What is a surveillance audit, and when must a surveillance audit be conducted?

The surveillance audit requirements apply for System Users certified under ISCC EU and ISCC CORSIA. They do not apply to System Users certified under ISCC PLUS, though if a System User is certified under both ISCC EU and ISCC PLUS, the surveillance audit requirements also apply.

Mandatory surveillance audits have to be conducted by the Certification Body six months after the initial certification of any System User in a high-risk supply chain. A high risk applies to System Users that are collecting, processing, storing or trading materials such as waste and residues (e.g. used cooking oil) or waste and residue-based products (e.g. biodiesel from used cooking oil) that may be eligible for extra incentives (e.g. double-counting) in individual EU Member States.

For collecting points and traders that are dealing with both waste and residues (e.g. used cooking oil or animal fat) and with virgin vegetable oils (e.g. palm oil, rapeseed oil), a surveillance audit shall be conducted three months after the first (initial) certification (covering the first mass balance period). This surveillance audit shall be conducted in addition to the surveillance audit that has to take place six months after the first certification, and it shall follow the same risk-based approach. Surveillance audits shall always be conducted on-site. The surveillance audits should mainly focus on traceability requirements, e.g. the verification of delivery documents and mass balances.

Further information about surveillance audits under ISCC EU is available in the  ISCC EU System Document 203: Traceability and Chain of Custody. 

Further information about surveillance audits under ISCC CORSIA is available in the  ISCC CORSIA System Document 204: Audit Requirements and Risk Management.