PEFC/01-00-01

PEFC ST 2003:2020

Requirements for Certification Bodies
operating Certification against thePEFC International Chain of
Custody Standard

PEFC
INTERNATIONAL
STANDARD

PEFC Council
ICC Building C1
Route de Pré-Bois 20
1215 Geneva 15
Switzerland

t +41 22 799 45 40
f +41 22 799 45 50
e info@pefc.org
www.pefc.org

Copyright notice© PEFC Council 2020
This standard is protected by copyright owned by the PEFC Council. The document is freely available
from the PEFC Council website www.pefc.org or upon request.
No part of this standard may be changed or amended, reproduced or copied, in any form or by anymeans for commercial purposes without the permission of the PEFC Council.
The official version of the document is in English. Translations of the document can be obtained fromthe PEFC Council or PEFC National Governing Bodies. When there is doubt in regard to language
interpretation, the English version is the reference.

Document name: Requirements for Certification Bodies operating Certification against the PEFC
International Chain of Custody Standard
Document title: PEFC ST 2003:2020
Approved by: PEFC General Assembly		

Date: 2020-01-17

Issue date: 2020-02-14
Date of entry into force: 2020-02-14
Transition date: 2021-08-14

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

2

Contents

1.

Scope. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

2.

Normative references. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

3.

Terms and definitions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7

4.

General requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
4.1

Legal and contractual matters. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.2Management of impartiality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.3

Liability and financing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.4

Non-discriminatory conditions. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.5

Confidentiality. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

4.6

Publicly available information.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

5.

Structural requirements.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

6.

Resource requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
6.1

Certification body personnel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10

6.2

Resources for evaluation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
Process requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7.
7.1

General. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7.2

Application. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7.3

Application review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

7.4

Audit.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

7.5

Review. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

7.6

Certification decision. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19

7.7

Certification documentation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20

7.8

Directory of certified products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

7.9

Surveillance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

7.10

Changes affecting certification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

7.11

Termination, reduction, suspension or withdrawal of certification. . . . . . . . . . . 22

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

3

7.12

Records.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22

7.13

Complaints and appeals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Management system requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

8.
8.1

Internal audits of the certification body. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23

Appendix 1 (normative): PEFC notification of certification bodies.. . . . . . . . . . . . . . . . . . . . . . . . . . . 24
Appendix 2 (normative): Accreditations accepted by the PEFC Council for
PEFC notification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Appendix 3 (normative): Multi-site chain of custody certification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Appendix 4 (normative): Minimum content of audit reports.. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

4

Foreword
The text of the document has been developed by a multi-stakeholder Working Group coordinated by
the PEFC Council, Programme for the Endorsement of the Forest Certification (PEFC), and approved by
the PEFC Council General Assembly on 17 January 2020. The requirements of the document become
effective for all certification bodies operating chain of custody certification against PEFC ST 2002, Chain of
Custody of Forest and Tree Based Products – Requirements as of 14 February 2020 (with a transition periodof eighteen months from the date of entry into force).
The PEFC Council provides mutual recognition of national forest certification systems and defines aninternational Chain of Custody standard (PEFC ST 2002) and rules for the usage of the PEFC trademarks(PEFC ST 2001). The PEFC Council requires that chain of custody certification shall be carried out bycertification bodies who are accredited by accreditation bodies that are signatories of the Multilateral
Recognition Arrangement (MLA) for product certification of IAF.
Accreditation reduces the risk for businesses and their customers by assuring that accredited certification
bodies are competent to carry out the work they undertake. Accreditation bodies that are members of
IAF are required to operate to the highest standard and to require the certification bodies they accredit tocomply with appropriate international standards and IAF Guidance to the application of those standards.
Accreditations granted by IAF accreditation body members, based on regular peer evaluations to assure theequivalence of their accreditation programmes, allow companies with an accredited conformity assessment
certificate in one part of the world to have that certificate recognised everywhere else in the world.
This document cancels and replaces PEFC ST 2003:2012 Second Edition.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

5

Introduction
The PEFC Council requires the certification bodies operating chain of custody certification meet therequirements of ISO/IEC 17065, PEFC documentation and the relevant provisions of ISO 19011 specified
in this document.
ISO/IEC 17065 is an International Standard that sets out criteria for bodies operating certification of
products, services and processes. The chain of custody certification is considered as a process certification
whereby the chain of custody is a set of interrelated or interacting activities that transforms input
information on the origin of procured raw material into output information on the origin of sold/transferred
products. The requirements for the PEFC chain of custody are described in PEFC ST 2002 and rules
for the usage of the PEFC trademarks are described in PEFC ST 2001 of the PEFC Council technicaldocumentation.
The term “shall” is used throughout this document to indicate those provisions that, reflecting therequirements of ISO/IEC 17065 and requirements specific for PEFC chain of custody certification, aremandatory. The term “should” is used to indicate guidance that, although not mandatory, is provided by IAF
and the PEFC Council as a recognised means of meeting the requirements.
Normative guidance to this document shall only be provided by the PEFC Council.
This document does not include the text of ISO/IEC 17065 and ISO 19011. These documents can beobtained from ISO or national standard organisations.

1. Scope
This document provides additional scheme specific requirements for certification bodies operating chain ofcustody certification against PEFC ST 2002.

2. Normative references
For dated references, only the edition cited applies. For undated references, the latest edition of thereferenced document (including any amendments) applies.
IAF MD 2, Mandatory Document for the Transfer of Accredited Certification of Management Systems
IAF MD 4, Mandatory Document for the use of Information and Communication Technology (ICT) forauditing/assessment purposes
ISO/IEC 17000, Conformity assessment – Vocabulary and general principles
ISO/IEC 17065, Conformity assessment – Requirements for bodies certifying products, processes
and services
ISO 19011, Guidelines for auditing management systems
ISO/IEC Guide 2:2004, Standardization and related activities – General vocabulary
PEFC ST 2002, Chain of Custody of Forest and Tree Based Products – Requirements (hereinafter the
Chain of Custody standard), (available from www.pefc.org)
PEFC ST 2001, PEFC Trademarks Rules – Requirements (hereinafter PEFC Trademarks standard),(available from www.pefc.org)

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

63. Terms and definitions
For the purposes of this standard, the relevant definitions given in ISO/IEC 17000, ISO/IEC 17065, ISO
19011, ISO/IEC Guide 2 and PEFC ST 2002 apply, together with the following definitions:

3.1

Audit

Systematic, independent and documented process for obtaining objective evidence and evaluating it
objectively to determine the extent to which the audit criteria are fulfilled.
Note: The term “audit” used in this document is equivalent to the term “evaluation” used in ISO/IEC 17065.

3.2

Certification decision makerA person or a group of persons (e.g. a committee) that has not been involved in the audit process and isassigned by the certification body to make the certification decision.

