Management System Policy

• To establish FVR's management system policy: the commitment it takes on as a Certification Body, the standards under which it meets it, whom it binds, and what it demands of every process of the system in both service lines. The policy statement is set out in §3.

• This policy covers the entire FVR management system, across its two service lines: certification of organizations' management systems (ISO/IEC 17021-1) and certification of persons (ISO/IEC 17024). It is the quality policy required by 9001 §5.2 under the Option B route of 17021-1 §10.3 (ISO 9001-based management system), therefore, its scope is the organisation as a whole rather than a single service line.
• Systems line — initial audit Stage 1 (CA-E1) and Stage 2 (CA-E2), surveillance (SA / FSA), recertification (RA), transfer (TA), special audit, multi-site and remote audit.
• Persons line — scheme design, question bank, examination, evaluation and the certification decision for persons.
• It applies to every FVR process and function and to internal and external personnel alike: auditors contracted under 17021-1 §7.3, examiners, evaluators and committee members.
• The operational provisions for each line are established in FVR_GD-DI-02 for systems and FVR_GD-DI-01 for persons. In case of discrepancy, the applicable procedure governs implementation and this policy governs the commitments.

• FVR is committed to operating as a Management Systems Certification Body providing reliable, technically robust and independent services, grounded in compliance with ISO/IEC 17021-1:2015 and the Quality Management System requirements of ISO 9001:2015.
• Through a competent audit team, documented certification schemes and continuous impartiality evaluation processes, FVR delivers certification of management systems under international standards (ISO 9001, ISO 14001, ISO 45001, ISO 22000, HACCP, ISO 27001, ISO 37001, ISO 50001 and other schemes within the accredited scope), generating trust among corporate clients, interested parties, the accreditation body and society.
• Our audit and certification activities are guided by the principles of impartiality, competence, responsibility, openness, confidentiality, responsiveness to complaints and a risk-based approach *(17021-1 §4)*, ensuring certification decisions are objective and independent from any commercial, financial or other pressure *(17021-1 §5.2)*.
• FVR promotes innovation, continual improvement and compliance with applicable requirements, ensuring that the certification cycle — from application to issuance, surveillance and recertification — meets applicable requirements and addresses the needs and expectations of organizations seeking certification of their management systems.
• This policy is communicated, understood and applied at all levels of FVR, provides the framework for establishing and reviewing the management system objectives *(9001 §5.2; 9001 §6.2)*, and ensures simultaneous compliance with ISO/IEC 17021-1:2015 (Option B 17021-1 §10.3) and ISO 9001:2015 requirements.
• FVR Management ensures the availability of the human, technical, financial, technological and infrastructure resources required for the implementation, maintenance and continual improvement of the management system, as well as to sustain the legal and financial responsibility associated with its systems certification activities *(17021-1 §5.3.1 + 17021-1 §5.3.2; 9001 §7.1)*.
• — This policy covers both lines and establishes the following commitments for the Persons line (ISO/IEC 17024). FVR undertakes to: certify persons only against the requirements of a documented scheme, deciding with the evidence gathered and nothing else; safeguard impartiality, keeping whoever trains or assesses apart from whoever decides; keep confidential the information of applicants, candidates and certified persons; make its process, its prerequisites, its fees and the status of its certificates public and verifiable without prior request; attend every complaint and every appeal from anyone, with no prior relationship required; and improve the system continually through the management review, the internal audit and corrective action. The objectives of the line are documented in FVR_GD-MZ-06, and top management designates a member of management with the responsibilities required by 17024 §10.2.1 and records the appointment in FVR_GD-FO-03.

• 1 · Maintain an auditable, traceable and reproducible certification process for each corporate client — 17021-1 §9 + 9001 §8
• 2 · Ensure documented competence of lead auditors, auditors and technical experts in every standard and sector audited — 17021-1 §7.1 + Anexo A + 9001 §7.2
• 3 · Safeguard impartiality through the external Impartiality Committee and continuous risk analysis — 17021-1 §5.2
• 4 · Maintain client confidentiality through legally enforceable agreements — 17021-1 §8.4 + 9001 §7.5.3 b
• 5 · Manage complaints and appeals with documented service deadlines and decision-makers independent from the original audit team — 17021-1 §9.7 + 17021-1 §9.8
• 6 · Meet the contractual deadlines applicable to each stage of the certification cycle — 17021-1 §9
• 7 · Ensure financial sustainability and professional liability coverage — 17021-1 §5.3 + 17024 §4.4
• 8 · Continually improve the effectiveness of the management system through management reviews, internal audits and corrective actions — 9001 §9.3 + 9001 §9.2 + 9001 §10.2 + 9001 §10.3

