IS-QPT-PEFC CoC-01 RINA ASSESSMENT AND CERTIFICATION OF ... · PDF fileRINA ASSESSMENT AND...

RINA

ASSESSMENT AND CERTIFICATION OF THE CHAIN OF CUSTODY OF FOREST BASED

PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 1/54

SUMMARY

1. 1. AIM AND SCOPE .................................................................................................................................. 2

2. 2. FIELD OF APPLICATION ...................................................................................................................... 2

3. REFERENCES .......................................................................................................................................... 2

4. DEFINIZIONI.............................................................................................................................................. 2

5. RULES ..................................................................................................................................................... 43

6. 6. DESCRIPTION OF THE PROCESS AND ACTIVITIES ........................................................................ 4

6.1 FLOW CHART FOR THE CERTIFICATION/RENEWAL AND SURVEILLANCE OF THE CHAIN OF CUSTODY OF FOREST BASED PRODUCTS ............................................................................................. 4

6.2 DESCRIPTION OF THE MAIN PHASES OF THE CERTIFICATION, SURVEILLANCE AND RECERTIFICATION PROCESS .................................................................................................................... 7

7. INVOICING .......................................................................................................................................... 2927

8. CHANGES TO CERTIFICATION ........................................................................................................ 2927

9. KEEPING RECORDS .......................................................................................................................... 2927

10. LETTER NOTIFYING EXPIRY, SUSPENSION OR WITHDRAWAL OF THE CERTIFICATE ....... 3028

11. POSTPONEMENT ........................................................................................................................... 3028

12. CERTIFICATE SUSPENSION AND WITHDRAWAL ...................................................................... 3028

13. ORGANISATIONS WHOSE MANAGEMENT SYSTEM HAS ALREADY BEEN CERTIFIED BY ANOTHER CERTIFICATION BODY ........................................................................................................... 3028

14. MULTI-SITE ORGANISATIONS ...................................................................................................... 3129

15. ANNEXES ........................................................................................................................................ 3129

ANNEX 1 – DEFINITION OF AUDIT TIME ................................................................................................. 3230

1. INTRODUCTION ................................................................................................................................. 3230

2. DEFINITIONS ...................................................................................................................................... 3230

3. APPLICATION ..................................................................................................................................... 3230

ANNEX 2 –MULTI-SITE CERTIFICATION .................................................................................................. 3735

1 GENERAL’ ....................................................................................................................................... 3735

2 APPLICABILITY ............................................................................................................................... 3735

3 AUDIT .............................................................................................................................................. 4038

4 SAMPLING ...................................................................................................................................... 4038

5 CONTRACT REVIEW ...................................................................................................................... 4441

6 ADDITIONAL SITES ........................................................................................................................ 4441

7 TREATMENT OF NON CONFORMITIES FOUND ......................................................................... 4441

8 CERTIFICATES ............................................................................................................................... 4542

ANNEX 3 – CERTIFICATE TRANSFER ..................................................................................................... 4643

ANNEX 4 – DUE DILIGENCE SYSTEM (DDS) PEFC ................................................................................ 4744

Annex 5 – SOCIAL, HEALTH AND SAFETY REQUIREMENTS IN CHAIN OF CUSTODY STANDARDS 5249

ANNEX 6 - USE OF PEFC LOGO ............................................................................................................... 5451

ANNEX 7 – NON CONFORMITYÀ .............................................................................................................. 5451

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 2/54

1. 1. AIM AND SCOPE

This instruction describes how the activities relevant to certification of the Chain of Custody of forest based products are to be carried out and relative maintenance pursuant to compliance with the PEFC ST 2002:2013 and ITA 1003:2 Standards.

This instruction applies to the activities performed by RINA according to what is stated in its Rules.

2. 2. FIELD OF APPLICATION

This instruction applies to all the Operational Units of RINA Services S.p.A. (RINA).

3. REFERENCES

a. PEFC ST 2002:2013 – Chain of Custody of Forest Based Products - Requirements

b. PEFC ST 2001:2008 – PEFC Logo Usage Rules - Requirements

c. PEFC ITA-1003:2010 2 – Requirements for Certification Bodies operating Certification against the PEFC International Chain of Custody StandardAccreditation scheme GFS, GSP and CoC – Minimum requirements

d. ISO / IEC 17065: 2012 – Conformity assessment – Requirements for bodies certifying products, processes and services

e. Rules for the concession and maintenance of chain of custody certification of forest based products (PEFC - CHAIN OF CUSTODY)

f. GP-CCB-IMP-01 – “Safeguard of impartiality in the activities of RINA Group Companies”

g. IS-QPT-PEFC_COC-02 – “Qualification and relative maintenance of the technical personnel for the Chain of Custody certification scheme for forest based products”

h. IS-CAF-CER-01 – “Issuing, suspending, reinstating and withdrawing certificates and attestations of conformity”

i. ISO 19011 – Guidelines for auditing management systems

4. DEFINIZIONI

AC: Corrective action

CEO: Chief Executive Officer

Audit (assessment): systematic, independent and documented process to obtain audit evidence and objectively assess, in order to establish to what extent the audit criteria (set of policies, procedures or requirements) have been met

Auditor for PEFC-COC assessments: technician who has all the requirements indicated on the Auditor

qualification sheet (IS-QPT-PEFC_COC-02).

Certificate of Conformity: document which certifies conformity of the organisation’s chain of custody of

forest based products with the reference standard (PEFC ST 2002:2013 and its annexes)

COD: Planning and operational control

CPI: Corruption Perception Index

CM: Certification Manager (Responsible for the Operative Office)

GVI: Audit team

Technical Expert – ESP-PEFC-COC: technician who has all the requirements indicated on the ESP-PEFC-COC qualification sheet (IS-QPT-PEFC_COC-02)

Formatted: English (U.K.)

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 3/54

ITR: Independent Technical Reviewer, Technician who has all the requirements indicated on the ITR

qualification sheet (IS-QPT-PEFC_CoC-02)

EXTERNAL WORK: Activities performed by individuals or small groups belonging to an organisation at a client’s premises or any other sites indicated by the client, or when engaged in an activity that requires them to move around.

Lead Auditor - Technician who has all the requirements indicated on the Lead Auditor qualification sheet

(IS-QPT-PEFC_CoC-02)

Micro enterprise: organization having fewer than 10 employees and annual turnover or global balance less

than 2 million EUR, or equivalent in the national currency

NC: Non Conformity

OdC: Certification body (RINA Services)

OPN: Operational Network

MULTI-SITE ORGANISATION: Organisation with a well-defined central function (in the following called head office) where certain activities are planned, controlled or managed and a network of local offices or branches (sites) where these activities are entirely or partially carried out.

PVI: Audit plan, activities required to plan and organise audits of an organisation’s Management System of Chain of Custody of forest based products (number and type) and to provide the resources to undertake them effectively and efficiently, by the established deadlines.

PVP: Five-year audit programme, general planning document of the audits to be performed during the

validity of the certificate, prepared by RPC, in conjunction with the Team Leader

QI: Informative questionnaire, document filled in by the client, containing all the information needed to draw

up the offer

QPT: Sustainability, Environment and Climate Change Sector

SCHEME MANAGER: Responsible for managing the specific certification scheme

RPC: File Manager, a technician who has all the requirements foreseen by the qualification table for RPC inside the instruction IS-QPT-PEFC-COC-02. He/she is the responsible of the review of all information obtained, for example, from the informative questionnaire and he/she acts as AR (Application Reviewer) and PR (program Reviewer). He/she has managerial responsibility for the certification files (e.g. analysis of the informative questionnaire, processing of the contract review, GVI assignment) he/she is given and is responsible for implementing the five-year audit programme for the file assigned. During the preliminary start-up of the scheme, offices without an RPC will be assisted by QPT.

RVI: Audit report

SEG: Technical OPN secretariat

Team Leader - TL: Team Leader -– technician who has all the requirements indicated on the Team LeaderLead Auditor qualification sheet (IS-QPT-PEFC_COC-02) and who has been given responsibility for the audit

CERTIFICATION TRANSFER: Recognition of an existing and valid PEFC-COC certificate, issued by an

accredited certification body, with a view to issuing its own certificate (Annex 3)

AZ: Single company (owned or managed) requesting individual certification

CoC: Chain of Custody

PEFC: Programme for the Endorsement of Forest Certification schemes

GR: Organisation requesting group certification

CONTROL OBJECTIVE. The control objective is the reason of the existence of the control, expressed in

simple world;

CONTROL AND RESPONSIBILITY. The control is the activity needed to obtain, with reasonable

confidence, the achievement of a goal.

Formatted: Font: Bold

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 4/54

5. RULES

The activities relevant to the certification process, renewal and surveillance of the chain of custody are indicated in the flow charts in 6.1 below and in tables 1 and 2 respectively in point 6.2.

The certificate is valid for five years. To maintain certificate validity, 4 annual surveillance audits will be carried out.

6. 6. DESCRIPTION OF THE PROCESS AND ACTIVITIES

6.1 FLOW CHART FOR THE CERTIFICATION/RENEWAL AND SURVEILLANCE OF THE CHAIN OF CUSTODY OF FOREST BASED PRODUCTS

The column headings of the flow chart indicate the operational responsibility of the phases shown in each column. Each phase is placed in the right column depending on the responsibility assigned.

Each phase or decision shown on the flow charts is numbered in order to relate the two flow charts to the following tables, giving a detailed description of each phase, showing inputs, outputs, critical factors and relative electronic and/or hard copy records. Flow charts 1 and 2 are to be read in conjunction with point 6.2, respectively Table 1 (first certification/renewal) and Table 2 (surveillance).

Any phases (at the client’s request) not part of the assessment activities

Moving from one phase to another

Decisions are represented by rhombuses. The rhombus divides the original flow into 2 flows; the main one focuses on achieving the final result while the secondary one consists of one or more phases which must be completed before returning to the main flow.

Sequential phases

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 5/54

FLOW CHART N. 1: MAIN PHASES OF THE CERTIFICATION AND RENEWAL PHASES: CONTRACT – ISSUE OF CERTIFICATE

CUSTOMER / ORGANIZATIONOFFICE MANAGER (CU)

SECRETARIAT (SEG) or QPTFILE MANAGER (RPC) OR

QPTAUDIT TEAM (GVI) ITR / QPT Resp.

1-2

DEFINITION AND

PREPARATION

OF THE OFFER

(SEG DRAWN UP)

OFFER

ACCEPTED?

4

CONTROL OF

ORDER/ RPC

APPOINTMENT

7

APPOINTMENT

OF GVI5

OPENING OF

JOB FILE /

SIGNING OF

CONTRACT8

PREPARATION

AND DESPATCH

OF ON-SITE

AUDIT PLAN

9

ON-SITE AUDIT

END

CoC

COMPLIANT ?

15

SIGNING THE

CERTIFICATE

(CEO)

14

PROPOSAL

APPROVED?

16

PUBLICATION OF

THE CERTIFICATE

AND

COMMUNICATION

TO PEFC

START

YES

NO

SENDING IQ

EVENTUAL

PREAUDIT

REQUEST

17

END OF PROCESS

AND DOCUMENTS

CHECKED FOR

COMPLETENESS

3

CONTROL/

SIGNING THE

OFFER

10

ACCEPTANCE

OF AC

PROPOSAL11

CERTIFICATION

PROPOSAL

12

PLANNING AND

PERFORMING

SUPPLEMENTARY

AUDITS

YES

NOCoC COMPLIANT ?

NO

YES

YES NO

END

6

PLANNING

PREAUDIT VISIT

(UPON

REQUEST)

6

PERFORMING

PREAUDIT VISIT

(UPON

REQUEST)

13

APPOINTMENT OF

INDEPENDENT

TECHNICIAN

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 6/54

FLOW CHART N. 2: DESCRIPTION OF THE MAIN SURVEILLANCE PROCESS PHASES

CUSTOMER /

ORGANIZATION

OFFICE MANAGER (CU)

SECRETARIAT (SEG)

or QPT

FILE MANAGER (RPC) or

QPTAUDIT TEAM (GVI) ITR / QPT Resp.

1

OPENING OF

UPCOMING

SURVEILLANCE

PROCESS

3

GVI APPOINTMENT

AND

COMMUNICATION

OF DATE

2

PVP REVIEW

4

ON SITE AUDIT

(SURVEILLANCE)

CoC

COMPLIANT ?

YES

NO

10

DOCUMENTS

CHECKED FOR

COMPLETENESS/

CLOSE PROCESS

5

AC ACCEPTED/

COMMUNICATIO

N OF AUDIT

POSITIVE

OUTCOME

CURRENT

CONTRACTS

9

SUSPENSION

PROPOSAL /

PROPOSAL

APPROVED

NO

YES

6

PLANNING AND

PERFORMING

SUPPLEMENTARY

AUDIT

CoC

COMPLIANT?