3.3

Chain of Custody standard

PEFC ST 2002, Chain of Custody of Forest and Tree Based Products – Requirements.

3.4

Client organisation

Organisation, including a multi-site organisation, that is applying for chain of custody, or whose chain ofcustody has been certified.
Note: The term “client organisation” used in this document is equivalent to the term “supplier” used in ISO/IEC 17065.

3.5

Major nonconformity

The absence of, or failure to implement and maintain, one or more requirements of the Chain of Custody
standard, that may result in a systemic risk to the function and effectiveness of the chain of custody and/or
affect confidence in the client organisation’s claims on certified raw material.
Note: A major nonconformity may be an individual nonconformity, or a number of minor but related
nonconformities that when considered in total are judged to constitute a major nonconformity.

3.6

Minor nonconformity

A single failure to fulfil the requirements of the Chain of Custody standard that may result in no systemicrisk to the function and effectiveness of the chain of custody and/or affect confidence in the supplier’s
claims on certified raw material.

3.7

Observation

An audit finding that does not indicate nonconformity. It may be identified by the audit team as anopportunity for improvement.

3.8

PEFC authorised body

The PEFC authorised body is an entity that has permission from the PEFC Council to issue PEFC
trademarks licences and to notify certification bodies on behalf of the PEFC Council. Usually the authorisedbodies are the PEFC National Governing Bodies.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

7

3.9

PEFC National Governing Bodies (PEFC NGBs)

The PEFC National Governing Bodies (PEFC NGBs) are independent, national organisations establishedto develop and implement a PEFC system within their country. A list of the PEFC NGBs and their contact
details can be found at the PEFC website. PEFC NGBs are often also the PEFC authorised body.
See 3.8.

3.10

Reviewer

A person or a group of persons (e.g. a committee) that has not been involved in the audit process andis assigned by the certification body to review all the information and results related to the audit.

3.11

Technical expert

Person who provides specific knowledge or expertise to the audit team. The technical expert is notconsidered an auditor.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

8

4. General requirements
The criteria against which the client organisation’s chain of custody is evaluated are those outlined in
the latest version of the Chain of Custody standard and of the PEFC Trademarks standard.
Note: The latest version of the Chain of Custody standard and the PEFC Trademarks standard, theiramendments and corresponding transition periods, are available from the PEFC website www.pefc.org.

4.1

Legal and contractual matters

All the requirements given in clause 4.1 of ISO/IEC 17065:2012(E) apply.

4.1.1

Where the certification body makes use of the PEFC logo on the certification document, or for any
other purposes linked to the PEFC certification scheme, the use shall only be carried out based ona valid licence issued by the PEFC Council or another entity authorised by the PEFC Council, and inaccordance with the PEFC Trademarks standard.

4.1.2

The certification body shall make clear to the client organisation that the PEFC logo on the issued
certificate only refers to the client organisation’s compliance with the PEFC certification schemeand does not provide the client organisation with the right to use the PEFC trademarks.

Note: The client organisation with a valid PEFC chain of custody certificate can only use the PEFC
trademarks with a unique PEFC trademarks licence number for “on-product” as well as “off-product”
purposes, based on a PEFC trademarks usage licence contract issued by the PEFC Council or another entity
authorised by the PEFC Council and in accordance with the PEFC Trademarks standard.

4.2

Management of impartiality

All the requirements given in clause 4.2 of ISO/IEC 17065:2012(E) apply.

4.3

Liability and financing

All the requirements given in clause 4.3 of ISO/IEC 17065:2012(E) apply.

4.4

Non-discriminatory conditions

All the requirements given in clause 4.4 of ISO/IEC 17065:2012(E) apply.

4.5

Confidentiality

All the requirements given in clause 4.5 of ISO/IEC 17065:2012(E) apply.
The certification body shall inform the client organisation that it is obliged to provide information to the
PEFC Council and/or a PEFC National Governing Body, and the range and usage of information to beprovided. The certification body shall have the written consent of the client organisation for the information
disclosed to the PEFC Council and/or the PEFC National Governing Body. This written agreement
shall be in compliance with any data protection legislation applicable in the countries in which the clientorganisation and the certification body are based.

4.6

Publicly available information

All the requirements given in clause 4.6 of ISO/IEC 17065:2012(E) apply.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

95. Structural requirements
All the requirements given in clause 5 of ISO/IEC 17065:2012(E) apply.

6. Resource requirements
6.1

Certification body personnel

6.1.1

GeneralAll the requirements given in clause 6.1.1 of ISO/IEC 17065:2012(E) apply.

6.1.1.1 Personnel involved in the certification activities
6.1.1.1.1 The certification body shall ensure that all personnel carrying out the key activities, such as contract
review, auditing, granting of certification, monitoring of auditors, etc. have the relevant and appropriate
knowledge and competencies corresponding to these activities.
6.1.1.1.2 Gender equality should be promoted.
6.1.1.2 Auditors
The certification body shall have a documented process to ensure that auditors have personal attributes,
knowledge and skills in accordance with clauses 7.1, 7.2.1, 7.2.2, 7.2.3.1, 7.2.3.2 and 7.2.3.4 of ISO
19011:2018.

6.1.1.2.1 Education
6.1.1.2.1.1 The certification body shall ensure that auditors have the knowledge corresponding to at least asecondary education that includes or is supplemented with courses related to forest and/or tree based andrelated industries where the auditor(s) conducts chain of custody audits.
Note: Secondary education is the part of the national education system that comes after the primary orelementary stage, but that is completed prior to entrance to tertiary education, e.g. university or similar
educational institution.

6.1.1.2.1.2 The specific education relating to forest and/or tree based and related industries can be substituted
by working experience in these sectors if the certification body can demonstrate it is equivalent to therequired education.
Note: Forest and/or tree based and related industries include, for example, activities relating to
manufacturing, research, education, standards development, forest industry/product associations, forest
law and regulation, transport, distribution and recycling or transport and storage of forest and/or tree based
products.

6.1.1.2.2 Working experience
6.1.1.2.2.1 For a first qualification of an auditor, the certification body shall ensure that the auditor has aminimum of three years of full-time related working experience in the forest and/or tree based and relatedindustries.
Note: Forest and/or tree based and related industries include, for example, activities relating to
manufacturing, research, education, standards development, forest industry/product associations, forest
law and regulation, transport, distribution and recycling or transport and storage of forest and tree based
products.

6.1.1.2.2.2 The number of years of total work experience may be reduced by one year, if the auditor has
completed a tertiary education appropriate and relevant to forest and/or tree based and related industries.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

10

Note: Tertiary education, also referred to as third stage, third level, and post-secondary education, is theeducational level following the completion of a school providing a secondary education.

