COVID-19 Announcement, Derogation 2020-3
Amendment to COVID-19 Announcement, Derogation sent on 7 April
2020 by GSTC.
Date: 10th July 2020
To: GSTC Accredited Certification Bodies
CC: Assurance Services International
Given the further developments around the global outbreak of COVID-19 andconsidering that many countries are moving toward the gradual lifting of travel
restrictions and opening of borders, the GSTC has amended the derogation sent on07 April 2020. This derogation replaces the previous derogation dated 7 April 2020.
This derogation applies to all GSTC audits planned by accredited CBs and requires
CBs to:1. Postpone the audit when the CB’s client is non-operational. This derogation allows
the CB to postpone the audit for a period of six (6) months from the date of thisderogation. If a GSTC certificate is due to expire in 2020, it may be extended for
up to twelve (12) months beyond its original expiry date. A recertification audit shallthen be performed before the maximum 12-month extension expires in order torenew certification.
2. Conduct remote audits when the CB’s client is operational, traveling to and fromthe client’s location is not legally allowed or logistically impossible while travel
restrictions in the client’s country of operation remain in place. CBs shall retain
evidence of any official domestic government travel restrictions that prevent onsite audits. The CB shall document in audit reports whether this derogation has
been applied and shall justify any instances where requirements were notevaluated due to remote auditing. The remote audit option shall only be applied in
the case of surveillance audits. Remote audits shall not be conducted in the event
where the CB’s client is non-operational.
3. Conduct hybrid audits only when the CB’s client is operational, but CBs are unable
to conduct a normal on-site audit due to travel restrictions in the client’s country ofoperation. The CBs shall retain documented evidence for the reasons to conduct
a hybrid audit. The CBs shall use a risk-based approach to determine therequirements to be evaluated remote and on-site. The timeline for conducting
remote and on-site audits shall be based on the risk-based approach, feasibility toassemble an audit team and travel restrictions in the client’s country of operation.
The CBs shall document in audit reports whether this derogation has been appliedand shall provide clear justification of the chosen methods for remote and on-site
audits. The hybrid audit option shall only be applied in the case of initial certification

audits. Hybrid audits shall not be conducted in the event where the CB’s client is
non-operational.
The following definitions applies to this derogation:••

Operational: When CBs client’s activities and functions are up and runningnormally.
Hybrid Audit: Combination of on-site audit (activities performed at the locationsuch as inspections) and remote audit (activities performed at any place otherthan the location of the auditee).

For conducting remote and hybrid audits, the following documents should beconsidered:• IAF ID 3: 2011: Management of Extraordinary Events or Circumstances
Affecting ABs, CABs and Certified Organizations• IAF MD 4: 2018: The Use of Information and Communication Technology(ICT) for Auditing/ Assessment Purposes• ISO 19011:2018: Guidelines for auditing management systems.
The CBs shall retain documented evidence for each case where this derogation has
been applied and specify clearly if the audit was conducted remotely, on-site or hybrid.
CBs are advised to regularly monitor official government travel instructions/advice. Assoon as official domestic government travel restrictions are lifted, audits shall be
conducted according to regular GSTC audit and certification requirements. It is
important however, that CBs ensure that the sources of official travel announcements
are consistent with the legal reference made by the CB’s travel insurance.
The GSTC will continue to monitor the situation and provide any updates. For any
other questions please contact GSTC Technical Team (td@gstcouncil.org).

Sincerely,

Randy Durband
GSTC CEO