Guidance
Guidance for certification bodies
Published 28 August 2026
1. Minimum requirements for certification bodies
You must:
- carry out certification and recertification audits using a risk-based assurance process
- investigate suspected non-compliance
- keep mandatory records
2. What you must do in annual audits
You must:
- complete a full audit before certification is granted
- complete a physical site visit before certification is granted
- continue to do audits, including site visits, at least once every 12 months for recertification
3. What you must do in a risk-based audit
You must:
- carry out risk assessments of certified businesses
- do surveillance audits during the first 12-month certification period
- make sure higher-risk businesses get extra scrutiny
- send your surveillance audit findings to the certification scheme operator
4. What records you need to keep
You must keep records on:
- certified businesses
- certification decisions
- certificates issued
- audit reports and audit results
- surveillance audit reports
- investigation outcomes
- accreditation information
You must keep these records in writing (including in electronic form) for 6 years.