6.1.1.2.2.3 The number of years of total work experience may be reduced by one year if the auditor has
performed, as auditor-in-training, four chain of custody audits under the leadership of a qualified auditor, in
addition to the chain of custody audits required as audit experience under 6.1.1.2.5.1.
6.1.1.2.3 PEFC chain of custody training
The certification body shall ensure that new auditors have received initial training on the PEFC system andthe Chain of Custody standard, that is recognised by the PEFC Council.
Note: The PEFC website www.pefc.org provides further information on training options.

6.1.1.2.4 Audit training
The certification body shall ensure that auditors have successfully completed training in audit techniques
based on ISO 19011.

6.1.1.2.5 Audit experience
6.1.1.2.5.1 For a first qualification of an auditor, the certification body shall ensure that the auditor within thelast three years has performed, as auditor-in-training, chain of custody audits for at least four organisations
under the leadership of a qualified auditor, including at least two PEFC chain of custody audits. The numberof chain of custody audits-in-training can be reduced to two PEFC chain of custody audits for auditors thatare qualified for chain of custody standards, ISO 9001 or ISO 14001 in forest and/or tree related sectors.
6.1.1.2.6 Competencies
6.1.1.2.6.1 The certification body shall ensure that auditors demonstrate ability to apply knowledge and skillsin the following areas:a) The objectives and core processes of the PEFC system including the requirements from the PEFC
Sustainable Forest Management standard (PEFC ST 1003) covered in the PEFC chain of custodydefinition of controversial sources, (PEFC ST 2002, clause 3.6 paragraphs b, c, d and e).
b) Audit principles, procedures and techniques (see 7.2.3.2.a of ISO 19011:2018): to enable theauditor to apply those appropriate to different audits and ensure that audits are conducted in aconsistent and systematic manner.
c) Organisation situations (see 7.2.3.2.c of ISO 19011:2018), including organisational size, structure,functions and relationships, general business processes and related terminology, and cultural andsocial customs such as knowledge of the client organisation working language, or language that thecertification body and client can agree on: to enable the auditor to comprehend the organisation’s
operational context.
d) Applicable international legislation and country specific forest governance and law enforcement
system relevant to forest and tree based raw material procurement and avoidance of raw material
from controversial sources: to enable the auditor to comprehend the client organisation’s contractual
relationships with suppliers and evaluate the client organisation’s procedures for avoidance of raw
material from controversial sources. Knowledge and understanding of this area shall cover:i.

contracts and agreements, including labour contracts and or collective bargaining
agreementsii.

forest governance and law enforcement system of countries of the uncertified raw material
origin, including those covering social, health and safety issues of workers

iii. international conventions relating to worker rights (ILO core conventions)iv. international treaties and conventions relating to the trade of forest and tree based products

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

116.1.1.2.6.2 The certification body shall ensure that auditors demonstrate ability to apply terminology, knowledge,
understanding and skills in the following areas of the PEFC chain of custody:a) principles and requirements of the Chain of Custody standard (PEFC ST 2002)b) products (including non-wood forest products and products from recycled material), processes andpractices in the specific sector, applied raw material flow, measurements and control measuresc) the application of management systems to forest and tree based and related industries andinteraction between their componentsd) information systems and technology for authorisation, security, distribution and control of
documents, data and recordse) application of PEFC trademarks and other product labels and claimsf)application of the measures to avoid procurement of raw material from controversial sources,
including the relevant risk assessment methodology and indicatorsg) social, health and safety requirements

6.1.1.2.6.3 The certification body shall maintain evidence of annual monitoring of chain of custody auditors,
applying methods such as reviewing audit reports or client organisations’ feedback, etc. based on thefrequency of their usage and the level of risk linked to their activities, and periodic witness audits.
In particular, the certification body shall review the competence of its personnel in the light of theirperformance in order to identify training needs.
6.1.1.3 Audit team
The audit team shall comprise auditor(s) fulfilling the requirements defined in 6.1.1.2 and gender balanceshould be considered.

6.1.1.3.1 Technical experts
In some cases, technical experts may be required to support the required auditor competency ina particular technical area by providing appropriate technical expertise. Technical experts shall be
independent from the auditee, and their names and affiliations shall be included in the audit report.

6.1.1.4 Reviewer and certification decision maker
The certification body shall ensure that the reviewer and the certification decision maker meet thefollowing requirements. If the reviewer and/or the certification decision maker are composed by a groupof people, at least one of the members meets the following requirements.
Note: The reviewer and the certification decision maker can be the same person. See note to clause
7.6.2 of ISO/IEC 17065:2012(E).

6.1.1.4.1 Education
6.1.1.4.1.1 The certification body shall ensure that the reviewer and certification decision maker have theknowledge corresponding to at least a secondary education that includes or is supplemented with courses
related to forest and/or tree based and related industries.
Note: Secondary education is the part of the national education system that comes after the primary orelementary stage, but that is completed prior to entrance to tertiary education, e.g. university or similar
educational institution.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard126.1.1.4.1.2 The specific education relating to forest and/or tree based and related industries can be substituted
by working experience in these sectors if the certification body can demonstrate it is equivalent to therequired education.
Note: Forest and/or tree based and related industries include, for example, activities relating to
manufacturing, research, education, standards development, forest industry/product associations, forest
law and regulation, transport, distribution and recycling or transport and storage of forest and tree based
products.

6.1.1.4.2 Working experience
6.1.1.4.2.1 To qualify as a reviewer or certification decision maker, the certification body shall ensure aminimum of three years full-time related working experience in conformity assessment.
6.1.1.4.2.2 The number of years of total work experience may be reduced by one year, if the reviewer or
certification decision maker has completed a tertiary education appropriate and relevant to forest and/or
tree based and related industries.
Note: Tertiary education, also referred to as third stage, third level, and post-secondary education, is theeducational level following the completion of a school providing a secondary education.

6.1.1.4.2.3 A qualified PEFC chain of custody auditor shall be considered as already meeting the minimum
working experience required.
6.1.1.4.3 PEFC chain of custody training
The certification body shall ensure that the reviewer and certification decision maker have received initialtraining on the PEFC system and the Chain of Custody standard, that is recognised by the PEFC Council.
Note: The PEFC website www.pefc.org provides further information on training options.

6.1.1.4.4 Audit training
The certification body shall ensure that the reviewer and certification decision maker have successfullycompleted training in audit techniques based on ISO 19011.

