Scheme Document SD 003

Scheme Document SD 003 Management Systems (ISO 9001, ISO 14001, BS OHSAS 18001 & PN111 Factory Production Control) SD 003 Rev 03.6 10 Oct 2013 Page 1 of 13

(blank) SD 003 Rev 03.6 10 Oct 2013 Page 2 of 13

Introduction This Scheme Document sets out the requirements for Quality Management System (QMS), Environmental Management System (EMS), Occupational Health & Safety Management System (OHSAS) certification, Factory Production Control (PN111) and Red Book Listing against the requirements of:- ISO 9001 Quality Management Systems Requirements ISO 14001 Environmental Management Systems Requirements with guidance for use BS OHSAS 18001 Occupational Health & Safety Management Systems Requirements PN111 Factory Production Control (relevant to Organisations already holding ISO 9001 certification, issued by a Certification Body accredited by an IAF Member). Note: ISO 9001:2008 supersedes ISO 9001:2000, certifications against which were withdrawn on 15 November 2010. 1. Scope This scheme provides an on-going independent, third party audit and certification of an Organisation s documented management system to ensure that the requirements of the Standard(s) are met and maintained in accordance with the requirements of this Scheme Document. The process for application and audit is summarised in the flow chart shown in Appendix 1. A glossary of terms is given in paragraph 10. 2. Applications for management systems approval An application for certification is made by completing and returning Form Number F015 Application for Management Systems Certification & Red Book Listing. All data submitted shall be in the English Language as all audits are conducted in English. Applications are of three main types i.e. completely new certifications; and transfer of certification from other Certification Bodies (for further information refer to Appendix 2). application for Factory Production Control (refer to PN111). 3. Quotation On receipt, all applications are checked for eligibility and completeness by undergoing a contract review process. A quotation is prepared which includes the scope of certification, the certification fees, and the number and duration of audit visits, including audits to site(s) where applicable. Quotations are based upon the size of the Organisation (i.e. number of staff and office locations) plus the complexity of the operations and activities that are undertaken. For Organisations with more than one site, differences between sites will be identified such that an adequate level of sampling can be determined. Quotations are sent to the Organisation with details of the method of acceptance, and upon receipt of acceptance, an invoice is raised for the audit fees, which must be paid in full prior to the commencement of any audit work. Travel, accommodation, and subsistence expenses (if applicable) are invoiced after each visit. The audit team is selected on the basis of knowledge of the audit standard(s), knowledge and experience of the Organisation s product/service and business processes, and demonstrated competence auditing to the requirements of ISO17021:2011. Sometimes it will be necessary for our audit teams to be accompanied by technical experts in the product/service area. Prior to any audits, BRE Global / LPCB will provide the name of, and, when requested, make available background information on each member of the audit team with sufficient time for the Organisation to object to the appointment of any particular Auditor or Technical Expert, and for BRE Global / LPCB to reconstitute the team in response to any valid objection. SD 003 Rev 03.6 10 Oct 2013 Page 3 of 13

The audit plan will be communicated and the dates of the audit will be agreed upon in advance with the Organisation. Note: Definitions of Sites are given in paragraph 10. 4. Initial Audit (Stages 1 & 2) The duration of both Stage 1 & Stage 2 audits is as detailed in the quotation, and the Organisation may schedule Stage 1 & Stage 2 audits of a single Standard (such as ISO 9001) separately or consecutively. **Before subjecting the system to a third party audit, we recommend that you operate it for a minimum period of 3 months and perform a full set of internal audits with a review of the results through management review. Audits involving more than one Standard (such as ISO 9001 & ISO 14001) shall be scheduled separately, i.e., Stage 1 & Stage 2. All audits are delivered and recorded using the English Language and as such, translations of the following documentation must be available:- manual policy objectives documentation control control of records internal audits control of non-conforming product corrective action preventive action Stage 1 The duration of a Stage 1 audit is detailed in the quotation. The purpose of this audit is to assess the Organisation s preparedness for the Stage 2 audit, and this involves:- **an audit of the Organisation s management system documentation **checks that internal audits and management review are being planned and performed a review of the location and site specific conditions discussions with the Organisation s personnel to assess their understanding of the requirements of the Standard gathering information regarding the scope of the management system, the processes involved, and relevant statutory and regulatory requirements and compliance (e.g. environmental, health and safety, legal aspects of the Organisation s operation and associated risks etc) allocation of resources for the Stage 2 audit and agreeing the details of the Stage 2 audit plan The Organisation's management system documentation review may be undertaken at the Organisation's premises or remotely, if it is viable to do so. The purpose of this review is to confirm that all of the requirements of the Standard(s) have been adequately considered and addressed by the Organisation, and that appropriate documented procedures are in place. It is acceptable to combine the documentation for quality and other management systems (such as for environmental or health and safety) as long as all requirements can be clearly identified, together with the appropriate interfaces to the other systems. The documentation should adequately describe the management system and make clear the relationship to any other related management system in operation in the Organisation. At the end of the Stage 1 audit, the Organisation is provided with a documented report of the audit team s findings, including identification of any areas of concern. The Team Leader will advise the client organisation s management of one of the following outcomes:- on the basis of the evidence seen, the Stage 2 audit can proceed immediately SD 003 Rev 03.6 10 Oct 2013 Page 4 of 13

