Certification Application

Certification analysis for your selected standard

Selecting a standard opens its analysis below. Complete these questions as part of this application.

For initial certification, complete and acknowledge each annex relevant to the standards you selected. For integrated certification, select each constituent standard above. Answer every question in each applicable annex; where an item does not apply, state "Not applicable" and explain why. Dates of audits or reviews not yet completed should be stated as "Not yet completed".

The annexes below form part of this application. Select your certification standards to identify the relevant annexes.

Annex A — Occupational Health and Safety Management System (ISO 45001)

Back to standard selection

1. Describe the work activities, locations, equipment and tasks within the proposed OH&S scope, including temporary or mobile sites.

2. Give the numbers of employees, contractors, subcontractors and visitors exposed to work activities at each site and shift. Identify who controls their work.

3. Describe significant hazards and OH&S risks, including hazardous substances, high-risk tasks, equipment, transport and work at height where applicable.

4. Identify applicable OH&S legal requirements, licences, permits and the arrangements used to evaluate compliance.

5. Explain how workers and their representatives are consulted and participate in OH&S matters, including contractor coordination.

6. Summarize significant incidents, occupational ill health, enforcement action and outstanding corrective actions during the past three years, or since operations began.

7. Describe emergency scenarios, preparedness exercises, site access restrictions and safety arrangements needed for an audit.

8. Give the OH&S system implementation date, latest internal audit and management review dates, and outstanding actions. State clearly if any are not yet completed.

OH&S exposure analysis

For each category, select the situation that applies across the proposed scope. Where exposure exists, give brief details, affected sites/people and controls. Select "Not yet assessed" if uncertain and explain the gap. These declarations support SCL review and do not determine a risk rating automatically.

1. Dangerous goods * Brief details, affected sites/people and controls (required unless no exposure is identified)

2. Vehicle and pedestrian interaction, including forklifts * Brief details, affected sites/people and controls (required unless no exposure is identified)

3. Powered plant, including mobile plant and plant rooms * Brief details, affected sites/people and controls (required unless no exposure is identified)

4. Other plant or mechanical hazards, including scaffolding * Brief details, affected sites/people and controls (required unless no exposure is identified)

5. Manual handling and repetitive tasks * Brief details, affected sites/people and controls (required unless no exposure is identified)

6. Hazardous substances, including asbestos where relevant * Brief details, affected sites/people and controls (required unless no exposure is identified)

7. Airborne contaminants outside confined spaces * Brief details, affected sites/people and controls (required unless no exposure is identified)

8. Ionizing or non-ionizing radiation * Brief details, affected sites/people and controls (required unless no exposure is identified)

9. Confined spaces * Brief details, affected sites/people and controls (required unless no exposure is identified)

10. Slips, trips and falls, including work at height * Brief details, affected sites/people and controls (required unless no exposure is identified)

11. Noise * Brief details, affected sites/people and controls (required unless no exposure is identified)

12. Thermal environment * Brief details, affected sites/people and controls (required unless no exposure is identified)

13. Below-ground work * Brief details, affected sites/people and controls (required unless no exposure is identified)

14. Storage or use of explosives * Brief details, affected sites/people and controls (required unless no exposure is identified)

15. Electrical hazards * Brief details, affected sites/people and controls (required unless no exposure is identified)

16. Pressurized work environment * Brief details, affected sites/people and controls (required unless no exposure is identified)

17. Bullying, violence or occupational assault * Brief details, affected sites/people and controls (required unless no exposure is identified)

I acknowledge that Annex A applies to this application and that its answers are complete and accurate to the best of my knowledge.

Annex B — Quality Management System (ISO 9001)

Back to standard selection

1. Describe the principal products/services, customers, process sequence and interactions within the requested QMS scope, by site.

2. Does the organization design or develop products/services? Describe the responsibility and activities, or explain why design and development is not applicable.

3. Identify key customer, statutory, regulatory and contractual requirements, including product approvals or licences where applicable.

4. Describe the consequences of product/service failure and the principal quality risks, including safety-critical or regulated activities.

5. Describe production/service controls, inspection and testing, release/acceptance criteria, traceability and monitoring/measuring equipment.

6. Identify externally provided processes, products and services, including subcontracted operations, and explain how providers are controlled.

7. Summarize customer complaints, significant nonconformities, recalls or rejected work, corrective actions and the performance measures used.

