CSR Performance

Ladder
Part B – Certification Scheme for
CSR Management Systems
CSR Performance Ladder 4.0 – 01-10-2023

A practical application of People, Planet & Profit,

inspired by the international standard ISO 26000,
supports the UN Sustainable Development Goals and
preparing for Corporate Sustainability Reporting Directive.
 CSR Performance Ladder
Part B – version 4.0

The CSR Performance Ladder –Requirements

for CSR Management Systems and the CSR
Performance Ladder - Certification Scheme
The CSR Performance Ladder is a practical application of People, Planet & Profit inspired by the international standard
ISO 26000, supports the Sustainable Development Goals and prepares for the Corporate Sustainability Reporting
Directive.

Rights
All rights reserved. If this document or any part of it is reproduced, stored in an automated database or published, in any f orm or
manner, whether electronically, mechanically, by means of photocopying, recording or in any other way whatsoever, the source
and version of the CSR Performance Ladder must be properly cited.
Use of the CSR Performance Ladder – Requirements for CSR Management Systems (Part A) and CSR Performance Ladder –
Certification Scheme (Part B) in order to issue a CSR Performance Ladder management system certificate is only permitted by
certification bodies that have concluded a written agreement with the Foundation Sustained Responsibility governing the right of
use.

Indemnification
The Foundation Sustained Responsibility, founder of the CSR Performance Ladder initiative, is not liable for any losses incur red by
a certification body or any third parties as a consequence of applying this certification standard.

Images
The use of the SDG logo and the references contained in this diagram are for information purposes only and are in compliance with
the SDG logo guidelines (May 2020 version).

Availability
The CSR Performance Ladder can be downloaded free of charge at [Link].

Answers to Frequently Asked Questions

For answers to frequently asked questions about CSR Performance Ladder, go to [Link].

Helpdesk/User Instructions
For questions about the content and application of the CSR Performance Ladder, please get in touch with the Foundation
Sustained Responsibility at info@[Link] or contact your certification body.

The two parts CSR Performance Ladder – Requirements for CSR Management Systems and the CSR Performance Ladder –
Certification Scheme were established by the Foundation Sustained Responsibility on the advice of the College of CSR Performa nce
Ladder Specialists on 1 October 2023. In Part B, the interim amendment of 5.1 – Audit days table was added on 23 November
2023.

Practical information about CSR Performance Ladder certification

On the website [Link] you can find information about the registered certification bodies, CSR
Performance Ladder certificates that have been issued, the CSR Performance Ladder standard and more.

Page 2 of 27
 CSR Performance Ladder
Part B – version 4.0

Contents
1 Substantion of CSR certification 5
1.1 Part B - certification scheme 5
1.2 Subject of the audit 6
1.3 Publication of certificates 8
1.4 Transparency and ethics of certification body 9

2 Requirements applicable to certification bodies 10

3 Organisation of the certification body 11
3.1 Personnel 11
3.2 Audit team 11

4 Procedures of the certification body 14

4.1 Frequency of external management system audits 14
4.2 Audits 14
4.3 CSR Performance Ladder – 5 levels 16

5 Audit days table and complexity of organization 17

5.1 Audit days table 17
5.2 Complexity of the organisation 18
5.3 Time to be spent on certification audits 20

6 Audit report and certificate 22

6.1 Requirements for audit report 22
6.2 Nonconformities and non-compliance 22
6.3 Recommendation for CSR management system certificate 23
6.4 Certification decision 23
6.5 Validity period of certificates 23
6.7 Text of the certificate 24
6.8 Sub-certificates 24
6.9 Use of logo and certificate 25

Annexes 26
Annex 1 Technical areas 26
Annex 2 Sample certificate 27

Page 3 of 27
 CSR Performance Ladder
Part B – version 4.0

Introduction
Part B of the CSR Performance Ladder lays down the requirements for certification bodies that currently carry out certification of
conformity with the requirements described in Part A or wish to do so in future.

The key changes in Part B (compared with the 2020 version) are:
• changes in references as a result of version 4.0 of Part A;
• modified Chapter 2 - Requirements applicable to certification bodies;
• changes in CSR issues, based on the CSR issues in version 4.0 of Part A;
• inclusion of the interim amendment dated 25 November 2020, in 5.1 – Audit days table.

A transitional arrangement for certificate holders and certification bodies has been published on the website of the Foundation
Sustained Responsibility (FSR).

Normative and other references

For general references, see the list published in Part A.

IAF MD 1 Audit and Certification of a Management System Operated by a Multi-Site Organization

IAF MD 5 Determination of Audit Time of Quality, Environmental, and Occupational Health and Safety Management
Systems
IAF ID 1 IAF Informative Document for QMS and EMS Scopes of Accreditation

Terms and definitions

For general terms and definitions, please refer to Part A. Further definitions of the certification process are based on ISO 17021.

Page 4 of 27
 CSR Performance Ladder
Part B – version 4.0

1 Substantion of CSR certification

The CSR Performance Ladder certificate provides objective evidence that an organisation has a Corporate Social Responsibility
management system that manages stakeholder requirements and expectations with a view to results. The CSR Performance Ladder
is a standard comprised of two documents:

1. Part A: CSR Performance Ladder – Requirements for CSR Management Systems. This document covers the CSR management
system, stakeholder management, issue management and the five levels of the CSR Performance Ladder.

2. Part B: CSR Performance Ladder – Certification Scheme. This document sets out the requirements for ensuring that CSR
Performance Ladder certification is carried out properly, including requirements concerning certification bodies, the
certification process, the five certification levels and the time to be spent on audits. This document is aligned with ISO 17021:
Conformity assessment. Requirements for bodies providing audit and certification of management systems.

The CSR Performance Ladder applies to organisations that feel the need to improve their societal impact, whatever sector they
may belong to. Obtaining certification and undergoing annual audits is a form of communication with internal and external
stakeholders. The organisation itself indicates the level (1 to 5) at which the CSR certification audit should begin. It is then up t o
the certification body to determine the level for which a CSR Performance Ladder certificate can be issued.

