities or if committee is given any other responsibility, then it should not have any conflict with its mandate. All records to demonstrate the requirements specified in clause 5.2 are met with shall be maintained.

6.0 Resource Requirements

6.1.2 Management of competence for personnel involved in the certification process

A6.1.2.1 b) Take responsibility for ensuring that training and qualification requirements are met for all empanelled personnel (auditors/inspectors) and the personnel of outsourced entity unless it is an accredited CAB;

A6.1.2.1.1 Auditors/inspectors/evaluators and other personnel including application reviewer, technical reviewer and/or decision maker shall meet the minimum qualifications as prescribed by the Scheme owners subject to the following for the auditors/inspectors/evaluators (howsoever named).

A6.1.2.1.2 Auditor shall have a bachelor's degree in relevant stream of Ayush (Ayurveda or Unani or Yoga etc.) and minimum work experience of 5 year including 2 years relevant experience of the domain to be audited within the Ayush stream e.g. industry experience for manufacturing, education/training experience for education/training, healthcare management experience for hospitals etc.

6.2 Resources for evaluation

6.2.1 Internal resources

A6.2.1.1 If the divisions, within the same legal entity, performing above evaluation activities, for example, inspection division, audit divisions, testing division, are not under direct control of the product/process/service certification division, then many of the requirements as specified in clause 6.2.2.3, 6.2.2.4 b), 6.2.2.4 e), as applicable, 4.2.11, 4.2.12 and other impartiality requirements under clause 4.2 as applicable, shall apply, There shall be some kind of internal documentation which will specify how this arrangement/process shall work)

A6.2.1.2 For Ayush Products: Internal resources may include in house laboratory, a separate inspection division, and/or management system certification division, as applicable

6.2.2 External resources (outsourcing)

A6.2.2.2.1 The certification body shall not outsource any activity to non-independent bodies (i.e. bodies which are not independent from the organization being audited Ref: ISO17065 6.2.2.2)

A6.2.2.4 g) Ensure that the outsourced resource is:

  1. competent to perform the outsourced work consistent with the requirements set out in these procedures for the certification body and its personnel;
  2. not involved with the operation, process, or product that is subject to certification in any way that may compromise impartiality; and
  3. committed to the policies and procedures as defined by the certification body.

A6.2.2.4 h) Monitor the performance of outsourced resources, including a minimum annual evaluation and ongoing monitoring of work (e.g. through the certification decision process).

7 Process requirements

7.1 General

A7.1.1.1 Following exceptions to certification requirements are permitted if adequately justified:

  1. These shall be permitted only if they are permitted in the relevant certification scheme.
  2. The certification body shall receive prior approval from Scheme owner for each exemption.
  3. The certification body shall have clear criteria and procedures for requesting and tracking exemptions.
  4. Exemptions shall be of limited duration and shall be resubmitted for approval as applicable.

7.2 Application

For application, the certification body shall obtain all the necessary information to complete the certification process in accordance with the relevant certification scheme.

7.3 Application review

A7.3.1.1 All Certification scheme requirements shall be followed.

7.4 Evaluation

A7.4.2.1 The certification body shall assign personnel to perform each evaluation task that it undertakes with its internal resources (see 6.2.1) having the necessary competence. All certification scheme requirements shall also be followed. Additional requirements as given below shall also be followed in respect of audit/inspection (or evaluation) teams.

a) If an auditor/inspector is not fluent in the operating language of the auditee, they shall be accompanied by an interpreter.

b) An interpreter is needed for worker interviews if the auditor/inspector and workers do not share a common language, even if management staff are able to communicate directly with the auditor.

c) An auditor/inspector in training or a technical expert may also act as an interpreter.

d) When translators or interpreters are used in audits/inspections, the translators and interpreters shall be independent of the organization being evaluated.

e) In all cases, the names and affiliations of translators and interpreters shall be included in audit/inspection reports.

f) When technical experts are used in audits/inspections, the technical experts shall be independent of the organization being evaluated. The names, qualifications, and affiliations of technical experts shall be included in audit reports.

A7.4.4.1 In case a product, process or service is regulated, the inspection/audit shall verify that the client has necessary regulatory approvals, has a system in place to meet the regulatory requirements and provides evidence of meeting such requirements. The audit/inspection report shall categorically report on verification of system for verifying such regulatory compliances. The certification body shall audit a sample of regulatory requirements to verify that the system is effective.

A7.4.4.6 The certification body shall follow the requirements given in the certification scheme regarding classification of the non-conformities. The certification body can define major and minor NC, if required and if not specified in the scheme.

