2000 Powell Street, Ste. 600 Emeryville, CA 94608 USA +1.510.452.8000 main +1.510.452.8001 fax www.scsglobalservices.com SCS FSC Chain-of-Custody Guidance for Certification of Multiple Sites FSC-STD-40-003 V2-1 Table of Contents Introduction... 2 Terms, Definitions, and Abbreviations... 2 I. Central Office Procedures... 3 A. Central Office and Certificate Manager... 3 B. Participation of Eligible Sites... 3 C. Training Plan... 4 D. Central Office Audit Program (Internal Audit Program)... 4 E. Record Keeping... 4 II. Central Office Administration... 5 A. Consent Forms (where applicable)... 5 B. Training Program... 6 C. Trademarks Management... 6 III. Management of Participating Sites... 6 A. Provision of Information and Documents... 6 B. Number and Increase of Participating Sites... 7 C. Requirements for Participating Sites... 8 IV. Central Office Audit Program... 9 A. The Central Office Audit Program (Internal Audit Program)... 9 B. Qualifications of Central Office Auditors (Internal Auditors)... 9 C. Requirements for CAR Issuance by the Central Office... 10 D. Central Office Internal Audit Reporting Requirements and Annual Review... 11 Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 1 of 11
Introduction This guidance covers Chain of Custody (COC) Certification of Multiple Sites, FSC-STD-40-003 V2-1, which replaces the Multi-site Standard V1-0 and the Policy for Group COC Certification (POL-40-002). Version 2-1 of the standard is effective as of January 1, 2015. It covers three types of FSC Chain of Custody multiple site certification: single COC certification with multiple sites, multi-site certification, and group certification. The eligibility conditions for each of these certificate types are found in clauses 1, 2, and 3 of the standard. The audit coordination staff at SCS can also help to determine which certificate is right for your organization. Terms, Definitions, and Abbreviations Central Office (CO): The identified central function (e.g. office, department, person) of a Multi-site or Group COC, that holds ultimate management responsibility for maintaining the certification contract with the certification body, for being responsible for upholding the Chain of Custody system and for ensuring that the requirements of relevant Chain of Custody certification standard(s) are met at the Participating Sites. Central Office s Auditors: Auditors that are selected by the Central Office to conduct initial or annual internal audits of Participating Sites when they are subject to a Central Office Audit Program. Central Office Audit Program: Monitoring of the Participating Sites by the Central Office to verify that all the requirements of certification (including the relevant certification standards and any other requirements of SCS and the Central Office) are fully implemented at the Participating Sites. Common Ownership: Ownership structure where all sites under the scope of the Chain of Custody certificate are owned by the same organization. Ownership means at least 51% of ownership interest over the sites. Certificate Sub-code: A unique COC code assigned to a Participating Site (e.g. SCS-COC-XXXXXX-A) that may be used in sales and delivery documentation to identify a product s origin. Sub-codes may be used at the Central Office s discretion. Corrective Action Request (CAR): The documentation of a nonconformity that was identified at either an internal audit by the Central Office or an audit conducted by SCS, which is presented to the responsible party at the Participating Site level or the Central Office level for redress within the deadline prescribed by the issuer of the CAR. Participating Site (PS): Site included in the scope of a Multi-site or Group COC certificate. Subcontractors that are used within the terms of outsourcing agreements are not considered Participating Sites. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 2 of 11
I. Central Office Procedures Requirement 5.1.2 The Central Office must develop, implement, and maintain documented procedures covering the applicable requirements of the multiple sites standard. This part of the guidance includes specifics of what must be covered in the written procedures. Along with ensuring the sections below are covered, CO written procedures must also cover: a. Procedures for ensuring that only Participating Sites claim their products as FSC-certified and use the FSC trademarks; b. The organization s process for adding/including and removing Participating Sites; c. A description of the measures taken to prevent the mixing of uncertified products from noncertified sites into certified product lines of Participating Sites; d. Description of the training program for staff members at Participating Sites that have responsibilities relating to the implementation of the FSC program; e. Description of procedures and processes for all applicable requirements of the applicable FSC standards, as appropriate for the scale and complexity of the certificate scope. A. Central Office and Certificate Manager Requirements 4.1, 4.2, 5.1.1, and 5.2.1 Every Multi-site or Group organization must designate a particular site, department, or function to be the Central Office (CO). This CO will administer the certificate and ensure the requirements of FSC-STD- 40-003 are met, as well as ensure that the relevant