Assuring Compliance withSocial and Environmental
Standards
ISEAL Code of Good PracticeVersion 2.0 – January 2018

Contents2

Foreword

5

Code Review Process

6

Introduction

7

1. Scope

9

2. Referenced Publications

9

3. Assurance System Desired Outcomes9

4. Efficiency and Improvement12

5. Rigour and Impartiality

15

6. Value and Accessibility

25

Appendix A: Definitions

28

3

Foreword
ISEAL Alliance is the global membership association for sustainability
standards. ISEAL is a non-governmental organisation whose mission
is to strengthen sustainability standards systems for the benefit ofpeople and the environment.
ISEAL is the global leader in defining and communicating
what good practice looks like for sustainability standards
through guidance and credibility tools such as the Codes
of Good Practice. ISEAL has four strategic priorities in its
work with sustainability standards:
Deliver credibility expertise	Measure and share impacts
Catalyse improvements and scalable solutions

 	
Build support for credible standards
ISEAL’s membership is open to all multi-stakeholder
sustainability standards and accreditation bodies that
demonstrate their ability to meet the ISEAL Codes ofGood Practice and accompanying requirements, and thatcommit to learning and improving. ISEAL also has a nonmember, subscriber category to engage with standards
systems in development and other stakeholders witha demonstrable commitment to the ISEAL objectives.
Further information about the ISEAL Alliance and its
membership is available at www.iseal.org

ISEAL Codes of Good Practice build credibility
The goal of all ISEAL Codes of Good Practice is tosupport standards systems to deliver positive social andenvironmental impact. ISEAL Codes of Good Practicecomplement each other to achieve this:The ISEAL Code of Good Practice for Setting Social 	and Environmental Standards (Standard-SettingCode) supports the development of standards thatare relevant and transparent and that reflect abalance of stakeholder interests;

4

The ISEAL Code of Good Practice for Assuring 	Compliance with Social and Environmental Standards(Assurance Code) helps to ensure accurate resultsfrom assessments of compliance and to encourage
the use of assurance to support learning; andThe ISEAL Code of Good Practice for Assessing the 	Impacts of Social and Environmental Standards
Systems (Impacts Code) supports standards systems
to measure and improve the results of their workand to ensure that standards are delivering thedesired impact.
Individually, each Code is useful in strengthening acomponent of a standards system. However, users ofstandards and other stakeholders will have a higher levelof confidence in the effectiveness of a standards system
when the Codes are implemented together.

Implementation
This version of the Assurance Code (v2) was approved by
the ISEAL Board of Directors in January 2018. It becomes
effective for all evaluations from 1 January 2019.
Organisations who wish to apply for ISEAL Associate
Membership can apply using either v1 or v2 of the
Assurance Code up to 31 December 2018. Applications
received after this date must relate to v2 only.
For more information on implementation timelines forv2.0 of the Code, please visit the ISEAL Alliance website:www.isealalliance.org/our-work/defining-credibility/
codes-of-good-practice5

Code Review Process

Introduction

The public review and revision process for the Assurance Code takes place

Purpose of the Assurance Code is to provide a framework for credible assurance

at least every five years. The next review is scheduled for 2023.

that is delivered consistently by sustainability standards systems, so as toimprove the effectiveness of their assurance models in contributing to theirintended sustainability impacts.

Where a revision is warranted, the ISEAL Secretariat
prepares the draft revisions and coordinates therevision process. The ISEAL Technical Committee,
a permanent multi-stakeholder governance body, is
responsible for monitoring the Code revision process,signing off on drafts, and recommending approval of
the revised Code to the ISEAL Board of Directors, basedon both the content of the Code and on the qualityof the revision process.
The ISEAL Alliance welcomes comments on the
Assurance Code at any time. Comments will beincorporated into the next review process.
Please submit comments by mail or email tothe address below.
ISEAL Alliance
Development House
56-64 Leonard Street
LondonEC2A 4LT
United Kingdom
Email: assurance@isealalliance.org

The Assurance Code sets out minimum criteria for
implementation of the assurance management systemand process, while also recognising that different
assurance models can be effective for different
purposes. The Assurance Code builds on a set ofdesired outcomes for effective assurance anddescribes how they can be achieved in practice.
Version two of the Assurance Code focuses morestrongly on the accountability of the scheme ownerto ensure that the chosen assurance model is fit for
purpose and that its effectiveness is monitored overtime. This enables the scheme owner to improve therigour, effectiveness, and value to stakeholders of
its assurance system and to be more responsive tooperating risks.
The ISEAL Assurance Code normative Requirements
are structured around Desired Outcomes in sections
4, 5 and 6 below. The Desired Outcomes are theresults that a sustainability standards system shouldseek to achieve with its assurance programme.
Complying with the Requirements that are linked
to each Desired Outcome should lead an organisationto achieve those outcomes.
The Assurance Code also includes Guidance
that provides supplementary information to theRequirements, as well as interpretation of key
phrases in the Requirements. The Guidance is an
important non-binding supplement to the Assurance
Code and should be taken into account when
applying the Code requirements. The Guidance
can be found in a separate column adjacent to
the Requirements.