1.1 Part B - certification scheme

The organisation undergoing certification is responsible for implementing the management requirements of the CSR Performance
Ladder, ensuring that they are embedded in the organisation and demonstrating compliance. The organisation whose activities
and business entity/entities are named on the CSR certificate has its own ethical responsibility for appropriate use and for accura te
communication regarding the validity and level of its CSR Performance Ladder certification.

An organisation’s performance in relation to the CSR Performance Ladder indicates the extent and depth of development of its
sustainability efforts. Stakeholders play a major role in ensuring that the organisation’s activities are acceptable to socie ty. The
constant thread running through the CSR Performance Ladder is the management of stakeholder engagement and expectations. At
each level the CSR Performance Ladder lays down requirements for the extent to which stakeholder engagement and
communication are realised and stakeholder expectations are effectively managed. Companies and organisations that choose to
undergo certification for conformity with this standard shall comply with Parts A and B of the CSR Performance Ladder.

There are five possible levels for CSR management systems. An organisation can be issued with a CSR Performance Ladder
certificate at any level from 1 to 5, depending on the results of the certification audit. At entry levels 1 and 2, this cert ificate is
valid for one year, and the organisation is expected to have a policy and plans in place to progress to at least level 3.

CSR Performance Ladder certificates at levels 3, 4 and 5 are valid for three years and are readopted or amended by the regist ered
certification body every three years. The level on the CSR Performance Ladder attained by the organisation is stated on the
certificate and registered at [Link].

Page 5 of 27
 CSR Performance Ladder
Part B – version 4.0

CSR certificates Recertification

Validity Subsequent audit
for each level within

Level 5 certificate 3 years Annual 3 years

Level 4 certificate 3 years Annual 3 years
Level 3 certificate 3 years Annual 3 years
Entry levels
Level 2 certificate 1 year - -
Level 1 certificate 1 year - -
The organisation indicates the level at which it wants to be assessed and the certification body determines the level at which
the organisation shall be certified. For entry levels 1 and 2, the organisation is obliged to have policy and plans in place to
progress to at least level 3.

Each CSR Performance Ladder audit is based on sampling and the certification body is unable to guarantee 100% conformity with
the standard. The certification body issues a declaration concerning the CSR management system in the form of a CSR Performan ce
Ladder certificate. The certification bodies that use the CSR Performance Ladder are registered at
[Link]. These auditors and certificate reviewers shall be able to demonstrate that they fulfil the training
and qualification criteria in relation to the CSR Performance Ladder. The registered certification bodies are accredited for
management system certification (ISO 17021) and apply the requirements described in Parts A and B of the CSR Performance
Ladder as well as the general certification rules laid down in their own certification schemes.

1.2 Subject of the audit

Each CSR Performance Ladder audit, whether it is an initial audit, annual audit or takes place for certificate expansion or
recertification purposes, will be carried out in the organisation and will in any case concern the primarily responsible parties as
described in Part A, Chapter 5, ‘Leadership’. The subject of the audit is to examine whether the organisation demonstrably
addresses CSR issues, through its ambitions and dialogue with stakeholders, as a result of leadership by its top management. Top
management is required to initiate and coordinate management efforts to achieve CSR results, as well as communication with and
feedback from stakeholders. Stakeholder management and communication shall be embedded in the management system.
The organisation shall demonstrably and transparently implement CSR and report on CSR annually.

The audit includes a sample of CSR issues, examining how the objective is established, the extent to which a CSR issue is
implemented and realised, and active communication with stakeholders, including feedback from stakeholders on the issue.
Different certification standards may apply at operational level. An organisation’s stakeholders may set specific requirements for
the management system and for products and processes, and may demand verification, declarations, reports or certificates
regarding certain aspects. These documents will be incorporated in the CSR management system. The CSR Performance Ladder
audit differs for each level. The scope of the organisation’s CSR management system is also examined by the CSR certification audit
and will be stated as an audit result in the CSR Performance Ladder certificate.

The CSR Performance Ladder certification audit focuses on the functioning of the CSR management system as regards:
1. the management system for policymaking and implementation;
2. the functioning of stakeholder management; and
3. the organisation’s CSR issue management.

The requirements for management systems and stakeholder management are regarded as universal by the audit team and require
general knowledge of management systems and of the management requirements described in the CSR Performance Ladder.

Page 6 of 27
 CSR Performance Ladder
Part B – version 4.0

The CSR issues, on the other hand, are distinctive. These issues require focus during the performance of the certification au dit. The
combination of the CSR management system and the focus on CSR are factors for determining the necessary auditor competence s
and the necessary audit time.

Six guiding principles for the CSR Performance Ladder are described in 1.2.1 to 1.2.6.

1.2.1 CSR management system

The aim of the CSR management system is to manage the development and implementation of CSR policy on CSR issues in dialogue
with stakeholders and to do this efficiently, effectively and focusing on results, in order to enable improved CSR performanc e and
active communication with stakeholders.

1.2.2 Technical area of the organisation

Six technical areas have been identified:
1. Production
2. Care & Healthcare
3. Trade & Distribution
4. Food
5. Construction
6. Services
Classifying the organisation based on one or more technical areas will bring focus to the certification body and its CSR cert ification
services.

1.2.3 Issues for technical areas

Annex 1 of Part A of the CSR Performance Ladder lists 26 issues. The requirements for stakeholder and issue management
described in Part A are used to elaborate these issues for the organisation. In Part B the 26 issues are divided into universal issues
and specific issues for particular technical areas for the purpose of CSR certification audits (see Annex 1).

[Link] Universal issues

On account of legislation and the subject area, the universal issues can be interpreted in a universal manner in certificatio n audits,
regardless of the technical area of the organisation in question. These include issues such as ‘Equal treatment’.

[Link] Specific issues

All specific issues will have a specific interpretation and impact in different technical areas and in light of a specific or ganisation’s
activities and sectoral/supply chain relationships, and this will be taken into account during the certification audit . The specific
issues shape the manner in which the audit is carried out and the specific knowledge required of the audit team.