7

APPOINTMENT

OF

INDEPENDENT

TECHNICIAN

8

PROPOSAL

APPROVAL BY

INDEPENDENT

TECHNICIAN

RINA

ASSESSMENT AND CERTIFICATION OF THE CHAIN OF CUSTODY OF FOREST BASED PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 7/54

6.2 DESCRIPTION OF THE MAIN PHASES OF THE CERTIFICATION, SURVEILLANCE AND RECERTIFICATION PROCESS

Table 1 - DESCRIPTION OF THE MAIN PHASES OF THE CERTIFICATION AND RECERTIFICATION PROCESS

N. PHASES

DESCRIPTION OF THE ACTIVITY

1 RECEIPT OF REQUEST OF

OFFER AND

INFORMATION FROM THE

ORGANISATION

INPUT Request of offer from an organisation

On receipt of a request for an offer from an Organisation, the pertinent office sends the dedicated form about the Informative Questionnaire (QI) to the Organization and requires it the documented procedures of the Chain of Custody.

A representative authorised by the organisation returns the documented procedures and completed QI (evidence of the person responsible for filling it in can either be the signature on the QI or dispatch via e-mail or other), together with any other additional documentation.

In order to be able to perform the application review and send an offer to the organisation, all mandatory fields in the QI are to be filled in.

For the purpose of application review, also information sent by the organisation via mail can be accepted provided it supplies in full all the elements needed to be able to correctly perform the review..

OUTPUT - Informative Questionnaire (QI) duly filled in

- PEFC-COC documented procedures

12 APPLICATION REVIEW DEFINITION OF OFFER

INPUT - Informative Questionnaire (QI) duly filled in

- PEFC-COC documented proceduresManual

The RPC or QPT performs the following activities:

- verifies that the scope of the certification is consistent with RINA accreditation;

- verifies any issues of the informative questionnaire not filled in or to be clarified with the customer;

- records the data required to prepare the offer in the dedicated in the form “Contract Review””, including all non-documented information received from the client (for examplee.g., information over the phone) in the informative questionnaire or reference to available records (i.e. e-mail, fax, etc.)

- verifies the existence of the necessary resources to carry out checks in proper time;

- make sure to have the skilled resources to carry out the audits, keeping into account the sector of the Organization and the language used by the applicant (if necessary, identifying the need for an interpreter), filling in the dedicated space into the form “Contract Review”;

- verifies if it is necessary carry out the audit at the contractors;

- verifies the annual turnover of Organization for the payment of fee due to PEFC-ITALIA;

- defines the time required to perform the main certification, surveillance and renewal audit, giving his/her reasons, in the field in the “Contract Review” form, for the time adopted, as stated in paragraph 4 of Annex 1 and any reductions or increases;

- calculates the cost of certification and relative maintenance on the basis of the table of fees, taking into account also the actual time needed

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 8/54

N. PHASES


for the service in man/days (see Annex 1)

- verifies if the eligibility criteria for the multi-site client organization (see annex 2) are met, before starting the evaluation process;

- in the case of multi-site organisations or groups, prepares the sampling plan (see Annex 2), (field “notes”Table at the end of the form “Contract Review” to the proper item);

- verifies if it is necessary carry out the audit at the contractors and, if it is applicable, prepares the sampling plan for outsources (field “notes”Table at the end of the form “Contract Review” to the proper item);

- records the data needed to draw up the offer in the “Contract Review” form.

For the purpose of avoiding the use of external, independent personnel, or those working for companies acting on behalf of RINA Services, which have carried out activities classified as risky in the last three years, the RPC must indicate the name of the technician (independent or from a company) appointed to provide advice on the information questionnaire completed by the Organisation and register it in the relevant section of the “Contract Review” form. If the technician providing such advice is a non-exclusive auditor for the OdC, the RPC must not appoint him/her for the audit (see GP-CCB-IMP-01).

RPC prepares and signs the module Contract Review and subsequently he sends it to CM for its signature for acceptance

OUTPUT - Definition of the sampling plan for site and/or outsourcers

- QI filled in by the client (MOD-QPT-PEFC-CoC-01)

- “Contract Review” filled in by OdC

23 DRAWING UP THE OFFER INPUT “Contract Review” filled in by OdC

SEG RPC or QPT, if not yet present, records the data of the potential customer on ANACLI.

SEG o QPT draws up the offer, including the sampling plan (if necessary for multi-site organisations), and the man/days and inserts the FEE due to PEFC ITALIA.

Basic information concerning the organisation means the legal status of the organisation subject to certification (registered name and office) and the operational units (sites) where the activities subject to certification are carried out.

Pay attention to the Production site (if different from the registred office).

The offer is to be prepared in CAI-C, drawn up on a suitable form of the PEFC_COC scheme and filed in CAI-C (is necessary to download from CAI-C and re-upload the offer drawn up on the dedicated form (function “Upload”))

NOTE: Pay attention to the Production site (if different from company headquarters).

OUTPUT Offer drawn up

34 CHECK/SIGN OFFER INPUT Offer drawn up

Formatted: Justified, Right: 0,5 cm

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 9/54

N. PHASES


CM checks and signs the offer.

SEG or QPT sends offer and the dedicated form “Certification Request” to the Organisation.

OUTPUT Offer signed by CU or QPT sent to organisation

45 RECEIPT OF CERTIFICATION REQUEST AND JOB OPENINGCONTROL OF ORDER/ APPOINTMENT OF RPC / QPT

INPUT Client order / Certification request on OdC form

CU examines:

A) the request/order to check it is complete and consistent with the offer sent

B) assigns responsibility for the file to an RPC or to QPT and informs SEG accordingly.

NOTE: In the case of multi-site organisations, the head office signs and sends the certification request on behalf of all the sites/members of the group together with the list of participating sites.

SEG, RPC or QPT records acceptance of the offer in CAI-C, inserting the name of the RPC and prints the document “Confirmation of acceptance” automatically generated by CAI-C or the dedicated form for the PEGC-COC scheme.

CM or RPC checks and signs the “Confirmation of acceptance”.

SEG, RPC or QPT:

- sends the “Confirmation of acceptance” to the client.

- create the storage folder of the Client’s documents on the portal, under the PEFC-Clients section.

NOTE: At the same time, the process for the technical management of the file is started in ASCESI.

OUTPUT Client order / Certification request on OdC form proper filled in and signed by the client “Confirmation of acceptance” form sent to the client

- Opening of contract in CAI-C

- Certification process started in ASCESI

- Archive folder of Client’s documents

- Assignment of the file to RPC

6 PLANNING/PERFORMING PRE- INPUT Request for pre-audit from client

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 10/54

N. PHASES


AUDIT (ON REQUEST) RPC or QPT defines sufficiently in advance (in general at least 3 daysone week before the audit date):

A) audit time to be agreed with the organisation

B) composition of the GVI (REPORT from New Age for auditor qualifications and/or file excel “Qualification_PEFC_CoC”).

The pre-audit is to be performed by a GVI whose members are to be qualified as Auditor, LEAD AUDITORTeam Leader or TEC Technical Expert and at least one member as LEAD AUDITORTeam Leader in the role of TL. The GVI must not be composed by members who have worked for the organization as a consultant for the products covered by the chain of custody in the previous 2 3 years. RPC or GVI sends to the Organisation the dedicated PEFC form “Communication of pre-audit date”, preparedsigned by RPC or TL.

During the pre-audit, the GVI checks that the organisation’s CoC meets the requirements of the reference standard and of the Rules of the OdC for the specific activity requested in the QI and in the certification request. Fills in the dedicated Pre-audit Report, identified by the file number followed by /P, containing any observations on compliance of the system and any other considerations.

RVI has to be signed by TL and countersigned by the client (OdC keeps the original, or its scan, and the client has the photocopy1

GVI or RPC fills in the steps on ASCESI.

NOTE:

- The outcome of the preliminary audit is not to be taken into account for certification purposes.

- The GVI must not be composed by members who have worked for the organization as a consultant for the products covered by the chain of custody in the previous 3 years.

OUTPUT Form “Pre-audit communication”

Pre-audit report

7 ASSIGNMENT OF GVI INPUT - QI

- Contract Review

- Certification process started in ASCESI

- Risk assessment

- List of system procedures implemented

The RPC or QPT receives from SEG the list of system procedures implemented and the risk assessment document (if applicable).

1 The RVI is prepared in word format and filed in the folder on the portal in the PEFC section

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 11/54

N. PHASES


RPC or QPT, On on the basis of the information contained in the QI and in the “contract review” form, he/she establishes the sites to be verified in the case of multi-site organisations or group certification on the basis of the sampling methods described in Annex 2, checks the time required on the basis of Annex 1 and appoints the GVI for the audit.

RPC or QPT:

- defines the members of the GVI and the TL, on the basis of the instruction IS-QPT-PEFC_CoC-02 and on the basis of the qualifications available on NEW-AGE and/or on the file excel “Qualification_PEFC_CoC”;

- fills in the steps on ASCESI.

The GVI must not be composed by members who have worked for the organization as a consultant for the products covered by the chain of custody in the previous 3 years.

RPC assigns and communicates to the designated members of GVI:

- the job of the activities of the eventual documental review,

- the on site visit to the production site,

- to the contractors (where applicable)

with all the information useful for the execution of the auditing activities (e.g. address of the organization, organization contacts, organization activities, products groups object of the certification service, name of the contractors to be audited)

An audit day consists of at least 8 hours, excluding travelling time

OUTPUT GVI defined

8 DOCUMENTAL REVIEW (if applicable)

INPUT - Certification process started in ASCESI

- Q.I

- Documented procedures

L’RPC or QPT:

- receives from SEG the list of system procedures implemented.

- verifies that field of application stated in the manual is in line with Certification Request.

RPC or QPT sends the QI and the documented procedures to the GVI, which determines the compliance of chain of custody documentation with the audit criteria and defines any request of amendments to it and examines the items to be clarified and fills in the form “Comments to documentation”.

GVI or RPC fills in the step on ASCESI Formatted: English (U.K.)

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 12/54

N. PHASES


NOTE: This assessment is to be carried out always on-site or off-site, at TL the discretion

OUTPUT Form “Comments to documentation”

89 PREPARATION AND DISPATCH OF AUDIT PLAN

INPUT GVI defined

The Team Leader or RPC / QPT agrees the date for the on-site audit with the client. They prepare and agree on the audit plan and send it to the organisation together with the names of the GVI at least 5 working days1 week before the on-site audit.

In case of multi-site organization, the audit plan has to report the sites to be sampled.

The organisation may object to the appointment of the GVI giving its reasons within 3 days of the communication of the names.

TL or RPC/QPT fills in the steps on ASCESI.

NOTE: Any changes to the audit plan already sent (change in GVI, audit dates,…) are to be communicated to the client.

OUTPUT - Piano di audit (MOD-QPT-PEFC-CoC-08) - Comunicazione PVI, GVI e data audit on-site all’Organizzazione (MOD-QPT-PEFC-CoC-06)

910 ON-SITE AUDIT INPUT - Audit Plan - GVI and on-site audit date communication - Form “Comments to documentation” - Documenti CoC dell’Organizzazione:

- CoC Manual

- List of procedures

- Operational procedures for the control of the certified raw materials within the organisation and throughout the chain

- Chamber of Commerce registration or equivalent document

- CoC organisation chart-

- Site(s) plan

- Last management review

- Planning of internal audits

- Report of internal audit(s) carried out

The GVI shall conduct the initial audit of a chain of custody following the relevant guidance provided in ISO 19011.

The designated GVI checks:

- the taking charge of any findings issued from documental assessmentthe manual, defines any requests for amendments to it and examines the items to be clarified. The GVI checks that the operational procedures drawn up by the organisation to control the Chain of Custody (i.e. procedure to control the flow of certified raw materials throughout the organisation’s production process/activities)

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 13/54

N. PHASES


- the conformity of the organisation’s chain of custody process with the requirements of the chain of custody standard and the relevant Appendix with the definition of the raw material origin and its effective implementation,

- the conformity of the organisation’s management system with the requirement of the chain of custody standardand its effective implementation,

- the conformity of the organization’s chain of custody process with requirements for the avoidance of raw material from controversial sources where applicable and its effective implementation,

- the conformity of the organization with the PEFC logo usage rules and its effective implementation.

- identification of the personnel whose work has an effect on the implementation and maintenance of the CoC with the indication of the responsibilities and authority concerning the CoC, and

- that the remaining documentation (invoices, delivery notes..) comply with the requirements of the standard and with the OdC rules for the specific activity requested in the QI and in the certification request.

GVI identifies areas for potential improvement of the organization’s chain of custody.

The auditor is also required to check compliance with the social, health and safety requirements contained in Chapter 9 of PEFC ST 2002:2013 (see Annex 5 of this instruction).

In the case of procurement of materials from controversial sources, the auditor is required to verify what is stated in Chapter 5 of PEFC ST 2002:2013 (see Annex 4 of this instruction).

In the case of multi-site organisations, the auditor verifies compliance with the requirements as per Annex 2 of this instruction for the head office and the sites subject to sampling.

