ISO27001 Certification Services

Our audit process includes the following activities, steps, and milestones:

Pre-certification activities

• Initial Application: PSC identifies the authorized representative of the applicant organization to provide the necessary information to establish certification scope, context, process details, functions, relationships, etc., and the standards or other requirements for which the applicant organization is seeking certification.
• Application review: PSC conducts a review of the application supplementary information to determine the following: the applicant organization and its management system is sufficient to develop an audit program; any known difference in understanding between PSC and the applicant organization is resolved; PSC has the competence and ability to perform the certification activity; the scope of certification sought, the site(s) of the applicant organization’s operations, time required to complete audits and any other points influencing the certification activity are considered (language, safety conditions, threats to impartiality, etc.).
• Application decision: After review of above points in the application, PSC either accepts or declines an application for certification. When PSC declines an application for certification as a result of the application review, the reason(s) for declining an application is documented and made clear to the client. Based on this review, PSC determines the competences it needs to include in its audit team and for the certification decision.

The initial ISO2700:2022 certification audit of a management system will normally be conducted in two stages (Stage 1 & Stage 2) as described below:

 

Stage 1 Audit

Planning ensures that the objectives can be met, and the client is informed of any “on site” activities during Stage 1. The high-level objectives of this stage are listed below.

• Review of client’s management system documentation.
• To evaluate the client’s location and site-specific conditions and to undertake discussions with the client's personnel to determine the preparedness for the Stage 2 audit.
• To review the client’s status and understanding regarding requirements of the standard, in particular with respect to the identification of key performance or significant aspects, processes, objectives and operation of the management system.
• To collect necessary information regarding the scope of the management system, including;
  • the client’s site(s)
  • the processes and equipment used
  • levels of controls established (particularly in case of multi-site clients)
  • applicable statutory and regulatory requirements
• To review the allocation of resources and competence for Stage 2 audit and agreeing with the client on the details of the Stage 2 audit.
• To provide focus for planning Stage 2 by gaining a sufficient understanding of the client’s management system and site operations in the context of the management system standard or other normative document.
• To evaluate the internal audits and management reviews are being planned and performed, and that the level of implementation of the management system substantiates that the client is ready for Stage 2.

Documented conclusions with regard to fulfilment of the Stage 1 objectives and the readiness for Stage 2 shall be communicated to the client, including identification of any areas of concern that could be classified as nonconformity during Stage 2.

When determining the interval between stages, our team gives great consideration to the needs of the client to resolve areas of concern identified during Stage 1. PSC may also need to revise its arrangements for Stage 2.

If any significant changes which would impact the management system occur, PSC experts determine the need to repeat all or part of Stage 1. The client is informed that the results of Stage 1 may lead to postponement or cancellation of Stage 2.

 

Stage 2 Audit

The purpose of the Stage 2 audit is to evaluate the implementation, including effectiveness, of the client’s management system. The Stage 2 audit will take place at the site(s) of the client. It includes at least the following:

• Information and evidence about conformity to all requirements of the applicable management system standard or other normative document.
• Performance monitoring, measuring, reporting and reviewing against key performance objectives and targets (consistent with the expectations in the applicable management system standard or other normative document).
• The client’s management system ability and its performance regarding meeting of applicable statutory, regulatory and contractual requirements.
• Operational control of the client’s processes.
• Internal auditing and management review.
• Management responsibility for the client’s policies.

Links between the normative requirements, policy, performance objectives and targets (consistent with the expectations in the applicable management system standard or other normative document), any applicable legal requirements, responsibilities, competence of personnel, operations, procedures, performance data, and internal audit findings and conclusions.

PSC normally agrees on the first surveillance date during the Stage 2 Audit. This date must be within 12 months of the last day of the Stage 2 Audit.

The audit team will analyze all information and audit evidence gathered to review the audit findings and agree on the conclusions. The audit team will then produce a report for the company detailing the findings (including any non–conformances, observations summary of the audit, etc.) and the conclusion reached by the audit team.

The audit team makes clear to clients that the recommendation made is only a recommendation and that the audit file (including the report) will be reviewed by PSC staff and will be submitted for a decision to the authorized certification decision maker.

 

Surveillance Audits

These assessments are not necessarily full systems audits and are planned together with the other surveillance activities so that PSC can maintain confidence that the certified management system continues to fulfill requirements between recertification audits.

The surveillance audit program for the relevant management system standard includes:

• Internal audits and management review.
• A review of actions taken on nonconformities identified during the previous audit.
• Complaint handling.
• Effectiveness of the management system with regard to achieving the certified client’s objectives and the intended results of the respective management system(s).
• Progress of planned activities aimed at continual improvement.
• Continuing operational control.
• Review of any changes.
• Use of marks and/or any other reference to certification.

Re-certification Audits

These include an onsite audit that addresses the following:

• The effectiveness of the management system in its entirety in the light of internal and external changes and its continued relevance and applicability to the scope of certification.
• Demonstrated commitment to maintain the effectiveness and improvement of the management system in order to enhance overall performance.
• the effectiveness of the management system with regard to achieving the certified client’s objectives and the intended results of the respective management system(s).

For any major nonconformity, PSC defines time limits for correction and corrective actions. These actions are implemented and verified prior to the expiration of certification.

When recertification activities are successfully completed prior to the expiry date of the existing certification, the expiry date of the new certification can be based on the expiry date of the existing certification. The issue date on a new certificate shall be on or after the recertification decision.