[Link] Additional issues

Stakeholder management may lead to one or more additional issues (for example, animal welfare). These ‘additional issues’ (se e
Part A, 4.4 – Material CSR issues and significant stakeholders) are specific to the particular audit in question.

Page 7 of 27
 CSR Performance Ladder
Part B – version 4.0

1.2.4 Complexiteit van de organisatie

The organisation is classified according to its complexity, and the audit time is then determined by taking into account the number
of personnel. Complexity is determined using six criteria:
1. the technical area of the organisation;
2. its international relations;
3. number of sites;
4. certification under other management system standards;
5. CSR report (possibly externally audited); and
6. desired certification level on the CSR Performance Ladder.

Organisations are assigned to one of the four CSR complexity categories: high, medium, low or limited. The ‘audit days table’ in
Chapter 5 is used to determine the audit time. Due to differences in complexity, audit time will always depend on the individual
circumstances.

1.2.5 Top management and CSR roles in the organisation

During the audit, the people working at an organisation are a source of information about the implementation of the CSR
management system. The focus of the CSR Performance Ladder audit should in any case be on top management and the
individuals with roles, responsibilities and authorities in the organisation that are relevant to CSR (part A, 5.3 – Roles,
responsibilities and authorities within the organisation). Additionally, for the sample concerning implementation of CSR issues
(part A, Chapter 8 – Execution), one or more employees in particular departments can also act as a source of information. The CSR
Performance Ladder’s focus on top management and responsibilities for management actions largely determines the planning of
the audit.

1.2.6 Details and results of CSR

Before the certification audit, time and space is allocated for desk research. In addition, during the audit sampling takes p lace
concerning implementation of the CSR issues within the organisation (see 4.2.5).

During the desk research carried out by the audit team’s lead auditor, the organisation is examined in its context in terms o f: CSR
presentation, realisation and perceptions in society. The desk research brings focus to the specific CSR knowledge about the
organisation.

The organisation establishes CSR issue management and stakeholder management in accordance with Part A. During the
certification audit, policymaking on CSR issues, including communication with stakeholders, is audited in accordance with the Plan,
Do, Check and Act (PDCA) management cycle. The sample covers the minimum number of CSR themes audited in the organisation
in relation to implementation in the primary and support processes. Applying sampling to the implementation of CSR issues bri ngs
focus to the audit.

1.3 Publication of certificates

The certification body shall ensure that CSR Performance Ladder certificates that have been issued or withdrawn are published at
[Link] in order to maintain an up-to-date public record. The certification body is responsible for
ensuring that the register remains up-to-date. The certification body will reach a formal agreement on this subject with the
certified organisation.

Page 8 of 27
 CSR Performance Ladder
Part B – version 4.0

1.4 Transparency and ethics of certification body

The certification body shall endeavour to perform its certification services in relation to the CSR Performance Ladder ethica lly and
transparently, in accordance with the provisions of this certification standard. The establishment, performance and reporti ng of
audits, the decisions made regarding certification and the issue of certificates in accordance with the CSR Performance Ladde r will
always take place in a reproducible, substantiated and demonstrable manner.

The certification body shall act ethically and make demonstrable efforts to increase support for this certification standard among
stakeholders for the benefit of the CSR Performance Ladder, taking into account the intrinsic and societal value of this stan dard
and service.

The certification body shall make use of the Board of Experts and submit questions concerning the interpretation and applicat ion
of the CSR Performance Ladder to the board, for the benefit of the general interests of stakeholders, including participating
certification bodies and the relevant certificate holders.

The CSR Board of Experts, which is appointed by the Foundation Sustained Responsibility (FSR), oversees the management of the
CSR Performance Ladder and makes adjustments where necessary in close cooperation with stakeholders in the area of corporate
social responsibility and certification.

Page 9 of 27
 CSR Performance Ladder
Part B – version 4.0

2 Requirements applicable to certification

bodies
The certification body shall conclude an agreement for CSR certification with the Foundation Sustained Responsibility (FSR). This
agreement with FSR allows the certification body to use the CSR Performance Ladder. The certification bodies that are entitle d to
carry out CSR certification in accordance with this certification standard are registered on the website
[Link].

The certification body shall hold a relevant and valid accreditation certificate for ISO/IEC 17021, specifying at least ISO 9 001. The
certification body shall comply with this certification scheme in order to perform CSR Performance Ladder certification activ ities.

In addition to the specific requirements for the CSR Performance Ladder contained in this certification scheme, the requireme nts
of ISO/IEC 17021-2015 also apply in full.

The accreditation for ISO 9001 should concern at least one IAF code within the technical area for which the certification bod y
carries out CSR Performance Ladder certification audits (see Annex 1).

The Foundation Sustained Responsibility (FSR) supervises the affiliated certification bodies by means of, among other things,
harmonisation days and consultation meetings with certification bodies. The details of this supervision are regulated by the
agreement between FSR and the certification body.

Page 10 of 27
 CSR Performance Ladder
Part B – version 4.0

3 Organisation of the certification body

3.1 Personnel
The certification body is responsible for establishing, securing and maintaining an appropriate qualification system for its audit
personnel in accordance with ISO 17021 and the criteria of the CSR Performance Ladder. The CSR Performance Ladder qualificati on
criteria are aimed at the basic qualifications in relation to CSR and for each technical area. The certification body shall a rchive its
qualification records and ensure that they are searchable by individual for all audit team members.

The personnel involved in certification are divided into the following roles:
• Auditor: responsible for carrying out the CSR certification audit. The auditor also assesses the organisation’s results, repo rts
on the audit, determines the organisation’s level on the CSR Performance Ladder, makes recommendations for CSR
certification and conducts annual follow-up visits.
• Reviewer: responsible for reviewing the audit process that has been carried out and the audit report that has been prepared.
• Decision maker: responsible for making decisions on the issue and renewal of a CSR certificate at a particular level.

The reviewer (of the audit report) and the decision maker may be the same individual. The qualified CSR auditor, reviewer and
decision maker shall work for a certification body that is registered on the website [Link]. The CSR
auditor may be hired externally, but the reviewer and decision maker shall be employees of the certification body. The CSR au ditor
shall demonstrably be qualified by his/her certification body to conduct audits in accordance with the CSR Performanc e Ladder.

