Skip to main content
Guidance

Guidance for certification bodies

Published 28 August 2026

1. Minimum requirements for certification bodies

You must:

  • carry out certification and recertification audits using a risk-based assurance process
  • investigate suspected non-compliance
  • keep mandatory records

2. What you must do in annual audits

You must:

  • complete a full audit before certification is granted
  • complete a physical site visit before certification is granted
  • continue to do audits, including site visits, at least once every 12 months for recertification

3. What you must do in a risk-based audit

You must:

  • carry out risk assessments of certified businesses
  • do surveillance audits during the first 12-month certification period
  • make sure higher-risk businesses get extra scrutiny
  • send your surveillance audit findings to the certification scheme operator

4. What records you need to keep

You must keep records on:

  • certified businesses
  • certification decisions
  • certificates issued
  • audit reports and audit results
  • surveillance audit reports
  • investigation outcomes
  • accreditation information

You must keep these records in writing (including in electronic form) for 6 years.