What is a surveillance audit, and when must a surveillance audit be conducted?

ISCC EU and ISCC CORSIA:

The surveillance audit requirements apply for System Users certified under ISCC EU and ISCC CORSIA.

Mandatory surveillance audits have to be conducted by the Certification Body six months after the initial certification of any System User in a high-risk supply chain. A high risk applies to System Users that are collecting, processing, storing or trading materials such as waste and residues (e.g. used cooking oil) or waste and residue-based products (e.g. biodiesel from used cooking oil) that may be eligible for extra incentives (e.g. double-counting) in individual EU Member States.

For collecting points and traders that are dealing with both waste and residues (e.g. used cooking oil or animal fat) and with virgin vegetable oils (e.g. palm oil, rapeseed oil), a surveillance audit shall be conducted three months after the first (initial) certification (covering the first mass balance period). This surveillance audit shall be conducted in addition to the surveillance audit that has to take place six months after the first certification, and it shall follow the same risk-based approach. Surveillance audits shall always be conducted on-site. The surveillance audits should mainly focus on traceability requirements, e.g. the verification of delivery documents and mass balances.

Further information about surveillance audits under ISCC EU is available in the  ISCC EU System Document 203: Traceability and Chain of Custody. 

Further information about surveillance audits under ISCC CORSIA is available in the  ISCC CORSIA System Document 204: Audit Requirements and Risk Management. 

ISCC PLUS:

Mandatory surveillance audits shall be conducted by the Certification Body regarding the six-month period following the initial certification of any System User that is part of a high-risk supply chain. Mandatory surveillance audits apply to the following scopes:

• Individually certified Points of Origin, Collecting Points and Central Offices of Points of Origin

• Processing Units which receive multiple inputs (both raw materials and intermediates)

Further information about surveillance audits under ISCC PLUS is available in the System Document ISCC PLUS 201 – System Basics (chapter 3.2.5, Mandatory Surveillance Audits). The document is valid from 13 November 2025 and mandatory from 1 January 2027.

When applying the version 3.4.2 of the ISCC PLUS System Document, surveillance audits do not apply under ISCC PLUS.