67

1. Scope
The ISEAL Assurance Code specifies normativerequirements for implementing an assurance system.
Requirements in the Code aim to support credibleand effective systems for managing risks to theintegrity of the assurance process and maximising thevalue of assurance. While the Assurance Code canapply generically to assurance systems for assessing
conformity with all types of standards, it is intended toapply primarily to assurance of sustainability standards
and related chain of custody standards. The Code does
not cover licensing or control of scheme labels.
The Assurance Code applies to schemes that include
assurance and oversight within their assurance
systems. It is the responsibility of the scheme ownerto ensure that the Code requirements are compliedwith throughout their assurance system.

2. Referenced Publications
ISEAL Impacts Code: 2014. Code of Good
Practice for Assessing the Impacts of Social andEnvironmental Standards

3.	Assurance System
Desired Outcomes
Sustainability assurance should be seen as a tool that
supports the achievement of sustainability impacts.
The foundations of assurance remain focused on
accurate assessments of compliance. However, it isalso critical for the scheme owner to have a goodunderstanding of the effectiveness of its assurance
strategies, through good information management
systems, and to find additional ways to create value
for stakeholders from the assurance process.
On the next page is a graphical representation of thedesired outcomes that frame the requirements in
the Assurance Code. The dual intent of these desired
outcomes is to connect assurance activities with theultimate goal of achieving sustainability impacts andto align assurance activities with the ISEAL Credibility
Principles. The desired outcomes can be used as a guideto evaluate the effectiveness of different assurance
strategies, while providing flexibility to apply a broad
range of credible approaches to deliver assurance.

ISO/IEC 2382:2015 Information Technology– Vocabulary
ISO 9000:2015 Quality Management Systems– Vocabulary
ISO 14001:2015 Environmental Management Systems– Requirements with guidance for use
ISO 17000:2004 Conformity assessment– Vocabulary and general principles
ISO 26000:2010 Guidance on Social Responsibility
ISEAL Sustainability Claims Good Practice Guide (2015)89

3.	Assurance System
Desired Outcomes
Assurance system supports
achievement of definedsustainability impacts

ISEAL Credibility Principles

4.5
The assurance system results inaccurate assessments of compliance

ISEAL Orange
CMYK 0.46.100.0
RGB 223.155.24
Hex #F99B1C

Effectiveness and efficiency of
the assurance system are improved
over time

ISEAL Orange
CMYK 0.46.100.0
RGB 223.155.24
Hex #F99B1CISEAL Forest GreenCMYK 60.10.100.0
RGB 137.168.52
Hex #76B043

The assurance system is accessible
and adds value to clients

ISEAL RedCMYK 0.94.78.0
RGB 196.41.55
Hex #EE333F
ISEAL Purple
CMYK 50.80.0.15
RGB 116.68.129
Hex #7D478D

ISEAL Forest GreenCMYK 60.10.100.0
RGB 137.168.52
Hex #76B043
ISEAL RedCMYK 0.94.78.0
RGB 196.41.55
Hex #EE333F
ISEAL Purple
CMYK 50.80.0.15
RGB 116.68.129
Hex #7D478D

5.5

5.6

4.2

4.1

4.3

6.1

6.2

6.3

The assurance
system is
implemented
consistently

The assurance
system is
implementedcompetently

The assurance
system is
implemented
impartially

Risks to theintegrity of
the assurance
system aremanagedThe schemeowner isresponsible
for and makes
improvements
to the assurance
systemAssurance
model is fit for
purposeClients derive
additional
value fromassurance

Barriers toaccess areminimised

Information
about how thesystem operates
is easily available

5.1

5.2

5.4

Operatingprocedures
are clear andsufficient

Assessment
follows
operatingprocedures

Oversight isindependentand effective

RigourImprovement

Transparency

Impartiality

Truthfulness

Relevance

Sustainability

Efficiency

Engagement

Accessibility

4.4
Assurance
personnel arecompetent

Risks areassessedregularly

Assurancedata isrelevant andaccurate

Data about
performanceis shared
with clients

Client hasaccess toadvice andresources

Eligibility
requirements
are clear

Assessment
takes arisk-based
approach

Icons in the diagram indicate
coverage by Assurance Code

5.3
Outputs ofrecognised
schemes areequivalent

10

Skills andknowledge
are defined

Assurance
personnel
are trained

Assurance
personnel
are assessed

Data iscollected
from various
sourcesGood
information
management
system in place

Stakeholders
provide input

Risks areidentified

11

4. Efficiency and Improvement
Clause 4.1 Scheme owner is responsible for and makes improvements to theassurance system
ClauseTopic

Requirement

4.1.1

Accountability

The scheme owner shall delineate
responsibilities and lines of accountability
within the assurance system and define
terms of reference for relevant committees.
The scheme owner’s senior management
shall be responsible for the overall
functioning and improvement of
the assurance system, including
information management and risk
management systems.

Guidance

Requirement

Guidance

NOTE: For further guidance on acceptableclaims, please refer to the ISEAL Claims Good
Practice Guide www.isealalliance.org/claims1

Cont.

For further guidance on data collection in thecontext of monitoring and evaluation, pleaserefer to the ISEAL Impacts Code of Good
Practice www.isealalliance.org/impacts2

Clause 4.4 Assurance data is relevant and accurate

ClauseTopic

Requirement

Guidance

4.2.1

Risk
Management
Plan

The scheme owner’s senior assurance staff
shall maintain a risk management planthat includes a list of the most significant
risks to the integrity of the assurance
system, a quantification of those risks,
and a description of the strategies being
employed to mitigate each of these risks.
The plan shall include a revision scheduleand be revised as risks arise or change.