If PSC has not completed the recertification audit or PSC is unable to verify the implementation of corrections and corrective actions for any major nonconformity prior to the expiry date of the certification, then recertification shall not be recommended, and the validity of the certification shall not be extended. The client shall be informed, and the consequences shall be explained for such case.

Following expiration of certification, PSC can restore certification within 6 months provided that the outstanding recertification activities are completed, otherwise at least a Stage 2 shall be conducted. The effective date on the certificate shall be on or after the recertification decision and the expiry date shall be based on prior certification cycle.

 

Special Audits

• Expanding scope: PSC will, in response to an application for expansion to scope of certificate already granted, undertake a review of the application (contract review) and determine any audit activities necessary to determine whether or not the expansion may be granted, including the requirement to conduct a visit. This may be conducted in conjunction with a surveillance visit.
• The certification decision maker will be responsible for granting an extension to scope based upon the information supplied. The process is the same as for initial certification following a stage 2 audit.
• Short notice or no-notice audits: When necessary, PSC may conduct short or no-notice audits to investigate complaints, or in response to changes, or as follow up to for Major Non-conformities or for suspended clients. In such cases:
  • PSC will describe and make known in advance to the certified clients the conditions under which these short notice visits are to be conducted, and
  • PSC will exercise additional care in the assignment of the audit team because of the lack of opportunity for the client to object to team members.
  • The report resulting from the short or no notice audit will be referred to the certification decision maker / competent person for consideration.

PSC has a process to conduct an effective review prior to making a decision for refusing or granting certification, expanding or reducing the scope of certification, renewing, suspending or restoring, or withdrawing of certification, to include validation that:

• The information provided by the audit team is sufficient with respect to the certification requirements and the scope for certification.

• for any major nonconformities, it has reviewed, accepted and verified the correction and corrective actions.

• for any minor nonconformities, it has reviewed and accepted the client’s plan for correction and corrective action.

For additional detail, please see the PSC procedure for certificate issue, suspension, and withdrawals.

PSC’s policy governing any mark it authorizes clients to use assures, amongst other things, traceability back to PSC.  The policy has provision for instructions on ensuring that no ambiguity, in the mark or accompanying text, as to what has been certified and that PSC has granted the certificate.

The policy also covers the prohibition of using the mark on a product or packaging seen by a consumer or in any other way that may be interpreted as denoting product conformity. The policy is available both on website and as hard copy; all certified companies receive a copy of the policy with their certificate.

The PSC mark is not permitted to be applied to laboratory test, calibration or inspection reports. The same are verified during the audit and is conveyed to all Auditors concerned.

For additional detail, please see PSC's Rules for use of Certification Mark and Logo

PSC has a documented process to receive, evaluate, and make decisions on appeals. The appeals handling process and documentation will be publicly available.

The Appeal Committee of PSC is responsible for all decisions at all levels of the appeals handling process. PSC ensures that the persons engaged in the appeals handling process are different from those who carried out the audits and made the certification decisions.

PSC ensures that any submission, investigation, and decision on appeals shall not result in any discriminatory actions against the organization or person making the appeal (appellant).

The appeals handling process includes at least the following elements and methods:

• The process for receiving, validating and investigating the appeal, and for deciding what actions are to be taken in response to it, taking into account the results of any similar appeals.

• Tracking and recording appeals, including actions undertaken to resolve them.

• Ensuring that any appropriate correction and corrective action are taken.

PSC is responsible for gathering and verifying all necessary information to validate the appeal.

PSC ensures that receipt of the appeal is acknowledged and will provide the appellant with progress reports and the outcome.

The decision to be communicated to the appellant shall be made by, or reviewed and approved by, individual(s) not previously involved in the subject of the appeal.

PSC gives formal notice to the appellant at the end of the appeals handling process.

For additional information on any topic regarding PSC ISO services, or to report a complaint or request an appeal, please email us: iso@paysw.com

For additional detail, please see the PSC procedure for Complaints and Appeals.

 

PSC is impartial, and being perceived to be impartial is imperative to deliver certifications that provide confidence to customers.

PSC acknowledges that impartiality is crucial to clients and other stakeholders, and we conform to the requirements of ISO/IEC 17021-1:2015 and ISO 27006:2015. The PSC impartiality procedures provide the necessary steps for identifying, assessing, and minimizing risks to impartiality.

To obtain and maintain impartiality, the CB Manager is not responsible for revenue collection.

To obtain and maintain confidence, PSC decisions are based on objective evidence of conformity (or nonconformity) obtained, and that its decisions are not influenced by other interests or by other parties.
Threats to impartiality are identified as follows;

A) Self-interest threats: threats that arise from a person or PSC acting in their own interest. A concern related to certification, as a threat to impartiality, is financial self-interest.

B) Self review threats: threats that arise from a person or PSC reviewing the work done by themselves. Auditing the management systems of a client to whom the auditor or PSC provided management systems consultancy would be a self-review threat.

C) Familiarity (or trust) threats: threats that arise from a person or PSC being too familiar with or trusting of another person instead of seeking audit evidence.

D) Intimidation threats- threats that arise from a person or PSC having a perception of being coerced openly or secretively, such as a threat to be replaced or reported to a supervisor.

PSC, its Directors, Managers, Staff and others involved in the organization fully understand the importance of impartiality in providing our ISO27001:2022 conformity assessment services.

PSC will therefore ensure that in its dealings with clients or potential clients, all employees or other personnel involved in this service are, and will remain, impartial. To ensure that impartiality is both maintained and can be demonstrated, PSC has identified and risk assessed all relationships which may result in a conflict of interest or pose a threat to impartiality.

For additional detail, please see our Impartiality Procedure.