From an examination of the documentation and processes/products, the status and understanding of the client as regards the requirements of the standard must be evident, with particular reference to the identification of key performance for the proper functioning and subsequent maintenance of the CoC.

In particular, from the “Management Review”, the following is checked:

- whether the internal audits have been carried out and any NC which have emerged and their management;

- whether training for the reference personnel for the CoC has been undertaken.

Examination of the site plan enables an assessment to be made of the processes and products to be seen related to the CoC.

GVI checks that the organisation’s CoC meets the requirements of the standard and of the OdC rules for the specific products requested in the QI and in the certification request.

The dedicated checklist for the PEFC scheme is to be filled in for the on-site audit.

Audit findings shall be classified as major nonconformities, minor nonconformities and observations.

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 14/54

N. PHASES


At the end of the on-site audit an audit report containing any major NC, minor NC and/or observations is presented to the client.

The audit report is provided to the customer and signed by both parties. The original, or the scan, is kept by RINA and the customer is

provided with a copy 2.

The following documents must be annexed to the Report:

- any registration/supporting document for non-conformity ascertained where there could be interpretation or comprehension issues regarding the information acquired.

- Report form (in the case of any critical issues reporting).

The initial audit and re-certification audits shall be conducted on-site. NOTE: Reaffirm that if there are critical observationsNCs, the audit is to be re-programmed and postponed to another date (supplementary audit).

MAJOR AND MINOR NONCONFORMITIES SHALL BE CORRECTED AND THE CORRECTIVE ACTION(S) VERIFIED BY RINA BEFORE GRANTING A CERTIFICATION AND RECERTIFICATION. TL, with the support of RPC, fills in the steps on ASCESI

OUTPUT Audit report Check list Other evidences, if necessary) Compilation corresponding step on Ascesi

1011 ACCEPTANCE OF AC PROPOSALS

INPUT Treatment, analysis of causes, AC proposals and implementation time

For major or minor NCs issued during the audit, the Client has to propose within 10 days the analysis of causes, the treatments, the AC and the implementation time for the NCs resolution. TL is responsible for the proposed analysis cause, treatment, AC and implementation time.

The Team Leader checks the adequacy of the treatment, of the analysis of the causes, of the corrective actions and implementation time proposed by the client. If the outcome of the check is positive, the Team Leader confirms acceptance in writing.

In case of differing opinions between the TL and the Organization subject of audit, the TL informs in advance the Scheme Manager.

NOTE: Major and minor nonconformities shall be corrected and the corrective action(s) verified by RINA before granting a certification and recertification.

Corrective action(s) for all nonconformities identified is/are verified by GVI by on-site audit or through documentary off site evaluation.

If the organisation does not send the AC proposals by the agreed date, 10 days after this date, the RPC sends a written reminder to the

2 The RVI is completed in word format and filed in the folder on the portal in the PEFC section.

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 15/54

N. PHASES


organisation stating that if they are not sent and following a further 5 working days, the RPC will draw up a suspension proposal (IS-CAF-CER-01).

OUTPUT Treatment, analysis of causes, AC proposals and implementation time accepted

12 PLANNING / CARRYING OUT SUPPLEMENTARY AUDIT

INPUT - RVI (Outcome CoC not compliant)

- Treatment, analysis of causes, , AC proposals and implementation time accepted

SEG, RPC or QPT opens the process on ASCESI.

The RPC or QPT defines (at least 1 week before the audit date):

A) date of audit

B) members of the GVI.

RPC/QPT or TL sends to Organization the “Communication need for supplementary audit”.

The GVI is to include at least one member who performed the previous audit, chosen in relation to the type of findings which made a supplementary audit necessary and who is qualified as LEAD AUDITORTeam Leader.

The extent of the supplementary audit is assessed by RPC in conjunction with the Team Leader depending on the case, based on the number and type of NC (type “A” findings) or observations (type “B" findings) identified.

a) If there are few non-conformities and they are precise, only the implementation of suitable AC will be checked (within 3 months of the audit which necessitated the supplementary audit)

b) If there are a lot of non-conformities/observations (>5) and/or the CoC overall appears inadequate, an audit will be performed on all the requirements/processes of the standard (within 3 months of the audit which necessitated the supplementary audit). It is possible that in this case a) the verification may be simply documental At the end of the audit, on-site o off-site, an audit report is filled in identified by the file number and followed by /S.

In case of on-site audit, the RVI is signed by both sides. The original report, or its scan, belongs to RINA3 and the copy goes to the client.

In case of off-site audit, the RVI is sent to the Organization for their signature.

RVI is stored into the folder on RINA portal, in the PEFC section.

TL or RPC/QPT fills in the step on ASCESI.

OUTPUT - Process opened on Ascesi

- Findings forms of the previous RVI with evidence that the NC /Observations

- RVI countersigned by the client (identified by the file number and followed by /S) 4



Formatted: English (U.S.)

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 16/54

N. PHASES


1113 CERTIFICATION PROPOSAL INPUT RVI (COC compliant)

Checklist

Treatment, analysis of causes, , AC proposals and implementation time accepted

The RPC / QPT, assisted by SEG, prepares the documentation to be sent to the ITR and signs the certification proposal.

The PVP is drawn up in conjunction with the Team Leader. RPC/QPT or SEG or TL fills in the step on ASCESI “Five-year audit programme-PVP”.

The date of the first surveillance audit after the initial audit corresponds to the date proposed by the GVI on the last page of the certification RVI which will subsequently be accepted by the ITR and is not to be fixed more than 12 months after the end of the initial audit

In any case, the PVP must include at least one verification every 12 months, according to a programme which enables every point of the reference standard to always be checked during the five-year validity of the certificate.

It is recommended that audits be programmed at 10 9 – 24 21 – 34 33 – 46 45 - 57 months, in order to meet the mandatory deadlines; for contracts which establish six-monthly audits, program the audits at 6-12-18-24-30-36-42-48-51 months.

The planning of the renewal must be foreseen in advance of 3 months respect on the date of the audit of the first certification.

RPC / QPT prepares the certification proposal, using the dedicated form.

OUTPUT - Document “Certification process or certification/extension proposal”

- PVP

1314 APPOINTMENT OF INDEPENDENT TECHNICIAN

INPUT - RVI (PEFC CoC Compliant)

- Check list

- Comments to the documental review)

- Certification / renewal proposal (procedure)

- QI

- Client Request

- Contract Review

- Supplementary audit report (where applicable)

- PVP

- Audit Plant

- Extract from the organisation’s manual with mapping of the processes/products subject to the CoC, CoC scope –

- Organisation chart

- List of supplier

- List of contractor


RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 17/54

N. PHASES


RPC or QPT appoints the independent technician/s (ITR) who shall carry out the review of the audit conducted on the basis of the documentation provided and fills in the step on ASCESI “Appointment of ITR”

Whether an individual or a group, the ITR in his whole must cover the following competences:

Qualification of PEFC-CoC Team Leader PEFC-COCLead Auditor,

Internal RINA,

Impartial and don’t have any conflict of interest neither financial neither commercial and be qualified for the sector of the organisation.

RPC sends the ITR the following technical documentation:

- RVI

- Check list

- Comments to the documental review

- Certification/renewal proposal (procedure)


- PVP

- QI

- Client Request

- Contract Review

- Audit plan

- Extract from the organisation’s manual with mapping of the processes/products subject to the CoC, CoC scope


- List of supplier



OUTPUT Appointment of ITR, also on ASCESI

1415 APPROVAL OF CERTIFICATION PROPOSAL BY ITR

INPUT - RVI

- Check list



RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 18/54

N. PHASES



- PVP

- QI

- Client Request

- Contract review

- Audit plan

- - Extract from the organisation’s manual with mapping of the processes/products subject to the CoC, CoC scope


- List of supplier


- Report form (in the case of any critical issues reporting)

The ITR checks the following documentation:

- RVI

- Check list




- PVP

- QI

- Client Request

- Contract review

- Audit Plan

- Extract from the organisation’s manual with mapping of the processes/products subject to the CoC, CoC scope


- List of supplier


- Form (in the case of any critical issues reporting).

The ITR checks the proposal for certification and issues an evaluation document (dedicated ITR form of PEFC scheme) for the relevant job

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 19/54

N. PHASES


with a judgement of approval or request of clarifications, integrations of documents.

Said document is acquired by RPC which provides (in case RPC is not the same person of TL) for acknowledging the Scheme Manager about the results of independent technical evaluation

In case there are requests of clarifications and/or integrations of documents, RPC sends the ITR document to TL that provides to fill in the proper field of the ITR document, giving answers to the requests issued.

ITR acquires its document with the TL’s answers and verifies if the answers given are acceptable and fill in the proper field as evidence of closure of the comments issued and finally approved and signed the document.

The ITR approves and signs the certification proposal (ITER) reporting “positive” in the field “decision”.

In respect of the positive certification decision, the SM assigns the certificate number to the Organization , through ASCESI (CERTIFY). (Certificate number assigned on the date the ITR approves the proposal).

In respect of the positive certification decision, the Scheme Manager assigns the certificate number to the Organization, allocated through ASCESI (CERTIFY). (Certificate number assigned on the date in which the ITR approves the proposal

The auditors qualified as Team Leader fo PEFC-CoC are qualified as independent technical reviewers.

Should the ITR decide to make changes to the RVI issued by the Team Leader to the organisation, as for example a different classification of a finding or the need for an audit before the due date, the organisation is to be informed.

SEG/QPT prints the “communication of certification/validation” from ASCESI and sends it to the client.

In case of eventual decision of do not issue the certificate, the Organization has to be notified about it, reporting the corresponding reasons.

OUTPUT - ITR form filled in

-“Certification / extension proposal” document stamped and signed as approved by the ITR - Certification/extension proposal” document stamped and signed as approved by the ITR

- Communication of certification to the client

- Process in “Certify process” on ASCESI

1516 CERTIFICATE SIGNATURE INPUT - Process in “Certify process”” on ASCESI

- Certificate printed

RPC prepares the certificate using the dedicated form of PEFC scheme.

The printed certificate has to report the expiry date 60 months from the date of approval of the proposal.

The Scheme Manager checks the text of the certificate.

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 20/54

N. PHASES


A Following the positive outcome of the check, the QPT Responsible signs the certificate electronically. Electronic signature through ASCESI (SIGNATURE).

NOTE: It is not possible to issue certificates without the ACCREDIA logo for an EA sector for which the OdC has been accredited by ACCREDIA.

OUTPUT Certificate signed by QPT Responsible

1617 PUBLICATION OF THE CERTIFICATE AND COMMUNICATION TO PEFC-ITALIA

INPUT Certificate signed by QPT Responsible

If the payment conditions are met, ASCESI automatically makes the certificate available in the client’s “member area“ and a copy is published on the RINA internet site for the public.

SEG/QPT prints from ASCESI the “communication of publication of certificate/validation and PVP in the member area” and sends it to the client.

NOTE: The certificate of compliance and the PVP are made available to the client through the “member area” reserved for the latter on the OdC portal.

If requested by the client, SEG/QPT prints the certificate and sends it to the client.

PEFC-ITALIA is informed that an organisation has been certified through transmission of the identification data related to it and to the pertinent certificate.

Together with the identification data of the certificate, the organisation also receives the documentation issued by PEFC-ITALIA so as to be able to request use of the PEFC logo.

Process closed.

OUTPUT “Communication of publication of certificate/validation and PVP in the member area” from ASCESI”

A copy of the certificate is made available to the public through the OdC site

1718 CHECK DOCUMENTATION IS COMPLETE

INPUT File documents

Check documentation is complete and if not, complete it (on the basis of QUASQA2).

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 21/54

N. PHASES


Check that all the steps in ASCESI have been completed (Completed).

OUTPUT Process closed

NOTES FOR RECERTIFICATION:

The phases in table 1 also apply to the recertification process.

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 22/54

Table 2 - DESCRIPTION OF THE MAIN PHASES OF THE SURVEILLANCE PROCESS

N. PHASES


1 START OF PROCESS FOR UPCOMING SURVEILLANCE

INPUT PVP

L’RPC or QPT:

- starts the process in ASCESI for the upcoming surveillance audit;

- sends the simplified QI to the ’Organization, using the dedicated form of the PEFC_COC scheme to require the information confirm. (Organisation has to send to RINA the informative questionnaire filled in only in the case of changes to previously declared).

The audits are to be carried out by the date indicated in the PVP or in any case, a surveillance audit is to be performed during the solar year and with the procedures defined during the contract review.

When planning a surveillance audit, it is necessary to check whether the PVP needs updating on the basis of the problems which occurred during previous audits; in such a case, a note is to be added related to the revision in ASCESI (process notes field).

NOTE: Postponement of a surveillance audit does not alter the dates of subsequent audits.

OUTPUT Process started in ASCESI

2 VERIFICATION OF PVP AND ORGANIZATION DATA

INPUT PVP

Simplified QI filled in by the Organization (in case of changes to previously declared).

