# Presentation: 704166

## Conformity AssessmentPractical Implications  

- InterAgency Committee on Standards Policy
**June 2007**
- Gordon Gillerman
- Conformity Assessment Advisor
- Homeland Security
- National Institute of Standards and Technology
- gordon.gillerman@nist.gov

## “The absence of standards and conformity assessment programs is creating confusion for the users”

**Does this work?**

**How do I test this?**

**Does****this solve****the right problem?**

**How do I ****use this?**

**Should I buy this?****How do I****comparison shop?**

**Will this work with my other devices?**

## Activity Overview

- Assist US Federal Government Agencies including the Department of Homeland Security and the Department of Justice in developing standards and conformity policies and administrative infrastructure
- Design and assist in the implementation of homeland security related conformity assessment programs
- Assist in the development of standards for homeland security
- Coordinate and network with standards development organizations
- Promote use of available international and national standards
- Identify standards suitable for homeland security procurement and grant guidance
- Participate in the development of key standards

## Conformity Assessment

- “demonstration that specified requirements relating to a product, process, system, person
- or body are fulfilled”
- ISO/IEC 17000

## Helpful Terminology

**The parties – who done it?**
- Conformity Assessment can be
- conducted by:
*first party* – seller or manufacturer
*second party* – purchaser or user
*third party* – an independent entity that
- has no interest in transactions between
- the 1st and 2nd parties
*government* – has a unique role in regulation,
- but is the second party in procurement

## Types of Conformity Assessment

- Supplier’s Declaration
- Inspection
- Testing
- Certification
- Registration
- Accreditation

## Typical Use – Testing(1st, 2nd or 3rd Party CA)

- Used when the critical characteristics can be evaluated via measurement under specified conditions.
- Type test is a test carried out on samples that represent production for the purpose of determining conformity.
- May be an element of a suppliers’ declaration or
- 	certification system.

## Typical Use – Suppliers Declaration(1st Party CA)

- Generally used:
- when the risk associated with noncompliance is low
- there are adequate penalties for placing noncompliant products on the market
- there are adequate mechanisms to remove noncompliant products from the market

## Typical Use – Inspection(1st, 2nd or 3rd Party CA)

- Typical Use – Inspection(1st, 2nd or 3rd Party CA)

- Used when the critical characteristics can be evaluated via physical examination or measurement.
- May be an element of a certification system.
- May be used to ensure that all parts of a system have been properly installed (ex. code inspection)

## Typical Use –Certification(3rd Party CA)

- Used when the risks associated with non-conformity are moderate to high.
- Includes evaluation, compliance decision, attestation of conformity and some form of *surveillance *or follow up.
- Always conducted by a third party.

## Management System Registration(3rd Party CA)

- Used to provide an assurance that a process meets requirements
- Not a silver bullet for product or service quality or compliance
- In the US registration is associated with third party certification of management systems.
- This process includes initial assessment of written management system procedures and implementation
- Audits are typically used for surveillance
- Scope of management system is key
- Useful for process critical applications, quality (ISO 9000) and environmental (ISO 14000) management systems.
- Sector specific applications are generally the most effective such as ISO 13485 (medical devices) and TS 9000 (automotive).

## Surveillance

- Used to ensure/enhance ongoing conformity.
- Key part of certification or registration system.
- For products pre-market and post-market
- Announced or unannounced
- Inspection, testing and audits are among commonly used methods
- Frequency and rigor should be balanced with the costs (direct and indirect) and confidence needs.
- Typically resource intensive

## Typical Use - Accreditation

- Used to assess and ensure/enhance ongoing conformity assessment body and program for competence, management and technical requirements.
- Used to attain needed confidence in laboratory testing operation and results.
- Used to attain needed confidence in certification system.

## Factors in CA System Design

**The risks associated with non-compliance should be proportional to the rigor and independence of the CA system****.**** **
- System over-design will add too much cost.
- System Under-design will result in too little confidence of compliance.
- Penalties associated with non-compliance may reduce the needed rigor and independence of the conformity assessment system.
- Timely mechanisms that effectively remove non-compliant products from the market may also reduce the needed rigor and independence of the system.

## Risk and Conformity AssessmentHow much confidence is needed?

## Conformity Assessment Hierarchy

**Who watches the watchers?**

**Manufacturers**

**Certifier/Inspection Body/Laboratory**

**Accreditor**

- More Confidence

- Less Confidence

- More Resources

- Less Resources

## Example: Main features of program under consideration for Body Armor

*Type testing* to applicable standards at NVLAP (National Voluntary Laboratory Accreditation Program) accredited laboratories to revised NIJ Standard
*Inspection *of armor for design requirements (eg. labeling) and design documentation
- Compliance decision based on* type test *data and *inspection *by* certifier*
- List of compliant models on website
*Follow-up *based on periodic retesting of samples drawn from unannounced visits to manufacturing facility – Two track system with less frequent follow-up where effective* **registered *body armor* *quality management system is in place.

## Example: Main features of program in development for Public Safety Land Mobile Radios P25

*Type testing* to applicable standards at peer assessed laboratories and facilities
*Standardized Test Report Forms **for reporting the results of TIA P25 tests*
*Formal formatted Suppliers Declaration of Conformity with supporting test data** per ISO/IEC 17050 Parts 1 and 2 – web accessible*
*Auditable revision management process*
*Federal technical oversight*
*NIST Special Publication to define program requirements, roles and responsibilities*