6.1.1.4.5 Audit experience
6.1.1.4.5.1 For a first qualification of a reviewer or a certification decision maker, the certification body shallensure that the reviewer or certification decision maker, within the last three years, have observed atleast one PEFC chain of custody audit.
6.1.1.4.6 Competencies
6.1.1.4.6.1 The certification body shall ensure that the reviewer and certification decision makerdemonstrate ability to apply knowledge and skills in the following areas:a) The objectives and core processes of the PEFC system including the requirements from the PEFC
Sustainable Forest Management standard (PEFC ST 1003) covered in the PEFC chain of custodydefinition of controversial sources, (PEFC ST 2002, clause 3.6 paragraphs b, c, d and e).
b) Audit principles, procedures and techniques (see 7.2.3.2.a of ISO 19011:2018).
c) Organisation situations (see 7.2.3.2.c of ISO 19011:2018), including organisational size, structure,functions and relationships, general business processes and related terminology, and cultural andsocial customs.
d) Applicable international legislation and country specific forest governance and law enforcement
system relevant to forest and tree based raw material procurement and avoidance of raw material
from controversial sources. Knowledge and understanding of this area shall cover:

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

13

i.

contracts and agreements, including labour contracts and or collective bargaining
agreementsii.

forest governance and law enforcement system of countries of the uncertified raw material
origin, including those covering social, health and safety issues of workers

iii. international conventions relating to worker rights (ILO core conventions)iv. international treaties and conventions relating to the trade of forest and tree based products

6.1.2

Management of competence for personnel involved in the certification process

All the requirements given in clause 6.1.2 of ISO/IEC 17065:2012(E) apply.

6.1.2.1 The certification body shall ensure that qualified reviewers, certification decision makers andauditors, every two calendar years, have participated in a refresher training in chain of custody offorest and tree based products that is recognised by the PEFC Council.
Note: The PEFC website www.pefc.org provides further information on training options.

6.1.2.2 When there is a new issuance of the Chain of Custody standard or/and the PEFC
Trademarks standard, the certification body shall ensure that qualified reviewers, certification
decision makers and auditors have participated in refresher training recognised by the PEFC
Council that covers the new version of the standards, before starting operating against them.
Note: The PEFC website www.pefc.org provides further information on training options.

6.1.2.3 For maintaining the qualification of the auditor, the certification body shall ensure that the auditor
has performed a minimum of five external audits in chain of custody standards, ISO 9001 or ISO 14001 inforest and/or tree based and related sectors per year, where the sum of these audits should cover at least
seven days of audit work, including at least two PEFC chain of custody audits.
Note: The seven days of audit work may include reporting time.

6.1.2.4 In exceptional circumstances, such as statutory leave or long term illness, auditors unable to comply
with 6.1.2.3 shall perform at least two PEFC chain of custody audits under the leadership of aqualified auditor.
6.1.2.5 Reviewers and certification decision makers shall observe at least one PEFC chain of custody
audit per calendar year.
Table: Overview of qualification requirements
Auditor
Education

Reviewer and certification
decision maker• Knowledge corresponding to at least a secondary education that includes
or is supplemented with courses related to forest and/or tree based andrelated industries.
• Specific education relating to forest and/or tree based and related industries canbe substituted by working experience in these sectors if the certification bodycan demonstrate it is equivalent to the required education.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

14

Reviewer and certification
decision maker

AuditorWorking experience• Minimum of 3 years full-time related
working experience in the forest and/or tree based and related industries.

• Minimum of 3 years full-time related
working experience in conformity
assessment.

• May be reduced by 1 year, if the auditor
has completed a tertiary education
appropriate and relevant to forest and/or tree based and related industries.

• May be reduced by 1 year, if thereviewer or certification decision
maker has completed a tertiary
education appropriate and relevant toforest and/or tree based and relatedindustries.

• May be reduced by 1 year if the auditor
has performed, as auditor-in-training,
4 chain of custody audits under theleadership of a qualified auditor, in
addition to the chain of custody audits
required as audit experience under
6.1.1.2.5.1.
Training• A qualified PEFC chain of custody
auditor shall be considered as alreadymeeting the minimum working
experience required.

• Initial training recognised by the PEFC Council• ISO/IEC 19011

Audit experience• The auditor, within the last 3 years
has performed, as auditor-in-training,
chain of custody audits for at least 4organisations under the leadership ofa qualified auditor, including at least 2
PEFC chain of custody audits.

• The certification body shall ensure thatthe reviewer or certification decision
maker, within the last 3 years, has
observed at least 1 PEFC chain ofcustody audit.

• Number of chain of custody auditsin-training can be reduced to 2 PEFC
chain of custody audits for auditorsthat are qualified for chain of custody
standards, ISO 9001 or ISO 14001 inforest and/or tree related sectors.
Competencies

See requirement 6.1.1.2.6

See requirement 6.1.1.4.6

Maintenance of the qualification
Training• Refresher training recognised by the PEFC Council every two years.
• When new issuance of PEFC Chain of Custody or Trademarks standards.

Audit experience• Minimum of 5 external audits in chainof custody standards, ISO 9001 or ISO
14001 in forest and/or tree based andrelated sectors per year, where the sumof these audits should cover at least
7 days of audit work, including at least
2 PEFC chain of custody audits.

• Observe at least 1 PEFC chain ofcustody audit per calendar year.

• In exceptional circumstances, such as
statutory leave or long term illness,
auditors unable to comply with 6.1.2.3
shall perform at least 2 PEFC chain ofcustody audits under the leadership ofa qualified auditor.

Note: This table is a summary of the qualification requirements for auditors, reviewers and certification
decision makers. The actual requirements are in the text of this standard.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard15

6.1.3Contract with the personnel

All the requirements given in clause 6.1.2 of ISO/IEC 17065:2012(E) apply.

6.2

Resources for evaluation

All the requirements given in clause 6.2 of ISO/IEC 17065:2012(E) apply.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

16

7. Process requirements
7.1

GeneralAll the requirements given in clause 7.1 of ISO/IEC 17065:2012(E) apply.

7.1.1

Additionally to ISO/IEC 17065:2012(E) clause 7.1.3, the certification body may provide publicly
available documents, such as guidance, clarifications, and interpretations published by the PEFC
Council or a PEFC National Governing Body.

7.2

Application

All the requirements given in clause 7.2 of ISO/IEC 17065:2012(E) apply.

7.2.1

The certification body shall obtain from the client organisation, as a minimum, the following
information and documentation as a part of the application for certification:a) corporate entity, name, address and legal statusb) documented procedures of the client organisation as defined in the Chain of Custody standardc) descriptive identification of the products covered by the PEFC chain of custody sufficient to identify
product groupsd) sites covered by the PEFC chain of custody in the case of multi-site certification (as defined in
the Chain of Custody standard)
Note: The information does not have to be obtained at the moment of first contact with the clientorganisation, but at least before activities under clauses 7.3 and 7.4 are carried out.

