ACERT · ASSURANCE SCHEMES
Different requirements.
One evidence-led approach.
Connect the principles you work to with evidence of what happens in practice.
Explore proposed ACert assessment scopes across quality, environment, safety, information security, continuity and controls readiness. Each engagement starts with defined requirements and a clear understanding of the assurance needed.
START WITH THE REQUIREMENT
What do you need
to demonstrate?
Your starting point may be a customer expectation, a management system framework or a set of controls that needs closer examination.
The assessment scope should identify the activities covered, the criteria applied and the evidence needed. The resulting conclusion must reflect what was actually assessed.
Working to selected principles, preparing for an external assessment and demonstrating conformity across a complete standard are different objectives. Agreeing the objective first keeps the outcome clear.
FRAMEWORKS TO EXPLORE
Build assurance around
your operational priorities.
These frameworks provide starting points for a scope discussion. The evidence examples below are illustrative; the agreed criteria determine what an assessment requires.
Quality management
ISO 9001
Connect customer requirements with the processes, responsibilities and improvement activities that support consistent delivery.
Evidence to consider
Process records, customer feedback, internal audits, corrective actions and management reviews.
Environmental management
ISO 14001
Examine how environmental commitments are translated into operational controls and reviewed outcomes.
Evidence to consider
Environmental aspects, objectives, operational checks, incident records and improvement actions.
Health & safety
ISO 45001
Explore the evidence behind how work-related risks, responsibilities and protective measures are managed.
Evidence to consider
Risk assessments, competence records, worker consultation, inspections and incident follow-up.
Information security
ISO 27001
Connect information risks with defined controls, assigned ownership and evidence of their operation.
Evidence to consider
Risk treatment, access reviews, incident handling, supplier assessments and control review records.
Business continuity
ISO 22301
Assess the evidence behind preparedness, response and recovery arrangements for important business activities.
Evidence to consider
Impact analysis, continuity plans, exercises, lessons learned and follow-up actions.
Controls readiness
SOC 2 readiness
Explore readiness and controls alignment against the relevant Trust Services Criteria within an agreed scope.
Evidence to consider
Control descriptions, ownership, operating records, identified gaps and remediation tracking.
These are proposed assessment areas, not a statement that every scheme is currently available. Scope, criteria, service availability and the form of the resulting report are confirmed before engagement.
DEFINE THE CLAIM
Say what was assessed.
Show what supports it.
The framework name alone does not explain the assurance.
An assessment may examine selected requirements, a defined set of controls or a wider management system. Its certificate and report should make that distinction explicit.
Where the scope concerns selected principles, the conclusion should identify those principles and their boundaries. It should not imply that unassessed requirements have been met.
CONNECTED MANAGEMENT SYSTEMS
Shared evidence.
Distinct assessment criteria.
One operational record may support several requirements. A competence record, supplier review or corrective action can be relevant across more than one framework.
Use the operational record
Bring relevant evidence together from the documents, activities, risks, audits and actions managed in Zebsoft.
Examine each requirement
Consider whether the shared evidence is sufficient for each criterion. Coverage in one area does not automatically establish coverage in another.
Make the outcome clear
Record which requirements are supported, what remains unresolved and where the assurance conclusion is limited.
SOC 2 READINESS
Understand the controls.
Prepare the evidence.
The proposed ACert readiness scope focuses on controls alignment, available evidence and gaps to address before a separate formal examination.
The intended output is a readiness or controls-alignment report describing the agreed scope and findings. It is not presented as a formal SOC 2 report.
Agree the intended outcome
Clarify which criteria and systems are relevant, whether controls are documented, what operating evidence exists and where further work is needed.
If your customer requires a formal SOC 2 report, establish that requirement at the outset so the readiness work supports the appropriate examination route.
CHOOSE THE RIGHT ROUTE
Fit the assessment
to the need.
Identify the reader
Who will rely on the outcome, and what decision do they need it to support?
Set the boundaries
Which activities, locations, systems and requirements need to be assessed?
Confirm suitability
Does the recipient require a particular accredited certification or formal report, or will scoped non-accredited assurance meet their need?
ACert assurance is non-accredited. The proposed assessment and resulting documents should be checked against the recipient’s requirements before engagement.
YOUR ASSURANCE SCOPE
Start with what matters.
Build the evidence around it.
Tell us which framework you work to, what your customers expect and what evidence you already manage. We can discuss the assessment scope and a suitable next step.
ACert’s continuous assurance model is in development. Assessment methods, availability and review arrangements are agreed before engagement.