on the basis of the evidence seen, the Stage 2 audit (see Note ii) can proceed at another time following receipt by BRE Global / LPCB of acceptable corrective actions to the findings raised at Stage 1 on the basis of the evidence seen, the Stage 2 audit cannot proceed due to the nature of the findings raised. A Stage 1 re-audit (see Note i) will be required following receipt by BRE Global / LPCB of notification of corrective actions to the findings raised at the initial Stage 1 audit. Note:- i. Further re-audits, if required, are subject to additional charge at the prevailing audit day cost. Please refer to Fee Sheet FS003 for confirmation of the charges for full and half day rates. ii. iii. In determining the interval between Stage 1 & Stage 2 audits, consideration is given to the needs of the Organisation to resolve areas of concern raised at the Stage 1 audit. Where this interval exceeds 180 days, BRE Global / LPCB reserves the right to re-schedule both the Stage 1 & Stage 2 audits, as necessary. At the end of the Stage 1 audit, and in the event that the Team Leader does not recommend proceeding with the Stage 2 audit, any audit time remaining in that day can, at the Organisation s option, be used to start looking at the Stage 2 audit even though there will not be a positive recommendation for Certification at the end of the audit. iv. For ISO 14001 and OHSAS 18001 certification, the Stage 1 audit shall be performed independently of the Stage 2 audit. Stage 2 The purpose of the Stage 2 audit is to evaluate the implementation, including effectiveness, of the Organisation s documented management system. Obtaining evidence of this involves auditing:- conformance against all the requirements of ISO 9001 and / or ISO 14001 and / or PN111 (FPC) and / or BS OHSAS 18001 the Organisation s monitoring, measuring, reporting and reviewing of its performance against policies, key objectives and targets the Organisation s documented management system and performance as regards statutory and regulatory compliance the operational control of processes the performance and reporting of internal audits and management review, and actions arising key management responsibilities links between the normative requirements, policy, performance objectives and targets competence of personnel An audit starts with an opening meeting between the audit team and the Organisation s management to explain the purpose of the audit, the scope, reporting method, the outline programme, and the approximate time and purpose of a closing meeting. At the end of the audit, the audit team holds a closing meeting with the Organisation s management to discuss any nonconformities and/or observations that have been raised, and to confirm the recommendation to be made. The audit team makes a written recommendation to BRE Global / LPCB as to whether the Organisation should be recommended for certification, subject to notification and receipt of evidence of satisfactory corrective actions addressing any nonconformities raised, or whether a full or partial re-audit is required. A copy of any nonconformities / opportunities for improvement (OFI) are left with the Organisation, who is required to respond to BRE Global / LPCB with completed corrective actions within 45 days of the audit. Where the corrective action is not acceptable, the Organisation is informed and asked to re-consider the details of the nonconformities / OFI s and provide a further response. Where certification cannot be recommended, BRE Global / LPCB will write to the Organisation confirming that a full or partial re-audit is required and explaining the reasons for this. Details of the additional costs associated with full or partial re-audit will also be confirmed. Organisations applying for approval against the requirements of PN111 for Factory Production Control are only required to undergo the Stage 2 audit. SD 003 Rev 03.6 10 Oct 2013 Page 5 of 13