7.2.2

The certification body shall obtain from the client organisation, as a minimum, for products coveredby the PEFC chain of custody, the following information relating to the application of the optional
requirements of the Chain of Custody standard, for each site and/or product group as applicable:a) chain of custody methodb) intended application of the PEFC trademarks
Note: The information does not have to be obtained at the moment of first contact with the clientorganisation, but at least before activities under clauses 7.3 and 7.4 are carried out.

7.2.3

The certification body shall obtain from the client organisation sufficient information to assess if
the application is to be treated as a transfer of certification instead of a new application. See also
requirement 7.4.10.

7.3

Application review

All the requirements given in clause 7.3 of ISO/IEC 17065:2012(E) apply.

7.3.1

The certification body shall carry out a review of the client organisation’s documentation(see 7.2.1 b) prior to the audit, to determine the conformity of the documentation with thecertification criteria.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

17

7.4

Audit

All the requirements given in clause 7.4 of ISO/IEC 17065:2012(E) apply.

7.4.1

The certification body shall have documented procedures to ensure that an audit plan is establishedfor each audit, to provide a basis for agreement regarding the conduct and scheduling of the audit
activities. The audit plan shall be communicated and the dates of the audit shall be agreed upon inadvance with the client organisation.

Note: Guidance for preparing the audit plan is provided by ISO 19011:2018, clause 6.3.2.

7.4.2

In the case of multi-site certification, the audit plan shall list the sites to be visited as part of thesample. The certification body shall refer to the normative Appendix 3.

7.4.3

The certification body shall have documented procedures for selecting and appointing the audit
team, including the audit team leader.

Note: Guidance for selecting the audit team and audit team leader is provided by ISO 19011:2018,
clauses 5.5.4.

7.4.4

The purpose of the audit is to:a) Determine the conformity of the client organisation’s:i.

chain of custody process with the requirements of the Chain of Custody standard and its
effective implementationii.

management system with the requirements of the Chain of Custody standard and its
effective implementationiii. chain of custody process with requirements for the avoidance of procuring raw material
from controversial sources where applicable (PEFC DDS requirements) and its effective
implementation
iv. usage of the PEFC trademarks with the PEFC Trademarks standard and its effective
implementation and that the trademarks licence contract, which shall be signed between
the client organisation and the PEFC Council or a PEFC authorised body in order forthe client organisation to be allowed to use the PEFC trademarks, is valid
Note: The usage of the PEFC trademarks and PEFC claims is to be evaluated at the time of the surveillance
and recertification audits. At initial audits, any proposed or intended use of the PEFC trademarks and PEFC
claims is to be evaluated.
b) Collect data as required by the PEFC notification contract.

7.4.5

The certification body shall conduct the audit following the relevant guidance provided in ISO
19011:2018, clause 6.4. In general, audits (initial, surveillance and recertification) shall be
conducted on-site, except in those cases where requirements 7.4.6 or 7.9.2 of this standard apply,
where certification bodies may decide to conduct remote audits.

7.4.6

For client organisations that operate without physical possession, audits may be conducted
remotely with the use of ICT tools in accordance with IAF MD 4. The certification body shalldemonstrate that the full scope of the audit can be covered using ICT tools.

Note 1: Client organisations that operate with physical possession but have not sold any physicalproduct with a PEFC claim since the previous audit, are not eligible to be audited remotely according tothis requirement.
Note 2: For cases where client organisations have not procured raw material and have not sold any
product with a PEFC claim since the last audit, requirement 7.9.2 of this standard may apply.
PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

18

7.4.7The certification body shall have documented procedures for determining audit time, and for eachclient organisation the certification body shall determine, with input from the audit team, thetime needed to plan and accomplish a complete and effective audit of the client organisation’s
PEFC chain of custody. The audit time determined by the certification body, and the justification
for the determination, shall be recorded. The minimum time for the on-site audit is four hours,
this shall not include reporting activities, unless under specific conditions where it can be justified
and documented.

7.4.8

The certification body shall have documented procedures for sampling within the audit
in accordance with the guidance provided in ISO 19011:2018, A.6.

7.4.9

In determining the audit time and sampling within the audit, the certification body shall as aminimum, consider the following aspects:a) the requirements of the Chain of Custody standardb) size and complexity of the client organisation’s operations within the scope of the PEFC chain ofcustodyc) extent of supplies that could create a significant risk of procuring raw material from controversial
sourcesd) extent of PEFC trademarks usage activitiese) any outsourcing of any activities included in the scope of the organisation’s chain of custodyf)

the results of any prior audits, including those of client organisation’s management systemsg) number of sites and multi-site considerations

7.4.10 In the case of transfer of certification, the certification body shall operate according to ISO/IEC
17065 clause 7.4.5 and IAF MD2:2017.
7.4.11 The audit report shall include at least the information specified in Annex 4.
7.4.12 On request, the certification body shall send a copy of the audit report and other necessary audit
records requested by PEFC, in English language, to the PEFC Council and/or a PEFC National
Governing Body, in accordance with 4.5.

7.5

Review

All the requirements given in clause 7.5 of ISO/IEC 17065:2012(E) apply.

7.6

Certification decision

All the requirements given in clause 7.6 of ISO/IEC 17065:2012(E) apply.

7.6.1

Audit findings shall be classified as major nonconformities, minor nonconformities
and observations.

7.6.2

Before granting initial certification, as a minimum, major and minor nonconformities shall becorrected and the corrective action(s) verified by the certification body.

7.6.3

Before granting recertification, as a minimum, major nonconformities shall be corrected and thecorrective action(s) verified by the certification body.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

197.6.4

Major and minor nonconformities identified in the audits shall result in corrective action(s)by the client organisation resolving the nonconformities. The corrective action plan, including atimeframe, shall be reviewed and accepted by the certification body. The time period for completionof the corrective action(s) for major nonconformities identified in surveillance audits and theirverification by the certification body shall follow the rules of the certification body but not exceed
three months. Corrective action(s) for minor nonconformities identified during recertification andsurveillance audits shall be verified no later than during the next audit.

7.7

Certification documentation

All the requirements given in clause 7.7 of ISO/IEC 17065:2012(E) apply.