When planning a surveillance audit, RPC or QPT, in conjunction with the Team Leader:

- checks the expiry date of the certificate in order to be able to inform QPT of any anomalies and asks the simplified QI (MOD-QPT-PEFC_CoC-21) to be filled in again relevant to the amended items;

- confirms the data of the Organization on the basis of simplified IQ (if it is not possible to confirm the data it is necessary to proceed with a new revision of the contract review)

- records the outcome in the pertinent field in the “CONTRACT REVIEW” form

Organisation has to send to RINA the informative questionnaire filled in only in the case of changes to previously declared

If products are added to the certification scope, it will have to be assessed whether it’s necessary to review the previously made offer.

The RPC or QPT shall evaluate whether to carried out the annual on-site surveillance audit at the Organisation’s premises or replace it with other audit techniques, such as documentation and records review.

This replacement can take place if:

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 23/54

N. PHASES


a) RINA can demonstrate that audit techniques used deliver sufficient confidence in the certified entity’s compliance with the certification criteria,

b) The Organisation is a micro enterprise, c) No nonconformities was raised during the previous initial, surveillance or re-certification audit, d) The Organisation procurement does not include high risk supplies, and e) The organisation provides to RINA with all the individual records required to be kept by the chain of custody standard or a list of

all the records which allow the certification body to establish an independent sampling.

The on-site surveillance can also be avoided and replaced by other audit technique where the submitted records provide sufficient evidence that the Organisation has not procured and has not made claims on certified raw material since the last certification, surveillance or re-certification audit.

The outcomes of documental assessment are reported on audit report using the form of audit report in which will be highlighted if it is documental assessment (/ D) or on the production site.

The period between the on-site surveillance audits shall not exceed two (2) years

OUTPUT - PVP checked

- Contract Review updated (if applicable)

- Offer revised (if applicable)

3 ASSIGNMENT OF GVI AND COMMUNICATION OF AUDIT DATE

INPUT - PVP

- RVI and checklist previous audit

RPC or QPT performs the following activities:

- checks the audit time in the PVP

- establishes the members of the GVI and the Team LeaderLEAD AUDITOR.

The RPC or QPT must establish a suitable GVI for the audit (see REPORT in New Age for auditor qualifications and/or the excel file

“Qualification_PEFC_CoC”)5

See step 7 Table 1. With regard to the audit, the following conditions are to be met:

RPC or QPT sends to GVI the PVP, the audit report of previous audit and, if necessary, the checklist.

- the members of the GVI must be qualified as Auditor or LEAD AUDITOR or TEC and one member must be qualified as LEAD AUDITOR in the role of TEAM LEADER

- the members of the GVI must not have been involved in the provision of consultancy services to the organisation for at least the previous 2 years; the RPC or QPT must show that this aspect has been checked by ticking the pertinent box in Ascesi “Is the audit team competent in

5 To safeguard the independence of the audit, every auditor qualified as TECTechnical Expert/Q/LEAD AUDITORTeam Leader, is required to inform the RPC of any relationship he/she has or has had in

the last three years with the organisation to be audited, before taking on this activity relevant to the organisation in question.

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 24/54

N. PHASES


relation to the company's activities and impartial as regards carrying out the audit?”

RPC or QPT informs the assignment of the members of the GVI

TL of GVI, accordingly with RPC or QPT:

- agrees on the audit date with the client

- checks the sites to be verified on the basis of the PVP

- prepares and sends to the client the communication “Dispatch of surveillance audit plan”name of GVI and the audit plan at least 1 week before the audit on-site. (the organisation may object to the GVI). The organisation may object to the appointment of the GVI giving its reasons within 3 days of the communication of the names

TL or RPC/QPT fills in the step on ASCESI.

NOTE: Any changes to the audit plan already sent (GVI variation, audit dates, ...) must be communicate to the Client

In particular personnel that performed consultancy activities for the chain of custody system of the Organization within the 3 previous years cannot be involved in the audit activities

OUTPUT - Assignment of GVI - PVI - Communication of PVI, GVI and audit data to the Organization.

4 SURVEILLANCE AUDIT INPUT -Communication “Dispatch surveillance audit plan” -PVP - RVI of previous audit

The GVI checks that the client’s CoC complies with the requirements of the reference standard and with the OdC Rules for the specific certified activity.

The audit is carried out for the items established in the PVP, with possible extension to other areas should it be necessary (for example a specific complaint from an interested party, activity extension, etc. …).

The following are always to be assessed:

- the conformity of the organisation’s chain of custody process with the requirements of the chain of custody standard and the relevant Appendix with the definition of the raw material origin and its effective implementation,

- the conformity of the organisation’s management system with the requirement of the chain of custody standardand its effective implementation,

- the conformity of the organization’s chain of custody process with requirements for the avoidance of raw material from controversial sources where applicable and its effective implementation,

- the conformity of the organization with the PEFC logo usage rules and its effective implementation.

- the internal audits and management review

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 25/54

N. PHASES


- any amendments to the CoC documents (manual, procedures…)

- treatment of any complaints, both those received from clients and those received by the OdC, recorded in the “Claims Certification" database in Lotus

- effectiveness of the CoC (delivery notes, invoices …);

- the AC taken following the NC found during the previous audit

- any preventive action taken following the recommendations made during the previous audit;

-use of the OdC and CoC logos

- advertising of the CoC and of the products supplied by the organisation, also by checking its internet site.

The auditor is also required to check compliance with the social, health and safety requirements contained in Chapter 9 of PECF ST 2002:2013 (see Annex 5 of this instruction).

In the case of procurement of materials from controversial sources, the auditor is required to verify what is stated in Chapter 5 of PEFC ST 2002:2013 (see Annex 4 of this instruction).

In the case of multi-site organisations, the auditor verifies compliance with the requirements as per Annex 2 of this instruction for the head office and the sites subject to sampling.

In case during the on-site audit there would be the need of certificate scope reduction (e.g. reduction of the product groups) the TL reports this information in the field “REMARKS AND SUPPLEMENTARY NOTES” at the end of the audit report and communicate it to the RPC. RPC prepares the certification proposal with the reduction of the certificate scope together with the other documents to be sent to ITR,

In case of minor NC issued during the previous audit, the TL records the evidence of implementation of corrective action indicated in the findings form of the previous RVI together with the AC proposal, giving a brief description for each finding of the evidence found, the outcome of the audit and the audit date.

The outcomes of documental assessment are reported on audit report using the form of audit report in which will be highlighted if it is documental assessment (/ D) or on the production site.

Audit findings shall be classified as major nonconformities, minor nonconformities and observations.

TL or RPC fills in the steps on ASCESI

NOTE: The period between the on-site surveillance audits shall not exceed two years

OUTPUT RVI “Surveillance audit”

Checklist

Other evidences (if necessary)

Findings form of the previous RVI (if applicable)

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 26/54

N. PHASES


5 APPROVAL OF CORRECTIVE ACTION (in the case of NC)

INPUT Treatment, analysis of causes, AC proposals and implementation time

The team leader checks the adequacy of the treatment, analysis of causes, corrective actions and of the implementation time proposed by the client. If the outcome of the check is positive, the team leader confirms acceptance in writing

If necessary, together with acceptance of the AC proposals, also a new PVP can be sent.

The time period for completion of the corrective action(s) for major nonconformities identified in surveillance audits and their verification but not exceed 3 months.

Corrective action(s) for minor nonconformities shall be verified no later than during the next audit.

Corrective action(s) for all nonconformities identified in the audit shall be verified by GVI by on-site visit or through a documental evaluation.

NOTE: If the organisation does not send the AC proposals by the agreed date, 10 days after this date, the RPC sends a written reminder to the organisation stating that if they are not sent and following a further 5 working days, the RPC will draw up a suspension proposal (IS-CAF-CER-01).

RPC/QPT or TL fills in the step on ASCESI

OUTPUT Treatment, analysis of causes, AC proposals and implementation time accepted

6 PLANNING/ CARRYING OUT SUPPLEMENTARY AUDIT

INPUT - RVI (Audit outcome: CoC not compliant)

- Treatment, analysis of causes, AC proposals and implementation time acceptedsee phase 12 Table 1

See phase 13 12 Table 16

The organisation is to inform RINA of any changes to or need to extend the scope of its certificate. Supplementary verifications can be documental or necessitate an on-site audit. On-site supplementary audits can be performed in the following cases:

- verification of the implementation of corrective action related to major NC, within 3 months of the date when the NC were issued;

- reduction for the scope of the certificate (reduction of product groups and/or standards applied);

- pre-audit request to assess whether the organisation is ready for the certification audit;

- any communications received by RINA concerning a certified organisation’s non compliance with one or more requirements of the PEFC standard for Chain of Custody.

6 Should the outcome of the supplementary audit be negative when the client is already certified, it is necessary to suspend the certificate (see phase 7 9 table 2).

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 27/54

N. PHASES


If the surveillance audit is upcoming, any extension/modification requests to the certificate can be performed during this audit.

If the audit outcome is positive, RINA will amend the scope of the previously issued certificate and ask the organisation to eliminate all copies of the previous certificate in its possession and will issue a new certificate.

In particular in case is a change that involves the change of the application field of the certification (e.g. new product groups or reduction of the product groups), with the consequent need to re-issue the certificate, a new certification proposal shall be prepared and approved by ITR.

NOTE: In the case of a request to extend the certification scope to new sites for group or multi-site certification, or new products subject to certification, it must be assessed whether the activity can be managed as a supplementary audit or must be managed as a new certification (see chapter 6 “Modification of certification”).

A change of scope can only be made if it does not involve extending the expiry date of the certificate beyond the date for which it was originally issued.

In particular, for each change for which RINA requires a supplementary audit, the organisation cannot issue any certificate concerning certified products derived from this change until RINA informs the organisation that it may.

OUTPUT - Findings form of previous audit with the evidence of the implementation of the NC/Observatios

- RVI countersigned by the Client (identified by the file number and followed by /S See Phase 13 Table 1

7 APPOINTMENT OF INDEPENDENT TECHNICIAN

INPUT - Supplementary /surveillance RVI;

- Certification proposal, (if applicable);

- Check lists;

- Audit plan

Both supplementary audits and surveillance audits pass through ITR.

RPC or QPT defines a person who can perform the ITR according to the requirements needed (see Table 1, phase 13 14 above)

RPC sends to ITR the following technical documentation:

- Supplementary /surveillance RVI; - Check lists; - Audit plan

Certification proposal (just in case of need of re-issue of the certificate cause of change of application field)

The competency and the independence between the persons who examine the file and who took part in the audit process must always be ensured (see above)

OUTPUT Appointment of ITR and his assignment on ASCESI See table 1 phase 13

8 PROPOSAL APPROVAL BY INDEPENDENT TECHNICIAN

INPUT Documentation for ITR

The ITR checks the documentation at the previous point and issues an evaluation document for the relevant job with a judgement of approval

RINA


IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 28/54

N. PHASES


or request of clarifications, integrations of documents.

Said document is acquired by RPC which provides (in case RPC is not the same person of TL) for acknowledging the TL , in case of requests of modifications and/or explanations about the results of independent technical evaluation. In case there are requests of clarifications and/or integrations of documents, TL provides them and/or send the requests to the Organization which will have to give adequate answer to positively conclude the surveillance process. On the other way round, in case of ITR approval, RPC closed the surveillance process If the ITR decides to make variations to the RVI issued by TL to the Organization, such as a change in the classification of a finding or the need for an audit before the planned date, or other substantial modifications, the Organisation must be informed accordingly.

In case of the change in the application field of the certification (e.g. extension or reduction of the scope certificate, change or new product group) for which is needed the re-issue of the certificate, ITR signs the certification proposal reporting his judgment. The Scheme Responsible acquires the ITR documentation (check list of the Independent technical reviewer and certification proposal) and in case of positive outcome, prepares and issues the revised certificate as foreseen in phase 15 and 16 of table 1.

In any case it is sent to the organization the communication about the outcome of the certification activity.

OUTPUT - ITR form filled in

- Communication to the client about the certification maintenance

- Communication to the organization (only in case of requests of modify from the technical independent review at RVI)

- Eventual certificate proposal signed by ITR

- Eventual certificate re-issue

- Communication reported inside phase 15 and 16 of table 1

9 SUSPENSIONPROPOSAL/APPROVAL OF PROPOSAL

INPUT Supplementary RVI (CoC NON COMPLIANT)

In the case of suspension for technical reasons, the RPC or QPT prepares and sends the suspension proposal, signed by the CU to the ITR, specifying the reason and attaching the supplementary RVI non-compliant. The ITR establishes a maximum suspension date in accordance with what is stated in IS-CAF-CER-01..

RPC or QPT proceeds with the suspension of the certificate in ASCESI and relative communications.

OUTPUT Suspension proposal signed by the CU and ITR

Certificate suspended

10 CHECK DOCUMENTATION IS COMPLETE/CLOSE PROCESS

INPUT File documents

Check documentation is complete and if not, complete it (on the basis of QUASQA2).

Check that all the steps in ASCESI have been completed (Completed).

Close process.