A7.4.9.1 The audit/inspection report shall have the following elements:

  1. The certification body shall provide a written report for each inspection/audit to the client. The audit team may identify opportunities for improvement but shall not recommend specific solutions Ownership of the audit report shall be maintained by the certification body.
  2. The inspection/audit/ team leader shall ensure that the audit report is prepared and shall be responsible for its content. The inspection/audit report shall provide an accurate, concise and clear record of the inspection/audit to enable an informed certification decision to be made and shall include or refer to the following:
  1. identification of the certification body;
  2. the name and address of the client and the client's representative;
  3. the type of audit (e.g. initial, surveillance or recertification audit or special audits);
  4. the inspection/audit criteria;
  5. the inspection/audit objectives;
  6. the inspection/audit scope, particularly identification of the organizational or functional units or processes audited and the time of the audit;
  7. any deviation from the inspection/audit plan and their reasons;
  8. any significant issues impacting on the inspection/audit programme;
  9. identification of the inspection/audit team leader, audit team members and any accompanying persons;
  10. the dates and places where the inspection/audit activities (on site or offsite, permanent or temporary sites) were conducted;
  11. inspection/audit findings reference to evidence and conclusions, consistent with the requirements of the type inspection/audit;
  12. significant changes, if any, that affect the management system of the client since the last inspection/audit took place;
  13. any unresolved issues, if identified;
  14. where applicable, whether the audit is combined, joint or integrated;
  15. a disclaimer statement indicating that inspection/auditing is based on a sampling process of the available information;
  16. recommendation from the inspection/audit team
  17. the inspection/audited client is effectively controlling the use of the certification documents and marks, if applicable:
  18. verification of effectiveness of taken corrective actions regarding previously identified nonconformities, if applicable;
  19. a conclusion on the appropriateness of the certification scope; the scope of certification shall not exceed the scope of products/services for which recognition is granted to the client;
  20. confirmation that the inspection/audit objectives have been fulfilled;
  21. information on the system for compliance to regulatory requirements and details of inspection/audit of regulatory requirements to provide reasonable assurance that the organization complies with applicable regulatory requirements, if the product/service is regulated.

A7.4.9.1.3 The inspectors/auditor(s) shall submit the inspection/audit report and supporting documentation promptly, providing sufficient time for review and the final certification decision to be made.

A7.4.9.1.4 Final reports shall be provided to the organization. If the inspection/audit checklist is not included in the inspection/audit report, it shall also be provided to the organization.

A7.4.9.1.5 The certification body shall document measures applied to verify the effectiveness of corrective actions taken by the clients to meet the requirements.

7.5 Review

A7.5.1.1 The review shall include a review of the report by a qualified certification individual or a committee consisting of at least one person having the competence as described below as well the criteria specified in the certification scheme.

A7.5.1.2 The person assigned for the review shall have competence in terms of knowledge and skills concerning the certification scheme and the technical areas of the scope applied for.

7.6 Certification decision

A7.6.1 The certification body shall keep the final responsibility for the issuing, maintaining, reissuing, suspending, and withdrawing of scope certificates.

7.8 Directory of certified products

A7.8.1 Additional requirements

  1. The certification body shall maintain a website for providing information about the Scheme.
  2. The certification body shall make publicly available on its website information about applications registered and certifications granted, suspended or withdrawn.
  3. On request from any party, the certification body shall provide the means to confirm the validity of a given certification.
  4. All requirements specified in the certification scheme shall be followed.
  5. Also refer the additional requirements specified in clause 4.6.

7.9 Surveillance

A7.9.1.1 The criteria and process for surveillance activities are defined by each certification scheme. In all such cases where validity of statement of conformity is permitted for a prescribed period, then surveillance shall be applicable.

7.10 Changes affecting certification

A7.10.1.1 All Certification scheme requirements shall be followed.

7.11 Termination, reduction, suspension or withdrawal of certification

A7.11.1.1 The certification body shall inform AYUSH/PO, the accreditation body.

7.12 Records

A7.12.1.1 All certification scheme requirements shall be followed.

7.13 Complaints and appeals

A7.13.1.1 The certification body shall respond to all information and complaints it receives directly or through any media about fraudulent products or services following its complaints process. If fraud or other misrepresentation is found to exist, the certification body shall initiate process for withdrawal of certificate (ref 7.11)

8 Management System requirements

8.2 General management system documentation (Option A)

A8.2.1.1 Only Option A shall be applicable.

8.4 Control of records (Option A)

A8.4.2.1 Record retention time shall be a minimum of five years or as per certification scheme or regulatory requirements, whichever is less.

8.6 Internal audits (Option A)

A8.6.2.1 The internal audit program shall include requirements of all conformity assessment schemes for which the certification body is accredited or has applied for accreditation.

A8.6.4 a) The personnel carrying out internal audits shall also have thorough knowledge of the certification scheme requirements and the audit criteria including base knowledge of the product/process/service under review and the technical requirements.