7.7.1

The certification document shall include at least the following information:a) identification of the certification bodyb) name and address of the client organisation, and where applicable its sites/legal entities, whose
chain of custody is subject to certification
Note 1: The name and address of the client organisation may be the name and address of a legal entity
where no PEFC chain of custody activities are taking place (e.g. a mailbox address). The name and addressof the client organisation whose chain of custody is subject to certification shall be included on thecertification document as well.
Note 2: In the case of PEFC chain of custody certification for specified projects, or ‘project certification’(refer to PEFC GD 2001, Annex 1), “name and address” refers to the name and address of the controlling
entity. The name of the project can be included in the scope of the project certificate.
c) type of certificate (individual, multi-site or producer group)d) scope of the certification granted (see 7.7.2)e) the PEFC logo with the certification body’s PEFC trademarks licence numberf)accreditation mark of the accreditation body (including accreditation number where applicable)g) the date of granting, extending or renewing certification and the expiry date or recertification due
date (see 7.7.6). The effective date on a certification document shall not be before the date of
the certification decision

7.7.2

The scope of certification shall include the following information:a) reference to PEFC ST 2002, Chain of Custody of Forest and Tree Based Products – Requirements,
and where relevant the national identification of this standard as adopted by a PEFC endorsed
national forest certification system
Note: The identification of the Chain of Custody standard shall refer to the version of the Chain of
Custody standard against which the audit was carried out and that was valid at the time when thecertification was granted.
b) reference to PEFC ST 2001, PEFC Trademarks Rules – Requirements, and where relevant
the national identification of this standard as adopted by a PEFC endorsed national forest
certification system
Note: The identification of the PEFC Trademarks standard shall refer to the version of the PEFC Trademarks
standard against which the audit was carried out and that was valid at the time when the certification was
granted.
c) applied chain of custody methodd) products covered by the chain of custody, according to the PEFC product categories
PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

20

Note: In the case of PEFC chain of custody certification for specified projects, or ‘project certification’ (refer
to PEFC GD 2001, Annex 1), the name of the project can be included in the scope of the project certificate.

7.7.3

Where the scope of the certification is included in an appendix to the certificate, the certificate shall
include a reference to the appendix, and the appendix shall be considered as part of the certificate
and be provided whenever the certificate is requested.

7.7.4

The number of the certificate shall be comprised, in this order, by: the abbreviation of thecertification body name (the same abbreviation shall be used for any PEFC certificates issued),followed by a dash (-), the abbreviation of the Chain of Custody standard: PEFC-COC, followedby another dash (-), and the corresponding number given by the certification body to the certificate.

Note: Two certification bodies cannot have the same abbreviation.

7.7.5

The certification body shall issue the certification document in English, any other language asappropriate and agreed upon working languages.

7.7.6

The certification shall be granted for a maximum of five years.

7.7.7

Certification bodies shall immediately inform the relevant PEFC National Governing Body, or
the PEFC Council where the PEFC National Governing Body does not exist, when certification is
granted, suspended, terminated, withdrawn, its scope is changed or any other changes affecting thecertification or the information that certification bodies shall report to PEFC.

7.8

Directory of certified products

All the requirements given in clause 7.8 of ISO/IEC 17065:2012(E) apply.

7.9

Surveillance

All the requirements given in clause 7.9 of ISO/IEC 17065:2012(E) apply.

7.9.1

The surveillance audits shall be carried out annually. The certification body shall carry out at least
four surveillance audits before the expiry date of the certificate.

Note 1: Annually means once every twelve months, plus or minus three months.
Note 2: If the certificate is valid for less than five years, the number of surveillance audits can be reduced
accordingly.

7.9.2

The on-site surveillance audit may be replaced by other audit techniques, such as documentation
and records review, and the period between on-site surveillance audits shall not exceed two years(plus three months) where:a) the certification body can justify that the audit techniques used deliver sufficient confidence in thecertified entity’s compliance with the certification criteria; andb) no nonconformity was raised during the previous initial, surveillance or recertification audit; andc) the client organisation procurement does not include significant risk supplies; andd) the client organisation provides the certification body with all the records required to be kept
by the Chain of Custody standard or a list of all the records that allow the certification body toestablish an independent sampling; ore) the submitted records provide sufficient evidence that the client organisation or clientorganisation’s site has not procured raw material and has not sold any product with a PEFC claim
since the last audit.
PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

21

7.10

Changes affecting certification

All the requirements given in clause 7.10 of ISO/IEC 17065:2012(E) apply.

7.11

Termination, reduction, suspension or withdrawal of certification

All the requirements given in clause 7.11 of ISO/IEC 17065:2012(E) apply.

7.11.1 If certification is terminated, suspended or withdrawn, the certification body shall inform the clientorganisation that any further use of PEFC trademarks and claims is not allowed. In case ofsuspension, the certification body shall monitor whether the client is in compliance.

7.12

Records

All the requirements given in clause 7.12 of ISO/IEC 17065:2012(E) apply.

7.13

Complaints and appeals

All the requirements given in clause 7.13 of ISO/IEC 17065:2012(E) apply.

7.13.1 The certification body shall notify the PEFC Council, within 30 days, of any substantiated claimsof noncompliance with certification requirements by client organisations, or complaints againstclient organisations it receives or about which it becomes aware.
7.13.2 The certification body shall provide the PEFC Council and the corresponding PEFC National
Governing Body with summary reports for resolved complaints and appeals against the PEFC
certified client organisations received by the certification body, including at minimum:a) identification of the appellant/complainant (subject to disclosure)b) identification of the client organisationc) subject of the complaintd) summary of the complaint handling processe) outcome/resolution of the complaint

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

228. Management system requirements
All the requirements given in clause 8 of ISO/IEC 17065:2012(E) apply.

8.1

Internal audits of the certification body

8.1.1

On request, the results of annual internal audits, limited to the performance of PEFC chainof custody certification activities, shall be provided to the PEFC Council or PEFC National
Governing Body.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

23

Appendix 1 (normative): PEFC notification of certification bodies(Requirements are additional to the accreditation of the certification body)
The certification body operating the PEFC recognised chain of custody certification shall be notified by
the PEFC Council or other PEFC authorised body for the specific country in which it operates.
The PEFC notification requires that the certification body shall have a valid accreditation recognised by the
PEFC Council (see Annex 2 of this document). The certification body shall provide the PEFC Council, or
the relevant PEFC authorised body, with information on granted certifications as specified by the PEFC
Council or the relevant PEFC authorised body.
Note: The information on granted certifications includes (but it is not limited to) identification of theclient organisation, scope of the granted certifications and the client organisation’s turnover where used for
determination of the PEFC notification fee.
The PEFC notification may require the certification body to pay a PEFC notification fee as specified by
the PEFC Council or the relevant PEFC authorised body.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

24

Appendix 2 (normative): Accreditations accepted by the PEFC Council
for PEFC notification
The PEFC Council requires that chain of custody certification shall be carried out by certification bodies who
are accredited by accreditation bodies that are signatories of the Multilateral Recognition Arrangement (MLA)
for product certification of IAF or IAF’s Regional Accreditation Groups such as European co-operation for
Accreditation (EA), Inter American Accreditation Cooperation (IAAC), Asia Pacific Accreditation Cooperation
Incorporated (APAC), Southern African Development Community Cooperation in Accreditation (SADCA),
African Accreditation Cooperation (AFRAC) and ARAB Accreditation Cooperation (ARAC).
The scope of the accreditation shall explicitly cover PEFC ST 2002, Chain of Custody of Forest and Tree
Based Products – Requirements and PEFC ST 2001, PEFC Trademarks Rules – Requirements in its valid
version as presented at the PEFC website www.pefc.org.
The scope of accreditation shall also explicitly state ISO/IEC 17065, PEFC ST 2003 and other requirements
against which the certification body has been assessed.
The accreditation certificate shall be available in English and any other language, as necessary.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

25

Appendix 3 (normative): Multi-site chain of custody certification(Appendix 2 to the Chain of Custody standard)

1. Introduction
1.1

This appendix is for the audit and certification of PEFC chain of custody in client organisations
with a network of sites, to ensure that the audit provides adequate confidence in the conformityof the client organisation’s chain of custody with the Chain of Custody standard across all sites
listed in the scope of the certificate and that the audit is practical and feasible in both economic
and operative terms.

