Quality, marks and confidentiality

The audit team audits and reports. They do not decide. The certification decision is taken by someone who took no part in the audit, on the basis of the audit report, the evidence, the findings and how any nonconformity was resolved.

That separation is the single most important control in ISO/IEC 17021-1, and in UMA it is enforced by the system that runs the body rather than by anyone remembering to observe it — the action is refused, not merely discouraged.

A certificate cannot be issued without a recorded decision, and a decision cannot be recorded without a completed audit. There is no route around either.

Every certificate carries:

• the certified organisation's name and the address of the certified site
• each standard, including its edition — a certificate against the 2013 edition of a standard is not the same claim as one against the 2022 edition
• the scope of certification, in words
• the certificate number, the issue date, the original certification date and the expiry date
• the issuing body and its address

The scope and site address are fixed at issue. If you move premises, the certificate we already issued continues to say where you were when we audited you — a certificate is a record of what was assessed, not a live directory entry. Changes are made by reissuing it, and the reissue is recorded.

You may use the mark on your website, letterhead, marketing material, tenders and proposals — anywhere you are describing your organisation and its management system.

You may not:

• put it on a product, on product packaging, or on anything a customer could read as certifying the product itself
• put it on a test or inspection report
• use it in a way that implies UMA certified something outside the scope on your certificate
• use it in a way that implies your product, service or person is certified — the certification is of your management system
• alter, redraw, recolour or crop it

If your certification is suspended or withdrawn you must stop using the mark immediately, and remove claims of certification from your website and material. We check, and misuse is itself grounds for suspension.

Where we find a misleading claim we ask you to correct it. If it is not corrected we may suspend or withdraw the certification and, where the claim is serious enough to mislead the public, publish the correction.

An audit means we see a great deal about how you work. Everything we learn is confidential, held securely, and not disclosed to anyone outside UMA without your written consent.

There are three deliberate exceptions, and you should know them before you engage us:

• The public register. The fact of your certification — organisation, standard, scope, location, status, dates — is published. That is the point of a certificate, and clause 8.3 requires it. Your audit findings are not published.
• Our accreditation body. Assessors examine our audit files, including yours, to verify we audit properly. They are bound by confidentiality in turn.
• Where the law requires it. If we are legally obliged to disclose, we will tell you what was disclosed and to whom, unless telling you is itself prohibited.

If we ever obtain information about you from a third party — a complainant, for instance — we treat that source as confidential too.

Enter the number on our verification page. You will get the live status immediately — no login, no form, no waiting for us to reply. Certificates we have suspended or withdrawn resolve too, and say so.

We think being able to check a certificate without asking permission is the minimum a certification body owes the people who rely on its certificates.