Dear Ladies and Gentlemen,

As communicated in previous System Updates, ISCC has exceptionally allowed that certification audits can be conducted remotely (i.e. on a desk basis) due to the ongoing COVID-19 pandemic. As stated in our system update as of 27 March 2020, after the 1st of July 2020, CBs will be required to complement the remote audits with on-site audits. We herewith provide you with further guidance regarding the remote audits and the complementary follow-up on-site audits. Please share this information with all relevant members of staff.

When do on-site audits need to be conducted again and when do follow-up on-site audits need to be conducted?

• ISCC EU (clarification from the European Commission): “(…) the end date for the possibility to carry out remote recertification (…) audits in any country shall be the last day of the month during which travel restrictions have been lifted. The implications may therefore vary between different countries and regions as well as between different auditors (in case additional travel restriction applying to auditors). The date by which the required on-site audits complementing the remote audits have to be done is being extended to five months after the above-mentioned end date of remote audits.“
• ISCC PLUS: Under ISCC PLUS the end date for the possibility to carry our remote certification audits shall be two months after the last day of the month during which the travel restrictions have been lifted. Follow-up on-site audits have to be conducted within a period of five months after the end-date of remote audits.
• If an audit is conducted remotely after 07 July 2020, the certification body shall submit a justification to ISCC explaining the respective travel restriction that has prohibited the audit from being conducted on-site. This justification shall be submitted to ISCC together with the certification documents (e.g. in the email). This applies for audits under ISCC EU and ISCC PLUS.

Under which circumstances is a follow-up on-site audit required?

• A follow-up on-site audit is not required if the risk assessment has demonstrated a regular risk (i.e. the risk of non-compliance and fraud can be expected to be low), compliance with all ISCC requirements was demonstrated and fully verified during the remote audit, and no non-conformities with ISCC requirements were detected during the remote audit.
• A follow-up on-site audit is required if a higher risk then regular was determined in the risk assessment, not all ISCC requirements could be fully verified remotely (i.e. one or more requirements could not be answered as “compliant” in the ISCC audit procedure from the remote audit), or if non-conformities with ISCC requirements were detected in the remote audit.

Which criteria have to be checked in the follow-up on-site audit?

• During the follow-up on-site audit, the auditor must assess all requirements, which could not (or not fully) be verified during the remote audit. This especially applies to such verification activities that usually include a “drill-down” to verify the compliance of sustainable deliveries in detail e.g. by comparing sustainability declarations, contracts and weighbridge protocols for incoming and outgoing deliveries. Furthermore, the auditor shall verify compliance with non-conformities found during the remote audit (if applicable) and also take into account risks that were identified in the risk assessment.
• It is not required to conduct a “full audit” and to verify all ISCC requirements again (e.g. management system requirements).
• The auditor shall indicate in the ISCC audit procedure used during the follow-up on-site audit at least the name of the operator, the date and the place of the follow-up on-site audit. In addition, all requirements which were not verified during the remote audit must be completed in the audit procedure.

If a follow-up on-site audit is required, does the time period between the remote audit and the follow-up on-site audit need to be audited?

• In general, the follow-up on-site audit shall focus on complementing the remote audit. This means, the period between the remote and the follow-up on-site audit is usually not subject to verification during the follow-up on-site audit. However, if the auditor has any indication for non-compliance with ISCC requirements, particularly regarding deliveries of sustainable material which took place since the remote audit, the auditor shall be obliged to verify a sample of deliveries from this period for compliance with the ISCC requirements (e.g. mass balance calculation, sustainability declarations, etc.).

If a follow-up on-site audit is required, can the auditor conduct a full re-certification audit instead?

• In general, the follow-up on-site audit shall focus on complementing the remote audit. Therefore the re-certification audit does not “replace” the follow-up on-site audit. However, it is possible to combine the follow-up on-site audit and the re-certification audit and to do both at the same time. This means that separate audit procedures have to be compiled (one for the missing requirements of the follow-up on-site audit and one for the re-certification audit). This particularly applies if requirements concerning traceability and chain of custody could not or not entirely be verified during the remote audit, because in this case different mass balance periods would need to be verified.

If ISCC system users have questions regarding their individual situation, we recommend that they consult their certification body.