OUTPUT Process closed

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 29/54

7. INVOICING

Invoicing is done in relation to the type of contract, at different stages of the certification process, by the administrative secretariat of the office, using the software programme CAI-C.

8. CHANGES TO CERTIFICATION

A client who asks for his/her certificate to be changed (for example, an amendment to the certificate scope, extension to another site(s)/product(s), change in the operational office, etc.) is to fill in and send the informative questionnaire to the OdC and the RPC or QPT will assess the situation on a case by case basis.

The RPC or QPT can treat the request as if it were certification or decide to check the change during a supplementary audit or during the surveillance audit.

If the change to certification involves the addition of new production sites and/or new certified products, the OdC will assess whether to perform an on-site audit with consequent recalculation of the number of man/days needed. In this case, the situation will have to be dealt with as a new certification (new offer, document check, on-site audit, proposal to extend certification).

In particular for additional production sites, the sampling procedure will be applied with the formula foreseen in the case of first certification.

In all other cases of amendment to the certificate which do not come within the above cases, the following is to be taken into account.

CASE A

If the change requested involves amending the man/days for the audit, the situation is to be managed as new certification (new offer, document check, on-site audit, proposal to extend certification).

CASE B

If the change requested doest NOT involve amending the man/days for the audit, the change to certification can be checked during an extra audit or during the surveillance audit. In this case, as well as the points foreseen in the periodic audit plan, also the other activities and products are examined, to which the organisation’s CoC applies, which are affected by the changes due to variations in the CoC. In relation to CASE B, if the change involves an extension to the scope, the file is to be examined by the ITR and the change filed in the file.

As regards audit time, reference is to be made to Annex 1.

In both cases, a new certificate will be issued.

In case B, to keep track of the change, the RPC, assisted by SEG, makes all the necessary changes in ASCESI, adding a note to ASCESI containing the author of the change, the type of change made, the date and reasons

7 and asks to have the new version of the document signed by the CEO, explaining the reasons

for the change.

9. KEEPING RECORDS

The records, on paper and computerised, relevant to certified organisations, are kept by OPN as follows:

o The records relevant to the activities carried out during the current five-year period as well as during the previous five-year period are to be kept in the audit files,

7 If this change involves more than one organisation, the note in ASCESI is to apply to all the organisations involved

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 30/54

o A copy of the certificates issued is to be kept forever,

o The outcome of the independent technical review is kept for at least 10 years.

10. LETTER NOTIFYING EXPIRY, SUSPENSION OR WITHDRAWAL OF THE CERTIFICATE

A notification letter is to be prepared and sent by the OU or by QPT to organisations whose certificate is due to expire or for which the suspension procedure is to be activated or whose certificate is to be withdrawn.

This letter is to be prepared, personalising the format expiry/suspension/withdrawal (IS-CAF-CER-01).

All notification letters sent to organisations are to be kept together with the pertinent written acknowledgement of receipt and awareness of the situation received from the organisations in reply.

11. POSTPONEMENT

Postponements are not permitted..

12. CERTIFICATE SUSPENSION AND WITHDRAWAL

Following issue of the certificate and during the certification maintenance period, RINA can suspend the organisation’s certificate:

1. if the organisation incorrectly or misleadingly uses or advertises the certification obtained;

2. if the organisation objects to or hinders the carrying out of the audit activities;

3. when the organisation doesn’t comply with the financial commitments made at the time of stipulating the contract with RINA (payments for the certification and surveillance activities established in the quotation first and then in the certification and surveillance contract after);

4. following audits which highlight particularly serious NC;

5. if the organisation doesn’t implement AC following particularly serious NC identified by RINA;

6. if the PEFC logo is used without having the licence to use it from PEFC Italia or for non payment of the annual fee for logo use (if due).

RINA will inform the organisation of the period of time by which the consequent AC are to be implemented. The suspension measure is also notified to PEFC-Italia through the scheme manager. Suspension will be revoked following a supplementary audit. The reasons for suspension are to be eliminated within a maximum of 90 days, otherwise the certificate and its use will be revoked.

The cost of the supplementary audit is borne by the applicant. During the period between suspension of the certificate and its revocation, the products obtained cannot be declared as compliant.

Withdrawal of the certificate means the organisation must cease to use it immediately and/or all the sub-certificates in the case of a Group are revoked. The decision to withdraw a certificate and the pertinent reasons are to be communicated to the organisation concerned and to PEFC-Italia.

For any matter not further detailed in this instruction, reference is to be made to instruction IS-CAF-CER-01.

13. ORGANISATIONS WHOSE MANAGEMENT SYSTEM HAS ALREADY BEEN CERTIFIED BY ANOTHER CERTIFICATION BODY

For organisations whose CoC has already been certified by another Certification Body, accredited by a national Accreditation Body member of the IAF (i.e. ACCREDIA in Italy), according to the ISO/IEC 17065:2012 and PEFC-CoC standards and subsequent notification by PEFC, what is stated in Annex 3 applies.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 31/54

14. MULTI-SITE ORGANISATIONS

See Annex 2.

15. ANNEXES

ANNEX 1 – DEFINITION OF AUDIT TIME

ANNEX 2 – MULTI-SITE CERTIFICATIONS

ANNEX 3 - TRANSFER OF CERTIFICATIONS

ANNEX 4 – DUE DILIGENCE SYSTEM (DDS) PEFC

ANNEX 5 – SOCIAL, HEALTH AND SAFETY REQUIREMENTS IN CHAIN OF CUSTODY STANDARDS

ANNEX 6 – USE OF PEFC LOGO

ANNEX 7 – NON CONFORMITIES

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 32/54

ANNEX 1 – DEFINITION OF AUDIT TIME

1. INTRODUCTION

This Annex defines the criteria to establish the time needed to perform PEFC ST 2002:2013 audits of organisations of different size and complexity involved in activities related to the chain of forest based products. Document ITA 1003:2 Is taken as reference.

2. DEFINITIONS

Man/days (m/d)

A m/d normally lasts 8 hours. All transfer times of more than one hour are to be calculated as additional time.

3. APPLICATION

Audit duration

The duration of an audit, for all types of audit, includes the time spent on site at the client’s premises and the time spent offsite for planning, document review, contacts with the client’s staff and to prepare the report.

This applies to initial, surveillance and recertification audits. Should more time be necessary to plan and/or draw up the report, this does not mean a reduction in the on-site audit time, for any type of audit.

The RPC is to suitably calculate and justify the time necessary for each on-site audit of the organisation to be assessed, taking into account the following aspects and recording the results in the “Contract review” form:

a) The requirement of the chain of custody standard,

a)b) b) b) Size and complexity of the organisation’s operation, number of product types and product lines covered by the production batch(es) and their unity (see table A)complexity (i.e. number of products to be certified, activities carried out, number of groups of products to be certified, see table A)

c) Extent of supplies that could create a high risk of procurement of raw material from controversial sources,

d) Extent of PEFC Logo labelling activities (applicable to Countries where the approval of the use of the logo PEFC is the responsibility of the certification body),

e) Any outsourcing of any activities included in the scope of the chain of custody outsourcing of activities included in the PEFC-CoC scope (contractors),

b)f) The results of any prior audits, including those of organisation’s management systems;

c)g) Number of sites and multi-site consideration of multi-site and group certification.

Table A shows the duration of on-site audits, calculated in man/days, on the basis of 8 hours a day, for individual organisations and in the case of first certification.

Table A – On-site audit time

Complexity Type of organisation

Critical aspects

Characteristics of critical aspects in relation to type of organisation

On-site audit time

LOW Very simple individual organisations

Number of different types of production activities (*)

Just one type (*) of activity or only commercial activities 0,5

Number of groups of products subject to

Maximum 2 groups of products

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 33/54



Critical aspects


On-site audit time

certification

Type of input material (certified/non certified)

PEFC certified material

Size of site in square metres relevant to the part involved in the PEFC chain of custody

Up to 1000 square metres

Number of personnel taken on involved in the PEFC chain of custody

Up to 7 people

Plant complexity Automated

Quota of production (in terms of production lines, e.g. how many rotating) dedicated to activities subject to certification

Only 1 production line

Extent of supplies that could create a high risk of procurement of raw material from controversial sourcesNumber of suppliers

Up to 30

PEFC Logo labelling activities. (applicable to Countries where the approval of the use of the logo PEFC is the responsibility of the certification body)

Up to 3

The results of any prior audits

Up to 3 minor nonconformities

MEDIUM Simple, individual organisations


Up to 2 types of production activities

1

Number of product groups subject to certification

Up to 4 product groups


Certified


Up to 5000 square metres


Up to 100 people

Plant complexity Manual

Quota of production (in terms of production lines, e.g. how many rotating) dedicated to activities

Up to 3 production lines

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 34/54



Critical aspects


On-site audit time

subject to certification


Up to 3Up to 10

PEFC Logo labelling activities

From 4 to 10 included


4-6 minor nonconformities

HIGH Very complex organisations


Several types of activity

2

Number of product groups subject to certification

More than 4 product groups


Use of non PEFC-certified material


More than 5000 square metres


More than 100 people

Plant complexity Manual

Quota of production (in terms of production lines, e.g. how many rotating) dedicated to activities subject to certification

More than 3 production lines


More than 3More than 10

PEFC Logo labelling activities

>10


More than 7 minor nonconformities

(*)Type: user company, first processing company, second processing company, trade, other.

The minimum time for the on-site audit is one half of a man day with the exemption to micro enterprises.

The minimum time for the surveillance and re-certification audit is the same as for the initial audit.

Any deviation, whether more or less (30% at the most), involving audit time which is different from the time indicated in table A is to be recorded and justified.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 35/54

At least 20% of the audit time established in table A is to be dedicated to inspection of the production activities. Moreover, the on-site audit is to be planned during the normal work activities when the PEFC product is used.

The expected amounts based on man/days shown in table A, have to be added the back-office costs for instruction, practice management and independent technical review. These costs have to be equal approximately to payment in euro of 0.25 man/days.

NOTES TO TABLE A:

1. A man/day consists of 8 hours, excluding travelling time; the minimum audit time, for certificates issued with ACCREDIA accreditation, is 1 man/day; tThe time spent daily beyond the 8 hours is not to be considered for the purpose of calculating the man/days.

2. The time of trainee auditors (observers) and of the technical experts is not to be considered as audit time.

3. When the combination of aspects contained in table A does not enable an organisation to be clearly assigned one of the three above-mentioned complexity types, the number of man/days will be defined by assigning the complexity class which the majority of critical aspects come under.

4. In the case of contractors and/or suppliers of non PEFC-certified material, the values in table A will be increased by those in table B.

In particular, as regards calculation of the man/days, the following aspects and reasons are to be recorded in the “Contract review” document by the CU RPC explaining clearly the reasons:

- the adoption of the audit time even if it coincides with that given in table A - every reduction/increase in audit time compared to that given in table A.

The minimum time for the on-site audit is 0,5 man/day, with the exemption to micro enterprise for which can be considered as lower times (es. 0,25 – 0,30 man/day). Micro enterprise is an organization having fewer than 10 employees and annual turnover or global balance less than 2 million EUR, or equivalent in the national currency.

The audit time of the surveillance and recertification is the same as to initial audit time established on the base of table A.

The time dedicated to the surveillance audit is to be proportional to the time dedicated to assessment for certification: 1/3 of the certification audit time is to be dedicated to surveillance audits and, in any case, not less than 0.5 days. At the time of planning the surveillance audit, an update of the client’s data is to be requested and the outcome recorded in the “Confirm data” field in the “Contract Review” form.

The time dedicated to the renewal audit is to be proportional to the time dedicated to the certification audit: 2/3 of the certification audit time is to be dedicated to renewal audits, based on the updated client information (Informative questionnaire + recording in the “Confirm data” field in the “CONTRACT REVIEW” form), on the outcome of the system performance review during the certification period (previous RVI) and on any amendments to the ITA 1003 reference standard for the calculation of the time and, in any case, not less than 0.5 days.

In the case of CONTRACTOR, annual sampling is conducted on the outsourcers and is calculated on the following formula:

y = √ x for first certification and renewals

y = 0,8 √ x for surveillance audits

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 36/54

where x corresponds to the number of outsourcers and y to the number of outsourcers to sample, rounded up.

All the contractors will be evaluated during the five years of the certificate validity.

For MULTI-SITE and/or GROUP ORGANISATIONS 0.5 man/days is to be considered for the registered office of a multi-site or group organisation, with a 0.25 increase in man/days for each simple, dependent/associated organisation (subject to audit) and a 0.5 man/day increase for more complex organisations (subject to audit)

RINA reports its justification for the time spent on multi-site audits in terms of its overall policy for allocation of audit time inside the contract review.

The minimum audit time to spend for each individual site as a part of the initial, surveillance and re-certification audits is the same as for the initial audit (see above table A). Reductions can be applied to take into account the clauses of the chain of custody standard that are not relevant to sites and are only examined at the central office.

No reduction is permitted for the central office.

Table B “Factors to be considered to increase or reduce the man/days” identifies the factors which may involve an increase or reduction in audit time compared to the time indicated in table A.