5. Certification & Red Book Listing A certificate is awarded when all audit activities have been satisfactorily conducted, the audit team has recommended that certification is granted, and the Organisation has fully implemented any corrective actions to close out all findings raised. The final decision to issue certification will be taken by personnel at BRE Global / LPCB, independent of the audit team. Certificates contain the name and address of the Organisation, the audit standard and assessed scope, a unique certificate reference number, and the issue and expiry dates. In addition to being sent the certificate, the details of the Organisation and the scope of certification are placed in Volume 2 of the Red Book, which can be accessed by the public through the BRE Global Limited / Red Book Live websites www.breglobal.com or www.redbooklive.com. Listing in the Red Book is a mandatory requirement on issue of certification. 6. Maintenance of Certification & Red Book Listing Surveillance audits are conducted in a similar manner to Stage 2 audits but only sample aspects from the approval Standard(s) are taken to confirm that the Organisation continues to satisfy the requirements. Where installation and servicing activities are undertaken, site audits will be conducted during the 3 year certification cycle. The number, frequency and duration of surveillance audits will be confirmed following the successful completion of the Stage 2 audit. A typical surveillance programme is shown below and surveillance audits are usually between two and four per year. The first surveillance audit shall take place within 6 months of the Stage 2 audit. TYPICAL MANAGEMENT SYSTEMS SURVEILLANCE PROGRAMME (including Full Surveillance) Year 1 Surveillance 1 6 months after certification granted Surveillance 2 (including site activities) 12 months after certification granted Year 2 Surveillance 3 18 months after certification granted Surveillance 4 (including site activities) 24 months after certification granted Year 3 Surveillance 5 30 months after certification granted Full Surveillance (including site activities) 35 months after certification granted** ** All certificates issued are subject to review (full surveillance) at three yearly intervals and this review shall take place at least one month prior to the expiry of the certificate. Upon successful completion of the full surveillance audit (similar to the format of a Stage 1 / Stage 2 audit), the certificate will be re-issued and the surveillance cycle will begin again. During surveillance audits, nonconformities or OFI s may be raised (where appropriate). To maintain certification, the Organisation must return nonconformity reports to BRE Global / LPCB together with details of completed corrective actions, or planned corrective actions (with timescales), and objective evidence where specified by the audit team. This information must be sent to BRE Global / LPCB within 30 days of the audit date. Following a surveillance audit, the Team Leader shall issue a report to BRE Global / LPCB with a recommendation as follows: (i) Certification should be maintained. SD 003 Rev 03.6 10 Oct 2013 Page 6 of 13

(ii) Certification should be maintained subject to addressing any nonconformities within 30 days. (iii) A warning should be issued to the Organisation (usually following one or more major nonconformities being identified), stating that a further audit must be conducted within 12 weeks to close out the nonconformities. Where it is not possible to resolve nonconformities, certification is suspended and may only be reinstated upon the successful completion of a further surveillance audit. Suspension - of certification can only be lifted following a new and successful audit within a specified period to be advised by the Team Leader. If suspension cannot be lifted, the certificate(s) and authority to use the BRE Global / LPCB Certification Mark will be withdrawn and cancelled. Withdrawal - Where an Organisation wishes to voluntarily withdraw approval, this must be advised to BRE Global / LPCB in writing and comply with the Terms and Conditions (PN 101). 7. Re-Certification Audits During the third year of certification, and at least one month prior to the certificate expiry date, a Full Surveillance Audit (re-certification audit) shall be conducted. This is conducted in a similar manner to a Stage 1 / Stage 2 audit. The duration of a Full Surveillance is determined by the Team Leader at the previous surveillance audit and shall ensure that the Organisation s management system continues to:- be entirely effective and accurately reflect the Organisation s activities continue to improve and enhance the Organisation s performance contribute to the achievement of the Organisation s policy and objectives. Re-certification audit activities may need to have a Stage 1 audit in situations where there have been significant changes to the management system, the Organisation, or the context in which the management system is operating (e.g. changes to legislation). At the end of the Full Surveillance, the Team Leader holds a closing meeting with the Organisation s management to discuss any nonconformities and / or opportunities for improvement, and to confirm the recommendation. The Team Leader makes a written recommendation to BRE Global / LPCB as to whether certification should be continued, or whether a full or partial re-audit is required. 8. Special / Short Notice Audits As detailed in (6) above, suspension of certification can only be lifted following a new and successful surveillance audit within a specified period to be advised by the Team Leader. If suspension cannot be lifted for any reason(s), the certificate(s) and authority to use the BRE Global / LPCB Certification Mark(s) will be withdrawn and cancelled. It may be necessary for BRE Global / LPCB to conduct audits of certified clients at short notice to investigate complaints, or in response to significant changes in the certified Organisation s management system, or as a follow up on an Organisation whose certification is suspended. In such cases:- a) BRE Global / LPCB will describe and make known in advance to the certified clients that these short notice audits are to be conducted, and b) BRE Global / LPCB will exercise additional care in the assignment of the audit team because of the lack of opportunity for the certified Organisation to object to audit team members. 9. BRE Global / LPCB Certification Mark(s) Once issued with a certificate, the certified Organisation may use the BRE Global / LPCB Certification Mark(s) as directed in the publication PN103 'Use of the Certification Mark'. The LPCB Certification SD 003 Rev 03.6 10 Oct 2013 Page 7 of 13

