ANAB is Now the Home of

www.anab.org | Milwaukee, WI | Alexandria, VA | Fort Wayne, IN | Cary, NC

Submitted February 26, 2018

Subject: ANAB Response to the Request for Comments on NIST Draft Conformity Assessment Publication 

SP2000-02: Conformity Assessment Considerations for Federal Agencies

Thank you for the opportunity to comment on the subject line document.

Similar to the ABC document, much of the text in the document is product certification focused. The descriptions should be expanded 

to include certification of management systems and personnel and also inspection and testing activities. Within the document where 

there are references to services and products, references to systems should also be included. In line 279, replace “product” with “an 

object of conformity assessment”. Replace references to product with references to “object of conformity assessment”. Include 

references to system in every instance in which product, service, and/or process is referenced (e.g., lines 277, 413, 417, 426, 427, etc.).

The document should be more concise and include references and links to readily available information, and use of tables would greatly 

benefit without overwhelming the reader with information. The ABC document should be referenced in the consideration document 

and vice versa 

Per OMB Circular A-119, government agencies should increasingly rely on the existing internationally recognized conformity 

assessment infrastructure. The document should provide more information on how government agencies could set up schemes 

(programs) using the existing third-party conformity assessment infrastructure.
Although it is clear in the document that the specificity of scheme requirements is at the discretion of the scheme owner, it should be 

clarified that the scheme (or program) owner also could specify requirements for the accreditation body, CAB, and/or object of 

conformity assessment. Requirements could range from fully relying on existing accreditation requirements (typically based on

international standards) or programs tailored to the specific needs with the development of checklists and/or reporting requirements, and 

specifying any personnel competence and qualification requirements. The oversight provided over the participants in the scheme could 

vary from relying solely on ILAC oversight of participating accreditation bodies to selecting oversight tools based on the needs of the 

agency. 

Different forms of oversight by the scheme owner should be clearly identified. As an example, scheme owner oversight could 

consist of all or a combination of the following, at a frequency determined by the scheme owner:

➢ Require application and re-application for recognition

➢ On-site evaluation of the accreditation body by the scheme owner

➢ Scheme owner’s participation at on-site assessments and/or witnessed audits

➢ Sharing of assessment reports by the accreditation body with the scheme owner

➢ Face-to-face meetings

➢ Requirements for the use of databases, assessor training, and communication

➢ Reporting metrics (e.g., assessments completed, assessors used, types of nonconformities identified, etc.)

The document should also include information on the current third-party system, including IAF and ILAC arrangements. This section 

needs to include information on IAF and ILAC and regional cooperations such as IAAC. These cooperation play a crucial role in the 

third-party conformity assessment system. It is crucial that the reader understand the difference between how ABs operate as ILAC and 

IAF members versus ABs that are not ILAC or IAF member, as well as the differences between member ABs, MLA signatories, and 

scopes of recognition and how this relates to technical competence and the integrity of the entire structure. 

The reader should be encouraged to align with the language used in a conformity assessment program based on ISO standards even 

when using references common in a specific industry. Not using terminology common in international standards creates confusion and 

also could result in misinterpretation of requirements (lines 230-231).

There is an opportunity to include more examples of successful programs, including programs that involve public-private partnerships. 

With reference to OMB Circular A-119, it would be beneficial to include examples of programs for which agencies are using the exiting 

conformity assessment framework (e.g., Energy Star and FCC relying on accredited ISO/IEC 17025 and ISO/IEC 17065 services and 

the NIJ body armor program with use of ISO/IEC 17021-1 accredited services).
Many of the examples used, such as OSHA, do not use third-party conformity assessment. The FCC and CAP 25 programs are examples 

in which the programs rely on accreditation of independent third parties laboratories, but this is not mentioned in the document. 

Because the audience is not familiar with the overall system, it is best to not use examples of specific accreditation bodies such as 

NVLAP or sole-source programs such as FedRAMP. Without understanding all the options available, the reader could potentially 

assume these are the only entities able to provide these services without understanding all the options available.

While FedRAMP is a conformity assessment program, there are many other programs more appropriate to be used as an example. Its

relevance is somewhat obscure to the masses when compared to something like Energy Star or the Toy Safety (CPSC). Using something 

like Energy Star, which has dual efforts from the Department of Energy and the EPA, connects with more parties and demonstrates a 

structure with TWO government agencies working together with the private sector. Likewise, the CPSC worked vigorously with the 

toy industry to build a program that grows stronger each day. Both of these program have been around much longer and are also better 

known than FedRAMP.