2. Eligibility criteria for the multi-site client organisation
2.1

Eligibility criteria for the multi-site client organisation, including definitions, are included inAppendix 2 to the Chain of Custody standard.

2.2

In addition to requirements of Appendix 2 to the Chain of Custody standard, the multi-siteclient organisation shall demonstrate its ability to collect and analyse data (including but notlimited to items below) from all sites including the central office and its authority over all sites
and its authority to initiate change if required:a) chain of custody documentation and chain of custody changesb) management reviewc) complaintsd) evaluation of corrective actionse) internal audit planning and evaluation of the resultsf)

2.3

different legal requirements in relation to the avoidance of raw material from controversial sources
With reference to Appendix 2 of the Chain of Custody standard, a multi-site client organisation,
which is established as a group of independent legal entities only for the purpose of obtaining andmaintaining chain of custody certification, shall only consist of typically small enterprises.

3. Eligibility criteria for the certification body
3.1

General

3.1.1

The certification body shall provide information to the client organisation about the eligibility
criteria laid down herein and in Appendix 2 to the Chain of Custody standard before starting theaudit process, and should not proceed with the audit if any of the eligibility criteria for the multi-siteorganisation are not met. Before starting the audit process, the certification body should inform theclient organisation that the certificate will not be issued if, during the audit, nonconformities inrelation to these eligibility criteria are found.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

26

3.2

Contract review

3.2.1

The certification body’s procedures shall ensure that the initial contract review identifies thecomplexity and scale of the activities covered by the chain of custody subject to certification andany differences between sites as the basis for determining the level of sampling.

3.2.2

The certification body shall identify the central function of the client organisation that is its
contractual partner for the performance of the certification. The agreement shall allow thecertification body to carry out the certification activities at all sites of the multi-site clientorganisation.

3.2.3

The certification body shall analyse, in each individual case, to what extent sites of an organisation
have similar raw material flow that enables the chain of custody to be applied in a similar manner.
The similarity of the sites included in the multi-site client organisation shall be taken into
consideration when applying the sampling procedures.

3.2.4

The certification body shall retain a record to demonstrate that the required activities in 3.2.1, 3.2.2
and 3.2.3 have been implemented.

3.3

Audit

3.3.1

The certification body shall have documented procedures to deal with audits under its multi-site
procedure. Such audit procedures, including documentation and records review, on-site audits,
etc., shall establish the way the certification body satisfies itself, inter alia, that the chain of custodyrequirements are actually applied to all the sites and that all the criteria in the Chain of Custody
standard, including its Appendix 2, are met.

3.3.2

If more than one audit team is involved in the audit of the network, the certification body shalldesignate a unique audit leader whose responsibility is to consolidate the findings from all the audit
teams and to produce a synthesis report.

3.4

Nonconformities

3.4.1

When nonconformities are found at any individual site, either through the client organisation’s
internal auditing or from auditing by the certification body, an investigation shall take place todetermine whether the other sites may be affected. Therefore, the certification body shall require
the client organisation to review the nonconformities to determine whether they indicate an overall
chain of custody deficiency applicable to all sites or not. If they are found to do so, corrective action
should be performed both at the central office and at the individual sites. If they are found not to doso, the client organisation shall be able to demonstrate to the certification body the justification for
limiting its follow-up action to the individual sites.

3.4.2

The certification body shall require evidence of these actions and may increase its sampling
frequency until it is satisfied that control is re-established.

3.4.3

For initial and recertification audits, at the time of the decision making process, if any site has anonconformity, certification shall be denied to the whole multi-site client organisation pending
satisfactory corrective action.

3.4.4

It shall not be admissible that, in order to overcome the obstacle raised by the existence of anonconformity raised by the certification body at a single site, the client organisation seeks to
exclude from the scope the “problematic” site during the certification process.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

27

3.5

Certificates

3.5.1

One single certificate shall be issued with the name and address of the central office of theclient organisation. A list of all the sites that the certificate relates to shall be issued, either on
the certificate itself or in an appendix or as otherwise referred to in the certificate. The scope orother reference on the certificate shall make clear that the certified activities are performed by the
network of sites in the list. The appendix or other reference is an integral part of the certificate andshall not be separated from the certificate.

3.5.2

If the individual sites are applying different chain of custody methods, the application of the Chain of
Custody standard shall be clearly stated in the certificate and any appendix for the individual sites.

3.5.3

A sub-certificate may be issued to the client organisation for each site covered by the certification,
on condition that it contains the same scope, or a sub-scope of that scope, and includes a clear
reference to the main certificate. The sub-certificate shall include a statement saying “the validityof this certificate depends on the validity of the main certificate”. In cases where the sub-certificate
includes also a sub-certificate number, it shall be linked to the certificate number and be included in
the certificate as per 3.5.1.

3.5.4

The certificate will be withdrawn in its entirety, if the central office or any of the sites does not/do
not fulfil the necessary criteria for the maintaining of the certificate (see 3.2 above).

3.5.5

The list of sites shall be kept updated by the certification body. To this effect, the certification bodyshall request the client organisation to inform it about the closure, establishment, or change inactivities of sites. Failure to provide such information will be considered by the certification bodyas a misuse of the certificate, and it will act consequently according to its procedures. Certification
bodies shall inform the PEFC Council or the PEFC National Governing Body accordingly.

3.5.6

Additional sites may be added by the certification body to an existing certificate between audits
provided it is within the scope of the certificate. The number of sites that may be added between
audits is limited to 100% of the existing sites at the previous audit. The following requirements
shall be met:a) The certification body shall be informed by the client organisation in advance of the clientorganisation’s desire to add new sites between audits to be covered by the chain of custodycertificate and shall be provided with the number of sites.
b) The certification body shall obtain from the client organisation the chain of custody procedures
covering the additional sites, including the applied chain of custody method and the products
covered by the chain of custody.
c) The certification body shall obtain the internal audit report for the site(s) being considered forinclusion in the certificate.
d) The certification body shall review results of the internal audit and determine if additional
information is needed while considering the request of the client organisation.
e) Based on the result of the review in (d), the certification body shall determine if an on-site audit of
the additional site(s) is required or if the review as per (b), (c) and (d) shows sufficient evidence thatthe sites can be added.
f)

If an on-site audit is not required before adding the additional site(s) to the chain of custodycertificate, these new site(s) shall be subject to on-site visit no later than the next scheduled audit.
The certification body may determine whether a sample of the new sites is required based on chapter 4.