certification requirements for each Participating Site (PS) are met. As part of this responsibility, the CO must be able to demonstrate that it has the necessary technical and human resources to manage the number of PS under the scope of the certificate. The CO must assign a Certificate Manager with legal or management authority and technical support necessary to implement the responsibilities specified in the multiple sites standard and manage the number of Participating Sites. The Certificate Manager must be someone with professional experience, knowledge, and competence to manage the certificate and implement the requirements of the applicable FSC standards at each PS. B. Participation of Eligible Sites Requirement 4.4 An organization is not required to include all of their associated sites on their certificate. A Central Office may also hold or administer more than one Multi-site or Group certificate. In both cases, clear procedures must be written to ensure that only the Participating Sites (sites included in the respective FSC certificate) claim their products as FSC-certified and use the FSC trademarks. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 3 of 11
C. Training Plan Requirements 5.1.3, 5.2.3, and 5.2.4 The Central Office is responsible for establishing training programs for both the CO s auditors (see section D below) as well as the relevant personnel at each PS. The plan for the training program must cover the latest version of all FSC Policies and Standards applicable to the scope of the certificate and any applicable CO procedures. The following personnel must be trained: a. The PS Chain of Custody representative; b. Any staff members at a PS and at the CO that are responsible for ensuring the COC certification requirements are being followed; c. CO auditors (internal auditors) to ensure CO audits (internal audits) are conducted objectively and cover the full scope of the certificate at each PS. For certificates with more than 20 Participating Sites, and where the Participating Sites are not linked through common ownership, the internal auditors must be in possession of a formal ISO 9001, ISO 14001, or OHSAS 18001 lead auditor certificate achieved through a recognized accredited training course. Recognized course certificates include those accepted by auditor registration schemes such as IRCA and RABQSA. D. Central Office Audit Program (Internal Audit Program) Requirements 4.5 and 4.6 All Participating Sites must be included in a Central Office Audit Program (a.k.a., internal audit program) developed and implemented by the CO. The only exception is in cases where SCS audits 100% of PS; only then is the CO exempt from implementing an internal audit program. For all cases where SCS conducts external audits of a sample of PS only (i.e. less than 100% of PS), the CO procedures must include a plan for the internal audit program. For further information on the CO Audit Program, please see Section IV below. E. Record Keeping Requirements 5.1.4 and 5.1.5 The CO is required to maintain up-to-date records of all PS under the scope of the certificate, including: a. A list of all Participating Sites. SCS has a template available to facilitate the creation of a list of Participating Sites, covering the information required in clause (a). Please ask for it if you are interested. The list of PS must include the following: i. Contact information (name, phone number, email address, physical address); ii. Appointed Participating Site s COC representative; iii. Date of entry into the Multi-site or Group COC certificate; Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 4 of 11
iv. Date of withdrawal from the scope of the certificate (if applicable); v. The certificate sub-code assigned; vi. The site activity (e.g. primary processor, secondary processor, trader, printer, retailer); vii. Indication if the PS implements a Controlled Wood verification program, Supplier verification program for reclaimed materials, and/or outsourcing; viii. Indication if the PS has signed a declaration stating that no material has been FSC labeled, sourced as controlled material, or sold as FSC certified or FSC Controlled Wood since the last internal audit. b. Where applicable, the signed consent form or contract of each PS (see Part II below); c. Records demonstrating the scope of COC certification for each Participating Site; d. Records of all internal audits (see Part IV below), including: i. Audit report covering information in clause 5.3.7; ii. Nonconformities identified in such audits; iii. Actions taken to correct them; iv. CO s annual review of its audit program and procedures; e. Records of training provided by, or on behalf of, the CO, and of participation therein; f. A list of the CO s auditors and their qualifications. Note that records must be archived for at least five (5) years and be made available to SCS upon request. II. Central Office Administration A. Consent Forms (where applicable) Requirement 4.3 A consent form or contract is necessary for any Multi-site or Group COC certificate where the Participating Sites are not linked through common ownership. A form or contract must be signed by each PS in the certificate scope and must include the following: a. Acknowledgement and agreement to the general obligations and responsibilities for participation in the Multi-site or Group COC certificate, as stipulated in the 40-003 standard, the certification contract, and the documented procedures of the CO; b. Agreement to conform to all applicable FSC certification requirements and the documented contractual obligations, corrective action requests, and procedures of the CO; c. Authorization of the CO to apply for and administer the FSC Chain of Custody certification on behalf of the PS; d. Acknowledgement of mutual responsibility for the maintenance of the certificate, where nonconformities identified at the level of the PS or the CO may result in corrective action requests, certificate suspension, and/or certificate withdrawal. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 5 of 11