Table B: Factors to be considered to increase or reduce the man/days

External contractors A 0,25-0,5 man/day increase is foreseen for the assessment of each contractor (external) whose activities may have or have a direct impact as regards the identification of the product and its possible certification.

In case of contractor, an annual sampling is conducted on the outsources and is calculated on the

following formula:

y = √ x in the case of first certification and renewal

y = 0,8 √ x in the case of the surveillance audit

where x is the number of contractors at risk of melting PEFC certified products with not certified PEFC products and y is the number of contractors sampled to be verified, rounded up.

All the contractors will be evaluated during the five years of the certificate validity. The activities that manage material already printed with PEFC labeling (e.g. stapling operations, cellophan packagin, etc) can be considered risk-free melting between PEFC certified material and PEFC non-certified material, and therefore not subject to sampling

ISO 9001 and ISO 14001 certified organisations

A 0.25 man/day reduction for simple organisations and a 0.5 man/day reduction for more complex organisations are foreseen in the case of certification combined with ISO 9001 or ISO 14001 certification.

Moreover, an increase in audit duration could be necessary in the following:

Complex logistics involving several buildings or sites where the work is carried out;

Personnel who speak different languages (if this involves the use of one or more interpreters or prevents individual auditors from working in an independent way).

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 37/54

ANNEX 2 –MULTI-SITE CERTIFICATION

1 GENERAL’

A multi-site organisation is defined as an organisation which has an identified central function (in the following, reference will be made to a central office but it does not necessarily have to be head office) where certain activities are planned, controlled or managed and a network of local offices or sites where these activities are entirely or partially carried out.

Multi-site organisations do not necessarily have to be a single legal entity but all the sites must have a legal or contractual link with the organisation’s central office and must be part of a common chain of custody which is kept under constant control by the central office. This means that the central office has the right to implement corrective action, when necessary, at any site. Where applicable, this should be established in the formal agreement between the central office and the sites.

Examples of possible multi-site organisations are given below: o Organisations operating in franchising or companies with several branches where the sites

are connected through property, management or other organisational link8

o A group of independent legal companies set up and operating for the purpose of chain of custody certification (groups of producers) (*)

(*)By group of producers is meant a network of independent enterprises, in general small, which have grouped together to obtain and maintain chain of custody certification. The central office can be an appropriate trade association or any other legal en tity, sufficiently expert, which is either appointed for the purpose by a designated group of members or offers a group service managed for the purpose and in line with the PECF ST 2002:2013 standard. The central office can also be administered by a member of t he group. In the case of a group of producers, the cen tral office can be called “group entity” and the sites can be defined as “members of the group”. Site means the place where the activities related to the organisation’s chain of custody are carried out. The group of producers is limited to participation of the sites which are situated in one country and which don’t have more than 50 employees (equivalent to full-time employees) and which don’t have a turnover in excess of 9.000.000 Swiss francs or equivalent (approximately 8.000.000 euro)

2 APPLICABILITY

Applicability for the possibility of sampling is based on the following assumptions. If they are not met, individual sites will have to be audited, applying the usual OdC procedures and with the issue of individual certificates.

The organisation’s Chain of Custody is to be administered at central level and is to undergo a central review. All pertinent sites (including the central administration’s office) are to be included in the organisation’s internal audit programme and audited according to this programme, prior to the beginning of the assessment process by the OdC.

It must be demonstrated that the organisation’s central office has implemented a chain of custody in compliance with the PEFC ST 2002:2013 standard and that the whole organisation (including all sites) comply with the requirements of the standard.

The organisation must be able to show that it is able to collect and analyse the data (including but not limited to items below) from all sites, including the central office, and that it has the authority and ability to make changes to the existing chain of custody, where appropriate:

a) Chain of custody documentation and chain of custody changes,

b) Management review,

c) Complaints,

d) Evaluation of corrective actions, e) Internal audit planning and evaluation of the results

8 The members of an association are not covered by the term “management or other organisational link” .

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 38/54

a)f) Different legal requirement in relation to the avoidance of raw material from controversial sources.

A multi-site client organisation, which is established as a group of independent legal entities only for the purpose of obtaining and maintaining chain of custody certification, shall only consist of typically small enterprises.

In general, the central office of the multi-site organisation must:

1. represent the multi-site organisation during the certification process, including communication and relations with the certification body

2. send the certification request and its scope, including the list of participating sites 3. guarantee a contractual relationship with the certification body 4. send the scope extension or reduction request to the certification body, including coverage of the

participating sites 5. ensure the commitment, on behalf of the whole multi-site organisation, to set up and maintain a

chain of custody in compliance with the requirements of the PEFC ST 2002:2013, 6. provide all the sites with the information and guidance necessary to effectively implement and

maintain the chain of custody in compliance with the PEFC ST 2002:2013. The central office is to provide the sites with the following information or guarantee access to the following information:

o a copy of the PEFC ST 2002:2013 standard and all guides relevant to implementation of the requirements of this standard;

o rules on use of the PEFC logo and all guides relevant to implementation of the rules on use of the PEFC logo;

o central office procedures for the management of the multi-site organisation; o contractual conditions with the certification body related to the certification or

accreditation body’s right to access the documentation relevant to the sites and to access the installations for audit and surveillance activities and to provide site information to the third party body;

o explanation of the principles and mutual responsibility 9 of the sites as part of the multi-

site certification; o results of the programme of internal audits and of the certification body’s auditing and

surveillance and relevant preventive and corrective measures applicable to individual sites;

o the multi-site certificate and all its parts relevant to the certification scope and site coverage

7. guarantee contractual and organisational links with all the sites, including the commitment of the sites to implement and maintain the chain of custody in compliance with the PEFC ST 2002:2013 standard. The contract is also to include the central office’s right to implement and impose any corrective or preventive action and to exclude any site from participating in the multi-site organisation’s chain of custody in the case of non compliance with the PEFC ST 2002:2013 standard,

8. establish written procedures to manage the multi-site organisation, 9. maintain the records relevant to central office and site conformity with the requirements of the

standard, 10. prepare an internal audit programme. This programme is to ensure:

o an on-site audit of all the sites (including own central administrative function) before RINA begins the audit,

o annual on-site audits of all the sites covered by the certificate scope (including the central administrative office),

o an on-site audit of every new site before RINA begins the certification scope extension process.

11. assess compliance of the central office and sites, including a review of the results of the internal audit programme and of the certification body’s audits and surveillance and must establish

9 The term “mutual responsibility” means that the non-conformities found at one site or at the central office could lead to corrective

action being taken at all sites; an increase in internal audits or withdrawal of the multi-site certificate.


RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 39/54

corrective and preventive measures if necessary and assess the effectiveness of the corrective action taken.

The sites linked to a multi-site organisation are responsible for the following:

a) application and maintenance of the chain of custody requirements in compliance with the PEFC ST 2002:2013 standard;

b) - effective reply to all requests from the central office or from the certification/registration body related to pertinent data, documentation or other information concerning formal controls, reviews or other;

c) - full cooperation and assistance to enable the internal audits made by the central office and the audits performed by RINA to be satisfactorily completed, including access to site plants,

d) - implementation of pertinent corrective and preventive action established by the central office, e) - stipulation of a contractual link with the central office, including the commitment to comply with

the chain of custody requirements and with the other applicable certification requirements.

Responsibility for implementation of the different parts of the PEFC ST 2002:2013 standard by the central office and sites is shown in the table below.

PEFC ST 2002:2013 requirements

Central office Site

Section 6.2: Physical separation method

Yes

Section 6.3 – Percentage based method

Yes

Section 8 – Minimum management system requirements

Yes

8.2 Responsibilities and authorities

Yes Yes

8.2.1 General responsibilities Yes Yes

8.2.2 Responsibilities and authorities for chain of custody

Yes (for points 4 and 5 of the above list)

Yes

8.3 Documented procedures Yes (for points 1, 5, 6) Yes

8.4 Record keeping Yes (for points 6, 7) Yes

8.5 Resource management

8.5.1 Human resources/personnel

8.5.2 Technical facilities

Yes (only for the activities provided)

Yes

8.6 Inspection and control Yes Yes

8.7 Complaints Yes Yes

RINA provides information to the Organisation about the eligibility criteria laid down herein (according to annex 2 of ITA 1002:2013 and ITA 1003:2014), before starting the evaluation process, and proceeds with the evaluation if any of the eligibility criteria for the muliti-site organisation are not met.

Before starting the evaluation process, RINA informs the Organisation that the certificate will not be issued if should any non-conformities arise during the audit in relation to these eligibility

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 40/54

3 AUDIT

In case of multisite, RINA verifies the compliance to requirements of chain of custody filling in the check list (MOD-QPT-PEFC_CoC-09) also for the part concerning the annex 2, for each site audited and for the central office.

The team leader prepares the final audit report that will be contain all findings issued by the audit team during the audit at the sites and at central office.

34 SAMPLING

RINA can apply sampling of sites for on-site audits where the site sampling is appropriate to gain sufficient confidence in the compliance of the multi-site organisation with the chain of custody requirements. RINA shall be able to demonstrate its justification for the selection of sites for the on-site audits to ensure that all differences across the sites and implementation of chain of custody have been assessed, arguing the appropriate justification for the choices made inside the contract review.

The sample for the initial, surveillance as well as re-certification audits shall be determined separately for sites using different chain of custody methods (physical separation and percentage based methods). The sample shall be representative concerning differences in sites’ processes and activities which are subject to the chain of custody certification.

The sample should be partly selective based on the factors set out below and partly non selective, and should result in a range of different sites being selected, without excluding the random element of sampling.

At least 25% of the sample shall be selected at random.

Taking into account the criteria mentioned hereafter, the remainder of the sample should be selected so that the differences among the sites selected over the period of validity of the certificate is as large as possible.

The site selection site shall include among others the following aspects:

a) Results of internal audits or previous certification audits, b) Records of complaints and other relevant aspects of corrective and prevention action, c) Significant variation in the size of the sites and in production processes of the sites, d) Variations in the applied chain of custody methods, e) Modifications since the last certification audit, f) Geographical dispersion.

This selection does not have to be done at the start of the evaluation process. It can also be done once the audit at the central office has been completed. In any case, the central office shall be informed of the sites to be part of the sample. This can be on relatively short notice, but should allow adequate time for preparation for the audit.

The central office shall be examined during every initial, surveillance and re-certification audit as part of the sample.

SIZE OF SAMPLE

The minimum number10

of sites to be visited per audit is:

Initial audit: the size of the sample should be the square root of the number of remote sites: (y = √ x), rounded to the upper whole number.

Surveillance audit: the size of the annual sample should be the square root of the number of remote sites with 0.6 as a coefficient (y = 0,6 √ x), rounded to the upper whole number.

10

Said requirements are based on the example of a low to medium risk activity with less than 50 employees at each site.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 41/54

Re-certification audit: the size of the sample should be the same as for an initial audit. Nevertheless, where the chain of custody system has proved to be effective over a period of three years, the size of the sample could be reduced by a factor 0.8, i.e.: ((y = 0,8 √ x), rounded to the upper whole number).

In the case of multi-site with activities with medium risk, the above sample will be increased by 1/4 and 1/2 in case of high risk (e.g. if the number of sampling company, applying the above formulas, is: 4 for the initial audit and 3 both for surveillance and renewal, if the multi-site company has activity with medium risk,the sampling will be: 5 (= 4 + (4*1/4)) in the case of initial audit, 4 (= 3 + (3*1/4)) for surveillance and renewal

The risk class of multi-site company is calculated on the table below, considering the following factors:

a) The size of the sites and number of employees;

b) The complexity and variations of raw material flow and chain of custody methods;

c) Variations in the application of the chain of custody methods and definitions of the raw material origin;

d) Level of risk of procurement of raw material from controversial sources;

e) Records of complaints and other relevant aspects of corrective and preventive action;

f) Any multinational aspects;

g) Results of internal audits.

The risk class assigned to the multi-site organization is that which covers the largest number of assessed risk factors.

