What impartiality requires of a certification body

Impartiality is the requirement that makes certification worth anything. If a body can be influenced by the client it certifies, the certificate stops being evidence of anything. ISO/IEC 17021-1 does not ask you to declare that you are impartial. It asks you to identify what could compromise it, to analyse those threats on an ongoing basis, and to keep the records that show what you did when one turned out to be real.

The threats the standard names

Self-interest is the obvious one: a client large enough that losing them would hurt. Self-review is auditing something your own organisation produced — which is why a body cannot consult and certify the same management system. Familiarity is the auditor who has audited the same client for years and stopped seeing it. Intimidation is the client who hints that a finding will cost you the account. There is also advocacy, where the body starts promoting the client rather than assessing them.

Identifying a threat is not a finding against you. Failing to identify it, or identifying it and doing nothing, is. The record that matters is the one that shows the threat, the analysis, and the safeguard applied — rotating the auditor, adding an independent reviewer, declining the engagement. A threat log with no decisions in it reads as a form that gets filled rather than an analysis that gets done.

What the committee is for

The mechanism for safeguarding impartiality has to be independent of the people who run the business, and it has to have real access: to the analysis, to the policies, and to the decisions taken. It is usually a committee with balanced representation of the interests involved — certified clients, their customers, industry bodies — and it must be able to act independently, including raising a concern to the accreditation body if the certification body ignores it.

In practice the committee is where impartiality records go to be forgotten. Minutes that were never written up, a meeting that slipped a quarter, an attendance list that no longer reflects a balanced membership. None of it is visible day to day, and all of it is visible in an office assessment. Keeping those records current alongside the internal audit programme and the management review inputs is what the Accreditation Agent is for — so the evidence exists before it is asked for.