If we subcontract special processes, is it acceptable to ONLY have a certificate of conformance/compliance from the vendor to meet the requirements of 7.5.2?