3.2 Audit team

The CSR Performance Ladder audit is carried out by an audit team. The audit team may be comprised of a single person and shall
have the basic qualifications (3.2.1) and the qualifications required for the organisation’s technical area (3.2.2).

The division of responsibilities within the audit team regarding CSR issues is as follows:
• The organisation is audited on specific issues for a particular area by an auditor who is qualified for that technical area.
• The organisation is audited on universal issues by an auditor who at least has the basic qualifications.

The audit team may be supplemented by experts in relation to employment, specific subjects and/or national legislation and lo cal
custom. An audit team expert will not be needed for fulfilment of the audit time requirement and his/her work will supplement –
and be supervised by – a CSR Performance Ladder auditor. The certification body ensures that the expert has the qualifications for
the technical area, but he/she does not require the basic qualifications for auditors.

Page 11 of 27
 CSR Performance Ladder
Part B – version 4.0

3.2.1 Basic qualifications and competence of auditors

The following (A) knowledge, experience and (B) skills are the basic qualifications required of CSR Performance Ladder auditors.

Basic qualification of CSR Performance Ladder auditors

A Knowledge and experience Basic qualifications

1 Knowledge of organisational management Qualification or equivalent experience at Bachelor degree level.

2 Knowledge of audit principles and of IRCA-accredited training for lead auditors or demonstrably
management system audits equivalent training.
3 Knowledge of ISO 26000 and its principles Internal or external training on ISO 26000.
4 Knowledge of the CSR Performance Ladder A training course based on the full CSR Performance Ladder (i.e.
Parts A and B), latest version.
5 Experience of working as a management Qualified by an ISO 17021-accredited certification body as
system auditor auditor/lead auditor for management systems in accordance with
17021.
6 Up-to-date knowledge of the CSR Performance Participation in the CSR Performance Ladder harmonisation
Ladder meetings at least once a year.

B Skills Basic qualifications

7 CSR Performance Ladder audit skills Successful performance of an audit in the role of auditor, assessed
on procedure for at least one full audit at level 3 or higher. The full
audit shall have been carried out under the supervision of a CSR
Performance Ladder lead auditor.
8 CSR Performance Ladder audit skills, level 5 • Qualified as a CSR Performance Ladder auditor for at least 1.5
years,
• during which at least three CSR Performance Ladder audits
have been carried out.

3.2.2 Auditor qualifications for CSR Performance Ladder technical areas

The following knowledge and experience are required specifically for each of the six individual technical areas. This means t hat CSR
Performance Ladder auditor needs the necessary qualifications for individual technical areas.

Auditor qualifications in technical areas for specific issues

CSR Performance Ladder
Knowledge and experience Demonstrable for each technical area by means of:

1 Knowledge of the technical area Qualified by an ISO 17021-accredited certification body as

auditor/lead auditor of one or more management systems in an IAF
code within the technical area.
2 Knowledge of the specific CSR issues in the Familiar with the characteristics* of the specific issues in the
technical area technical area.
3 Up-to-date knowledge of the technical area** Familiar with the changes in the characteristics of the specific
issues in the technical area, as identified by the certification body.
* Characteristics for each specific issue for each technical area shall include at least:
• legislation related to the issue;
• measurement methods related to the issue;
• stakeholders related to the issue;

Page 12 of 27
 CSR Performance Ladder
Part B – version 4.0

• voluntary agreements and/or sectoral policy on CSR.

** The certification body is responsible for documenting the characteristics in writing and for determining, updating and
communicating them (based on its own customer base) for the specific issues in each technical area covered by its CSR
Performance Ladder activities. The certification body determines these characteristics and communicates them to the auditors
who have the relevant qualifications.

3.2.3 Reviewer CSR Performance Ladder

The following knowledge and skills criteria apply to the CSR Performance Ladder reviewer.

Knowledge and experience Demonstrable for 6 technical areas by means of:

1 Knowledge of organisational management Qualification or equivalent experience at Bachelor degree level.

2 Knowledge of the CSR Performance Ladder A training course based on the full CSR Performance Ladder (i.e.
Parts A and B).
3 Experience as an auditor of management Qualified by an ISO 17021-accredited certification body
systems

3.2.4 Decision maker CSR Performance Ladder

The following knowledge and skills criteria apply to the CSR Performance Ladder decision maker.

Knowledge and experience Demonstrable for 6 technical areas by means of:

1 Knowledge of organisational management Qualification or equivalent experience at Bachelor degree level.

2 Knowledge of the CSR Performance Ladder A CSR training course based on the CSR Performance Ladder (Part
certification process B).

Page 13 of 27
 CSR Performance Ladder
Part B – version 4.0

4 Procedures of the certification body

4.1 Frequency of external management system audits
CSR Performance Ladder audits of certificate holders and prospective certificate holders are carried out at least once a year.

4.2 Audits
CSR Performance Ladder certification audits are conducted in accordance with the steps set out in 4.2.1 - 4.2.6.

Desk research Fase 1 Fase 2

Initial audit ✓ ✓ ✓
Surveillance audit ✓
Recertification ✓ ✓
Higher level ✓ ✓ ✓
Certificate expansion ✓ ✓

4.2.1 Preparatory desk research

Desk research is a formal part of CSR Performance Ladder certification audits. It involves preparatory research by the lead a uditor
and always take place prior to stage 1, recertification and certificate expansion.

Desk research does not need to be carried out on-site at the organisation’s premises. During desk research, the organisation is
examined in its current context in terms of: CSR presentation, realisation and perceptions in society. The sources for desk r esearch
will in any case include:
a. The customer’s website and websites from the sector and technical area, for instance CSR report, sectoral policy and
voluntary agreements.
b. Online research using search terms targeted at the organisation and one or more of its activities as well as search terms for a
sample of the specific issues for this audit (Annex 1).

The desk research brings focus to the specific CSR knowledge about the organisation and also functions as input for the audit .