• The first six prohibitions are implemented as system controls and are documented here to make their operation auditable.
• Both lines
• 1. Approving a certification decision without recording in writing what supports it *(17021-1 §9.5; 17024 §9.4)*.
• 2. Allowing whoever performed the work to review or decide on their own file *(17021-1 §9.5)*.
• 3. Editing a document already accepted by the client without opening a new version with its trail.
• 4. Letting a commercial, financial or personal consideration alter a finding, a verdict or a certification decision *(17021-1 §5.2; 17024 §4.3; 17024 §9.4.4)*. Anyone receiving such pressure must report it through the channel in FVR_GD-POL-04.
• 5. Certifying a client in which the Directorate or a partner holds an interest without the Impartiality Committee having assessed and documented it.
• Systems line (ISO/IEC 17021-1)
• 6. Providing management system consultancy to a certified or candidate client.
• 7. Assigning an auditor who provided consultancy to that client within the previous two years.
• 8. Issuing a certificate with open nonconformities, beyond the exceptions the procedure itself declares.
• Persons line (ISO/IEC 17024)
• 9. Having the same person train a candidate and then examine or decide on them *(17024 §5.2.3; 17024 §9.4.4)*.
• 10. Having whoever wrote an examination item evaluate or decide the certification of a candidate assessed with it.
• 11. Disclosing the content of the question bank outside the documented control, or reusing it without the integrity check.
• 12. Letting the defence interview AI agent — the only AI of the persons line — say pass or fail, or weigh on a certification on its own: its transcript is evidence, and the verdict and the determination are human and traceable to a person (FVR_IM-PR-03-17024 §4).

• Responsibilities are assigned to roles, rather than to named individuals.
• Executive Management — approves this policy, provides the resources, and answers for the financial sustainability and the legal liability of certification in both lines *(17021-1 §5.3; 17024 §4.4)*. Chairs the management review.
• Technical Management — answers for the technical integrity of the whole certification process: team competence, audit time, decision and certificate. Owns the operations indicators.
• Quality Officer — maintains the documented system, the internal audit programme and the corrective action cycle. Answers for the system being in force, not merely drafted.
• Technical Coordination — schedules and assigns audit teams against the competence matrix.
• Audit team — performs the audit and supports its findings with evidence. Does not decide certification.
• Technical reviewer — examines the file and approves the technical review. That approval is the first of the two acts forming the certification decision; certificate issuance is the second. The reviewer may not act on a file they audited, and the decision basis is recorded in the frozen FVR_RD-FO-04.
• Examiners and evaluators (persons line) — examiners validate examination items under the documented scheme; evaluators assess defence interviews; and the platform marks examinations against the answer key. Each role is responsible for the integrity of its assigned activity *(17024 §6.2; FVR_EC-PR-02-17024; FVR_EC-PR-03-17024; FVR_IM-PR-03-17024)*.
• Question Bank personnel — maintain the item bank, its versioning and its traceability to the competence matrix. Whoever writes an item does not decide on the candidate assessed with it.
• Technical Advisory Committee (CTC) — approves the validation method of the defence interview AI agent and reviews the bias control of the defence cycle (FVR_GD-PR-05). The agent does not decide: it produces evidence.
• Commercial Coordination — answers for the offer matching the scope, the audit time and the available competence. Does not take part in the certification decision.
• Platform and Content Support (IT) — keeps the ERP and the platform content available. Does not capture or modify audit or examination evidence.
• Impartiality Committee — assesses the threats in the risk register and decides the safeguards. Its ruling is not overridden by Management.
• All personnel, internal and external — including auditors contracted under 17021-1 §7.3, examiners, evaluators and committee members — are bound by this policy and declare their conflicts of interest before each assignment.

• This policy is implemented through the management system risk and opportunity register FVR_GD-MZ-04, which covers both service lines *(9001 §6.1)*. · Every principle in this policy has its threat identified in that register, with its safeguard and its owner. · Impartiality threats are assessed by the Impartiality Committee; financial ones by Executive Management. Threats to examination integrity and to the defence interview AI agent are assessed by the technical committee that owns them. · A risk that materialises opens a corrective action, with its effectiveness check. · Opportunities feed the management system objectives and their action plan. · The management review examines the whole register and decides whether the risk profile remains acceptable. Review frequencies are not duplicated here: the complete matrix is reviewed at least every three months and upon the additional events defined in FVR_GD-PR-04 §4, while each risk is monitored at the frequency recorded in FVR_GD-MZ-04.

• Top management commitment to the management system — 9001 9001 §5.1.1
• The policy as the framework for objectives — 9001 9001 §5.2, 9001 §6.2
• Resources and financial/legal capacity — 17021-1 17021-1 §5.3 · 9001 9001 §7.1
• Communication of the policy — 9001 9001 §5.2.2, 9001 §7.4
• Review and updating of the policy — 9001 9001 §9.3
• Customer focus — 17021-1 17021-1 §9 · 9001 9001 §5.1.2
• Impartiality as the governing principle — 17021-1 17021-1 §4.2, 17021-1 §5.2
• Continual improvement — 9001 9001 §10.3

Approvals / Aprobaciones