In most cases, risks will arise or change
frequently which can trigger regularreviews of the risk management plan,e.g. at least every 6 months.

The scheme owner shall have adequate
arrangements to cover liabilities arisingfrom its operations and shall have thefinancial stability and resources required
to carry out those operations.

Arrangements that are adequate to coverliabilities can include insurance, reserves,
contract language, etc. Arrangements
can match the scale of operation of
the scheme.

Liability and
Financing

Topic

4.3.1

Clause 4.2 Risks to the integrity of the assurance system are managed

4.2.2

ClauseClause 4.3 A ssurance model is fit for purpose
ClauseTopic

Requirement

Guidance

4.3.1

Assurance
model

The scheme owner shall prescribe
an assurance structure and activities
commensurate with the scope of thescheme, risks inherent in the sector, typeof data collected, and end uses of thescheme, including the types of claims being
made by assurance system actors, and shallbe able to provide a rationale for its choiceof structure and activities.

The choice of structure and activities
includes definition of the types ofassessment to be employed (see clause
5.1.2 and accompanying guidance formore information).

ClauseTopic

Requirement

Guidance

4.4.1

Data sources

The scheme owner shall maintain a list of thedata sources it uses to monitor risks to theintegrity of the assurance system.

4.4.2

Information
management
systemThe scheme owner shall maintain an
information management system that
supports gathering, management and analysisof relevant data from internal and externalsources, including compliance data fromassurance providers and oversight bodies.

The information management system
can be used to inform risk management,
assurance system learning, andmonitoring and evaluation.

4.4.3

Data integrity

The scheme owner shall have adequate data
control protocols and sufficient capacity toensure data consistency and integrity forthe data it manages.

The protocol can include criteria
to assess data completeness andconsistency, and can outline how thedata is maintained and updated atregular intervals.

4.4.4

Data
governance

The scheme owner shall define who owns
different types of assurance system data
and what data is available to whom andunder what conditions.

This information can include who is
responsible for making changes toeach type of data. It can also include
a publicly available data policy thatsummarizes the use, distribution
and format by which each type ofdata owned by the organization ismade available.
A data registry can support thedevelopment of a data governancepolicy. When developing a data
governance policy, the scheme owner
may want to consider how to comply
with national privacy laws related
to data security and holding of
personal data.

1. https://www.isealalliance.org/credible-sustainability-standards/what-are-credible-sustainability-standards
2. https://www.isealalliance.org/credible-sustainability-standards/iseal-codes-good-practice1213

5. Rigour and Impartiality
Clause 4.5 Effectiveness and efficiency of the assurance system are maintained
and improved over time

Clause 5.1 O
 perating procedures support consistent implementation of theassurance system

ClauseTopic

Requirement

Guidance

ClauseTopic

Requirement

4.5.1

Management
reviews

The scheme owner’s senior management
shall conduct management reviews at least
once a year to assess performance of its
assurance system, update classificationof risks, and inform improvements.
The scheme owner shall use analysis of
assurance system data to inform those
assessments and risk classification.

The scheme owner can choose to makeuse of the following resources to inform
its management review:

5.1.1

Documented
management
systemThe scheme owner shall have a documented
management system that specifies
requirements for implementation of its
assurance system and includes at least:Anyinternal or external system auditsthat have been conducted;N ormative standard or standards;

 isk assessments of the assuranceRsystem and mitigation measures taken;C riteria for accepting assurance providers
to the scheme (6.2.1);

 ny recommendations from assuranceA
providers and the oversight body tosupport system improvements;C riteria for accepting clients to thescheme (6.2.1);
T ypes of client assessment used in thescheme and a methodology for each
(5.1.2);S ystematic review of client
assessments (audits);P rocedure for regulating exceptions to thestandard or assessment process (5.1.5);

External audits of assurance providers; nalysis of the types and nature ofA
complaints received;R equirements for the certificate and/or
claims related to assurance status (5.1.11);

Chain-of-custody checks;M ethodology for oversight of assurance
providers (5.4.1); andCustomer (and public) surveys;
Client surveys;

D ocument and record control procedures(5.1.14).

 onitoring labelled products inM
the market;
S takeholder input regarding the qualityof the assurance system;
Monitoring and evaluation data; nalysis of market and scientificA
trends; and riteria and data to assess strengths
Cand weaknesses of the assurance
system.
4.5.2

Improvement
feedback loop

The scheme owner’s senior management
shall take preventive measures to manage
risks to the integrity of the assurance
system and shall oversee effective
implementation of improvements identified
in data analysis and management reviews.

Guidance

5.1.2

Assessment
methodology

The scheme owner shall require assurance
providers to follow a consistent,
documented methodology that specifies
requirements for each type of assessmentof clients, is sufficient to determine client
conformance with the requirements, and iscommensurate with the claims being madeby assurance system actors. The assessment
methodology shall include procedures for atleast the following activities:A ssessment of conformance with thestandard;

Different types of assessment carriedout by assurance providers can include
pre-assessments, full audits, surveillance
audits, on-site audits, document reviews,
external group or multi-site audits,
unannounced audits, witness audits,
parallel audits, remote audits, etc.
Independent assessment is a necessarycomponent of schemes that allow
public claims of compliance. Third party,
independent, accredited certification is
the most credible form of assessment.

R eview and decision;I ssuance of a certificate, where this is partof the scheme;P eriodic re-assessment.
For each type of assessment used, thescheme owner shall specify requirements
for conducting the assessment that includes
at least the following:f requency and intensity of assessment;
Requirements continue on the next page...