4.2.2 Certification audit - stage 1

Stage 1 of the audit is intended to determine whether the extent to which the management system has been implemented
indicates that the customer is ready for stage 2. It also determines the necessary resources and planning for stage 2. Beside s the
subjects specified in ISO 17021, specific assessment points for the CSR Performance Ladder are:
a. Determination of the scope of the system using the analysis of the context of the organisation (Part A, Chapter 4);
b. Determination of the structure of leadership and organisation (Part A, Chapter 5) and CSR policy (Part A, 5.2);
c. Assessment of the structure and embedding of the CSR management system (Part A, Chapters 4 to 10);
d. Assessment of the determination of issues and stakeholders (Part A, 4.4);
e. Assessment of the structure of active stakeholder communication (Part A, 7.4).

This input is used in preparing the audit plan and as initial information for the audit report. Stage 1 and the desk research provide
an indication of the certification level and assist with the preparations for stage 2 of the certification audit.

Page 14 of 27
 CSR Performance Ladder
Part B – version 4.0

4.2.3 Certification audit - stage 2

Stage 2 of the audit is conducted on-site at the organisation’s premises in accordance with the audit plan drawn up after stage 1.
The aim is to assess how all the requirements in Part A are implemented and complied with in practice. Stage 2 consists of an audit
of the CSR management system (including stakeholder and issue management) in practice, according to the Plan, Do, Check and
Act (PDCA) cycle. The audit of the implementation of CSR issues (including material CSR issues) is based at least on the samp le
described in 4.2.5. The certification audit will lead to a positive or negative certification decision.

4.2.4 Annual surveillance audits

These audits only apply at levels 3, 4 and 5, and are carried out on-site at the organisation’s premises. An annual surveillance audit
examines the level status and development of the CSR management system, stakeholder management and CSR issues (including
material CSR issues) in accordance with the requirements set out in Part A. In practice that means an assessment of:
a. the implementation of annual management actions;
b. the updating and elaboration of issues (including material issues);
c. the updating and elaboration of stakeholder management;
d. stakeholder communication, implementation of plans, feedback and updating;
e. updates, changes and registrations of the CSR management system as described in Part A, Chapters 9 and 10;
f. a sample concerning (Part A, 4.4) the implementation of objectives in relation to CSR issues (including material issues);
g. the effectiveness of CSR policy in relation to realising objectives and intended results;
h. the CSR report;
i. the final annual audit of the three-year period is also used to draw up an audit plan for recertification.

4.2.5 Sampling during audits

Audits involve sampling the implementation of the analysis and actions related to the CSR issues (including material issues). The
sampling takes place on-site at the organisation’s premises and the sample shall include at least one issue for each core subj ect. If
an issue has been determined to be material, then that issue shall be assessed.

4.2.6 Recertification of the CSR management system

After each three-year period, a recertification audit is conducted for levels 3, 4 and 5 on-site at the organisation’s premises. The
aim of the recertification audit is:
a. To determine or recalibrate the organisation’s level and its compliance with the requirements set out in Part A (see also
4.2.3). Developments in the context of the organisation, for instance in the sector, may lead to changes in the issues
(including the issues determined to be material).
b. Recertification also involves desk research.
c. To audit the organisation in relation to the effectiveness of stakeholder management, the ability to make adjustments based
on results and the realisation of CSR policy objectives by means of its CSR management system.

Page 15 of 27
 CSR Performance Ladder
Part B – version 4.0

4.3 CSR Performance Ladder – 5 levels

4.3.1 Entry levels 1 and 2

A CSR certificate at level 1 or 2 is valid for one year and expires at the end of that period. The issue of another level 1 o r level 2
certificate is not permitted. An organisation at level 1 or 2 is expected to progress to at least level 3 once that perio d ends.

4.3.2 Level 3, 4 and 5

A CSR certificate at level 3, 4 or 5 is valid for three years, is audited annually based on sampling and is readopted every t hree years.
The following additional conditions apply at level 4 and 5.

[Link] Level 4
An organisation at level 4 has consciously chosen to maintain – and has worked on maintaining – level 4 for a period of three years.
After being certified at level 4 for three years, upon recertification the organisation shall demonstrate in relation to al l applicable
requirements that it can be certified again at level 4 for another three years. The alternative, upon recertification followi ng three
years of CSR management at level 4, is certification at level 3 (this could happen if for instance the level in the sector has risen
substantially and the organisation’s performance no longer stands out).

[Link] Level 5
Level 5 is the highest level of attainment on the CSR Performance Ladder. In order to attain level 5, the organisation shall have
demonstrably implemented the requirements for level 3 or 4 of the CSR performance ladder and, in addition, it shall demonstra bly
comply with the requirements of level 5. An organisation at level 5 has consciously chosen to maintain – and has worked on
maintaining – level 5 for a period of three years. After being certified at level 5 for three years, upon recertification the
organisation shall demonstrate in relation to all applicable requirements that it can be certified again at level 5 for another t hree
years. The alternative, upon recertification following three years of CSR management at level 5, is certification at level 4 or 3 (this
could happen if for instance the level in the sector has risen substantially and the organisation’s performance no longer sta nds
out).

Page 16 of 27
 CSR Performance Ladder
Part B – version 4.0

5 Audit days table and complexity of

organization
The audit time for the CSR Performance Ladder can be determined in terms of audit days based on the organisation’s complexity
and number of personnel. Organisations are divided into different complexity categories in order to determine audit time. The
categories (in order of decreasing complexity) are: high, medium, low and limited (as in the IAF MD5 for EMS).

5.1 Audit days table

The audit time in the audit days table is a unit for determining the minimum time to be spent on all types of CSR Performance
Ladder audits for the organisation that is undergoing certification.

Duration of initial certification audit in days (desk research, stage 1 + stage 2),
depending on number of personnel and complexity of the organisation.

