Compliance and beyond
It’s common knowledge that certification and auditing are mired in controversy at the moment – arguments abound over the inherent value of the auditing process. But international certification body DNV has devised a new approach with Risk Based Certification*, which purports to have a ‘wider focus’ than the ISO regime and adds value to audits. Ferry Jansen investigates
Risk Based Certification is not a replacement for accredited management system certification, but another way of delivering it. It means focusing audits on identified risk areas in addition to the regular quality, safety and environmental performance. It means that the end result of the certification process is not simply a certificate on the wall - a risk-based approach offers much more value to the whole process.
As opposed to the traditional approach, Risk Based Certification gives companies the opportunity to define three to five focus areas (these could be, for example, increased customer retention, improved project management, or reduction in returned goods) related to those issues which have the biggest impact on their business. This goes beyond compliance to any standard; it is vital in assisting the business to identify key improvement areas.
Another important new part of the process is also the post-audit briefing, where the auditor provides direct feedback on the key issues to the customer. The feedback is summarised in a report and left with the customer. During the periodic audits and re-certification processes customers can focus on new issues, accommodating possible changes in priorities.
Flying high
One of the first companies certified according to the Risk Based Certification methodology was an Asian airline company. During the audit in late October 2004, the customer asked DNV to focus on two particular areas in addition to those normally covered by the environmental management system (EMS) standard ISO 14000.
The lead auditor of DNV Certification who took part in the airline’s innovative audit, explains that: ‘Focus areas were the supplier control process and environmental awareness and training. The company believed that environmental awareness and training were essential in the implementation of its EMS. How its suppliers handle waste and act in relation to environmental issues are also important.’
He believes that one of the ways in which this audit approach is innovative was the greater degree of follow up the auditing team engaged in. ‘In advance, we asked the customer's managers to specify some areas to be focused on. With the customer, we investigated all types of problems within the elected area. Finally, we summarised the auditing team's findings and handed over the report to the customer for further action.’
For the airline company, which has outsourced its ticketing service and parts of its maintenance work, it was important to ensure that these tasks are carried out in line with the airline's policy. ‘From our findings we concluded that there were some very real gaps to close - gaps that would not have been discovered without the new Risk Based Certification regime,’ explains the auditor. ‘For example, the training sessions at the customer's head office were good, while those held at most of the local offices should have been much better.’
CEO of DNV Henrik O Madsen observes: ‘The certification business has shown signs of maturing in certain markets. Companies that have gained a high level of competency now expect more value from their certification partners. A change in the certification process is of vital importance to move the business beyond compliance verification.’
Feedback from the International Accreditation Forum (IAF) has been positive towards the new approach – Madsen even goes as far as to predict that this kind of certification will soon become mainstream and be incorporated into the standards themselves in time.
About the author
Ferry Jansen is marketing assistant for DNV Certification Benelux, UK and Ireland. For more information on Risk Based Certification visit www.dnv.co.uk/certification/managementsystems
*Risk Based Certification is a trademark of Det Norske Veritas AS.