14

15

Clause

Topic

5.1.2
Cont.

Requirement

Guidance

sampling protocol for assessment;

ClauseTopic

Requirement

Guidance

5.1.6

Group
assessment

Where assurance includes assessment ofgroups, the scheme owner shall specify
requirements for assurance providers toconsistently evaluate the effectiveness ofa group’s internal management system in
identifying and resolving non-conformities
within the group.

Internal management systems can
include the following elements:

knowledge and skills required in
an auditor or assessment team (ifassessment team is used);minimum set of issues that need to bechecked in every assessment;minimum content of assessment reports;
andP rocedures for obtaining agreementswith all group members to ensuregroup members understand what
is required of them and to allow
for assessments, both internaland external;

timelines for submission of completed
reports, following assessments.

P rocedures for approval and removalof members;

a means of calculating the time needed
for an assessment;sources of evidence to be assessed;

5.1.3

5.1.4

5.1.5

Sampling
within theassessment

Use oftechnical
experts

Exceptions

The scheme owner shall define a sampling
procedure for assurance providers to use
during the assessment that includes, atminimum, a description of when sampling
is to be employed in the assessment,
the depth and intensity of sampling, andguidelines for the type of sampling to be
employed in each instance.

P rocedures for annual decision-making
on the assurance status of eachmember in the group;

Sampling within the assessment means
defining the basis on which auditors
will determine what to look at during
the assessment, e.g. the most common
problematic issues, the issues with thehighest risk, the easiest issues to check,etc. This can include determining theselection of a sample within a group or
multi-site.

C hain of custody / product flow;G roup and group member record
keeping requirements;P rocedure for internal assessment; andP rocedure for sanctions and appeals

The scheme owner shall require thatinterpreters or technical experts employedby assurance providers or oversight bodies
are independent of the client, unless this is
not feasible due to logistical constraints. In
all cases, the names and affiliations of theseexperts shall be included in audit reports.
The scheme owner shall have a procedure
for regulating exceptions to the standard orassessment process.

External assessments can include:A review of the documentation of theinternal management system to ensureinternal assessments have been carriedout, records are complete and nonconformities are resolved;A n audit of a sample of group members
to assess the accuracy of the results of
the internal management system;

An exceptions procedure is useful even incases of anticipating future exceptionsP rocedures to address nonconformities including sanctions in thecase of systemic failure of the internalmanagement system.

Exceptions can include exemptions,which provide for situations where arequirement is not applicable;
Elements of an exceptions procedure can
include that:a ssurance providers receive approval
from the standards system owner oroversight body for each exception;t he scheme owner or oversight bodymakes a list of existing exceptions
available to all assurance providers andclients working within the standards
system so that these are appliedconsistently; ande xceptions are only valid until thenext standard review exercise, at whichtime they are considered as input tothe review.

16D escription of the roles, responsibilities
and competencies of individuals
responsible for different aspects of
the internal management system;

5.1.7

Group nonconformities

Where assurance includes assessmentof groups, the scheme owner shall define
consequences for non-conformities inindividual group members. Where thenumber of non-conformities identified insampling individual group members signifies
a systemic problem with the group’s
internal management system, the schemeowner shall ensure that this results in nonconformities being issued against the groupas a whole.

17Clause

Topic

Requirement

Guidance

ClauseTopic

Requirement

5.1.8

Decisionmaking
mechanism

The scheme owner shall define a decisionmaking protocol for compliance assessmentthat enables consistent determination oflevels of non-conformity, and shall require
assurance providers to implement it.

Examples of decision-making protocols
can include scorecards, traffic lightsystems, critical criteria, etc.

5.1.12Complaints
procedure

5.1.9

Appeals

The scheme owner shall require assurance
providers and oversight bodies toimplement a publicly available appeals
procedure whereby clients and assurance
providers respectively can appeal
assessment decisions.

The scheme owner shall have in placea publicly available and accessible
complaints resolution procedure andshall require this also of its assurance
providers and oversight bodies. Eachprocedure shall require the respective
body to:5.1.105.1.11

Remediation
andconsequences

Integrity ofassurance
statusinvestigate and take appropriate
action regarding relevant complaints,
within defined timelines;r eview and take any necessary
corrective actions; andThe scheme owner shall require assurance
providers and oversight bodies to follow
consistent procedures on remediating nonconformities, which shall include definedtime limits for implementing corrective
actions, steps for verifying corrective
actions, and repercussions of continued
non-conformity.
The scheme owner shall have proceduresin place that define the rules governing use
and communication of assurance status,
claims of compliance, and references toassurance, and shall require that clientscomply with these rules.
NOTE: For further guidance on acceptableclaims, please refer to the ISEAL Claims
Good Practice Guide www.iseal.org/claims3

Guidancek eep a record of all complaints
and resulting actions to be madeavailable for internal audits andmanagement reviews.
5.1.13

Misrepresentationand corruption

The rules governing use andcommunication of assurance status,
claims and references to assurance
can include that the client:f ollow-up of suspended clients tomonitor cessation of claims; anda publicly available mechanism forstakeholders to report instancesof potential misrepresentationor corruption.

c onforms to the requirementsof the assurance provider when
making public reference to its
assurance status; oes not make or permit anydmisleading statement regarding its
assurance status;
 pon withdrawal of its assuranceustatus, discontinues its use of all
advertising matter that contains areference to assurance;

The scheme owner shall ensure
monitoring activities are in place that
include actions to identify and mitigate
misrepresentation or corruption. These
actions shall include at least:

5.1.14

Records anddocument control

Actions can also include market
surveillance to detect fraudulent
claim use.
The mechanism for stakeholders could
be the scheme’s complaints process
but this should then specificallyaccommodate informal and confidential
allegations of corruption.
Monitoring activities can be
implemented by assurance providers,or by oversight bodies in thecase of monitoring assurance
providers’ performance.