# of personnel High Medium Low Limited

1-5 3 2.5 2.5 2.5
6-10 3.5 3 3 3
11-15 4 3.5 3 3
16-25 4 3.5 3 3
26-45 5 4 3 3
46-65 6 5 4 3.5
66-85 6 5 4 3.5
86-125 6 5 4 3.5
126-175 7 5.5 4 3.5
176-275 8 6 4.5 3.5
276-425 10 8 6 4.5
426-625 12 9 7 5
626-875 13 10 7 5
876-1175 15 11 8 5.5
1176-1550 16 12 9 6
1551-2025 17 13 10 6.5
2026-2675 18 14 11 7
2676-3450 20 16 12 7.5
3451-4350 22 17 12 8
4351-5450 23 18 13 8.5
5451-6800 25 19 14 9
6801-8500 27 20 15 10
8501-10700 29 22 16 11
>10700 Extrapolate if the number of personnel is higher

Page 17 of 27
 CSR Performance Ladder
Part B – version 4.0

Notes on the audit days table:

1. The audit time depends on the complexity category to which the organisation has been assigned: high, medium, low or
limited.
2. The complexity of the organisation is determined using the next clause (5.2).
3. The audit time excludes travel time to and from the organisation’s premises.
4. The audit time includes time for the audit report.

In determining the number of personnel in the organisation, the following factors are taken into account:
1. The number of personnel (including self-employed contractors, on-call workers and workers with flexible employment
relationships) at the organisation undergoing certification is based on the number of FTEs.
2. On the total number of FTEs, FTEs can be deducted when dealing with repetitive functions (large quantities of a single
process) (application of IAF MD5), and this group of FTEs may be reduced to justify the correct audit time (for example: 100
FTE is thus reduced to 25 FTE).
3. The number of personnel in the table should be seen as a continuum rather than a stepped change.
4. For organisations with more than 10,700 employees, the certification body shall follow its own procedure.
5. In the technical area (2) Care & Healthcare, the organisation’s volunteers are converted into FTEs.

5.2 Complexity of the organisation

The complexity of the CSR organisation that is undergoing certification is based on:
1. the technical area of the organisation;
2. its international relations;
3. the number of sites;
4. certification under other management system standards;
5. CSR report (possibly externally audited); and
6. the desired certification level on the CSR Performance Ladder.

In addition, internal cohesion within the organisation is another factor in determining whether complexity should be determin ed in
one instance (via sampling) or on multiple occasions.
• If it is demonstrable that the organisation is controlled centrally with a single management system and that the underlying
entities/sites with similar activities function on the basis of this central control, the organisation may be eligible for sa mpling
(see IAF MD1). Sampling: the complexity and audit time for the entire organisation can be determined in a single instance if
such coherence exists in the organisation. This has implications for the aspects of complexity:
o Aspects 1, 2 and 3 increase complexity if these apply to the organisation.
o Aspects 4 and 5 shall be demonstrably applicable to the entire organisation, otherwise they will not apply as
aspects that reduce complexity.
• The categorisation of an organisation according to its complexity is determined for each independent entity of the
organisation, following which the number of personnel can be used to determine the audit time for this entity.

Using the requested information, the certification body determines the complexity of the organisation and the necessary audit
time, which it documents in the customer data. This shall be updated prior to each audit that results in a certification deci sion.

Page 18 of 27
 CSR Performance Ladder
Part B – version 4.0

Aspects of the complexity of the organisation Increase/decrease in complexity: +/-

Do the organisation’s activities fall within more More than one technical area? In that case, each extra
1 +…
than one technical area? technical area increases complexity by one step.
Import / outsourcing. Do a substantial portion of
2 the activities involve supplies of components If the answer is ‘yes’, this increases the organisation’s +…
and/or raw materials from abroad? complexity by one step.
Does the organisation have multiple sites? If the answer is ‘yes’, this increases the organisation’s
3 +…
Sites will be sampled during the audit. complexity by one step.
Certification in conformity with at least two other
management system standards, such as ISO 9001,
If there are two management systems, this reduces
ISO 14001, ISO 45001 or ISO 22000. This
complexity by one step;
4 certification has the same scope as the CSR -/- …
if there are three or more management systems, this
management system and takes place pursuant to
reduces complexity by two steps.
ISO 17021 accreditation by an IAF-affiliated
accreditation body.
Is there an externally audited CSR report for the
organisation that is undergoing certification, If the answer is ‘yes’, this reduces complexity by one step.
5 issued no more than 1 year prior to the audit with -/- …
a recommendation for the CSR Performance External auditing is mandatory at level 5.
Ladder certificate?
Sum total of changes in complexity:
Copy the result to (6) in column B, adjacent to the desired certification level.

Column A Column B Complexity of the organisation

What is the desired
6 Level x represents Sum total of H M L L
certification level?
the category: change High Medium Low Limited

Level 1 Limited

Level 2 Limited

Level 3 Low

Level 4 Medium

Level 5 High

Determining of the complexity of the organisation

1. The effect of the aspects of complexity (1 to 5) on the organisation generates the sum total of the change in complexity.
2. What certification level does the organisation want to attain? The sum total of the change in complexity (from 1 to 5 above)
is noted (in 6), in column B, adjacent to the desired certification level, on the same line.
3. The complexity of the organisation is determined using the sum total of the change in steps – increase (+) or decrease (-),
column B – compared with the category given in column A. In the audit days table, if the result is an increase (+), complexity
shifts to the left. If the result is a decrease (-), complexity shifts to the right compared with the level category (6).
The complexity of the organisation always falls into a single category: high, medium, low or limited.
Example: an organisation has 100 personnel, the sum total of the change in complexity is +1 step and the desired level is 3. In
that case, the complexity of this organisation is (low + 1 step =) medium. In the audit days table, where the organisation ha s
100 personnel and its complexity is medium, the audit time indicated is five audit days.

Page 19 of 27
 CSR Performance Ladder
Part B – version 4.0

4. If a large organisation (multinational) with high media exposure, lots of international stakeholders and/or international sit es
is undergoing certification, the complexity of the organisation is classified as high, giving reasons for this, and a cautiou s
approach should be taken to reducing audit time.
5. See aspect 3: sites abroad. In the case of organisations that have sites abroad and are covered by a CSR Performance Ladder
certificate, the calculations should always be based on the central office (to be stated on the certificate). (Reference: IAF MD
1 rules) Specific requirement regarding audit samples at sites: the allocation within the sample between domestic sites and
sites abroad shall be substantiated, giving relevant, clear reasons in writing. The sample shall always include at least one site
abroad in the case of initial audits, annual surveillance audits and recertification audits.
6. See aspect 5. An externally audited CSR report that complies with the requirements set out in Part A, 7.5 d/e.

