There must be enough competent people for the schemes and standards in scope, and every one of them must keep client information confidential.
What applies today
The body must employ, or have access to, enough people to cover its operations across the schemes it runs and the standards or other normative documents it applies. The people must be competent for what they do, including the technical judgements the process requires, the policies they define and the way they carry those policies out. The duty covers people who work for the body, people on individual contracts and people under a formal agreement that places them inside the body's management control and procedures. Everyone, including committee members, people from external bodies and people acting for the body, must treat as confidential everything it obtains or creates while certifying, except where law or the scheme requires disclosure.
Why it matters
This clause is the foundation for the competence and contract rules that follow. It is written at the level of sufficiency, not headcount: a small body can meet it with a tight scope and good access to specialists, while a large body can fail it by spreading thin across schemes it cannot staff. The confidentiality duty is placed here as well as in clause 4 because the people who see client data are not only employees.
The public FDIS contents lists clause 6.1.1 as General. This site uses the shorter label Certification body personnel: general for the page. The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
This is a resource clause, and the public contents adds titled subclauses around it. The 2012 requirement remains the basis of an assessment until publication. A first artefact an assessor commonly asks for here is scheme-by-scheme plan of functions, people and backup. The party this touches first is The resource manager and every function owner in the certification process.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Resource plan | Scheme-by-scheme plan of functions, people and backup |
| Access list | Employees, contractors and external people with their agreements |
| Confidentiality | Signed commitment covering every category of person |
| Competence link | Reference from each function to its competence record |
One common question. compare the scope with the people available and ask what happens during leave or a surge. A plan with no named backup is a common finding.
Common failures
- The body relies on one specialist for a whole scheme with no backup
- Committee members and external body staff are missing from the confidentiality list
- Contractors are treated as outside the management system
Prepare before publication
List every live scheme and the people who can perform each function. Mark any function with a single person and no backup.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 6.1.1 has no separate date.
Cross-references
4.5 Confidentiality · 6.1.2 Management of competence for personnel · 6.1.3 Contract with the personnel · 6.2.1 Internal resources
Source
Source for 6.1.1: ISO/IEC 17065:2012, Clause 6.1.1, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.