The scheme owner shall implement
document control procedures that guidethe management and storage of system
documents and records.

a mends all advertising matter
when the scope of assurance has
been reduced;
 oes not imply that assurance appliesdto activities and sites outside thescope of assurance; and oes not use its assurance status indsuch a manner that would bring theassurance system into disreputeand lose public trust.

3. https://www.isealalliance.org/credible-sustainability-standards/what-are-credible-sustainability-standards

18

19Clause 5.2 A
 ssessment is implemented according to operating procedures

Clause 5.4 T here is independent oversight of implementation

ClauseTopic

Requirement

ClauseTopic

Requirement

5.2.1

Legality

The scheme owner shall ensure thatoversight bodies and assurance providers
are legally incorporated entities.

5.4.1

Oversight
mechanism

5.2.2

Legal
contracts

The scheme owner shall have legally
enforceable contracts with oversight bodies
and assurance providers (either directly or
through the oversight body) that delineate
responsibilities and obligations, including
data use and confidentiality. The schemeowner shall also require this of assurance
providers with their clients. Where thescheme owner is the assurance provider,
it shall have legally enforceable contracts
with the clients.

The scheme owner shall specify
the approach to oversight and its
implementation appropriate to the scopeand operations of the scheme. This
shall include the frequency of oversight,
responsibilities for different functions,procedures to be followed, and reporting
requirements back to the scheme owner.

5.2.3

Internal audits

The scheme owner shall require thatassurance providers conduct annual internal
audits on scheme-related performance andshare the results with the scheme owner.

5.2.4

Responsibility
foroutsourcing

The scheme owner shall require thatoversight bodies and assurance providers
take responsibility for ensuring the quality
and integrity of all assurance activities
outsourced to another body.

5.2.5

Authority forassurance
decisions

Guidance

Getting agreement from clients on useof their data, confidentiality of that data,
and related obligations is critical. These
agreements with clients can be madeeither by the assurance provider or by
the scheme owner.

The scheme owner can devolve
responsibility for defining the details of
implementation to the oversight body but
shall retain authority for defining the overall
approach and shall be clear on exactly who
has responsibility for defining which partsof the oversight system.
The oversight process shall include a reviewof the performance of assurance providers
and auditors in conducting the assessment.

The scheme owner shall ensure thatoversight bodies and assurance providers
retain authority for decisions related totheir assessments (i.e. the decision-making
is not outsourced).

5.4.2

Independenceof oversight

The scheme owner shall ensure that theoversight body is independent of theassurance provider(s) being assessed.

5.4.3

Competenceof oversight
personnel

The scheme owner shall ensure thatassessment staff within the oversight
body have in-depth knowledge of thestandard and its intent, and of the scheme’s
assurance requirements.

5.4.4

Authorityof oversightbodies

The scheme owner shall ensure that theoversight body has the authority to takeaction regarding the compliance status ofassurance provider(s). Where the schemeowner is the assurance provider, it shallensure that issues raised by the oversight
body are addressed and remediated.

5.4.5

Accreditation

Where the scheme incorporates
accreditation as an oversight mechanism,
the scheme owner shall ensure that
accreditation bodies comply with thecurrent version of ISO/IEC 17011 in addition
to the Assurance Code requirementsthat apply to oversight bodies.

Clause 5.3 Outputs of recognised schemes are equivalent

20

Guidance

ClauseTopic

Requirement

Guidance

5.3.1

Equivalence
arrangements

Where the scheme owner accepts asequivalent or partially equivalent theassurance results of another scheme orbody, it shall define the steps taken or
additional assurance activities required
to have confidence in the results of theother scheme.

Equivalence arrangements differ fromproxy accreditation in that the former isabout equivalence of assessment resultsin different schemes while the latter
is about the competence of assurance
bodies to carry out assessments inthe same scheme.

This means that the oversight body isusually a separate organisation from theassurance provider but it is possible thatindependence can be shown in other ways.

Where other forms of oversight are
implemented, the scheme owner may
also want to consider regular evaluation
against ISO/IEC 17011 to improve thequality of its oversight system.

21

Clause 5.5 The assurance system is implemented competently
ClauseTopic

Requirement

Guidance

ClauseTopic

Requirement

5.4.6

Proxy
accreditation

Where the scheme owner accepts
assurance providers that have been
accredited against other scopes, they shallrequire that those assurance providers
carry out regular internal audits against
the scheme-specific scope and share theresults and any remediation with thescheme owner. The scheme owner shallalso require those assurance providers tomeet personnel competence requirements
set by the scheme owner. Additionally, thescheme owner shall employ supplementarymeasures to assess the scheme-specificcompetence of assurance providers.

Such measures can include one or moreof the following strategies:

5.5.1

Personnel
competencies

The scheme owner shall define
the qualifications and competency
requirements for its assurance staff andfor auditors and other assurance personnel,
as well as the verification mechanisms toassess whether the requirements
are fulfilled.