FedRMP is also a closed program whereby only one accreditation body is involved and side steps the purpose and structure of the 

international cooperations, going against the international IAF/ILAC structure. This structure, which promotes third party conformity 

assessment with oversight, is the reason the public/private partnerships and the US Government’s adoption of these programs exists 

today as well as supports OMB Circular A-119.

Similar to the ABC document, the document appears to favor SDoC without providing adequate information on the potential negative 

consequences of its use. The information on SDoC should be revised to indicate that when deciding to use SDoC there has to be

legislative framework available to deal with any issues that arise. The document states that SDoC is a “trade-friendly” approach, which 

could be misleading because many countries do not accept SDoC. In addition, there is a higher likelihood of having to repeat the 

conformity assessment activity such as testing with SDoC. That likelihood decreases significantly under internationally recognized 

third-party models (i.e., ILAC for testing).

Section-specific comments follow:

Section: Reason: Suggested Change:

Note 21 ISO/IEC 17067 is specific to product certification. Suggest 

deleting to keep the document neutral to all conformity 

assessment activities.

Remove reference to ISO/IEC 

17067.
Line 656 ISO/IEC 17007 is guidance for drafting normative documents 

suitable for use in conformity assessment.

Explore referencing ISO/IEC 

17007 or incorporating concepts 

therein in this document.

Line 668 It would be best to have a committee that includes subject 

matter expertise and other stakeholders, such as end users, 

industry representatives, private entities engaged in 

conformity assessment (CABs and ABs).

Line 685 (iii) terminology, symbols, packaging, 

marking or labeling requirements as 

they apply to a product, process, or 

production method system.

Line 870 Audit is considered a type of surveillance. Replace reference to surveillance 

with “ongoing oversight”.

Line 888 -

891

Nonconformances could impact all objects of conformity 

assessment (e.g., personnel, systems) and not just products. 

The effectiveness of penalties for placing 

non-conforming (primarily regulated) 

products, services, persons, or systems

products in the market; 

Line 921 Clarification. b. Leverage the attestations (SDoC or 

certification accredited third-party 

conformity assessment) as providing 

assurance thatrequirements

Line 976 This is specific to product certification. Considerations for relying on product 

certification or operating as a product 

certifier.
Line 1056 “Most certification organizations have a surveillance 

function.” This is true for product certification. Under 

management systems certification, surveillance is mandatory 

per ISO/IEC 17021-1.

Either remove or clarify.

1146/1147 Policies should support the confidentiality of a product under 

development, and the confidentiality of a product not yet publicly 

announced. 

“Confidentiality is applicable to all areas of CA not just product.”

References to product should be 

revised to “product, service, 

personnel, or systems” as 

appropriate.

Policies should exist that 

articulate how stakeholders 

determine conformity of a 

product, person or conformity

assessment organization. Many 

Federal agency conformity 

assessment programs use a 

listing mechanism (e.g., a 

publicly available webpage) for 

the set of approved conformity 

assessment organizations. Some 

programs use the listing 

mechanism for approved 

products, persons or 

organizations, while other 

programs require the use of a 

certificate, report, mark or label.

Line 1278 ISO is the standards development organization. ISO CASCO is a 

committee within ISO responsible for developing standards related to 

conformity assessment.

Clarify.
Line 1285 “Should” is optional That is, the organizations should must 

have competence in operating the 

management system for the activity, as 

well as the specific knowledge, expertise 

and capability to accredit, test, inspect, 

certify or surveil in a manner that meets 

program requirements. 

Line 1286 There is no specific standard for surveillance. Surveillance is a 

conformity assessment activity used in certification programs for 

products, personnel, and organizations.

.....as the specific knowledge, expertise 

and capability to accredit, test, inspect, 

certify or surveil audit in a ....

Glossary 

Table 

Specified requirement, including product, management systems, 

personnel requirements, that is fulfilled by the client as a condition of 

establishing or maintaining certification

Add ISO/IEC 17021-1 and ISO/IEC 

17024 to the 3rd column

Note 38: ISO/IEC 17065 only includes terminology related to products. 

Terminology and concepts for management systems certification 

bodies are found in ISO/IEC 17021-1 and for personnel in ISO/IEC 

17024.

Expand to include ISO/IEC 

17021-1 and ISO/IEC 17024.

References: Many of these reference are out of date. For example, ISO/IEC 17021 

has been replaced by 17021-1:2015 and the current version of 

IS0/IEC 17025 is 2017. There should be a reference to ISO/IEC 

17024.

Update references.

Again, thank you for the opportunity to provide input. ANAB will gladly provide advice and reasoned input based on our relevant 

experience as a global accreditation body.

Respectfully,

Natalia Larrimer

ANAB