Mark can only be used where the certified Organisation has also applied for LPCB product certification for fire and/or security products or services. Organisations that do not hold LPCB product certification shall use the BRE Global Listed Certification Mark. Assessed to ISO 9001 Assessed to ISO 9001 Certificate No. ### Certificate No. ### Assessed to ISO 14001 Assessed to ISO 14001 Certificate No. ### Certificate No. ### Assessed to BS OHSAS 18001 Assessed to BS OHSAS 18001 Certificate No. ### Certificate No. ### Upon satisfactory completion of the approvals process, electronic artworks of the Certification Marks shall be made available. SD 003 Rev 03.6 10 Oct 2013 Page 8 of 13

10. Glossary of Certification Terms Audit This is a systematic audit and review of the Organisation s documented management system against the clauses of the audit standard(s) for the activities detailed in the scope of audit. Included in the audit is a review of any complaints received concerning the product or service and the close out of any opportunities for improvement (OFI s) from the management systems documentation audit plus any nonconformities and OFI s raised during any previous audit(s). Surveillance this is a systematic audit and review of the Organisation s documented management system against the clauses of the audit standard(s) for the activities detailed in the scope of certification. Included in the surveillance is a review of any complaints received concerning the product or service and the close out of any findings from the previous audit(s). Nonconformity reports set out areas where the documented management system does not conform to the requirements of the audit standard or where activities of the Organisation do not conform to the documented management system. [ Nonconformity may sometimes be termed non-compliance or non-conformance.] Nonconformities may be of a major or minor nature. Major nonconformity Where the Organisation has failed to address a requirement of the audit standard(s) (i.e. ISO 9001 - no system in place to address the requirement) Total breakdown of a system intended to meet the requirement (i.e. system exists but does not work) Any nonconformity that could result in supplying a nonconforming product or service to the customer Any nonconformity that could result in the failure of the documented management system to assure controlled processes and products A number of minor nonconformities against one clause of the audit standard(s) / specific requirement Minor nonconformity Where a lapse has occurred in an area of the documented management system Opportunity for Improvement a report that highlights areas where there is insufficient objective evidence to raise a nonconformity, yet there appears to be the suggestion that, if left unaddressed, a situation could arise which could lead to nonconformity. Close out This is a formal check that any corrective actions associated with nonconformities or observations have been completed satisfactorily. Site - This is typically defined as any location at which activities under the control of a Organisation are carried out, including any connected or associated storage of raw materials, by products, intermediate products, end products and waste material, and any equipment or infrastructure involved in the activities whether or not fixed or where required by law, correspond to definitions laid down in national or local licensing regimes. This also applies to shared facilities. Temporary Sites - These are sites, such as construction sites, that are covered under the Organisation s documented management system irrespective of location. Such sites may be subject to audit on a sample basis as part of the certification process to provide evidence of the operation and effectiveness of the system. Non Site Specific Organisations - Where it is not practicable to define a location, the coverage of the certification should take into account the Organisation's headquarters activities as well as delivery of its services. Where relevant and in special cases BRE Global / LPCB may decide that Stage 2 audits will only be carried out where the Organisation delivers its services. In such cases the interfaces with its headquarters should be audited. Organisation This definition is taken from ISO 9001:2008 and is interchangeable with the term "Supplier", when read in conjunction with our Terms and Conditions document PN101. SD 003 Rev 03.6 10 Oct 2013 Page 9 of 13

11. Health & Safety Requirements During all visits, BRE Global / LPCB Auditors plus any accompanying Technical Experts must be accompanied at all times by a representative of the Organisation. The Organisation is responsible for pointing out to the BRE Global / LPCB Auditors, any Health and Safety requirements including details of any fire or evacuation procedures, and must supply any necessary protective equipment. BRE Global / LPCB Auditors are not permitted to operate any equipment or machinery including computer terminals in order to access information. If required this information must be accessed and supplied by the Organisation's representatives. 12. Complaints & Appeals BRE Global / LPCB operates procedures for complaints and appeals. Further details are available on request. SD 003 Rev 03.6 10 Oct 2013 Page 10 of 13

