Impartiality is managed as an ongoing risk, not declared once, and the body must be able to show how each risk was removed or reduced.
What applies today
Certification has to be carried out impartially, and the body carries responsibility for keeping it that way against commercial, financial or other pressure. It must look for risks to impartiality as its activities and relationships change, including the relationships of its people. A relationship is not automatically a risk, but it has to be considered. Where a risk is found, the body must be able to demonstrate how it removed or reduced it, and that demonstration goes to the impartiality mechanism. Top management must show commitment. The body, together with any part of its legal person and any entity it controls, must not design, make, install, distribute or maintain the certified product, design or run the certified process, design or provide the certified service, or offer consultancy to its clients. Where the scheme evaluates a management system, management system consultancy and internal audit are also barred. Separate legal entities with which the body has a relationship must not compromise its impartiality, and where such an entity produces the product or offers consultancy, the people who manage, review or decide certification must stay out of that entity's work. Marketing must not link certification to a consultancy in a way that suggests the certificate is easier or cheaper with that consultancy. A person who has consulted for a client cannot review or decide that client's certification until a defined period has passed. The body must respond to risks created by other parties, and everyone who can influence certification must act impartially.
Why it matters
This is the longest clause in the standard and the one most often reduced to a signed declaration. The text asks for a live system: identify, demonstrate, inform the mechanism, act. It also draws a structural line around the legal person, because the common failure is not a bribed assessor but a group that sells consultancy and certification from the same building. The clause does not ban every commercial relationship. It requires the body to see the risk and show what it did.
The public FDIS contents lists clause 4.2 as Management of impartiality. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
This is a general requirement. The public contents keeps its number and title, so the 2012 wording remains the basis of an assessment until the new edition is published. A first artefact an assessor commonly asks for here is impartiality risk register with source, control, owner and review date. The party this touches first is Top management, the impartiality committee and every person who can influence a certification decision.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Risk register | Impartiality risk register with source, control, owner and review date |
| Structural analysis | Map of the legal person and controlled entities against the prohibited activities |
| Mechanism minutes | Minutes showing the mechanism received the risk information and gave input |
| Consultancy bar | Declaration and check covering review and decision personnel for the defined period |
| Management commitment | Board minutes, policy or resourcing decision that shows top management commitment |
One common question. ask for the risk that was hardest to control and what changed as a result. A register copied from a template, with identical residual ratings, is treated as no register.
Common failures
- The register lists only staff conflicts and ignores ownership and group services
- A group company sells consultancy and the review and decision people are not screened
- The mechanism sees a summary once a year and never the underlying risks
- The two-year bar is written in the procedure but no record shows it was applied
Prepare before publication
Interview the people who sit on review and decision panels. Ask each one to name their last consultancy or employment connection to a client. Reconcile the answers with the register.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 4.2 has no separate date.
Cross-references
4.1.1 Legal responsibility · 5.2 Mechanism for safeguarding impartiality · 6.1.3 Contract with the personnel · 7.5 Review · 7.6 Certification decision · 7.13 Complaints and appeals
Source
Source for 4.2: ISO/IEC 17065:2012, Clause 4.2, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.