B. Training Program The plan for the training program included in the CO procedures must be implemented and maintained to ensure that all Central Office s auditors (a.k.a., internal auditors) and relevant PS staff are aware of the latest FSC Policies and Standards and are able to meet the requirements. Initial training must be completed prior to the first evaluation audit from SCS, and it must follow the training plan thereafter. Please note: the training plan may be modified at any time, but the CO should take care to ensure that the documented procedures are kept up-to-date to reflect any changes. C. Trademarks Management Requirements in FSC-STD-50-001, Annex 2, Section 1 In addition to the regular trademark requirements found in FSC-STD-40-004 and FSC-STD-50-001, the CO is responsible for enforcing the additional Multi-site and Group certificate holders requirements found in part 1 of FSC-STD-50-001 V1-2, Annex 2. The CO must ensure that all uses of the FSC trademarks (i.e., the initials FSC, the name Forest Stewardship Council, and the FSC checkmark-and-tree logo) by any PS in any application, such as an on-product stamp, a website, on-site poster, or print advertisement, are approved by SCS. Although the Certificate Manager is encouraged to seek the approval on behalf of any PS, alternative arrangements can be made with SCS upon request. At minimum, the CO should have access to all logo approval records. Sub-codes of Participating Sites cannot be added to the FSC trademark license code. For Group COC Certificates, the CO must not produce any document similar to an FSC certificate for the Participating Sites. If individual membership documents are issued, no other forest certification schemes marks or names, like PEFC or SFI, can appear on the document; and both of these statements must be included: a. Managing the FSC certification program of [name of group] b. Group certification by SCS III. Management of Participating Sites A. Provision of Information and Documents Requirement 5.4.1 It is the Central Office s responsibility to: a. Provide each PS with a copy of the FSC Chain of Custody standard (FSC-STD-40-004), the FSC Trademarks standard (FSC-STD-50-001), and any other relevant certification standards (e.g., FSC- STD-40-005, FSC-STD-40-007). All standards are available for download at the FSC website; b. Provide each PS with a copy of the documented (most up-to-date) CO procedures; c. Ensure that all PS representatives understand that SCS and/or SCS s accreditation body, ASI, has the right to access any site covered under the certificate for the purposes of evaluating the Chain of Custody program with or without advanced notice; Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 6 of 11
d. Ensure that all PS representatives understand which information SCS, ASI and/or FSC may collect and publish for public viewing 1, including: PS name and address, contact person, email, phone, certificate sub-code (if applicable), certificate issuance and expiration dates, the standards against which PS is certified, product groups, Controlled Wood Risk Assessments and Controlled Wood Summary Certification Report, where applicable; e. Ensure that all PS representatives understand which obligations must be met in order to participate in the certificate, including which nonconforming actions may result in a site s exclusion from the certificate. This information and documentation may be kept online or on an intra-organizational server in order to ease the administrative burden, as long as it can be viewed at-will from every PS, and produced on request for any auditor at each and every site audit. B. Number and Increase of Participating Sites Requirements 5.5.1 5.5.7 For any Multi-site or Group certificate that maintains an internal audit program, SCS will approve an annual growth rate after each external audit (e.g., evaluation, annual surveillance, expansion of scope). The growth rate, ranging from 0-100%, will be indicated in the audit report, and will be based on SCS s assessment of the ability of the CO to manage the number of PS. The factors considered to determine the growth rate include the number of CARs issued, the past growth rate, the experience and number of qualified auditors, and other risk factors. The annual growth rate is determined at SCS s sole discretion. For those certificates with an approved growth rate, the CO may add a new PS at any time until they reach the annual growth limit. To add a new PS to the certificate, the CO must submit the initial internal audit report for each applicant