Appendix 1 - The Certification Process SD 003 Rev 03.6 10 Oct 2013 Page 11 of 13

Appendix 2 Transfer of Accredited Certification of Management Systems (reproduced from IAF MD2:2007) This document is mandatory for the consistent application of Clause 9.1.1. of ISO/IEC 17021:2011 and is based upon guidance previously provided in IAF GD2: 2005 Annex 4 and IAF GD6:2006 Annex 2. All clauses of ISO/IEC 17021:2011 continue to apply and this document does not supersede any of the requirements in that standard. This mandatory document is not exclusively for Quality Management Systems (QMS) and Environmental Management Systems (EMS) and may be used for other management systems. 0. INTRODUCTION 0.1. This document provides normative criteria on the transfer of accredited management system certification between certification bodies. The criteria may also be applicable in the case of acquisitions of certification bodies accredited by an IAF MLA signatory. 0.2. The objective of this document is to assure the maintenance of the integrity of accredited management system certifications issued by one certification body if subsequently transferred to another such body. 0.3. The document provides minimum criteria for the transfer of certification. Certification bodies may implement procedures or actions which are more stringent than those contained herein provided that a client Organisation's freedom to choose a certification body is not unduly or unfairly constrained. 1. DEFINITION 1.1. Transfer of Certification The transfer of certification is defined as the recognition of an existing and valid management system certification, granted by one accredited certification body, (hereinafter referred to as the issuing certification body ), by another accredited certification body, (hereinafter referred to as the accepting certification body ) for the purpose of issuing its own certification. Note: Multiple certification, (concurrent certification by more than one certification body), does not fall under the definition above, and is not encouraged by IAF. 2. MINIMUM REQUIREMENTS 2.1. Accreditation 2.1.1. Only certifications which are covered by an accreditation of an IAF MLA signatory shall be eligible for transfer. Organisations holding certifications that are not covered by such accreditations shall be treated as new clients. 2.2. Pre-Transfer Review 2.2.1 A competent person from the accepting certification body shall carry out a review of the certification of the prospective Organisation. This review shall be conducted by means of a documentation review and should, normally, include a visit to the prospective Organisation. Reasons for not conducting a visit shall be fully justified and documented and a visit shall be conducted if no contact can be made with the issuing certification body. The review should cover the following aspects and its findings shall be fully documented: (i) confirmation that the Organisation s certified activities fall within the accredited scope of the accepting certification body; (ii) the reasons for seeking a transfer; (iii) that the site(s) wishing to transfer certification hold an accredited certification that is valid in terms of authenticity, duration and scope of activities covered by the management system certification. If practical, the validity of certification and the status of outstanding nonconformities should be verified with the issuing certification body unless it has ceased trading. Where it has not been possible to SD 003 Rev 03.6 10 Oct 2013 Page 12 of 13

communicate with the issuing certification body, the accepting certification body shall record the reasons; (iv). A consideration of the last certification or recertification audit reports, subsequent surveillance reports and any outstanding nonconformities that may arise from them. This consideration shall also include any other available, relevant documentation regarding the certification process i.e. handwritten notes, checklists. If the last certification, recertification or subsequent surveillance audit reports are not made available or if the surveillance audit is overdue then the organisation shall be treated as a new Organisation:- (v) complaints received and action taken; (vi) the stage in the current certification cycle (see Clause 2.3.4 of this document); and (vii) any current engagement by the Organisation with regulatory bodies in respect of legal compliance. 2.3. Certification 2.3.1 Normally, only valid accredited certification should be transferred. In cases where certification has been granted by a certification body which has ceased trading or whose accreditation has expired, been suspended or withdrawn, the accepting certification body may consider such a certification for transfer at its discretion. In such cases, before it proceeds with the transfer, the accepting certification body shall obtain agreement from the accreditation body, whose mark it intends to place on the certificate. In the case of acquisitions the acquiring certification body should, where practical, fulfil the contractual obligations of the acquired certification body. 2.3.2. Certification which is known to have been suspended or under threat of suspension shall not be accepted for transfer. If the accepting certification body has not been able to verify the status of the certification with the issuing certification body, the organisation shall be required to confirm that the certificate is not suspended or under threat of suspension. 2.3.3. Outstanding nonconformities should be closed out, if practical, with the issuing certification body, before transfer. Otherwise they shall be closed out by the accepting certification body. 2.3.4. If no further outstanding or potential problems are identified by the pre-transfer review a certification may be issued following the normal decision making process. The programme of ongoing surveillance should be based on the previous certification regime unless the accepting certification body has conducted an initial or recertification audit as a result of the review. 2.3.5 Where doubt continues to exist, after the pre-transfer review, as to the adequacy of a current or previously held certification, the accepting certification body shall, depending upon the extent of doubt, either: Treat the application as a new Organisation or conduct an audit concentrating on identified problem areas. The decision as to the action required will depend upon the nature and extent of any problems found and shall be explained to the Organisation and the justification for the decision shall be documented and the records maintained by the certification body. SD 003 Rev 03.6 10 Oct 2013 Page 13 of 13