In-depth monitoring of a specificissue across all assurance providers
in the standards system, to compare,and therefore determine the levelof competence and consistency ofassurance across the standards system; eview audits: onsite visit to a clientR
without the auditor but with the lastinspection report. This is not a fullinspection but more a spot check to
see if the inspection report of theassurance provider correlates withwhat is seen at the time. This also
includes a client interview to get theirimpression of their assurance provider.
Review audits generally do not lastmore than a few hours but can yieldvaluable insight into the competenceof assurance providers;

Guidance

Competencies shall include at least indepth knowledge of the standard and its
intent, the sector(s) in which the standard
applies, an understanding of the goals of
the standards system, and, in particular, thecritical sustainability issues in the standard.
5.5.2

Building
competence

The scheme owner shall require thatassurance provider and oversight body
auditors and other assurance personnel,
including the scheme owner’s assurance
staff, receive initial training and ongoingprofessional development according to therequirements of their respective positions.

 eview of information obtainableRfrom the databases of assurance
providers in order to reduce onsite
visits to offices of assurance providers.
Time and money can be saved if data
review is performed remotely, rather
than onsite;

5.5.3

Auditorcalibration

The scheme owner shall require assurance
providers to implement an ongoingprogramme for auditor and assurance
personnel calibration. Where the scheme
employs multiple oversight bodies, it shallrequire a similar programme of calibration
for the auditors of these bodies.

 eview of the effort (usually measuredR
as time) spent on audits. If thisinformation is entered in a databasethe oversight body could have agood idea of the effort expended for
different types of audits and could
compare this with the performanceof assurance providers; and5.5.4

Evaluation ofcompetency

The scheme owner shall require that
auditor competence is demonstrated ona recurring basis through evaluation by
assurance providers, oversight bodies, orother entities, using defined verification
mechanisms that include witnessing
auditor performance.

 eview of client assessment reports
R(audit reports) and subsequent followup of discrepancies discovered.

22

23

6. Value and Accessibility
Clause 5.6 The assurance system is implemented impartially

Clause 6.1 A ssurance system delivers additional value to clients

ClauseTopic

Requirement

Guidance

ClauseTopic

Requirement

Guidance

5.6.1

Impartiality
and Conflictsof interest

As part of its risk management plan, thescheme owner shall define and document
potential risks to impartiality and conflictsof interest within its assurance system andhow these potential risks and conflicts
should be avoided or mitigated. The
scheme owner shall have a mechanism
for monitoring efforts to manage theserisks and conflicts.

Transparency is one potential
contributing factor to maintaining
impartiality and avoiding conflictof interest.

6.1.1

Informationonperformance

The scheme owner shall ensure that
performance insights are provided toclients.

Performance insights can be as simple
as providing the client with audit
reports and noting changes since theprevious report. However, additional
value for the client can be derived from
communicating improvements over time,
performance in relation to peers, or inassisting clients to understand where
and how they can improve.

5.6.2

Auditor
impartiality

As part of the assessment of risks to
impartiality, the scheme owner shallassess the potential risks to auditor
impartiality and, where warranted, shallrequire assurance providers and oversightbodies to implement practices to mitigate
these risks.

Some of the practices that can mitigate
the risks to impartiality include:

Clause 6.2 Barriers to access are minimisedr otation of auditors and other technicalexperts in assessments;

ClauseTopic

Requirement

Guidanceassurance body rotation;

6.2.1

Accessibility

The scheme owner shall have publicly
available information that describes
eligibility requirements for assurance
providers and clients, and the rationale
behind any restrictions on access.

Eligibility requirements can also be madepublicly available by the oversight body.

 ccasionally having second set of eyeso- have a second auditor join; and itness audit / inspection every x
wtime period.

5.6.3

Impartiality
in theassessment

Where the scheme owner allows
auditors or other assurance personnel
to provide information to clients during
the assessment, the scheme owner shalldocument the types of information that canbe provided and the steps taken to avoid
conflicts of interest.

Some steps that could reduce thepotential for conflict of interest include: roviding information in accordancepwith guidance notes issued by thescheme owner;

Impartial
decisionmaking

 aving a consistent approach for howhinformation is offered to clients; andL imiting geographic or sectoral scope
based on the competence or capacityof the scheme;

The scheme owner shall require thatassurance providers and oversight bodies
use competent personnel other than theauditor or audit team to make impartial
decisions on compliance.

N ew schemes or pilot initiatives that
limit focus or number of clients; andV ariations in intensity of assessments
based on risk profiles.
6.2.2

24

R
 equiring membership in the scheme
as a prerequisite for application, solong as membership fee levels do notprevent stakeholders from applying
for membership;D enying participation to stakeholders
who do not meet a scheme-specific,
publicly available Codes of Ethics or
a Policies of Association;r ecording in the audit report the typeof information provided.
5.6.4

Examples of acceptable restrictions onaccess include:

Risk-based
assessment

Where a risk-based approach is used todetermine assessment frequency andintensity in assurance or oversight, thescheme owner shall have a documented
risk management protocol to assess therisk level of clients or assurance providers
and the resulting assessment frequency
and intensity, and shall require its use
by assurance providers and oversightbodies respectively.