Table B – Risk classification for multi-site organization

.Risk factors Range Risk class

Size of the sites Up to 1000 mq

LOW

Number of employees < 50 employees

The complexity and variations of raw material flow

Only PEFC certified material input – no use of raw material from controversial source

The complexity and variations of chain of custody methods

Only physical separation method

Variations in the application of chain of custody methods and definitions of the raw material origin

Only physical separation method and definition of origin of raw material from Country with negligible risk to due diligence

Level of risk of procurement of raw material from controversial sources

Negligible risk of procurement of raw material from controversial sources

Records of complaints and other relevant aspects of corrective and preventive action

Up to 3 complaints

Any multinational aspects All sites in the same Country

Results of internal audits Up to 3 minor NCF found and recommendation

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 42/54

Size of the sites From 1001 mq to 5000 mq

MEDIUM

Number of employees >= 50 employees a <= 300 employees


Predominant presence of PEFC certified material input– minimal presence of raw material from controversial sources


Physical separation and/or percentage based method


Physical separation and/or percentage based method and definition of origin of raw material from Country with negligible risk to due diligence


Negligible risk of procurement of raw material from controversial sources


> 3 complaints received <= 10

Any multinational aspects Sites in 2 or 3 Countries

Results of internal audits > 3 minor NC found and presence of 1 major NC

Size of the sites >= 5001 mq

HIGH

Number of employees > 300 employees


High presence of raw material from controversial source


Physical separation and/or percentage based and/or volume credit method


Physical separation and/or percentage based and/or volume credit method and definition of origin of raw material from Country with significant risk to due diligence


Significant risk of procurement of raw material from controversial sources


> 10 complaints received

Any multinational aspects Sites in more than 3 Country

Results of internal audits Presence of more than 1 major NC

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 43/54

In case in which should one or more findings attributable to multiple sites should be issued,the responsible of audit team with the RPC will increase the sampling frequency of the sites by increasing the classification of organization of one risk class

Before carrying out the site audits, the GVI will audit the Chain of Custody as regards the activities performed by the central office, with particular focus on the assessment of the results of the internal audits, checking that all the sites have been covered and are compliant, and on the documentation relevant to identification of the activities carried out at the sites connected with the chain of custody of forest based products.

The sample is to cover all types of companies to which the chain of custody can be applied. In this connection, the types of companies to be considered are: user companies, first processing companies, second processing companies, trade, other.

In the case of complex companies which perform activities involving several different types, assignment of the type is made in relation to the company’s main type of activity. The minimum sample is obtained according to the following formula:

X = √ n

Where:

X rounded up to the next whole figure indicates the number of companies to be audited;

n indicates the number of subjects in the Group requesting certification.

Increases in the representative sample calculated as above can be made on the basis of criteria suitably supported by evidence of the reasons from the OdC and with reference to the voluntary standards in force for OdC.

The Group’s central office requesting certification is always considered in addition to the calculated sample and is always to be audited.

The criteria which allow an increase in the representative sample, calculated according to the above-mentioned formula, are as follows:

results of internal site audits and management reviews or of previous certification audits;

recording of complaints and other pertinent aspects of corrective and preventive action;

significant changes in the size of the sites;

significant changes in the shift system and work procedures;

complexity of the management system and processes performed at the sites;

changes after the last certification audit;

differences in culture, language and regulatory requirements.

The sample is to be made so as to have the greatest possible differences among the sites chosen during the period of validity of the certificate.

The choice of sites can be made after the audit of the central office has been completed. In any case, the central office is to be informed of the sites which will be included in the sample. This can be done through relatively short notice which should allow, in any case, sufficient time to prepare the audit.

Any sampling plans which substantially differ from what is established in this document are to be submitted by the operational offices to QPT for the necessary considerations of the case and, if there are significant variations, the accrediting body could be asked for its opinion.

Formatted: Not Highlight








RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 44/54

If the organisation intends to add an additional lot of sites to those already certified, the new lot is to be

considered independently from those previously certified and therefore, the formula (X = √ n) once again

applies to them. Then, for subsequent surveillance audits, the total number of sites will be considered

45 CONTRACT REVIEW

On the basis of the QI submitted and on the preliminary contacts with the organisation, the complexity, type and location of the activities covered by the organisation’s Chain of Custody and the differences among the sites are to be verified in order to determine the sampling level.

In any case, the extent to which the sites essentially carry out similar activities, using the same procedures or methods, is to be checked.

RINA shall identify the central function of the Organisation that is its contractual partner for the performance of the certification. The agreement shall allow RINA to carry out the certification activities at all sites of the multi-site Organisation.

Moreover, the organisation is to inform the OdC in advance of the sites which, at the time of the initial audit, are not yet ready and therefore not subject to certification. In particular, the organisation is to inform the OdC in advance of the sites it wishes to include in the certification and those it wishes to exclude.

RINA shall analyse, in each individual case, to what extent sites of an organisation have similar raw material flow that enables to implement the chain of custody to be applied in a similar manner. The similarity of the sites included in the multi-site organisation shall be taken into consideration when applying the sampling procedures.

The method of application of the site sampling plan is to be part of the documentation provided to the organisation with the quotation, as the organisation is of course to be informed of the criteria used by the OdC for the initial and surveillance audits. In the Forms database on Lotus, as an example, a sampling plan scheme to be presented to the organization is attached, with the relative introduction

5 6 ADDITIONAL SITES

Additional sites11

can be added to an existing certificate as the result of surveillance / reassessment activities.

When a request is made to include a new group of sites in an already certified multi-site network, in order to determine the size of the sample, each new group of sites should be considered as an independent group. After the new group of sites has been included on the certificate, the new sites will be added to the existing ones to establish the size of the sample for future surveillance or recertification audits.

67 TREATMENT OF NON CONFORMITIES FOUND

If a non-conformity is found at the central office or at an operational site, corrective action is to be implemented at all the sites covered by the certificate. Verification of the positive outcome of the corrective action may be made by the audit team also at a different site to the one where the non conformity was found, subject to verification of the documentation submitted by the organisation.

If recurring marginal non conformities are found, the GVI must decide whether to require the organisation to suitably increase audit frequency (initially only internal audits; if the non conformities persist, also those of the OdC). an investigation shall take place to determine whether the other sites may be affected. RINA shall require the Organisation to review the nonconformities to determine whether they indicate an overall chain of custody deficiency applicable to all sites or not. If they are found to do so, corrective action should be

11

Temporary sites such as building sites set up by an client organisation in order to perform specific works are not to be trea ted as part

of a multi-site operation. Any sampling of the activities performed at such sites will be for the purpose of confirming the activities of the permanent office whose chain of custody is subject to certification, not for the purpose of granting certificates to the temporary sites themselves.




RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 45/54

performed both at the central office and at the individual sites. If they are found not to do so, the organization shall be able to demonstrate to the RINA the justification for limiting its follow-up action.

RINA shall require evidence of these actions and increase its sampling frequency until it is satisfied that control is re-established, as previously described.

At the time of the decision making process, if any site has a nonconformity, certification shall be denied to the whole multi-site organization pending satisfactory corrective action.

It shall not be admissible that, in order to overcome the obstacle raised by the existence of a nonconformity at a single site, the organization seeks to exclude from the scope the “problematic” site during the certification process.

8 CERTIFICATES

One single certificate shall be issued with the name and address of the central office of the Organisation. A list of all the sites to that the certificate relates shall be issued, either on the certificate itself or in an appendix or as otherwise referred to in the certificate. The scope or other reference on the certificate shall make clear that the certified activities are performed by the network of sites in the list.

If the individual sites are applying different chain of custody methods or definitions of the raw material origin, the application of the chain of custody standard shall be clearly stated in the certificate and any appendix for the individual sites.

A sub-certificate may be issued to the organization for each site covered by the certification on condition that it contains the same scope, or a sub-scope of that scope, and includes a clear reference to the main certificate.

The certificate will be withdrawn in its entirely, if the central office or any of the sites does not/do not fulfil the necessary criteria for the maintaining of the certificate.

The list of sites shall be kept updated by RINA. To this effect, RINA requests the Organization to inform it about the closure, establishment, or change in activities of sites. Failure to provide such information will be considered by RINA as a misuse of the certificate, therefore RINA will ensure the suspension of the certificate.

Additional sites can be added to already existent certificate as result of evaluation/surveillance activity.



RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 46/54

ANNEX 3 – CERTIFICATE TRANSFER

The transfer of the certificate will be performed in compliance with the document IAF MD 2:2007.

Moreover the PEFC certificate can be transfer just in case:

- the certificate is valid

- there aren’t any majour NC pending from the previous CB

- the last certification, recertification or subsequent surveillance audit reports are available

- the surveillance audit is not overdue

The certificate will be transferred just after the positive outcome of the on site audit, during which, aside from the check of the respect of the requirements of the PEFC standard for certification activities, it’ll be also verified the correct closure of any minor NC and/or recommendations pending from the previous CB.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 47/54

ANNEX 4 – DUE DILIGENCE SYSTEM (DDS) PEFC

The Due Diligence System (DDS) is a system to minimise the risk that the procured material originates in controversial sources.

This system is to be implemented for all input forest based material covered by the organisation’s PEFC chain of custody , with the exception of:

- recycled material; and

- material originating from species listed in Appendices I to III of CITES provided it complies with applicable international, European and national legislation relating to CITES.

The auditor has to check that PEFC DDS is supported by the organisation’s management system meeting requirements of clause 8 of PEFC ST 2002:2013 standard.

During the on-site audit, the auditor has to check that, if the organisation uses incoming forest based material not covered by certification, as per one or more of the above points, the organisation has implemented a procurement control system of these forest based materials aimed at avoiding procurement from controversial sources.

For this purpose, the auditor has to check that the organisation:

- has gathered the information;

- has performed a risk assessment; and

- manages significant risk supplies

In particular, the auditor has to check that:

- the organisation’s procurement of raw materials originating from listed in Appendix I to III of CITES shall comply with applicable international, European and national legislation relating to CITES;

- the organisation does not procure any restricted forest based material originating from countries covered by applicable UN, EU or national government sanctions restricting the export/import of such forest based products;

- the organisation does not use conflict timber;

- the organisation does not include any material from genetically modified forest based organisms in products covered by the organisation’s PEFC DDS;

- the organisation does not include in products subject to the PEFC DDS, any wood based material coming from the conversion of forests to other vegetation type, including conversion of primary forests to forest plantations.

4.1 – Gathering of information

The PEFC DDS is based on information provided by the supplier. The auditor has to check that the organisation has accessed to the following information:

identification of the material/product, including its trade name and type12

;

identification of the tree species included in material/product by their common name and/or their scientific name

13 where applicable;

12

Usage of a trade name of species is considered ad equivalent to the common name in cases where all species covered by the trade

name have an equivalent risk of originating in controversial sources.

13 Access to the scientific name of species is required in cases where the usage of a common name could pose a risk of wrong

identification of the species.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 48/54

country of harvest of the material and where applicable sub-national region14

and/or concession of harvest

1516 .

4.2 – Risk assessment

The RINA auditor has to check that:

- the organisation has carried out the risk assessment of procurement of raw material from controversial sources for all input forest based material covered by the scope of the PEFC DDS, classifying the supplies as “negligible” or “significant” risk, with the exception of:

o certified material/products delivered with a claim by a supplier with PEFC recognised certificate;

o other material/product delivered with a claim by a supplier with PEFC recognised chain of custody certificate.

- the risk assessment carried out by the organisation is based on: o the likelihood that activities defined under the term controversial sources occur in the

country/region of the supply or for the tree species of the supply (called “likelihood at the origin level”) and;

o the likelihood that the supply chain is not able to identify a potential controversial source of supply (called “likelihood at the supply chain level”);

- all the supplies are classified as “significant” risk which have one or both the above likelihoods classified as high significant;

the organisation has classified the risk of the supplies on the base of the indicators listed in the following tables

17.

TABLE C – List of indicators for “low” likelihood on origin and supply chain level (negligible risk) 1819

.

Indicators

Supplies:

a) certified material/product delivered with a claim by a supplier with PEFC recognised certificate, b) other material/product delivered with a claim by a supplier with PEFC recognised chain of

custody certificate..

14

Access to the sub-national level of the material origini s required in cases where sub-national regions within one country do not

represent an equivalent risk relating to the controversial sources.

15 The term concession of harvest means a long – term and exclusive contract for harvest on defined geographical area of the publicly

owned forests.

16 The term “country/region” is further used throughout this clause to identify a country, a sub-national region or a concession of harvest

of the material/product origin.

17 The indicators for “low likelihood” on origin as well as on supply chain level (table C) describe options for a first step of risk mitigation

(e.g. provision of additional information) before starting the formal risk mitigation process described in clause 5.5. Hence, if the supplies can be characterized by indicators indicating “low likelihood” on the supply chain level or the origin level this always overrules a high “likelihood” indicator on the same axis.

18 The timber verification by a DDS according to the requirements of the European Timber Regulation, monitored by a Monitoring

Organisation, can be used ad evidence for a legality of the supplies.

19 An Organisation can conduct a risk assessment and identify negligible risk for deliveries from a specific geographical area,

subsequent to the following conditions:

- The Organization shall keep updated: - A clear definition of the particular area, - A list with tree species delivered from the area, - Appropriate evidence to verify that its sources of supply are limited to the identified geographic area and tree

species. - No indicator listed in Table 2 and Table 3 shall be applicable. - The area specific risk assessment shall be carried out before the first delivery from the area. It shall be revised at least once a

year. - The area specific risk assessment shall be reviewed and if necessary revised if (a) is changed

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 49/54

Supplies declared as certified against a forest certification scheme (other than PEFC endorsed) supported by a forest management or chain of custody certificate issued by a third party certification body.

Supplies verified by governmental verification or licensing mechanisms other than forest certification schemes focused on activities covered by the term controversial sources.

Supplies supported by verifiable documentation which clearly identifies:

- Country of harvest and/or sub-national region where the timber was harvested (including consideration of the prevalence of armed conflict)

- Trade nema and type of product as well as the common name of tree species and, where applicable, its full scientific name.

