Located in Victor, New York, Surmotech is a full-service electronics contract manufacturer. For more than 20 years the company has provided a complete range of manufacturing, design, and engineering services to the military, medical, industrial, and telecommunications industries and consumer markets.

At its 20,000 sq ft facility, the Surmotech team performs complete product assembly, consignment, and turnkey electromechanical assembly, as well as product design and testing services. Being certified to the international quality management system standard, ISO 9001, is an essential requirement for Surmotech’s business, and the company has held its ISO 9001 certification since 1999.

Certification to ISO 9001 is valid for three years. To maintain its certification, a company’s management system must be audited every three years by an independent body—a registrar, aka certification body—to verify that the company conforms to the requirements specified in the standard. Surmotech’s certification was set to expire on Jan. 18, 2012. Given the importance of maintaining its certification, the company had repeatedly alerted the registrar that had carried out the certification process about the upcoming deadline, but prompt responses were not forthcoming. As the end of 2011 neared, Surmotech’s quality personnel found themselves looking for a new registrar.

When selecting a certification company, Tim Bibens, the quality manager at Surmotech, recommends looking for a reputable registrar that is accredited to ISO 17021, the conformity assessment standard with requirements for bodies providing audit and certification of management systems. An accredited registrar is audited regularly by an accrediting body, which provides a formal recognition that the registrar is competent to carry out the certification process.

With the expiration deadline looming, Bibens got in touch with TÜV Rheinland’s regional office on Dec. 1, 2011, describing the time constraints and requesting a quote.

“I typically wait for about four weeks to get a quote, which is too long in general and would have been disastrous in this case,” explains Bibens. “TÜV Rheinland’s prompt response was instrumental in helping us maintain the certification.”

Given the urgency of the situation, the registrar’s team was able to give Surmotech priority and provided the quote within four days. Once the quote is provided, it might take more than a month for a registrar to prepare for auditing a new company. Surmotech’s purchase order was executed on Dec. 8, and the audit was scheduled for Jan. 9–11, 2012.

Surmotech’s case was challenging because of the tight deadline, and TÜV Rheinland had to adjust its process to make sure that the certification went smoothly. For example, a technical reviewer, who usually does not enter the process until the audit is completed, had to be lined up before the audit was conducted, in order to be ready to work on Surmotech’s file when it was submitted for the certification decision.

When a company seeks certification to a standard from the International Organization for Standardization (ISO), the company’s level of readiness plays a large role in the process. To determine if a company is ready for an audit, a registrar conducts a preliminary one-day “readiness” examination of the management system, commonly known as a stage-one audit. This preliminary audit includes a review of the required documented procedures; the system’s key components and processes; and the organization’s internal audit process, management review process, and document control. If a company has not been certified before, a stage-one audit may identify gaps that will need to be corrected before the certification can proceed. If these gaps can be fixed relatively easily, the company receives a 30-day window within which to take action.

“Prepare everything at least two months in advance of the audit to ensure a successful certification,” advises Bibens. “Ensure that your management review is recent, and everyone within the organization is aware of your strengths and weaknesses. It is smart to know any deficiencies that might exist and work on them before the auditor arrives.”

According to Bibens, a company owner or president who signs off on the quality manual should be actively involved in the process and informed of any concerns that might be interpreted as nonconformities as issues begin to surface during the audit process.

“Top management needs to understand why an auditor may identify a nonconformity and be prepared to explain and defend the process if they believe that it is compliant, by providing objective evidence of conformance,” says Bibens.

If a stage-one audit reveals that a company does not have an adequate management system in place, the company might consider working with a consultant to build a more robust system. This might take from three to six months.

Once an applicant successfully completes a stage-one audit, a more detailed and comprehensive stage-two audit will be conducted. Depending on the size of the company, it can typically take from one to five days. When being audited for compliance to an ISO standard, the audit is a transparent process conducted in accordance with ISO 19011—“Guidelines for auditing management systems.” An audited company typically receives a plan outlining the process from its registrar before the audit commences.

Surmotech’s audit was a comprehensive recertification assessment, which included the following elements:
• An opening meeting provided an opportunity for representatives of Surmotech and TÜV Rheinland to meet and review the intentions and scope of the audit.
• A meeting with top management allowed the registrar to understand the level of management commitment to the system.
• A plant tour helped TÜV Rheinland better understand the company and its processes.
• Process sampling is a key step of any audit, during which the company records are examined and samples of the process are evaluated for compliance to the ISO 9001 standard.
• Employee interviews were part of process sampling, during which the registrar determined the employees’ knowledge of the applicable procedures, work instructions, and relevant sections of the company’s management system. Employees must demonstrate a thorough understanding of the system and that they follow the company’s established procedures.
• Daily wrap-up meetings allowed the registrar and the company to discuss any issues that came up during the day.

An audit can be a stressful experience, and an issue that an auditor may think is a nonconformity may be a mere misunderstanding. A daily discussion helps clarify findings so that both parties understand and agree on the issues at hand. Even if an observation is indeed a nonconformity, the customer will know about it right away and can begin taking corrective action. Such an approach leaves no room for a surprise at the end of the audit, and it helped Surmotech to stay on schedule and work on any issues as the audit went on.

Daily wrap-up is not a required step in an audit, and some registrars discuss all their findings at the end of the assessment. On rare occasions, an audit may take another course when an auditor finds a serious nonconformity that precludes a company from getting a certification and will stop the audit altogether. The company would need to address the problem before an audit can be repeated.

TÜV Rheinland recommends that in these cases a company still completes the audit. The company pays for the entire audit, regardless of the outcome, so knowing the full picture of the compliance requirements will help a company better prepare for future audits.

For Bibens, an auditor plays a big part in a certification process because he feels the key attribute of a good auditor is her ability to review a company’s processes objectively and substantiate findings based on a significant sample size, not a one-off instance. Bibens also emphasizes the importance of the auditor’s ability to relate to the manufacturing process, understand the objectives of manufacturing, and know how systems relate to the assembly process.

According to TÜV Rheinland, a good auditor will separate his own understanding of what a management system should look like and evaluate objectively whether a system conforms to the standard requirements or not.

“We found it very helpful that our auditor explained his rationale and allowed us to clarify how our processes either met or did not meet the requirements,” says Bibens.

A closing meeting was the final step of Surmotech’s audit. The registrar summarized the results and determined the next steps. A few minor nonconformities were identified, which Surmotech addressed using the following steps:
• Review of processes to identify other areas that might be affected and implement appropriate correction and containment
• Conduct a thorough root cause analysis to determine why a nonconformity happened
• Establish a plan for corrective action that includes revising any affected procedures and provide the appropriate training to employees
• Provide evidence to the registrar confirming that the corrective action was effectively implemented

In Surmotech’s case, the company provided its correction and containment, the root cause, and initial plan of corrective action within a week. Because the company was alerted about its nonconformities as the audit progressed, the company personnel had already been working on addressing the problems. Generally, an applicant needs to submit a plan within 30 days after the audit and present the evidence that the action was taken within an additional 60 days.

As a final step in the certification process, an auditor sends her file to a technical reviewer after nonconformities, if any, are addressed. The reviewer is part of the registrar’s team but is not involved directly with the audit. The reviewer ascertains that the auditor took all the necessary steps to evaluate a management system and makes the final decision to issue the certification.

Surmotech received its new certificate on Jan. 17, 2012. It is currently contracted with TÜV Rheinland for ISO 9001:2008 registration services, which include surveillance and recertification support.