25

Clause 6.3 Information about how the system operates is easily available
ClauseTopic

Requirement

6.3.1

Publicly
available
information

The scheme owner shall ensure thefollowing information about their assurance
system and its implementation is current
and publicly available:
Description of the structure of theassurance system including decisionmaking (4.3.1);
Information on data ownership andavailability (4.4.4);
Criteria for accepting assurance providers
and clients to the scheme (6.2.1);
Application procedures for clients;
Current list of oversight bodies andassurance providers that are approved
to work in the assurance scheme;
General information on fees charged
to clients and applicants;
Description of the assessment
methodology: type(s) of assessment
employed, how clients are assessed,
how often, and by whom, and thebasis for decisions (evaluation
framework) (5.1.2);

GuidanceIn some cases, oversight bodies canmake this information publicly available
on behalf of the scheme owner.

ClauseTopic

Requirement

Guidance

6.3.2

Stakeholder input

The scheme owner shall define thepoints in the assurance and oversightprocesses at which stakeholders
may provide input to about client
and assurance provider performance
respectively and shall ensure
stakeholders are informed of theseopportunities to engage.

Gathering additional stakeholder input
about the assurance system beyond
input from ongoing operations (e.g.
complaints mechanism) is not required,but can strengthen the credibilityof the assessment and be useful
information to support assurance
system improvements. Stakeholders
can potentially provide input toassessments, on the quality of auditors
or the assurance process, and on risks to
the integrity of assurance.

6.3.3

Changes to theassurance system

The scheme owner shall have defined
protocols for implementation of changes
in requirements, including timelines bywhich changes come into effect andmechanisms to communicate thosechanges to affected stakeholders.

 ata ownership and availability refersDto what data is made available towhom and for what purposes.
S cheme owners can decide whatbasic assessment information should
be shared. Basic information can
include: dates, locations and scopeof auditing, team composition,
number and type of non-conformities,
certification status. Good practiceis to make summary reports ofassessment findings for every client
publicly available.
 aking basic assessment informationM
available applies to existing clients
who have failed a reassessment
but not to new applicants.

Policy on information provision(knowledge sharing) to clients byassurance providers (5.6.3);
Description of how stakeholders
can provide input to the assurance
process (6.3.2);
Description of consequences fordifferent levels of non-conformity(5.1.10);
Summary of resolved complaints (5.1.12)
Steps taken to have confidence inthe results of other schemes deemed
equivalent or partially equivalent(5.3.1);
Current list of certified clients, theirscope of assurance, and expiry date of
their certificate (where expiry dates areused) (the list can be made available
at the assurance provider level); andBasic information about the resultsof assessments of both clients andassurance providers.

26

27

Appendix A:
Definitions
AppealCertificate

Data

Information Management System

Request by the client to the assurance provider orby the assurance provider to the oversight body forreconsideration of their assessment decision.
(adapted from ISO 17000)

Generic expression used to include all means ofcommunicating that fulfilment of specified requirements
has been demonstrated. (adapted from ISO 17000)

Reinterpretable representation of information in
a formalized manner suitable for communication,interpretation or processing. (adapted from ISO/IEC 2382)

Certification

Data governanceA documented set of procedures and processes
for information management, including functionsof controlling the acquisition, analysis, retention,
retrieval and distribution of information.

Assessment
The combined processes of audit, review and decision
on a client’s conformance with the requirements of astandard or of the assurance provider’s conformancewith requirements for assurance.

Assessment methodology
The steps that comprise an assessment in orderto provide assurance.

Assurance
Demonstrable evidence that specified requirements
relating to a product, process, system, person or bodyare fulfilled. (adapted from ISO 17000)

Assurance provider
Body responsible for performing the assessmentof clients. NOTE: In the context of this Code, anaccreditation body is considered an oversight bodyrather than an assurance provider.

Audit
A component of an assessment. A systematic,
documented process for obtaining records, statements
of fact or other relevant information and assessing themobjectively to determine the extent to which specified
requirements are fulfilled. (adapted from ISO 17000)

Claim
A message used to set apart and promote a product,
process, business or service with reference to one ormore of the pillars of sustainability: social, economic
and/or environmental. NOTE: The ISEAL Sustainability
Claims Good Practice Guide (2015) provides further
guidance on developing and managing environmental,social and/or economic claims.

Client
The person or enterprise that is seeking assurance of
their conformance with the requirements in a standard.

Complaint
Expression of dissatisfaction, other than appeal, by any
person or organisation to a scheme owner, assurance
provider or oversight body relating to their respective
activities, where a response is expected. (adapted fromISO 17000)

Conformity
Demonstration that requirements of a standard
are fulfilled.

Auditor

Corruption

Person who performs the audit.

The abuse of entrusted power for private gain. Examples
of corruption include bribery, conflict of interest, fraud,money laundering, embezzlement, concealment andobstruction of justice, and trading in influence.
(adapted from ISO 26000)

Calibration
The process by which different auditors and otherpersonnel involved in assurance exchange knowledge
and learn from each other to achieve more consistentinterpretation and application of the standard.

28

The issuance of a third-party statement that fulfilmentof specified conformance requirements have been
demonstrated. (adapted from ISO 17000)

The overall management of the availability, usability,
integrity, and security of the data employed in an
organisation. A data governance programme includes
a governing mechanism, a defined set of procedures,
and a plan to execute those procedures.

Equivalence
An assessment that different assurance processes
achieve functionally equivalent results.

Internal audit
An internal, systematic, documented process for
obtaining records, statements of fact or other relevant
information and assessing them objectively to determine
the extent to which specified requirements are fulfilled
to support the objectives of an assurance system.
(adapted from ISO 17000)

Internal Management System

An instance when a specified requirement in a standard
or policy is excluded from conformity evaluation or isadapted for a particular circumstance.

