Impartiality and Inquiries

Introduction

At the core of A-LIGN’S impartiality policy is A-LIGN’S management’s commitment to maintaining independence, in fact, perception and removing threats to impartiality. A-LIGN  defines threats as a relationship that threatens the impartiality based on ownership, governance, management, personnel, shared resources, finances, contracts, marketing, and payment of a sales commission and/or other inducements for the referral of new clients.

Review and analysis of impartiality are conducted on an ongoing basis as well as annually with regards to all prospects, clients, and personnel to ensure all conflicts of interest and threats to impartiality are identified, reviewed, analyzed, resolved, and monitored. In addition, A-LIGN’S review process ensures that we do not perform audit services for clients where non-audit services have been performed and that ISO management consulting services are not performed by A-LIGN.

A-LIGN’S leadership ensures adherence to the impartiality policy through periodic management reviews, automated monitoring tools, internal audits, and formal risk assessments of our audit processes.

A-LIGN operates under and complies with the independence requirements established by the American Institute of Certified Public Accountants, Payment Card Industry Security Standards Council (PCI SSC), ISO/IEC 17021:2015, ISO/IEC 27006:2015,  ISO/IEC 17020:2012 and FedRAMP and has developed this impartiality policy and supporting procedures to ensure ongoing compliance.

Certificate Decisions

Information on the certification body’s processes for granting, refusing, maintaining, renewing, suspending, restoring, or withdrawing certification or expanding or reducing the scope of certification is defined below.

Granting of certification:

Upon completion of the initial certification, recertification or certification transfer audit process, A-LIGN’s certification decision maker will perform a comprehensive review of the audit file and any corrective action plans and supporting evidence. The review will verify that the Company’s management system is in conformance with the applicable ISO standard and non-conformities have been properly addressed. Upon successful completion of this review, A-LIGN grants the certification.

Refusing of certification process:

Should A-LIGN’s certification decision maker’s comprehensive review of the submitted audit package result in the identification of open issues or non-conformities, A-LIGN’s certification decision maker shall withhold the granting of certification until such time that the Company can demonstrate all criteria for certification has been achieved. If the Company exceeds the allowable remediation period outlined in the applicable standard a new initial certification audit will be required.

Maintaining certification process:

A-LIGN requires that over the lifecycle of the certification, annual surveillance audits must be completed in years two and three, with a recertification audit to be completed prior to the expiration of the certification. A-LIGN’s certification decision maker may suspend or withdraw the Company’s certification if the required audits are not performed or open non-conformities have not been properly addressed.

Suspension of certification process:

A-LIGN will initiate its suspension process if the Company does not re­ establish conformance of its management system standard requirements within the allowable timeline, fails to abide by the contract terms and agreements or fails to perform the required audits.

Restoring of certification process: 

A-LIGN will restore a certification that has been placed on suspension once all outstanding issues have been closed and verified as such through off-site or on-site review.

Withdrawal of certification process:

A-LIGN will withdraw a certification as a direct result of, but not limited to, non-performance of audits, miss-representation, non-closure of open corrective action, failure of the appeals process to close an open corrective action or at the request of the Company.

Expansion of certification process:

At the request of the Company through an application process, A-LIGN will request and review documentation supporting the additional scope. Upon completion of the review, an on-site audit will be performed to determine conformance of the Company’s additional scope with the applicable ISO standard. This may require an addendum to the contract and/or additional fees.

Reduction of certification process:

A-LIGN may require that the Company’s scope of certification be reduced if it is determined that the scope is no longer valid. A-LIGN’s certification decision maker will approve a request from the Company for scope reduction if audit procedures support that the scope is no longer applicable to the Company’s business. A-LIGN’s certification decision maker will refuse scope reduction if the reduction is to avoid non­ conformities.

As an accredited certification body, A-LIGN has developed a trademarked logo that demonstrates our certified clients’ conformance with relevant ISO standards. The rules associated with the use of our name and logo regarding ISO certifications are documented in the terms and conditions of our contract and again upon successful certification for our clients. A-LIGN monitors the use of its name and logo to ensure compliance with our contractual agreement, ISO 17021:2015 and ISO 27006:2015.

Appeals and Compliants

APPEALS

Appeals filed against A-LIGN are received, handled and resolved in accordance with ISO/IEC 17021-1:2015 and ISO/IEC 17020:2012. A-LIGN’s audit team strives to clearly communicate the justification for their decisions related to the certification and inspection services. When a situation arises where the client does not agree with the audit team they may appeal the decision to A-LIGN’s leadership. A point of contact, who is separate from the audit team, is assigned to research the appeal. A-LIGN’s leadership will review the results of the research and communicate the decision to the client. Appeals may be generated directly by the client’s audit team or by emailing [email protected].

In the event the Organization Seeking CMMC Certification is not satisfied with the appeals decision rendered by A-LIGN, the appellant may elevate their appeal to the CMMC Accreditation Body for additional consideration and determination. All appeals decisions rendered by the CMMC Accreditation Body are final.

COMPLAINTS

Complaints filed against A-LIGN, or our certified clients, are received, handled and resolved in accordance with ISO/IEC 17021-1:2015 and ISO/IEC 17020:2012. A-LIGN has developed a process managed by a group independent of our audit team to document and track the complaint. The complaint will be investigated and resolved in accordance with our documented policies. The complaint initiator will be kept informed throughout the process and of the complaint resolution. Complaints may be filed by emailing [email protected].

Information Requests

Inquiries may be submitted directly to A-LIGN, including areas where we operate, certificate status and information for our certified clients by emailing [email protected].