5.3 Time to be spent on certification audits

The audit time in the audit days table (complexity/number of personnel) is a unit for determining the time to be spent on all of the
following CSR Performance Ladder audits. Reporting time is a percentage of the audit time.

5.3.1 Initial audit

The initial certification audit requires the total number of audit days indicated in the table and encompasses stage 1 (inclu ding
desk research) and stage 2.
1. Stage 1 of the audit requires at least one audit day, with half a day for desk research at least half a day for an on -site visit to
the organisation. An interim report will be prepared.
2. The rest of the audit time is allocated to stage 2 of the audit. A final report will be prepared.

5.3.2 Annual surveillance audits

In the case of surveillance audits, 50% of the audit time indicated in the audit table is allocated (the number of audit days is
rounded up).

5.3.3 Recertification at level 3, 4 or 5

In the case of recertification audits, two-thirds of the audit time indicated in the audit table is allocated (the number of audit days
is rounded up). These audits are conducted once every three years. Recertification does not involve a separate stage 1. The
recertification audit does include half a day for off-site desk research.

5.3.4 Audit for a higher level

The audit time as indicated in the audit days table. Conducted as an initial audit.
Following each level change, the level 3, 4 or 5 CSR Performance Ladder certificate will be reissued for three years, replaci ng the
previous certificate and starting a new certification period with a new expiry date.

5.3.5 Audit for a lower level

An organisation may request that its next audit should be aimed at certification at a lower level (no lower than level 3). In that case
the audit time for this lower level will be determined. No new initial audit will be necessary.

Page 20 of 27
 CSR Performance Ladder
Part B – version 4.0

5.3.6 Audit for certificate expansion (not for a higher level)

Such an audit will always be carried out in conjunction with one of the CSR Performance Ladder audits. When carried out in
combination with an audit for recertification or an audit for a higher level, the audit time will be determined based on the adjusted
complexity and the number of personnel.

For an organisation at level 3, 4 or 5, a certificate adjustment of this nature may also be desirable during the course of a three-year
certificate period as a result of an increase in complexity. A certificate expansion may be combined with the annual sur veillance
audit, and extra audit time will be added for this purpose. The organisation may also request an interim assessment for the
purposes of certificate expansion. The extra audit time can be determined by consulting the audit days table and comparing the
audit time for the previous complexity/number of personnel with the audit time for the new complexity/number of personnel. Th e
difference between these audit times (new audit time minus previous audit time) is the extra audit time. If the difference i s
calculated as 0, at least one extra day will be taken. In addition, the extra audit time that is calculated shall also actual ly be spent
on certificate expansion.

Page 21 of 27
 CSR Performance Ladder
Part B – version 4.0

6 Audit report and certificate

6.1 Requirements for audit report
The report on the CSR audit shall meet the same requirements that apply to management system certification under ISO 9001.
Depending on the type of audit, the following results shall be documented:
• the requirements and implementation of the applicable CSR Performance Ladder level;
• Plan, Do, Check and Act (PDCA) requirements and implementation of the CSR management system;
• demonstrable documents from the organisation concerning the status and results of CSR and the CSR management system;
• overall picture of the results for each core subject, the material issues and the accompanying CSR indicators obtained as a
result of the audit;
• details and implementation findings about the issues covered by the audit sample.

If the requirements could not be demonstrated or the organisation was not yet able to fulfil them, this will be stated in the report.
Each audit report shall include the lead auditor’s conclusion on the status in relation to the CSR Performance Ladder. The audit
report will be submitted to the organisation’s top management by the certification body.

The audit report remains inextricably linked with the certificate as substantiation of the organisation’s level on the CSR
Performance Ladder. The audit report is confidential and cannot in itself be used to demonstrate to third parties that the
organisation complies with the requirements of the CSR Performance Ladder.

6.2 Nonconformities and non-compliance

At each level the CSR management system shall comply, at the very least, with the management system requirements and
stakeholder management. In addition, the system shall include all issues prescribed for that level.
If a requirement of the standard is not complied with (or complied with in full), then major or minor nonconformities will be
identified. These nonconformities will be identified and followed up in accordance with the requirements of ISO 17021. A
supplementary definition of major nonconformities, specifically applicable to the CSR Performance Ladder, is given below in 6.2.1.

In addition, a nonconformity may be identified in relation to a requirement that only applies to the level for which certific ation has
been requested. In some cases it will be then be possible to certify the organisation at a lower level until this ‘level nonconformity’
has been resolved. More detailed rules on this subject are given in 6.2.2.

6.2.1 Major nonconformity

In the case of nonconformities in relation to components of the management system or non-compliance with requirements related
to CSR issues (involving a failure to recognise or take sufficient account of societal interests), the audit report shall not e this as a
major nonconformity. In the case of nonconformities of this nature, the organisation may be failing to fulfil its corporate s ocial
responsibility.

Page 22 of 27
 CSR Performance Ladder
Part B – version 4.0

6.2.2 Level nonconformity

A failure to comply with level requirements, stakeholder management and CSR objectives may give rise to nonconformities that
determine whether the organisation should be certified at a lower level. In the case of nonconformities of this nature, the
organisation will not be failing to fulfil its corporate social responsibility.
• In the case of initial certification, the organisation may be eligible for a certificate at a lower level than the level it r equested.
• In the case of recertification, the result cannot be certification at level 1 or 2. In the case of level 3, a level nonconfor mity will
be treated as a critical nonconformity.
• In the case of recertification or surveillance audits at levels 4 and 5, a level nonconformity will result in a lower level ( no
lower than 3). In such a case, the organisation’s CSR performance no longer exceeds the sectoral average and the
requirements for stakeholder management and indicators can only be fulfilled at a lower level.
• Level nonconformities at level 4 or 5 that also involve failure to comply with the requirements for level 3 will be treated a s
major nonconformities.

