Clause §5.2 of ISO/IEC 17021-1:2015 establishes an impartiality rule for bodies auditing and certifying management systems: the separation between consultancy, implementation and certification auditing must be strictly managed to avoid conflicts of interest, including restriction periods where applicable. This report presents a signed technical interpretation of that rule. It is not just another requirement of the scheme; it is the one that underpins all the others.
The operational rule
ISO/IEC 17021-1 sets out principles and requirements for competence, consistency and impartiality for bodies auditing and certifying management systems. Within that framework, §5.2 establishes the essentials. A body must not certify a system when its ties — prior, concurrent or subsequent — compromise the independence of the process.
The principle fits into one sentence. Those who designed or implemented the system are not in a position to certify their own work. If the consultancy that implemented it audits its own intervention, there is no independent verification. There is self-assessment with a seal.
How it is circumvented in practice
Auditing practice recognises at least three mechanisms of circumvention. Criterion 12 — the third-party chain — provides their doctrinal framework; here they are examined in their operational form, as encountered by reviewers.
Separate corporate entities with common ownership
The consultancy implements under legal name A. The certification body — under common ownership — issues the certificate under legal name B. On paper, they are two entities. In substance, a single operation. Clause §5.2 was drafted precisely to anticipate this arrangement.
Cross-subcontracting
Consultancy A implements. Certification body B issues. And B subcontracts as an auditor a person who also works at consultancy A. The conflict moves down from the institutional to the individual level. It does not disappear; it changes scale.
Rushed timing
Time restrictions are treated as a formality. The days are counted without examining whether the actual conflict has been removed. The cooling-off period exists as an impartiality safeguard. Counting without examining complies with the letter and hollows out the rule.
What the audited organisation loses
When the certified system is self-assessed by its implementer, the organisation that paid loses three specific things.
First: the opportunity to discover real errors. Those who evaluate their own design face a self-review threat: they may normalise a previous decision or downplay a failure that also compromises their work.
Second: the technical credibility of the certificate with third parties. If a client or regulator reconstructs the chain and finds a relationship incompatible with impartiality, they will question the process and its outcome. The organisation that contracted in good faith also bears that uncertainty.
Third: organisational learning. Independent auditing provides an interpretation that does not need to defend the previous design and can formulate findings with greater professional distance.
Three checks before signing the contract
Before contracting a certification body, management must request documented answers to these questions. Speed of response does not determine impartiality; evidence does.
| Question | Expected answer |
|---|---|
| Is the entity that will audit the same one that implemented? Is there a corporate relationship or common ownership? | No relationship · verifiable in public corporate registers, with the legal names specified. |
| Do the individual auditors have a contractual or financial relationship with the implementing consultancy? | An impartiality declaration signed by each auditor on the team, available on request. |
| Is the body's accreditation current and listed in the public register? | Named accreditation body, accreditation number and verifiable recognition under the multilateral agreement administered by Global ACI — Criterion 04 sets the reference — or an applicable equivalent framework. |
An incomplete answer requires clarification before signing. The aim is not to obtain a promise of independence, but to reconstruct relationships, declarations and sufficient accreditation to assess the threat.