Impartiality and independence assurance
In the event an opportunity arises to perform an audit or inspection activity, we must first validate that we meet the requirements for impartiality and independence. To do this, we review all previous work performed for that client in the past two years. If any organization that Fortreum INTL has a relationship with that could impair impartiality served as an advisor, consultant or internal auditor to any security standard within that two-year period, then we will turn the work down.
It is as simple as that. Fortreum INTL executives have over 20 years of experience performing these services and know where the line needs to be drawn to maintain independence. As a result, we are confident that we employ sufficient processes and separation to ensure audit and certification services are properly isolated, and that any potential organizational conflicts of interest are mitigated. All determinations on impartiality and independence are routed to the president for final approval.
To protect impartiality, Fortreum INTL does not:
Certification oversight
Certify other certification bodies for their management systems.
Audit delegation
Outsource audits to another management system consultancy organization.
Internal audit practices
Conduct internal audits for the standard(s) being certified, or other related standards that have significant overlap with the standards being audited — that is, any information security standards or requirements.
Marketing strategy for certification services
Market or offer CB services linked to management system consultancy activities, or make statements that certification would be simpler, easier, faster or less expensive if a specific management consultancy organization is used.
Consultancy collaboration policy
Allow any management system consultancy organization to state or imply that use of Fortreum INTL's ISO CB would make certification simpler, easier, faster or less expensive.
Audit personnel assignment policy
Assign any personnel to an ISO CB audit (including management) or certification activities where that person has provided management system consultancy to the client within the previous two years.