Supplier Verification

Supplier assurance processes help buyers gain confidence in the quality of supplied products and services, preventing defects and ensuring long-term reliability.

The Cullen Report into the incident at Ladbroke Grove made a recommendation (24) that all suppliers of safety-critical products and services should be approved by a third party.

‘Suppliers of products or services of a safety-critical kind for use on, or in regard to, the railways in Great Britain should be required to hold an accreditation as a condition of being able to engage in that activity’.

The Rt Hon Lord Cullen PC, Ladbroke Grove Rail Enquiry 2001

Some larger buyers undertake direct assurance of their suppliers’ activities—usually where it is specialist or contract outcome-related. Others use RISQS and RISAS as a primary assurance process and carry out their own assurance beyond that, recognising the evidence and reports gathered by RISQS. Some use RISQS and RISAS for all of their safety-critical assurance needs. They usually make this clear in their contracts with the supplier or supply chain. Others, like Network Rail and TfL, make it clearly visible on their websites and supply chain processes. If in doubt, ask your buyer what they require of you.

RISQS delivers both verification of evidence and audits (where our auditors review processes being used) on behalf of over 80 buyers to minimise the level of risk being imported into the railway system and multiple individual buyer audits. The requirement for a verification or an audit is driven by the Railway Industry Commodities and Classification List (RICCL).

Where a supplier is only ‘Verified’, we will have only verified them for reasons of Procurement Act 2023 compliance and other requirements of the buyers in the scheme(s). This would include the following (and note that this list is not exhaustive):

• Companies House registration
• business relations
• carbon management
• commercial requirements, including persons of significant control
• competency management
• corporate social responsibility
• health and safety
• environment
• human resources
• legal requirements
• product and infrastructure
• quality
• supply chain management.

The RICCL informs buyers and suppliers alike on what industry originally decided regarding whether products and services should be verifiable or auditable. This is now being reviewed, as some supplier entities have dropped their third-party product or service lifecycle accreditation, approval, or certification that was in place at the time of the first RICCL development.

When the changes to the RICCL have been approved by RSSB, RISQS will determine if the evidence submitted by a company is third-party certification, or a viable alternative, valid to the location and activity delivered to the product or service selected in the RICCL codes. If not, a ‘Limitation’ will be applied informing all buyers that they may wish to make their own arrangements to assure that the product or service they are procuring is fit for purpose or contractually require that third-party assurance takes place.

All affected suppliers in RISQS will be informed of the need to provide certification and of the consequences of not doing so.

Suppliers with Limitations will still be visible to buyers, as will the reason for the Limitation.

Appropriate assurance can be submitted at any time to remove the Limitation.

Our team works hard behind the scenes to ensure that our industry suppliers have the correct assurance in place to mitigate risk, and we feed back on emerging safety issues to the industry and RSSB. We also strive to make a level playing field while removing or reducing barriers to entry. All of our profit is reinvested into the industry.

The verified evidence and information will include time-sensitive information or information that may naturally expire. 

Missing or out-of-date information can result in non-conformance, which means suppliers are no longer visible to potential buyers within the RISQS portal. 

Remember, RISQS and RISAS deliver audits that can be seen by any buyer member, meaning that those buyers can reduce or remove their requirement to audit you separately and individually (i.e. each buyer). This saves the industry time and money. 

We carry out a verification and audit processes for the following reasons:

Legal compliance 

Great Britain’s railways are subject to strict regulations and safety standards enforced by government authorities. Companies must adhere to these regulations to ensure the safety of their workers, passengers, and the infrastructure itself. Proper documentation demonstrates compliance with these legal requirements.

Safety protocols

Detailed documentation outlines safety protocols and procedures that employees must follow when working on or near the railway. This includes information about hazards, emergency procedures, and safety equipment usage. Without proper documentation, workers may not be adequately trained or informed about how to work safely, increasing the risk of accidents.

Risk management

Documentation helps companies identify and mitigate risks associated with railway work. By documenting potential hazards, conducting risk assessments, and implementing appropriate controls, companies can reduce the likelihood of accidents and injuries.

Quality assurance

Documentation also plays a role in ensuring the quality of work performed on the railway. By documenting procedures, inspections, and maintenance activities, companies can track the condition of railway infrastructure and identify any issues that need to be addressed.

Communication

Proper documentation facilitates communication among various stakeholders involved in railway projects, including employees, contractors, regulatory agencies, and the public. Clear and accurate documentation ensures that everyone is on the same page regarding project requirements, timelines, and safety protocols.

Overall, having the correct documentation is essential for companies working on the railway to operate safely, comply with regulations, manage risks, maintain quality, and facilitate effective communication.

What should you do next?

To avoid falling into a non-compliant status, it is imperative to ensure that your documents are always kept up to date.

This role could be assigned to an individual who has responsibility to periodically review your company’s portal. Documents, such as insurances, usually have a specified validity date on them, so adding reminders into calendars to update records can also help prevent expirations. 

(N.B. The image below is an example and not a real company.)

The RISQS team reviews non-compliant companies each month and send communications to those affected to request that appropriate action is taken. If you do receive one of those communications, it is in your interest to act swiftly. Remember, non-compliant companies will not be visible to buyers on the RISQS portal. 

For any questions related to the RISQS scheme, please contact info@risqs.org.