Note: For those cases where the standard allows remote audits (see requirement 7.4.6), the on-site audit
can be replaced by a remote audit.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard28

4. Sampling for on-site audits
4.1

Methodology

4.1.1

The certification body can apply sampling of sites for on-site audits where the site sampling isappropriate to gain sufficient confidence in the compliance of the multi-site client organisation
with the chain of custody requirements. The certification body shall be able to demonstrate its
justification for the selection of sites for the on-site audits to ensure that all differences acrossthe sites and implementation of chain of custody have been assessed.

4.1.2

The sample shall be representative concerning differences in site processes and activities that are
subject to the chain of custody certification. The sample shall be determined separately for sites
using different chain of custody methods (physical separation, percentage or credit methods).

Note: “Determined separately” means that the sample is determined after the sites are separated.

4.1.3

The sample shall be determined separately if sites were added between audits and no on-site audit
was required (as per Appendix 3, subclause 3.5.6, paragraph e).

Note 1: “Determined separately” means that the sample is determined after the sites are separated.
Note 2: Subclause 4.1.2 also applies to 4.1.3.

4.1.4

The sample should be partly selective based on the factors set out below and partly non selective,
and should result in a range of different sites being selected, without excluding the random elementof sampling.

4.1.5

At least 25% of the sample should be selected at random.

Note: In the context of risk based auditing, the selection of sites should avoid visiting sites from the previous
sample, unless it is justified by the identified risk. This may lead to sampling where less than 25% of thesample could be selected at random.

4.1.6

Taking into account the criteria mentioned hereafter, the remainder of the sample should beselected so that the differences among the sites selected over the period of validity of thecertificate is as large as possible.

4.1.7

The site selection criteria shall include among others the following aspects:a) results of internal audits or previous certification auditsb) records of complaints and other relevant aspects of corrective and preventive actionc) significant variations in the size of the sites and in production processes of the sitesd) variations in the applied chain of custody methodse) modifications since the last certification auditf)geographical dispersiong) sites added since the last external audit

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard29

4.1.8This selection does not have to be done at the start of the audit process. It can also be done
once the audit at the central office has been completed. In any case, the central office shall be
informed of the sites to be part of the sample. This can be on relatively short notice, but should allow
adequate time for preparation for the audit.

4.1.9

The central office shall be audited during every initial, surveillance and recertification audit as a partof the sample.

4.2

Size of sample

4.2.1

The certification body shall have documented procedures for determining the sample to be taken
when auditing sites as part of the audit and certification of a multi-site client organisation. Thisshould take into account all the factors described in this appendix.

4.2.2

In the event that application of the certification body’s procedure results in a smaller sample thanwould result from the application of the guidance set out below, the certification body shall record
the reasons justifying this and demonstrate that it is operating in accordance with its approved
procedure.

4.2.3

The minimum number of sites to be visited per audit shall be for:a) Initial audits and sites added since the last audit where no on-site audit was required(as per subclause 3.4.5, paragraph e): the square root of the total number of sites, rounded up
to the next whole number:
y= x
y = number of sites to be visitedx = total number of sitesb) Surveillance audits: the square root of the total number of current sites reduced by a factor 0.6,
rounded up to the next whole number:
y=0.6 xy = number of sites to be visitedx = total number of sitesc) Recertification audits: the square root of the number of current sites, rounded up to the next
whole number:
y= x
Where the central office did not receive any major nonconformities over the certification cycle,
the size of the sample could be reduced by a factor 0.8, rounded to the upper whole number:
y=0.8 xy = number of sites to be visitedx = total number of sites
Note: For sites added since the last audit where no on-site audit was required (as per subclause 3.4.5,
paragraph e), the reduction factors shall not be used.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard30

4.2.4The size of sample shall be increased where the certification body’s risk analysis of the activities
covered by the multi-site client organisation subject to certification indicates increased risk due
to factors like:a) size of the sites and number of employeesb) complexity and variations of raw material flow and chain of custody methodsc) variations in the application of chain of custody methods and definitions of the raw material origind) level of risk of procurement of raw material from controversial sourcese) records of complaints and other relevant aspects of corrective and preventive actionf)

any multinational aspectsg) results of internal and external auditsh) the type of multi-site (multi-site or producer group)

4.3

Audit times

4.3.1

The certification body shall be able to demonstrate its justification for the time spent on multi-site
audits in terms of its overall policy for allocation of audit time.

4.3.2

The minimum audit time to spend for each individual site as a part of the initial, surveillance andrecertification audits is the same as for the audit defined in clause 7.4.7. Reductions can beapplied to take into account the clauses of the Chain of Custody standard that are not relevant
to sites and are only examined at the central office.

4.3.3

No reduction is permitted for the central office.

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

31

Appendix 4 (normative): Minimum content of audit reports
Audit reports shall include, as a minimum, the following content:

1. Front page
2. Description of client organisation
3. Description of client organisation’s PEFC chain of custody, including:a) management systemb) parts of the organisation and/or sitesc) processes/activities including outsourcingd) product groups and their products covered by the PEFC chain of custody, including for each site
and/or product group as applicable:i.

chain of custody methodii.

intended application of the PEFC trademarks

4. Scope of the audita) applied certification criteria from ST 2002 and ST 2001, including for each product group and/orsite as applicable:i.

chain of custody methodii.

the PEFC trademarks rulesiii. PEFC Due Diligence System requirementsb) sites visitedc) for remote audits:i.

justification for conducting audit remotelyii.

applied techniques and their justificationd) for multi-site audits:i.

calculation of the sample size according to clause Appendix 3, 3.2.3

ii.

justification of the samplingiii. audited sites

5. Audit findingsa) presentation of findings demonstrating conformity or nonconformity to all the applicable clauses of
the certification requirementsb) issued corrective actions and time frames for reporting of corrective actions and close-outc) evaluation of previously issued corrective actionsd) recommended certification decision

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

32

Bibliography
IAF MD 1, Mandatory Document for the Certification of Multiple Sites Based on Sampling (IAF MD 1)

PEFC ST 2003:2020 — Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody Standard

33

PEFC Council
ICC Building C1
Route de Pré-Bois 20
1215 Geneva 15
Switzerland

t +41 22 799 45 40
f +41 22 799 45 50
e info@pefc.org
www.pefc.org