8. Give the QMS implementation date, latest internal audit and management review dates, and outstanding actions. Has the system operated for at least three months? State clearly if any activity is not yet completed; SCL will assess readiness.

9. Are the documented QMS arrangements implemented? Identify the manual, procedures, work instructions and forms/records used where applicable, with their status or version. State what is still being prepared.

10. Identify processes whose results cannot be fully verified by later inspection or testing. Describe how these processes are validated and controlled, or explain why this does not apply.

11. Does the organization hold customer or external-provider property, including data, drawings or equipment? Describe identification, protection and reporting of loss/damage, or explain why this does not apply.

QMS documented information and readiness

For each title below, do you have documented and implemented arrangements covering this subject? Select the current position and provide the reference, version, owner and approval/review date where available. If work is incomplete, explain the gap and planned action. If not applicable, explain the reason in relation to your scope, risks and obligations.

These prompts cover documents, records and process arrangements relevant to your scope. Equivalent or combined documents and suitable electronic records can be referenced. A separate quality manual or individually named procedure is not automatically required. Explain any non-applicability; SCL will assess the justification and readiness. Give references and brief explanations only; do not paste documents or confidential records.

1. QMS scope and justified non-applicability (4.3) * Reference and implementation details, planned action or applicability explanation *

2. Quality policy, approval and communication (5.2) * Reference and implementation details, planned action or applicability explanation *

3. Quality objectives and plans to achieve them (6.2) * Reference and implementation details, planned action or applicability explanation *

4. External-provider evaluation, selection, monitoring and re-evaluation criteria, results and actions (8.4.1) * Reference and implementation details, planned action or applicability explanation *

5. Competence evidence, including relevant training, skills, experience and qualifications (7.2) * Reference and implementation details, planned action or applicability explanation *

6. Product/service requirements review, including new or changed requirements (8.2.3.2) * Reference and implementation details, planned action or applicability explanation *

7. Applicable design/development planning, inputs, reviews, verification/validation, outputs and change records (8.3.2-8.3.6) * Reference and implementation details, planned action or applicability explanation *

8. Monitoring/measuring resources fitness-for-purpose evidence and applicable calibration or verification records (7.1.5.1-7.1.5.2) * Reference and implementation details, planned action or applicability explanation *

9. Product/service characteristics and controlled production/service arrangements, including work instructions where needed (8.5.1) * Reference and implementation details, planned action or applicability explanation *

10. Customer/external-provider property controls and records of loss, damage, unsuitability and communication where applicable (8.5.3) * Reference and implementation details, planned action or applicability explanation *

11. Production/service change reviews, authorization and necessary actions (8.5.6) * Reference and implementation details, planned action or applicability explanation *

12. Product/service release evidence, acceptance criteria and authorizing persons (8.6) * Reference and implementation details, planned action or applicability explanation *

13. Nonconforming-output records, actions, concessions and decision authority (8.7.2) * Reference and implementation details, planned action or applicability explanation *

14. Performance monitoring/measurement results and customer-satisfaction arrangements (9.1.1-9.1.2) * Reference and implementation details, planned action or applicability explanation *

15. Internal audit arrangements, programme, implementation evidence and results (9.2) * Reference and implementation details, planned action or applicability explanation *

16. Management review arrangements and retained results (9.3) * Reference and implementation details, planned action or applicability explanation *

17. Nonconformity/corrective-action records and effectiveness results (10.2.2) * Reference and implementation details, planned action or applicability explanation *

18. Arrangements for context, interested parties, risks and opportunities (4.1, 4.2 and 6.1) * Reference and implementation details, planned action or applicability explanation *

19. Document/record control and process documentation; a quality manual may be referenced if used (4.4 and 7.5) * Reference and implementation details, planned action or applicability explanation *

20. Storage, handling, warehousing and preservation arrangements where applicable (8.5.4) * Reference and implementation details, planned action or applicability explanation *

21. Infrastructure/equipment maintenance arrangements supporting process operation (7.1.3) * Reference and implementation details, planned action or applicability explanation *

I acknowledge that Annex B applies to this application and that its answers are complete and accurate to the best of my knowledge.

Annex C — Environmental Management System (ISO 14001)

Back to standard selection

1. Describe activities, products/services, locations and environmental boundaries, including neighbouring land uses and sensitive receptors.

