Recognition of the independent risk assessment body

Structure of the recognition of the independent risk assessment body:

1. Formal application

An application for recognition shall be submitted to the Inspectorate.

An application for recognition may only cover specific areas of competence to be indicated in the application form for recognition.

An independent risk assessment body shall be recognised for one, more or all areas of competence:

(a) organisation, namely the necessary measures to ensure a coordinated approach to achieving system security based on a common understanding and application of risk control measures for subsystems;

(b) the methodology, namely the evaluation of the methods and resources put in place by different stakeholders to support security at subsystem and system level; and

(c) the technical aspects necessary to assess the suitability and completeness of risk assessments and the level of safety of the system as a whole.

2. Examination of the application

The Inspectorate shall examine the application submitted by the applicant in order to verify whether the information and documents submitted are sufficient to carry out the recognition process.

3. Assessment of recognition

The Inspectorate shall carry out conformity assessment by means of audits (in accordance with the applicable requirements of ISO 17021:2012, ISO 17065: 2012), assess the conformity of the risk assessment system with the Commission Implementing Regulation (EU) No 402/2013 of 30 April 2013 on the common safety method for risk evaluation and assessment and repealing Regulation (EC) No 352/2009 .

4. Issuance of a recognition Decision

The assessment group shall issue a recognition report which will form the basis for the recognition decision. The recognition report shall be compiled using the results of the assessment based on evidence.  

The Inspectorate shall take a decision no later than 2 weeks after the validation report has been issued by the evaluation team. The Inspectorate shall take a decision regarding the recognition of an independent risk assessment institution not later than 4 months after receipt of all information and documentation.

5. Monitoring activities

The Inspectorate shall carry out the supervisory activities of recognised independent risk assessment bodies to verify continued compliance with the Commission Implementing Regulation (EU) No 402/2013 of 30 April 2013 on the common safety method for risk evaluation and assessment and repealing Regulation (EC) No 352/2009 requirements set out in Annex II.

6. Rerecognition process

The recognition decision may be renewed when its original 5-year validity expires.

Rerecognition shall be formally requested by the recognised independent risk assessment body and shall be planned and carried out in a timely manner in order to ensure the timely restoration of recognition before the expiry of the recognition decision, thereby ensuring the continuity of recognition.

Re-recognition may require a new formal application (application form, information and documentation) and therefore a full re-assessment of the requirements of the risk Regulation and standard EN/ISO/IEC 17020:2012, depending on the results of the supervisory measures, the performance of the risk assessment system, changes to the risk assessment system or recognition.