Outsourced evaluation must go only to competent, independent bodies under a binding contract, and the certification body keeps responsibility.
What applies today
The body may outsource evaluation only to organisations that satisfy the relevant standards where they apply and any scheme documents. Testing must meet ISO/IEC 17025, inspection ISO/IEC 17020 and management system auditing ISO/IEC 17021, and the impartiality rules for evaluation personnel always apply. Where the work goes to a non-independent body, such as a client laboratory, the body must manage it so that the results can be trusted and keep records that justify that confidence. There must be a legally binding contract with the provider, including confidentiality and conflict of interest provisions. The body remains responsible for all outsourced activity; must ensure the provider and its people are not involved in a way that could undermine the credibility of the result; It must keep written rules, processes and records for qualifying, assessing and monitoring providers; must keep a list of approved providers; must take corrective action for breaches; and must tell the client in advance so that the client can object. Hiring an individual on a contract is not outsourcing.
Why it matters
Outsourcing is where accountability most easily leaks away. A body can buy a test, but it cannot buy away the duty to stand behind the certificate. The clause therefore combines competence of the provider, independence, a contract and active monitoring. The client's right to object is easy to overlook and is a frequent assessor question. The distinction between outsourcing and hiring an individual contractor matters because the two are managed differently.
The public FDIS contents lists clause 6.2.2 as External resources (outsourcing). The FDIS requirement wording is not held, so the requirement above is the 2012 text that applies until publication.
Where this clause lands in the revision
This is a resource clause, and the public contents adds titled subclauses around it. The 2012 requirement remains the basis of an assessment until publication. A first artefact an assessor commonly asks for here is approved providers with scope and review date. The party this touches first is The outsourcing owner and the certification manager who remains accountable for the result.
What the assessor asks for
| Category | Artefact to have ready |
|---|---|
| Provider list | Approved providers with scope and review date |
| Contracts | Binding contract with confidentiality and conflict terms |
| Monitoring | Qualification, assessment and monitoring record per provider |
| Client notice | Advance notice of outsourcing and any objection recorded |
| Corrective action | Breach record and the action taken |
One common question. follow one outsourced test from the client file to the provider's scope and contract. A provider that is accredited for a different method than the one used is a common defect.
Common failures
- The provider list exists but the scope of each provider is not recorded
- The contract has no conflict of interest clause
- The client was never told that part of the evaluation was outsourced
- A client laboratory is used without a record justifying confidence
Prepare before publication
Take every live outsourced activity and match it to a provider, a scope and a contract. Record the client notice for each.
Dates that matter
The public record gives stage 50.20 on 4 August 2026 and voting to 27 October 2026. The planning date, 15 February 2027, is an estimate from that stage and not an ISO date, and clause 6.2.2 has no separate date.
Cross-references
6.2.1 Internal resources · 7.4 Evaluation · 4.2 Management of impartiality · 7.2 Application
Source
Source for 6.2.2: ISO/IEC 17065:2012, Clause 6.2.2, with the ISO/IEC FDIS 17065 public record. Our statement, not the instrument verbatim; the FDIS wording is not held.
Not legal advice; does not certify. A reading of the requirement and the evidence an assessor commonly samples, not a substitute for the standard or your accreditation body's rules.