2. Is a register of significant environmental aspects and impacts available? Give its date/version and summarize the significant aspects, including normal, abnormal and emergency operations and relevant life-cycle stages. State if it is not yet prepared.

3. Describe principal raw materials, energy and water use, hazardous substances, storage arrangements and resource-intensive processes.

4. Describe air emissions (such as smoke, fumes or dust), noise, wastewater (such as effluent, sewage, chemicals or biological waste), solid waste (such as plastics, metal, used oil, biomedical or municipal waste), and soil/groundwater risks. State which do not apply.

5. Identify environmental permits, legal and other compliance obligations, monitoring requirements and how compliance is evaluated.

6. Summarize spills, environmental incidents, complaints, enforcement action and outstanding corrective actions during the past three years, or since operations began.

7. Describe outsourced environmental services, contractor controls, emergency preparedness and audit access or seasonal constraints.

8. Give the EMS implementation date, latest internal audit and management review dates, and outstanding actions. State clearly if any are not yet completed.

9. Give the total surface area of each site, with units, and describe the main uses of the land/buildings within the EMS boundary.

10. Are documented EMS arrangements, including relevant procedures and records, available and implemented? Identify their status/version and what remains to be prepared.

11. Is an internal environmental audit programme available and implemented? Give the programme period, activities completed and dates, and identify work still outstanding.

12. Describe the industry type and factors affecting environmental complexity. Identify waste/emission control equipment, such as effluent treatment, scrubbers, dust collectors, incinerators or oil traps. SCL will determine the audit-planning complexity category.

I acknowledge that Annex C applies to this application and that its answers are complete and accurate to the best of my knowledge.

Annex E — Facility Management System (ISO 41001)

Back to standard selection

1. Describe the facility management services, facilities, locations and boundaries requested for certification, and identify the demand organization/client.

2. Explain the relationship between the demand organization, FM provider, owners, occupiers and other service providers, including responsibilities.

3. Summarize the facility portfolio: building types, size, occupancy, operating hours, critical assets and locations.

4. Describe in-house and outsourced FM services, staffing by site/shift, subcontractors, suppliers and service interfaces.

5. Identify service agreements, customer/user needs, agreed service levels, performance measures and complaint arrangements.

6. Describe critical service risks, continuity and emergency arrangements, asset maintenance and dependencies that may affect service delivery.

7. Identify relevant statutory, regulatory, contractual, health/safety, environmental and asset-related obligations and compliance arrangements.

8. Give the FM system implementation date, latest internal audit and management review dates, and outstanding actions. State clearly if any are not yet completed.

I acknowledge that Annex E applies to this application and that its answers are complete and accurate to the best of my knowledge.

Annex F — Food Safety Management System (ISO 22000)

Back to standard selection

1. Describe your activities and position in the food chain, products/product groups, intended consumers and intended use. Identify vulnerable consumer groups where relevant.

2. List production, storage, transport, catering or service sites, production lines, shifts, seasonal operations and employee numbers involved in food safety.

3. Describe process flows, processing technologies, raw materials, packaging, storage conditions, shelf life and distribution arrangements.

4. Summarize the hazard analysis, significant biological/chemical/physical/allergen hazards and the HACCP or hazard-control plan, including CCPs/OPRPs where identified.

5. Identify the prerequisite programmes used, including hygiene, cleaning, pest control, supplier assurance, allergen management and prevention of cross-contamination.

6. Identify food-safety legal/customer requirements, approvals, licences and product/market requirements and how compliance is evaluated.

7. Explain traceability, withdrawal/recall and emergency arrangements. Summarize recalls, food-safety incidents or enforcement actions and any open corrective actions.

8. Identify outsourced food-safety-relevant processes and give FSMS implementation, latest internal audit and management review dates. Describe outstanding actions and any incomplete readiness activities.

I acknowledge that Annex F applies to this application and that its answers are complete and accurate to the best of my knowledge.

Annex G — Information Security Management System (ISO/IEC 27001)

Back to standard selection

1. Describe the ISMS boundaries, business activities, locations, remote work, systems and interfaces proposed for certification.

2. Describe categories of information and critical assets handled, their sensitivity, principal services and relevant technology environments. Do not provide passwords, keys or confidential records.

3. Give the number of people in scope, roles, locations, shifts and contractors, including personnel carrying out identical activities.

4. Identify outsourced IT/cloud/hosting services, third parties, dependencies, shared responsibilities and controls over external access.

