Ronald Reagan

1 card

1. 01

   Certification is not an event but a three-year cycle: two stages at the start, surveillance every year, recertification at the end.

   Remarks on Signing the Intermediate-Range Nuclear Forces Treaty · 1987

   Stage 1 judges the documents, stage 2 judges the evidence, and accreditation judges the body that judges both.

   The certification audit comes in two stages. Stage 1 looks at documentation and readiness: the scope, the policy, risk assessment and treatment, the statement of applicability, evidence that the internal audit and the management review actually happened. Its output is not a grade but the plan for stage 2 and the list of things that would block it. Stage 2 checks implementation: records from the elapsed period are requested, people inside the processes are interviewed, what is written is compared with what is done. After the certificate come annual surveillance, on a sample of processes and controls, and full recertification every three years. The body issuing the certificate is itself accredited against ISO/IEC 17021-1, in Romania by the national accreditation body RENAR; a certificate with no accreditation behind it is paper, not recognition. For the same reason of independence, whoever implemented the system cannot also audit it.

   “We have listened to the wisdom in an old Russian maxim. And I'm sure you're familiar with it, Mr. General Secretary, though my pronunciation may give you difficulty. The maxim is: Dovorey no provorey — trust, but verify.”

   Open the card →