Surveillance After an Undisclosed Change Causes Duplicate Invoices
A certification body certified an invoicing product, version 5.0, eight months ago. The certificate is used in a public procurement contract. The client recently deployed version 5.2.1 without notifying the body, although the certification agreement requires notification of changes affecting invoiced output. After deployment, 0.3% of 1.2 million monthly invoices were duplicated because a retry loop re-sent a payment instruction after a timeout. The client describes 5.2.1 as a 'minor logging change'. The duplicates led to about $180,000 in customer credits. The body's surveillance audit is scheduled in six weeks. The client asks the body to keep the certificate valid and to handle the issue at the scheduled audit, arguing that the defect is fixed in 5.2.2.
1. What immediate certification action should the body take: maintain, suspend or withdraw? Justify the choice.
Read the worked answer
Open a nonconformity and consider suspension, but do not withdraw immediately. The undisclosed change and the field failure are serious: the product produced duplicate financial instructions, and the certificate is used in a public procurement contract. The body should first verify whether 5.2.1 falls within the certified scope and whether the change-notification clause was breached. Because the client has already deployed 5.2.2, the body should require evidence that the retry defect is fixed and that no other output-affecting changes are present. Suspension is appropriate pending the investigation if the body cannot confirm that the certified configuration is still in place. Withdrawal would be premature without a root-cause and scope assessment. The decision must be documented and communicated in writing. If suspension or withdrawal is issued, check the scheme rules on notifying the public procurement authority and the directory listing.
2. What investigation and evidence would you require before deciding whether the certificate can be restored?
Read the worked answer
Require a change impact analysis for 5.2.1 and 5.2.2, the retry-loop root cause and test evidence for timeout and duplicate-prevention behavior. Check change-control records: who approved the 'logging change', whether the payment path was in scope, and why notification was missed. Reproduce the duplication with a controlled timeout, verify idempotency keys or transaction deduplication, and review logs from the affected invoices. Sample the 0.3% population to confirm the failure mode and the fix. Require field data after 5.2.2, including duplicate rate and reconciliation results. Also verify whether the certificate mark or claim was used on 5.2.1 before the fix. If the investigation shows the certified configuration was not maintained, the body should consider reducing the scope or requiring re-certification of the changed module before restoring the certificate.
3. What should the surveillance audit cover, and how should the body respond to the client's request to defer the issue to the scheduled audit?
Read the worked answer
Refuse the deferral request because the field failure is a certificate validity issue, not a routine surveillance item. At the audit, add a focused review of change management, release notification and payment retry logic. Require a corrective action plan with root cause, containment and verification. Impose a shorter surveillance interval, for example three months, and a post-fix field data review. Check whether the public procurement contract requires reporting and whether the client's customer communications were accurate. Record the decision and rationale. If the evidence shows the defect is fixed and change control is restored, the certificate can remain valid under tightened surveillance; if not, suspend or reduce scope. The audit should also sample other changes made since certification to determine whether the notification failure is isolated or systemic.