5. Identify relevant information-security, privacy, statutory, regulatory and contractual obligations, including applicable jurisdictions.

6. Give the date/version of the information-security risk assessment, risk-treatment plan and Statement of Applicability, and summarize their coverage and outstanding work.

7. Summarize significant security incidents and continuity/recovery exercises, corrective actions and restrictions affecting audit access, without disclosing sensitive technical details.

8. Give the ISMS implementation date, latest internal audit and management review dates, and outstanding actions. Describe arrangements for secure evidence review during the audit.

9. Is an approved information-security policy available, communicated to relevant personnel and reviewed? Identify the policy owner and approval/review dates. Explain how you identify the topic-specific policies needed for your risks and obligations, and state any gaps. Provide titles/references only, not full policy text or confidential information.

Information-security policy and document awareness

These are awareness prompts covering policies, statements, plans and procedures. Equivalent titles or combined documents are acceptable for review; this list does not require 32 separate policy documents. Applicability and readiness will be reviewed by SCL. Enter references and brief explanations only; do not paste policy content, passwords or confidential records.

1. Information Security Policy * Reference and implementation details, planned action or applicability explanation *

2. ISMS Scope Statement * Reference and implementation details, planned action or applicability explanation *

3. Risk Assessment and Treatment Methodology * Reference and implementation details, planned action or applicability explanation *

4. Statement of Applicability * Reference and implementation details, planned action or applicability explanation *

5. Information Security Objectives * Reference and implementation details, planned action or applicability explanation *

6. Information Security Roles and Responsibilities * Reference and implementation details, planned action or applicability explanation *

7. Asset Management and Acceptable Use Policy * Reference and implementation details, planned action or applicability explanation *

8. Information Classification and Handling Policy * Reference and implementation details, planned action or applicability explanation *

9. Information Transfer Policy * Reference and implementation details, planned action or applicability explanation *

10. Access Control Policy * Reference and implementation details, planned action or applicability explanation *

11. Identity and Authentication Policy * Reference and implementation details, planned action or applicability explanation *

12. Supplier and Third-Party Security Policy * Reference and implementation details, planned action or applicability explanation *

13. Cloud Security Policy * Reference and implementation details, planned action or applicability explanation *

14. Incident Management Policy and Procedure * Reference and implementation details, planned action or applicability explanation *

15. Business Continuity and ICT Disaster Recovery Policy * Reference and implementation details, planned action or applicability explanation *

16. Privacy and PII Protection Policy * Reference and implementation details, planned action or applicability explanation *

17. Document and Records Management Policy * Reference and implementation details, planned action or applicability explanation *

18. Physical and Environmental Security Policy * Reference and implementation details, planned action or applicability explanation *

19. Remote Working Policy * Reference and implementation details, planned action or applicability explanation *

20. Mobile Device and BYOD Policy * Reference and implementation details, planned action or applicability explanation *

21. Cryptography and Encryption Policy * Reference and implementation details, planned action or applicability explanation *

22. Backup and Restoration Policy * Reference and implementation details, planned action or applicability explanation *

23. Logging and Monitoring Policy * Reference and implementation details, planned action or applicability explanation *

24. Vulnerability and Patch Management Procedure * Reference and implementation details, planned action or applicability explanation *

25. Malware Protection Policy * Reference and implementation details, planned action or applicability explanation *

26. Network Security Policy * Reference and implementation details, planned action or applicability explanation *

27. Secure Development Policy * Reference and implementation details, planned action or applicability explanation *

28. Change Management Policy and Procedure * Reference and implementation details, planned action or applicability explanation *

29. Data Retention Disposal and Destruction Policy * Reference and implementation details, planned action or applicability explanation *

30. Clear Desk and Clear Screen Policy * Reference and implementation details, planned action or applicability explanation *

31. Human Resources Information Security Policy * Reference and implementation details, planned action or applicability explanation *

32. Compliance and Legal Regulatory Requirements Policy * Reference and implementation details, planned action or applicability explanation *

I acknowledge that Annex G applies to this application and that its answers are complete and accurate to the best of my knowledge.

1. Company information

2. Certification requested

Certification analysis for your selected standard

OH&S exposure analysis

QMS documented information and readiness

Information-security policy and document awareness

3. Sites, staff numbers and audit planning

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

Employee numbers at this site

4. Other issues

5. Declaration