6.3 Recommendation for CSR management system certificate

At each level the CSR management system shall at least match the requirements for the CSR management system, CSR issue
management and stakeholder management.
In the case of a positive audit report, the conclusion will state the level that the organisation complies with and if necessary will
give a recommendation for the issue or amendment of the CSR certificate (or its scope or level).

6.4 Certification decision

The certification body’s decision on the issue of a CSR certificate will be made on the basis of a full CSR audit report with a positive
conclusion regarding the level attained and a recommendation concerning the CSR certificate.

6.5 Validity period of certificates

A CSR certificate for the entry levels 1 and 2 will be issued for a period of one year. A CSR certificate at level 3, 4 or 5 will be issued
for a period of three years, both initially and upon recertification. If interim amendments are made without a recer tification audit,
the original expiry date will remain unchanged.

The certification body will notify FSR about the certificate by emailing info@[Link] for the purpose of publication
on the website [Link]. The CSR Performance ladder certificate will be published on this website for the
validity period of the certificate. Annual contributions for each certificate will be owed to FSR. These contributions will b e used for
the management and development of the certification scheme.
Details of the contributions payable per main certificate and per (optional) sub -certificate are published on
[Link].

Page 23 of 27
 CSR Performance Ladder
Part B – version 4.0

6.7 Text of the certificate

• The CSR Performance Ladder certificate shall include the following:
• The name of the organisation that has undergone certification, as referred to in Part A, §4. 5. Also, the entity or entities of
this organisation covered by CSR Performance Ladder certification, specifying their name, address, place of business and
Chamber of Commerce registration number;
• The CSR Performance Ladder standard and the level attained by the organisation on the CSR Performance Ladder (1, 2, 3, 4 or
5);
• The following statement: ‘The CSR Performance Ladder, a practical application of ISO 26000 to Corporate Social
Responsibility’;
• The name and logo of the certification body;
• The scope declaration;*
• The following statement: ‘This CSR certificate has been registered on the website [Link] /
[Link].’;
• Date of first issue and of most recent issue and expiry date;
• In the case of sub-certificates: a clear explanation of how the organisation’s sub-certificates are derived from/linked to its
main certificate;
• The following illustration showing the 5 levels of the CSR Performance Ladder.

* The following shall be stated on the CSR Performance Ladder certificate as the scope of the organisation:
‘CSR management system for managing the development and implementation of policy on CSR issues in dialogue with stakeholders
in the technical area [Technical area(s)] with regard to [scope].’
Technical area(s): insert here the technical areas applicable to organisation, in accordance with Annex 1 to this document.
Scope: insert here the applicable scope description for the organisation, in accordance with Annex 1 to this document, stating the
organisation’s activity, service or product.

See Annex 2 for a sample certificate.

6.8 Sub-certificates
The certification scheme allows a certification body to issue a main certificate for the CSR Performance Ladder where an
organisation’s structure includes: multiple legal entities, divisions, operating companies and/or subsidiaries.

For marketing reasons, one part of the certified organisational structure (see the possible components listed above) may requ ire a
certificate specifically for that part of the organisation. Such a certificate for an individual part of an organisation is k nown as a
‘sub-certificate’. The provisions on drawing up certificates and the text of certificates in 6.7 also apply to sub-certificates.

At the request of an organisation and with the agreement of the certification body, a sub -certificate may also be registered at
[Link].

Page 24 of 27
 CSR Performance Ladder
Part B – version 4.0

6.9 Use of logo and certificate

A certified organisation with a valid CSR certificate shall ensure that the logo and the certificate are used
appropriately. Certification bodies supervise compliance with this requirement. The requirements for use
of the logo are published on the website [Link].

Page 25 of 27
 CSR Performance Ladder
Part B – version 4.0

Annexes
Annex 1 Technical areas

Six technical areas of the CSR Performance Ladder and their IAF sector codes.

IAF Brief description,

Technical area Specific CSR issues
Code for example:
2, 4, 5, 6, 7, 9, 10, 11, 12,
13, 14, 15, 16, 17, 18, 19, Technical area –
1 Production
20, 21, 22, 23, 24, 25, 26, Production of …
27 3 Health and safety of staff
9 Child labour in the value chain
Care & Social sector –
2 38, 39 10 Forced and compulsory labour in the
Healthcare Healthcare …
value chain
11 Rights of impacted communities
4, 5, 6, 7, 9, 12, 13, 14,
Trade & Purchasing and selling, storage 16 Consumer and end user health and
3 15, 16, 17, 18, 19, 22, 25,
Distribution & transshipment, transport safety
26, 27, 29, 31
17 Product information
18 Marketing and communication
4 Food 1, 3, 30 Food and feed
19 Privacy
23 Biodiversity
Construction, construction 24 Emissions, waste water and residual
5 Construction 28, 34 industry and construction- waste
related 26 Societal involvement and development

8, 30, 32, 33, 34, 35, 36,

6 Services Profit and non-profit services
37

For further clarification of how to determine the relevant technical areas based on a company’s activities, a reference has b een
included to the IAF ID1 codes used by accreditation bodies and others to specify the scope of accreditation.

Page 26 of 27
 CSR Performance Ladder
Part B – version 4.0

Annex 2 Sample certificate

Certificate
It is hereby declared that the CSR management system of

<<Name1>> <<Name2>>
<<Address>> <<Country>>
Chamber of Commerce no.:

For managing the development and implementation of policy on

CSR issues in dialogue with stakeholders in the
technical area <<see Annex 1>> with regard to

<<scope>>

has been assessed by <<name of certification body>> and complies with the:

CSR Performance Ladder at level <<1, 2, 3, 4 or 5>>

In conformity with the CSR Performance Ladder certification standard (version 4.0), a practical
application of ISO 26000 to Corporate Social Responsibility, and registered at [Link].

Certificate no: Issue date of 1st certificate: <<original date>>

<<certificate number>> Issue date of current certificate: <<current date>>
Certificate expiry date: <<expiry date>>

Issue by: <<name and address certification body>>

<<logo of certification body>>

Page 27 of 27