Certification process
From application to certificate, in eight stages
The process is the same for every programme. What changes is the standard applied, the depth of verification required by the level sought, and the scope agreed at stage two.
Application
The organisation submits an application stating the certification programme sought, the proposed scope, and basic information about its size, systems and processing activities. No fee is payable at this stage and no commitment arises for either party.
Eligibility and scope review
The Agency reviews the application for eligibility, confirms that the proposed scope is capable of assessment, and checks for any circumstance that would compromise impartiality. Where the scope is unclear or too broad to assess meaningfully, the Agency proposes an amended scope before proceeding.
Preliminary assessment
A documentary review against the applicable EDCA standard, identifying gaps before the formal audit begins. The preliminary assessment is advisory: findings raised here do not count as non-conformities and the organisation is expected to address them before the audit.
Certification audit
The assessment team examines evidence, interviews responsible personnel and performs technical verification of controls within the agreed scope. Findings are classified as major non-conformities, minor non-conformities, or observations, in accordance with EDCA-STD-00.
Corrective action
The organisation submits a corrective action plan addressing each non-conformity, with evidence of implementation. Major non-conformities require verified closure before a certificate may be issued; minor non-conformities may be carried into the surveillance cycle with an agreed deadline.
Certification decision
The decision is taken by the Certification Committee, which is separate from the assessment team and did not participate in the audit. The Committee may grant certification, grant it at a lower level than applied for, defer the decision pending further evidence, or refuse it. Reasons are given in writing and the applicant may appeal within 30 days.
Issue and publication
The certificate is issued with a unique number, the certified scope, the applicable standard version and its period of validity. The entry is published in the public Register of Certified Organisations, where its status can be verified by any third party at any time.
Surveillance and recertification
Continued validity depends on surveillance appropriate to the level held. The organisation must notify the Agency of material changes to its scope, ownership, infrastructure or processing. Certificates may be suspended or withdrawn where requirements are no longer met; any change of status is reflected in the register immediately.
Classification of findings
| Classification | Meaning | Effect |
|---|---|---|
| Major non-conformity | A requirement is not met, or a control is absent, failed or ineffective in a way that materially affects the assessed scope. | Certificate cannot be issued until closed and verified. |
| Minor non-conformity | A requirement is met in substance but with a gap in documentation, consistency or coverage. | May be carried into surveillance with an agreed deadline. |
| Observation | No requirement is breached, but a practice presents avoidable risk or is likely to become a non-conformity. | Recorded and reviewed at the next assessment. |
Suspension and withdrawal
A certificate is suspended where the Agency has reason to believe requirements are no longer met but the position is capable of remedy — for example a failed surveillance assessment, a material unreported change of scope, or a significant unremediated incident. Suspension is recorded in the register with its date and reason, and the organisation must not present the certificate as being in force while suspended.
A certificate is withdrawn where requirements are not met and are not remedied within the period allowed, where the certificate or the certification mark has been used misleadingly, where the assessment was obtained on the basis of false information, or at the request of the holder.
Any change of status appears in the public register immediately. A third party relying on a certificate should verify its status at the time of reliance rather than at the time of issue.
Fees
Fees are fixed before the assessment begins and are set by programme, level and the size of the agreed scope. They are payable irrespective of the outcome: the Agency does not accept payment contingent on a certificate being issued, and no fee is charged for the application itself.
A fee schedule is issued at stage two, once the scope is confirmed. Fees for surveillance assessments are stated in the same schedule so that the full cost of a certification cycle is known before it starts.
Begin the process
Stage one takes about ten minutes and creates no obligation on either side. You will receive an application reference and an acknowledgement within two working days.