COVID-19 Announcement, Derogation 2021-1
Amendment to COVID-19 Announcement, Derogation sent on 10 July
2020 by GSTC.
Date: 08th March 2021
To: GSTC Accredited Certification Bodies
CC: Assurance Services International
Given the latest updates around the global outbreak of COVID-19 and considering thatmany countries have implemented new constraints on travel and gathering, the GSTC
has amended derogation 2020-3 sent on 10 July 2020. This derogation 2021-1
replaces the previous derogation 2020-3 dated 10 July 2020.
This derogation applies to all GSTC audits planned by accredited CBs and requires
CBs to:1. Postpone the audit when the CB’s client is non-operational or partially operational.
This derogation allows the CB to postpone the audit for a period of six (6) months
from the date of this derogation. If a GSTC certificate is due to expire in 2021, it
may be extended for up to twelve (12) months beyond its original expiry date. A
recertification audit shall be performed as soon as travel restrictions are being liftedand before the maximum 12-month extension expires in order to renew
certification.
1.1. In the case the audit has already been postponed, or an extension was granted
in 2020 based on derogation 2020-3, certificates may be extended with theproper justification up to 12 months from the date of application of derogation
2020-3 and the corresponding audit must be planned and completed at theearliest opportunity within the extended period. The GSTC requires the CB toinform the GSTC Technical Team (td@gstcouncil.org) of the approach taken
in each case.
1.2. The CB shall determine clients that fall into the partially operational category
based on the local, regional, or national regulations and context.
2. Conduct remote audits only when the CB’s client is operational, but the CBs areunable to conduct a normal on-site audit due to travel restrictions in the client’scountry of operation. The CB shall retain documented evidence for the reasons toconduct a remote audit.
2.1. The CB shall use a risk-based approach to determine whether the audit should
be carried out on-site or remotely. The CB shall conduct an assessment ofhealth risk to the client and appointed auditor involved in the on-site audit, todetermine whether an on-site audit is deemed appropriate. The CBs shalldocument in audit reports the type of audit (remote, on-site or hybrid) and shallprovide clear justification of the chosen method.

2.2. The CB shall evaluate all the requirements in the remote audit and document
whether a requirement/finding raised during the remote audit may be subject
to re-evaluation through an on-site audit when travel and gathering restrictions
are lifted in the client’s country of operation. The remote audit option shall only
apply in the case of surveillance audits. This is expected to be a short timemeasure till the COVID-19 situation improves and constrains on travel andgathering are no longer applicable. Remote audits shall not be conducted in
the event where the CB’s client is non-operational (see point 1 above).
3. The CB shall use a risk-based approach to determine the feasibility of a hybrid
audit and the requirements to be evaluated remotely and on-site. The timeline for
conducting remote and on-site audits shall be based on the risk-based approach,feasibility to assemble an audit team and travel restrictions in the client’s countryof operation. The CBs shall document in audit reports whether this derogation has
been applied and shall provide clear justification of the chosen method.
3.1. Hybrid audits can have two variations:3.1.1. Two-part audit combining on-site activities and off-site activities withina determined period.
3.1.2. Two auditors: one performing the remote activities and anotherperforming the on-site activities. Both auditors shall comply with theGSTC Auditor Training qualifications according to the GSTC
Accreditation Manual v2.4. The lead auditor shall comply with theGSTC Auditor qualifications.
3.2. The hybrid audit option shall apply only in the case of initial and recertification
audits. Hybrid audits shall not be conducted in the event where the CB’s client
is non-operational.
The CBs shall retain documented evidence for each case where this derogation has
been applied and specify clearly if the audit was conducted remotely, on-site or hybrid.
The following definitions applies to this derogation:••

Operational: When all the CBs client’s activities and functions are up andrunning.
Hybrid Audit: Combination of on-site audit (activities performed at the locationsuch as inspections, interviews, observations, etc.) and remote audit (activities
performed at any place other than the location of the auditee).

For conducting remote and hybrid audits, the following documents should beconsidered:• IAF ID 3: 2011: Management of Extraordinary Events or Circumstances
Affecting ABs, CABs and Certified Organizations.
• IAF MD 4: 2018: The Use of Information and Communication Technology(ICT) for Auditing/ Assessment Purposes.
• ISO 19011:2018: Guidelines for auditing management systems.
• ISEAL Guide on Using Technology and Data in Remote Audits.

CBs are advised to regularly monitor official government travel instructions/advice. Assoon as official domestic government travel restrictions are lifted, audits shall be
conducted according to regular GSTC audit and certification requirements. It is
important however, that CBs ensure that the sources of official travel announcements
are consistent with the legal reference made by the CB’s travel insurance.
The GSTC will continue to monitor the situation and provide any updates. For any
other questions please contact GSTC Technical Team (td@gstcouncil.org).

Sincerely,Randy Durband
GSTC CEO