Certification Decision Under Go-Live Pressure for a Payroll Module
A certification body is evaluating a payroll calculation module, release 5.1, for a certificate the client needs before a contractual go-live in 10 days. The certification scheme requires 100% traceability for high-risk requirements, zero open severity-1 defects, at least 85% statement coverage on every calculation module, and 30 consecutive days of field data from at least three customers. The evidence pack shows 96% high-risk traceability; the four untraced requirements are labeled 'reporting only', but one supplies statutory deduction values. One severity-1 defect remains open: overtime rounding on shifts that cross midnight, reproducible in 2 of 50 runs. Coverage is 88% on core calculation and 79% on reporting. Field data covers 21 days from three pilot customers, and two severity-2 defects are open. The client's commercial team asks for the certificate with a 'known limitations' annex so the go-live can proceed.
1. Should the certification decision be grant, grant with conditions, defer, or deny? Justify the decision against each scheme criterion.
Read the worked answer
The defensible decision is to defer: the evidence does not meet the scheme, but it also does not show systemic incapability that would justify denial. Work criterion by criterion. Traceability is 96%, not 100%; the 'reporting only' label cannot be accepted at face value because one untraced requirement supplies statutory deduction values, which is high-risk by any reasonable classification. The zero-open-severity-1 criterion fails: the midnight-crossing rounding defect is open and affects pay. Coverage on reporting is 79%, below the 85% floor, even though core calculation is at 88%. Field data is 21 days, not 30. Granting with a 'known limitations' annex would waive mandatory scheme requirements; a certification body cannot do that unless the scheme itself provides for limited scope, and no such clause is cited. Denial is not supported because the gaps are closable and there is no evidence of a failed quality system. The deferral should name the closure evidence and a decision date. Commercial urgency is irrelevant to conformity; document that the request was received but did not influence the technical verdict.
2. What additional evidence would you require for the open severity-1 defect and the four untraced requirements, and how would you answer the request for a known-limitations annex?
Read the worked answer
For the severity-1 defect, require a root-cause analysis rather than only a fix. A 2-in-50 reproduction suggests a timing or data-dependent path, so require deterministic reproduction with controlled clock and timezone inputs, boundary tests at 23:59, 00:00 and daylight-saving transitions, and a regression run of at least 200 iterations of the scenario. A single passing rerun is not closure. For the four untraced requirements, require a trace matrix linking each requirement to design, code and test evidence; the statutory deduction requirement should be reclassified as high-risk and reviewed by a second analyst, with a test that proves the deduction value is correct. For the annex, explain that 'known limitations' cannot override mandatory scheme criteria. If the scheme permits a reduced scope, the only defensible exclusion would be a genuinely non-statutory reporting feature, and even then the exclusion must be recorded on the certificate and in the public directory. The statutory deduction feature cannot be excluded because it is part of the certified payroll function.
3. How should the certification body document the decision and what surveillance or post-market conditions would you impose if the certificate is later granted?
Read the worked answer
Record a nonconformity for each failed criterion, the evidence reviewed, the decision-maker, the date and the rationale. The deferral letter should state closure evidence with acceptance criteria: 100% high-risk traceability including the statutory deduction requirement, zero open severity-1 defects with the regression evidence, at least 85% coverage on both modules, and 30 consecutive days of field data ending after the fix. Require notification of any change between deferral and decision. If the certificate is granted, impose surveillance at three months with sampling of production invoices for duplicate or mis-rounded payments, and a post-market review at six months. Check whether the client has already used the certificate mark or referenced certification in the procurement process; if so, require corrective communication. Keep the decision independent of the commercial team and record the pressure in the impartiality file, because the scheme's impartiality requirements apply even when the client is strategically important.