Regulatory Open Forum

I know of a small company that has been certified by TUV SUD to ISO 13485 for years.  In August 2019 they were audited by TUV for MDSAP certification.  There were no major issues and they were recommended for MDSAP.  In August 2020, they were audited and again there were no significant issues found.  The problem?  Their MDSAP certificate still has not arrived. There have been some changes in the Quality organization and the missing certificate was not followed up on until about July 2019.  They reached out through their established channels and then raised it up one level.  All they seem to be getting is "we'll look into it" and "it's being reviewed."  I don't know what they can do now to get that certificate.  Any suggestions?  This has been going on for far too long.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------

Certification Bodies are generally governed by ISO 17021-1 which requires those Bodies to receive, investigate, and resolve complaints in a formal and responsive fashion. ISO 17021-1 also says that the Certification Body is prohibited from any discriminatory actions against the complainant.  My thought is that it's easier for the Certification Body to figure out how to simply follow through with its certification obligations/responsibilities rather than that plus also enduring the additional burdens of formally processing a complaint.  Accordingly, a reasonable first step before formally lodging an actual complaint might be to inform the Body that its Client is considering such an action.  That might jar the issue loose.  If not, then the Client can submit a formal complaint to the Certification Body.  My understanding is that the Body's corresponding decision-making and complaint resolutions must be made by, reviewed by, and approved by an independent person(s) not previously involved with the matters that are the object of the complaint.

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
ComplianceAcuity, Inc.
Ridgway, CO
United States
www.complianceacuity.com
© Copyright 2020 by ComplianceAcuity, Inc. All rights reserved.
------------------------------

Original Message:
Sent: 26-Jan-2021 08:41
From: Susan Hamann
Subject: MDSAP Certificate

I know of a small company that has been certified by TUV SUD to ISO 13485 for years.  In August 2019 they were audited by TUV for MDSAP certification.  There were no major issues and they were recommended for MDSAP.  In August 2020, they were audited and again there were no significant issues found.  The problem?  Their MDSAP certificate still has not arrived. There have been some changes in the Quality organization and the missing certificate was not followed up on until about July 2019.  They reached out through their established channels and then raised it up one level.  All they seem to be getting is "we'll look into it" and "it's being reviewed."  I don't know what they can do now to get that certificate.  Any suggestions?  This has been going on for far too long.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------

Hi Susan,

Wow.  I could wish this would be a one off instance, but I hear this too often.  For these "certification bodies" to not even follow their own quality system requirements baffles me to no end.  What I would recommend is filing a formal, written complaint with the certification body (Auditing Organisation).  There is some key points you should address in the complaint, but most importantly getting the certificate in a timely manner - because this may be important for other regulatory reasons.  If there is not a response in a good time frame, then would escalate this to the accreditation group.  if this is for MDSAP, there is information for escalating this through there, though good luck with that also because I have not heard of timely responses there either.

------------------------------
Richard Vincins RAC
Vice President Global Regulatory Affairs
------------------------------

Original Message:
Sent: 26-Jan-2021 12:59
From: Kevin Randall
Subject: MDSAP Certificate

Certification Bodies are generally governed by ISO 17021-1 which requires those Bodies to receive, investigate, and resolve complaints in a formal and responsive fashion. ISO 17021-1 also says that the Certification Body is prohibited from any discriminatory actions against the complainant.  My thought is that it's easier for the Certification Body to figure out how to simply follow through with its certification obligations/responsibilities rather than that plus also enduring the additional burdens of formally processing a complaint.  Accordingly, a reasonable first step before formally lodging an actual complaint might be to inform the Body that its Client is considering such an action.  That might jar the issue loose.  If not, then the Client can submit a formal complaint to the Certification Body.  My understanding is that the Body's corresponding decision-making and complaint resolutions must be made by, reviewed by, and approved by an independent person(s) not previously involved with the matters that are the object of the complaint.

------------------------------
Kevin Randall, ASQ CQA, RAC (U.S., Europe, Canada)
Principal Consultant
ComplianceAcuity, Inc.
Ridgway, CO
United States
www.complianceacuity.com
© Copyright 2020 by ComplianceAcuity, Inc. All rights reserved.

Original Message:
Sent: 26-Jan-2021 08:41
From: Susan Hamann
Subject: MDSAP Certificate

I know of a small company that has been certified by TUV SUD to ISO 13485 for years.  In August 2019 they were audited by TUV for MDSAP certification.  There were no major issues and they were recommended for MDSAP.  In August 2020, they were audited and again there were no significant issues found.  The problem?  Their MDSAP certificate still has not arrived. There have been some changes in the Quality organization and the missing certificate was not followed up on until about July 2019.  They reached out through their established channels and then raised it up one level.  All they seem to be getting is "we'll look into it" and "it's being reviewed."  I don't know what they can do now to get that certificate.  Any suggestions?  This has been going on for far too long.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------

Thank you, Richard and Kevin.  Your answers are helpful.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------

Original Message:
Sent: 26-Jan-2021 08:41
From: Susan Hamann
Subject: MDSAP Certificate

I know of a small company that has been certified by TUV SUD to ISO 13485 for years.  In August 2019 they were audited by TUV for MDSAP certification.  There were no major issues and they were recommended for MDSAP.  In August 2020, they were audited and again there were no significant issues found.  The problem?  Their MDSAP certificate still has not arrived. There have been some changes in the Quality organization and the missing certificate was not followed up on until about July 2019.  They reached out through their established channels and then raised it up one level.  All they seem to be getting is "we'll look into it" and "it's being reviewed."  I don't know what they can do now to get that certificate.  Any suggestions?  This has been going on for far too long.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------

Glad to help.  One more clarification:  Because we hope to have comfortable, fulfilling, and enduring relationships with our certification bodies, it is most wise to employ as much diplomacy as possible in order to avoid unnecessarily straining the relationship.  If it were me, the first thing I would do is contact the certification body informally and simply ask a couple questions like, "What is the process for lodging a complaint?", and, "To whom can I lodge a complaint?".  That alone might jar the issue loose without having to actually encumber the parties and the relationship with an actual complaint.  Best of luck!

------------------------------
Kevin Randall, ASQ CQA, RAC (Europe, U.S., Canada)
Principal Consultant
ComplianceAcuity, Inc.
Ridgway, CO
United States
www.complianceacuity.com
© Copyright 2020 by ComplianceAcuity, Inc. All rights reserved.
------------------------------

Original Message:
Sent: 28-Jan-2021 16:14
From: Susan Hamann
Subject: MDSAP Certificate

Thank you, Richard and Kevin.  Your answers are helpful.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA

Original Message:
Sent: 26-Jan-2021 08:41
From: Susan Hamann
Subject: MDSAP Certificate

I know of a small company that has been certified by TUV SUD to ISO 13485 for years.  In August 2019 they were audited by TUV for MDSAP certification.  There were no major issues and they were recommended for MDSAP.  In August 2020, they were audited and again there were no significant issues found.  The problem?  Their MDSAP certificate still has not arrived. There have been some changes in the Quality organization and the missing certificate was not followed up on until about July 2019.  They reached out through their established channels and then raised it up one level.  All they seem to be getting is "we'll look into it" and "it's being reviewed."  I don't know what they can do now to get that certificate.  Any suggestions?  This has been going on for far too long.

------------------------------
Susan Hamann RAC, FRAPS
President
Hamann QR Consulting
Middletown, DE
USA
------------------------------