- All suppliers within the supply chain and

- The forest management unit of the supply origin

- Documents or other reliable information indicating compliance of those timber and timber products with activities referred to by the term controversial sources..

Special attention shall be given to documentation which is produced by a governmental body of the country with TI CPI below 50.

TABLE D – List of indicators for “high” likelihood on origin level 20

Indicators

The actual corruption perception index (CPI) of the country presented by Trasparency International (TI) is lower than 50

21

The country/region has a prevalence of armed conflict.

The country/region is known as a country with low level of forest governance and law enforcement.

Tree species included in the material/product is known as species with prelevance of activities covered by the term controversial sources.

TABLE E – List of indicators for high likelihood on supply chain level

Indicators

Actors and steps in the supply chain before the first verification by a verification system accepted as indicator for low risk in this risk matrix are unknown

Country/regions where the timber and timber products have been traded before the first verification by a verification system accepted as indicator for low risk in this risk matrix are unknown.

Tree species in the product are unknown

Evidence of illegal practices by any company in the supply chain.

The auditor has to check that the organisation has carried out the risk assessment:

- for the first delivery of every individual supplier, reviewed and if necessary revised at least annually.

- For every delivery by an individual supplier in which changes regarding the characteristics listed in clause “Gathering of information” occurred.

20

Examples of external refernces and more detailed explanation can be found in the recent issue of PEFC GD 2001 Chain of custody

of forest-based products – Guidance for use. 21

Trasparency International has indicated that its corruption perception index is not always appropriate for forestry. And therefore,

where more appropriate indicators exist, these can be used with a prior agreement with the PEFC Council in consultation with Transparency International. These indicators will be listed in the chain of custody guidance document.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 50/54

4.3 – Substantiated comments or complaints

The auditor has to check that:

- The organisation ensures that substantiated concerns provided by third parties concerning supplier compliance with legal requirements and other aspects of controversial sources are promptly investigated and, if validated, result in (re-)assessment of the risks associated with the relevant supplies.

- The organisation has undergone a risk assessment according to the above requirements, in case of substantiated concerns, material originally excluded from the risk assessment.

4.4 – Management of significant risk supplies


- For supplies identified as “significant” risk, the organisation has requested the supplier to provide additional information and evidence, if possible, which allows the organisation to classify the supply ad negligible risk

22

- the organisation has established a second or third party verification programme for supplies classified as “significant” risk;

- the verification programme covers: o identification of the entire supply chain and forest management unit(s) of the supply’s

origin; o on-site inspection whenever relevant and o risk mitigation, corrective and preventive measures as required;

- the organisation has requested and obtained from all suppliers of “significant” risk supplies, detailed information on the entire supply chain and forest management unit(s) of the supply’s origin to enable the organisation to plan and execute on-site inspections

23

- the organisation’s verification programme includes on-site inspections of suppliers of “significant” risk supplies and that these inspections have been carried out by the organisation or by a third party on behalf of the organisation

24;

- the organisation or third party on behalf of the organisation has sufficient knowledge and competence in the legislation applicable to the origin of “significant” risk supplies and relevant to the definition of the controversial source;

- the organisation has determined a sample of significant risk supplies from one supplier to be verified by the verification programme,

- the size of the annual sample is to be at least the square root of the number of “significant” risk supplies: (y = √x), rounded to the nearest whole number

25

- the sample includes all suppliers of the high risk supplies;

22

The supplier shall ensure that:

a) It will provide the organisation with necessary information to identify the forest management unit(s) of the raw material and the whole supply chain relating to the “significant” risk supply.

b) It will enable the organisation to carry out a second party or a third party inspection of the supplier’s operation as well as operations of the previous suppliers in the chain.

These procedures can be ensured e.g. by contractual agreements or a written self-declaration by the supplier. 23

In cases where the supplies can be verified ad negligible risk according to the indicators in Table C at one step in the supply chain

the organisation is not required to track the whole supply chain to the forest management unit.

24 The organisation can substitute the on-site inspection with a document review provided the documentation supplies sufficient

confidence in the material origin from controversial sources.

25 Where the previous on-site inspections proved to be effective in fulfilling the objectives of document PEFC ST 2002:2013 (Due

Diligence), see the content of th Chapter 5, the size of the sample may be reduced by a factor of 0.8, i.e. (y = 0.8 √x) rounded up to the next whole number.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 51/54

- the on-site inspections have covered: o the direct supplier and all suppliers in the supply chain in order to assess compliance with

the supplier claims on the origin of the raw material; and

o the owner/manager of the forest management unit of the supply origin or any other party responsible for management activities on that forest management unit in order to assess their compliance with legal requirements;

- the organisation has defined written procedures to implement corrective measures for non compliance for suppliers identified by the organisation’s verification programme;

- the range of corrective measures is based on the scale and seriousness of the risk that timber or timber product(s) may be from controversial sources and includes the following:

o clear communication of the risk identified with a request for addressing the risk identified within a specific timeline so as to ensure that timber or timber product(s) from controversial sources is not supplied to the organisation;

o requirement that suppliers define risk mitigation measures related to forest management unit compliance with legal requirements or efficiency of the information flow in the supply chain;

o cancellation of any contract or order for timber or timber product(s) until the supplier can demonstrate that appropriate risk mitigation measures have been implemented.


- Timber or timber product(s) from unknown sources or from controversial sources has not been included in product groups covered by the organisation’s PEFC chain of custody.

- Timber known or reasonably suspected as coming from illegal sources (controversial source) has not been processed and, has not been traded and/or has not been placed on the market unless appropriate documented evidence has been provided and verified which allows the timber supplied to be classified as presenting “negligible” risk”.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 52/54

Annex 5 – SOCIAL, HEALTH AND SAFETY REQUIREMENTS IN CHAIN OF CUSTODY STANDARDS

The auditor is required to check that the organisation shows its commitment to meeting social, health and safety requirements as per the following:

- the workers are not prevented from free association, choosing their representatives and bargaining collectively with their employer,

- forced labour is not used,

- workers under the minimum legal age of 15 are not used or workers of compulsory school age, where the age is higher,

- workers are granted equal work and treatment opportunities,

- working conditions do not endanger health and safety. The auditor is to carry out the above checks by looking at employee contracts, employee age, any trade unions, any pertinent company policies/procedures and risk assessment document as well as any other relevant document to demonstrate compliance with the above-mentioned requirements. In case of organization that is placed in Countries that haven’t ratified the ILO conventions, the verifier with reference to what written above will verify the respect of the PEFC social requirements on the bases of the following tools of evaluation:

- the presence of relevant certifications26

(es. SA 8000, BSCI, SEDEX/SMETA, WRAP Gold/Silver) and their status of validity and which PEFC social requirements are covered by those certification standards

27;

- the presence of organization’s policies that recognize the freedom or the associations and the rights for collective bargaining;

- the presence of organization’s agreement with a workers’ association operating within the organization or within the relevant economic sector which covers the workers freedom of association and the right of collective bargaining;

- the presence of a sector specific agreement between an employer’s organization and a workers’ association which is binding for the organization;

- The evidence of a workers association or a workers’ committee operating within the organization, remit of the worker association or committee in collective bargaining;

- The evidence of negotiations between the organization and workers’ association; - The presence of any results of a control/monitoring by governmental authority where the

requirements workers freedom of association and the right of collective bargaining are sufficiently covered by the applicable legislation;

- The presence of any results of a control/monitoring by governmental authority where the requirements are sufficiently covered by the applicable legislation;

- The presence of any results of a control/monitoring by governmental authority where the requirements of freedom of association and rights for collective bargaining are sufficiently covered by the applicable legislation;

- Employment contracts (verifying that they don’t prevent workers from freedom of association and rights for collective bargaining);

- Interviews with workers and/or workers’ representatives for verifing that they can associate freely, to select their own representatives and have collective bargaining with their employer;

26

The precondition for acceptance of any other third party performed verification results is the validity of a specific certificate at least

until the next PEFC surveillance or certification audit. If the organization already applies yet third party verification schemes, the verifier can assess if such schemes cover the PEFC’s requirements as part of the verification scheme (example: some aspects can also be included inside quality management systems).

27 This verification can be done by assessing relevant documentation of the organization (e.g. management handbooks, certificates,

standards, audit report ecc.)

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 53/54

- Interviews with workers and/or workers’ representatives for verifing that they can associate freely, to select their own representatives and have a collective bargaining with their employer;

- The presence of organization’s policies prohibiting the use of forced labour; - Absence of forced labour inside the employment contracts; - Results of a control/monitoring by governmental authority where the requirement related to the

forced labour is sufficiently covered by the applicable legislation; - Interviews with workers and/or workers’ representatives related to the absence of forced labour; - The presence of organization’s documented procedures or polities for workers’ recruitment and

verification of their age; - Formal evidence of workers in relation to the compulsory school attendance age and the

minimum legal labour age; - Risults of a control/monitoring by governmental authority where the requirement of the minimum

legal age is sufficiently covered by the applicable legislation; - Interviews with workers and/or workers’ representatives related to the minimum legal applicable

age and check of their age; - Random check of the organization’s facilities in order to verify the respect of the minimum legal

applicable age; - The organization’s policies/procedures providing for equal opportunity of employment and

treatment; - Organizations systems for advertising and hiring new staff; - Results of a control/monitoring by governmental authority where the requirement is sufficiently

covered by the applicable legislation; - Interviews with workers and/or workers’ representatives finalized to find out incorrectness from

the point of view of ethical/social group, gender and position; - Evidence on system of worker grievances and their resolution; - The presence of any second audit programme that cover the social requirements and the control

that these social requirements are in line with the PEFC social requirements; - The presence of organization’s procedures relating to occupational health and safety; - Results of a control/monitoring by governmental authority where the requirement of the labour

conditions that don’t endanger employers’ health and safety is sufficiently covered by the applicable legislation;

- Organization’s records relating to occupational health and safety, its control and monitoring, training, accidents books etc.;

- Purchase records for all necessary protective equipment and evidence on their free delivery to workers;

- Permits and certificates required for occupational health and safety in the Country of operation; - Interviews with workers and/or workers’ representatives in connection with occupational health

and safety; - Random check at the organization’s facilities in connection to occupational health and safety.

RINA


PRODUCTS

IS-QPT-PEFC_CoC-01

Rev. 1213

Pag. 54/54

ANNEX 6 - USE OF PEFC LOGO

Where RINA makes use of the PEFC Logo on the certification document or for any other purposes linked to the PEFC certification scheme, the use shall only be carried out based on a valid licence issued by the PEFC Council or the relevant PEFC National Governing Body. Where RINA makes use of the PEFC Logo on the certification document, it shall make clear to the Organisation that the PEFC Logo on the certificate only refers to the Organisation’s compliance with the PEFC certification scheme and does not provide the Organisation with the right to use the PEFC Logo.

28

ANNEX 7 – NON CONFORMITY

Audit findings shall be classified as major nonconformities, minor nonconformities and observations..

Is defined:

- Major nonconformity29

: The absence of, or failure to implement and maintain, one or more requirements of the chain of custody standard, that may result in a systemic risk to the function and effectiveness of the chain of custody and/or effects confidence in the client organisation’s claims on certified raw material.

- Minor nonconformity: A single failure to fulfil the requirements of the chain of custody standard that may result in no systemic risk to the function and effectiveness of the chain of custody and/or effects confidence in the supplier’s claims on certified raw material.

- Observation: An evaluation finding that does not warrant nonconformity but is identified by the audit

team as an opportunity for improvement.

Major and minor nonconformities shall be corrected and the corrective action(s) verified by RINA before granting a certification and recertification.

Major and minor nonconformities identified in the surveillance audits shall result in corrective action(s) by the organisation resolving the nonconformities. The corrective action plan, including a timeframe is reviewed and accepted by RINA, in the person of TL. The time period for completion of the corrective action(s) for major nonconformities identified in surveillance audits and their verification by RINA cannot exceed 3 months. Corrective action(s) for minor nonconformities shall be verified no later than during the next audit

Corrective action(s) for all nonconformities identified in initial, surveillance and re-certification audits shall be verified by RINA by site visit or through documental evaluation.

28

The Organisation with a valid PEFC chain of custody certificate can only use the PEFC Logo with a unique PEFC licence logo

number for “on-product” as well as “off-product” purposes based on PEFC Logo usage licence contract issued by the PEFC Council or another entity authorised by the PEFC Council and in accordance with the PEFC logo usage rules.

29 A major nonconformity may be an individual nonconformity or a number of minor but related nonconformities, that when considered in

total are judged to constitute a major nonconformity.

IS-QPT-PEFC CoC-01 RINA ASSESSMENT AND CERTIFICATION OF ... · PDF fileRINA ASSESSMENT AND...

Documents

Transcript of IS-QPT-PEFC CoC-01 RINA ASSESSMENT AND CERTIFICATION OF ... · PDF fileRINA ASSESSMENT AND...