site to SCS (see Part IV below). New PS are considered certified after the site information is published in the FSC database. If the addition of a PS would exceed the approved growth limit, then SCS must conduct a sample-based audit of all the new sites added since the previous external audit before the new sites which exceed the limit can be added to the certificate. For example: 1 By signing the FSC Trademark License Agreement, the Licensee agrees that FSC Global Development as well as the FSC Network may process and use the name and address as well as email address and telephone number for direct marketing purposes, i.e. to promote the FSC Certification Scheme and FSC AC s mission to promote responsible management of the world s forests. The Licensee may object to this use of the contact data at any time by sending an email to privacy@fsc.org. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 7 of 11
A Multi-site certificate has 30 PS and a growth limit of 30% (~10 additional PS). The CO conducts initial internal audits of 10 new PS and those are added to the certificate, thus reaching the growth limit. The CO then wishes to add 5 more new PS, so the first step is to conduct initial internal audits of those 5 sites. However, at this point SCS is required to conduct a sample-based external Expansion of Scope audit of all 15 new PS (and also audit the CO) before the second group of 5 new sites can be added to the certificate. To remove a PS from the certificate, the CO must notify SCS in writing within three working days of the PS being considered removed by the CO. The PS will then be removed from the FSC database. Multi-site and Group COC certificates without a Central Office Audit Program can only add new Participating Sites to the scope of the certificate after all applicant sites have been audited and approved by SCS. C. Requirements for Participating Sites Requirements 6.1 and 6.2 Although the CO is responsible for ensuring that the standard requirements are met, the PS also have some responsibilities. Each PS must: a. Assign a representative who has authority to ensure that all applicable requirements are met and procedures are followed, and who serves as the contact for the CO; b. Conform to all applicable FSC Chain of Custody requirements; c. Conform to all applicable participation requirements as specified by the CO; d. Respond to all requests from the CO or SCS; e. Inform the CO of all changes that may affect conformance to certification or participation requirements (such as changes in ownership, staff, procedures, or processes); f. Provide full cooperation and assistance with respect to the completion of audits performed by the CO, SCS, or ASI; g. Ensure that all CARs issued by the CO or SCS are addressed within their established timelines. Participating Sites must also include the multi-site or group certificate code on sales and transport documents when invoicing for FSC material. It is optional for a PS to use their assigned sub-code. Details on the assigned sub-code that may be used by each PS will be provided by FSC. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 8 of 11
IV. Central Office Audit Program A. The Central Office Audit Program (Internal Audit Program) Requirements 5.3.1, 5.3.2, 5.3.3, and 5.3.5 The Central Office is responsible for ensuring that all sites included in their certificate meet all relevant Chain of Custody requirements. There are two options for ensuring this: a) SCS can audit 100% of Participating Sites each year; or b) the CO can implement an internal audit program for its PS, and SCS will then audit only a sample of PS with each external audit. This section covers requirements for those certificates which will implement an internal audit program. The Central Office must conduct an audit prior to an applicant site s inclusion as a Participating Site (initial internal audit). In the case of initial evaluation audits, the CO must complete initial internal audits of all PS prior to SCS conducting our external sample-based audit. Central Office audits of each PS must also be conducted at least annually. If a Participating Site also serves as the Central Office, then the operational aspect of that site (e.g. those requirements specified in 40-004) do not need to be included in the internal audit program. However, those operational aspects will be annually audited by SCS. The CO may waive the annual internal audit for any PS under the following conditions: a. The site has already been audited by SCS in the same calendar year; and/or b. The site has submitted a signed declaration to the CO stating that no material has been FSC labeled, sourced as controlled material, or sold as FSC certified or FSC Controlled Wood since the last internal audit. NOTE: The Central Office cannot waive more than two consecutive annual internal audits for any site. The default for internal audits is that they are to be conducted on-site at each PS. However, internal audits may be conducted remotely ( desk audit ) instead of on-site for any PS that is: a. Trading in finished and labelled products (e.g. retailers); b. Trading products without taking physical possession; c. Exclusively handling certified products made of a single input material (e.g. the whole site production is FSC 100%). B. Qualifications of Central Office Auditors (Internal Auditors) Requirement 5.2.2 The Central Office is responsible for ensuring that internal auditors are qualified and have the training and experience required in order to conduct audits of Participating Sites. The following must be considered in the selection of CO auditors: Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 9 of 11