In group assurance, the documented set of proceduresand processes that a group will implement to ensure it
can achieve its specified requirements. The existence ofan Internal Management System allows the assurance
provider to delegate inspection of individual groupmembers to an identified body within the group.

External Assessment

LicensingIn group assurance, the systematic inspection and reviewof the internal management system performed by theassurance provider.

The issuance of an official permission to make, useor own a claim.

ExceptionGroup
An organized body of people or enterprises that sharesimilar characteristics, are part of a shared internalmanagement system and, for assessment purposes,
are considered as a single client (eg: groups of farmers,of retail stores, of distributors).

Group Member
The individual enterprise (eg: farmer, retail store owner,
distributor) that is enrolled in a group assurance scheme.

Information
Knowledge concerning objects such as facts, events,
things, processes, ideas or concepts that, within acertain context, has a particular meaning. (adaptedfrom ISO/IEC 2382)

Management review
Evaluation of fulfilment and effectiveness of thecollective services and processes that comprise
an assurance management system, including theperformance of the scheme owner, assurance providers,and oversight body.

Multi-site Operation
An enterprise with multiple production sites that are
centrally managed and are assessed as one client.

Non-compliance
An identified occurrence of non-conformance with
one requirement of a standard, identified as part ofan assessment. Synonym: non-conformity29

On-site assessment

Sanction

Common Synonyms

An assessment occurring on the physical site of aclient’s operations.

Repercussion of non-conformity with one or more
requirements in a standard.

Term

Synonyms

Assessment

Audit

Outsourcing

Self-declaration

The contractual obtaining of goods or services froma third party.

A statement issued by a client, on behalf of itself, andbased on its own determination, that states its statusagainst specified conformance requirements of astandard. (adapted from ISO 14001)

Assessment methodology

Audit procedure

Assurance

Certification, verification

Assurance Provider

Certification body, verification body, conformity assessment body (CAB)

Audit

Inspection, evaluation, verification

Individual or group that has an interest in any decisionor activity of an organization. (ISO 26000)

Auditor

Inspector, verifier, assessor

Certificate

Statement of conformity, Assurance Statement

Standards system

ClientOperator, enterprise, entity, participant, producer, member

Internal Assessment

Internal audit

Oversight

Accreditation

Oversight provider

Accreditation body

Scheme ownerStandards system ownerOversight
Assessment of an assurance provider’s demonstrationof competence to carry out specific assurance tasks.
(adapted from ISO 17000)

Oversight body
Body responsible for performing the assessment ofassurance providers.

Peer review
Assessment of a client against specified requirements
by other clients in, or candidates for, an organised
group. (adapted from ISO 17000)

The collective of organisations responsible for theactivities involved in the implementation of a standard,
including standard setting, capacity building, assurance,labelling and monitoring.

Scheme owner

Easily accessible online or otherwise to the public.

The organisation that is responsible for the standards
system and accountable for the performance of its
assurance system. The scheme owner determines theobjectives and scope of the standards system, as wellas the rules for how the scheme will operate and thestandards against which conformance will be assessed.
NOTE: The scheme owner can be the standards owner,
assurance provider, a governmental authority, tradeassociation, group of assurance providers or other body.

Reassessment

Surveillance

Proxy accreditation
A type of oversight employed by a scheme, whereby
recognition of another scheme’s oversight mechanism
is deemed sufficient to demonstrate assurance.

Publicly available

An assessment conducted for the purpose of renewing
a certificate.

Risk
The chance of something happening that will havean impact on objectives. It is measured in terms of a
combination of the probability of an event and theseverity of its consequences.

Risk mitigation (Risk reduction)
Actions taken to lessen the probability, negative
consequences, or both, associated with a risk.

Risk register
Document containing the results of risk analyses and risk
response planning. The risk register details significant
risks, potentially including description, category, cause,
probability of occurring, impact(s) on objectives,proposed responses, owners, and current status.

30

Stakeholder

Assurance activities used to monitor misrepresentationand misuse of claims and labels in order, to support
assurance.

Third-party assurance
Assurance activity that is performed by a person or bodythat is independent of the person or organization thatprovides the object of assurance and of user interestsin that object. (adapted from ISO 17000)

Verification
Confirmation, through the provision of objective
evidence, that specified requirements have been
fulfilled. (adapted from ISO 9000)

Our Cover© Forest Stewardship Council (FSC). ISEAL Member Forest Stewardship Council is dedicated to promoting responsible managementof the world’s forests.
Photography
We would like to thank all members that provided photography for this ISEAL code of Good Practice.
Page 2 and 31 © LEAF. Page 4, 11 and 24 © Rainforest Alliance. Page 6 and 7 © Global Coffee Platform. Page 8 © Better Cotton Initiative.
Page 9 and 14 © UTZ Certified. Page 19 © Fairtrade. Page 22 © Responsible Jewellery Council. Page 23 © Bonsucro.
Page 27 © Roundtable on Sustainable Palm Oil.
Editor ISEAL Secretariat
Graphic Designer Kelly Gregory | kellylouisegregory@hotmail.com

31

ISEAL Alliance
56-64 Leonard Street
LondonEC2A 4LT
United Kingdom+44 (0)20 3246 0066
info@isealalliance.org
twitter.com/isealalliancewww.iseal.org