At the check out

Lifting the lid

So having described the advantages of certification to end user customers, buyers, specifiers and insurers alike, what are the specific operational implications for service providers? In practice, certification is attained and maintained through a rigorous ongoing audit programme – a not insignificant investment cost for the approved company.

There are clear benefits to operating in line with approval in terms of operational effectiveness, demonstrably maintaining competence and capability. The certification process for applicant service providers involves ‘due diligence’ checks on the company’s financial stability, along with verification of company directors and an assessment of the competency of key individuals involved in the provision of the service for which certification is sought.

In the case of fire detection and fire alarm systems, for example, this includes system designers. Once all checks are completed successfully, an auditor with specific expertise in the relevant discipline is assigned to carry out an initial certification audit. This process usually takes two to three days, depending on the size of the company and the certification applied for.

The procedure involves sample auditing of the applicant company’s office processes and procedures. This includes looking at client files, checking competency and continuing professional development (CPD) records for personnel involved in providing the system or service, and looking at the processes for providing the product or service.

Importantly, audits are also conducted on site at premises where systems have recently been installed or where risk assessments are being carried out. This allows the auditor to assess the competency of the individuals involved in providing the system or service, as well as the quality of the system or service itself.

 However, the initial certification audit is only the start of the process. Once a company has achieved its initial certification, it signs up to a programme of ongoing annual audits to ensure continued compliance with relevant standards, codes of practice and applicable legislation.

A strong focus is maintained on the ‘continual improvement’ process within the company by looking to see if a company is realistically and tangibly reviewing its processes and procedures, to enhance its performance and increase the quality of the product or service provided to the customer.

Every third year, approved companies undergo a major ‘recertification audit’. This involves the auditor evidencing existing competence by sampling relevant activities to ensure the provider continues to meet the benchmark standards required. If successful, the approved company is issued with a renewed certificate of approval spanning the following three years.

Auditing the auditors

Certification bodies, including NSI, earn their own accreditation through opening themselves up to the scrutiny of auditors at the United Kingdom Accreditation Service (UKAS), the sole national accreditation body for the UK (both before and after Brexit). UKAS tailors its audit programmes so that all certification bodies are comprehensively audited in accordance with international guidelines, such as International Accreditations Forum (IAF) documents.

Adaptability has been a key element for certificating bodies in maintaining the necessary rigour of the auditing process during the COVID-19 pandemic. Different approaches have been adopted as solutions to this conundrum, but given the various lockdown and tier guidance issued by the governing authorities across the four nations of the UK over the past year, NSI has evolved its audit programmes with what it calls its ‘blended approach’.

This incorporates remote audits – using communications technologies where they are appropriate – into its audit programmes, complementing the rigour of essential site visits. Interest in remote auditing has exploded dramatically over the last 12 months. COVID-19, so the headlines have it, means that in the world of auditing the time for remote audit has come.

Where audit programmes require a focus on reviewing and a reliance on documentation, the now widely familiar technologies of Skype, Teams, Zoom and the like go a long way to making this possible. Yet there are solid reasons why remote auditing is not always practically possible or desirable.

On site audits continue to be valuable in gathering evidence of compliance to technical product (and service) standards. NSI’s adopted blended audit strategy is a carefully considered combination of remote and on site audit capability, which is fit for the future post pandemic world and in sync with government COVID-19 guidelines.

As part of NSI’s new blended audit programme, remote audits are now being routinely carried out at NSI’s discretion for assessing ‘management system’ requirements, where process and control has a greater emphasis on documentation; whilst on site verification and evidence gathering of service delivery ensures that the audit jigsaw is completed.

Understanding the pros and cons and the limits of what can be achieved through remote auditing is key. So what is its place in the auditor’s toolbox? What are the benefits and drawbacks?

Pros and cons

Remote audit means many parts of an audit programme jigsaw can now be completed without a physical, on site presence. However, in many sectors, and certainly in the fire safety sector, remote auditing is not and never will be a universal panacea for the public and businesses reliant on the certification proxy.

To suggest that it is, is folly: it cannot be considered a complete confirmation of the ongoing ability to consistently provide products and services that meet customer and applicable statutory and regulatory requirements. Without on site verification and evidence gathering of service delivery, the audit jigsaw remains incomplete.

‘Trust in the audit’ is key: when an auditor has physical access during face to face, one to one interviews, the strength of evidence gathered is unquestionably greater; confidence in observations and reports made first hand is stronger; and the opportunity to seek clarification when needed is far more open. Unscrupulous auditees have much less opportunity to be economical with the truth, disguise grey areas and hide non conformities during physical audits. The opportunity for auditors to dip sample ‘off piste’ and ‘kick the tyres’ in a free ranging way is clearly easier in person.

Non verbal signals evident in a face to face meeting can be virtually impossible to detect during a remote audit, lessening the opportunity for in depth situational analysis. Moreover, the auditor’s skill in triangulating fully the evidence presented through independent interview of multiple parties and ‘disconnected’ documentation is severely hampered and potentially nullified.

Only where information gathering is highly structured, with an audit trail readily reviewable and dip sampling facilitated by business tools, can remote auditing deliver unquestionably. Establishing the new normal for the use of these tools is crucial. Will the pendulum swing too far toward remote audit, as early enthusiasm in the technology takes hold? It’s almost inevitable. The rules of successive approximation dictate it.

Will the take up of remote audits add value in the world of certification? In many cases, most certainly. Finding the optimal balance for each client, as part of its individually designed blended audit programme, is the job of the certification body.

An important factor

Certification (or approval) is being seen as increasingly important in keeping people safe. Post Grenfell, the Setting the Bar report, the draft BSB and other legislation currently underway – including the Fire Safety Bill and the separate review of the Regulatory Reform (Fire Safety) Order 2005 now being considered – all point to it.

This is not the time for the industry or legislators to tolerate watering down TPC with ineffectual light touch regimes. On the contrary, NSI approved companies know that maintaining approval with teeth might, from time to time, seem an effort or even a challenge, particularly as standards evolve and prompt businesses to move with the times.

But in the round they also know that TPC, as evidence of competency and capability which buyers of fire safety products and services can rely on, helps save lives and protect property

Richard Jenkins is chief executive of NSI