a. The professional experience and ability to evaluate a Participating Site s conformance with the COC standard, and other FSC standards as relevant (e.g., STD-40-005, STD-40-007); b. Fluency in the language used at the site (or accompaniment by a translator); c. Objectivity and impartiality: Auditors may not audit activities for which they are directly responsible to handle or execute or participate in, or for which they have any other conflict of interest. (For example, a person who is responsible for material handling at a facility on a day to day or operational basis cannot audit their facility against the material handling requirements in 40-004). d. For certificates with more than 20 Participating Sites, and where the Participating Sites are not linked through common ownership, the internal auditors must be in possession of a formal ISO 9001, ISO 14001, or OHSAS 18001 lead auditor certificate achieved through a recognized accredited training course. Recognized course certificates include those accepted by auditor registration schemes such as IRCA and RABQSA. C. Requirements for CAR Issuance by the Central Office Requirements 5.3.6 and Annex B The Central Office must have the formal authority to issue Corrective Action Requests (CARs) to Participating Sites. The CO auditor must evaluate a nonconformity to determine if it constitutes a minor or major CAR. The auditor must consider the impact of the nonconformity on the supply chain and the credibility of the FSC system when evaluating it. A nonconformity can be considered minor if: a. It is a temporary lapse; or b. It is unusual/non-systematic; or c. The impacts of the nonconformity are limited in their temporal and organizational scale; and d. It does not result in a fundamental failure to achieve the objective of the relevant requirement. A nonconformity must be considered major if it results in, or is likely to result in, a fundamental failure of the COC system at the Participating Site. Such fundamental failure is indicated by nonconformity(ies) which: a. Continue over a long period of time; b. Are repeated or systematic; or c. Affect a wide range of the production or a large proportion of workers; or d. Are not corrected or adequately addressed by the Participating Sites once it has been identified. The CO may also issue observations to PS. An observation does not in itself constitute a nonconformity, but the auditor has identified a potential problem which may lead to a future nonconformity if not addressed by the PS. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 10 of 11
CAR closure must be implemented within the following timelines: a. Minor CARs one year OR by the next annual Central Office audit (whichever happens first); b. Major CARs three months. Minor CARs that are not closed within the established timelines must be upgraded to major CARs. The decision regarding whether or not a site is eligible to be included or remain in the scope of the certificate must be determined according to the outcomes of Central Office audits. If any of the following occurs, then the site must be immediately removed from the Multi-site or Group COC certificate: a. Major CARs have not been addressed within established timelines; b. Five (5) or more major CARs are issued for a single standard (e.g. 40-004 or 40-005) to a Participating Site during a Central Office audit. NOTE: If Major CARs are issued during the initial audit by the Central Office, then the applicant site cannot be included in the scope of the Multi-site or Group COC Certificate until the Major CARs are closed. D. Central Office Internal Audit Reporting Requirements and Annual Review Requirements 5.3.7 and 5.3.8 The results of the internal audit of each Participating Site must be documented in a report that includes (at a minimum) the following information: a. Participating Site details (sufficient to identify the site); b. Checklist covering all certification requirements applicable to the PS (at a minimum the COC standard FSC-STD-40-004 and the trademark standard FSC-STD-50-001), providing a systematic presentation of findings, and demonstrating conformity or nonconformity to each requirement; c. Status of CARs issued by SCS and the CO, including CARs from both the previous and current audit; d. Verification of FSC material balance for each PS in accordance with the requirements of FSC- STD- 40-004; e. Summary of audit conclusions, including the decision on whether or not the site is eligible to be included or remain in the scope of the certificate. The CO must conduct an annual review of its internal audit program and procedures. This review includes the results of each Participating Site s internal audit in order to address any necessary changes or identified issues. If you have questions or concerns as you prepare for your upcoming SCS audit, please feel free to contact any member of our staff. Version 4-1 (January 2015) SCS Global Services FSC-A000521 Page 11 of 11