ACERT · CERTIFICATES & REPORTS
The conclusion is clear.
The evidence is traceable.
A certificate communicates confidence. An assurance report explains the basis for it.
ACert’s approach connects the two, bringing the assessed scope, operational evidence, findings and review arrangements into a coherent assurance record.
THE CERTIFICATE
A defined statement.
A clear scope.
The certificate should tell its reader who has been assessed, which activities are covered and what requirements formed the basis of the assessment.
Its meaning comes from that defined scope. A conclusion about one site, process or service should not imply assurance over the whole organisation.
ACert’s intended certificate format links the outcome to a supporting report and states the relevant dates and review arrangements.
ACert
CERTIFICATE OF ASSURANCE
What the certificate should identify
Organisation & scope
The entity, activities and locations assessed.
Assessment criteria
The defined requirements against which evidence was examined.
Assurance conclusion
The outcome supported by that assessment.
Dates & reference
The issue date, evidence period and linked report reference.
Review arrangements
When and how the basis for assurance will be reconsidered.
Illustrative information structure — not an issued certificate.
THE SUPPORTING REPORT
See how the conclusion
was reached.
The report turns a statement of assurance into something that can be examined.
It should distinguish what the organisation says it does from what the reviewed evidence demonstrates. Gaps, exceptions and limitations belong in the record alongside positive findings.
INSIDE THE ASSURANCE RECORD
Enough detail to
understand the outcome.
Scope and boundaries
The activities, sites, systems and time period included, together with exclusions that affect how the conclusion should be read.
Assessment basis
The requirements applied, the methods used and whether the assessment examined control design, operation or both.
Evidence considered
References to the relevant records, their dates and sources, and an explanation of sampling or other limits to coverage.
Findings and exceptions
What the evidence supports, where it is incomplete and which issues affect the assurance conclusion.
Actions and ownership
Required responses, named responsibilities and the evidence needed to demonstrate that an issue has been addressed.
Decision and review
The authorised conclusion, its limitations and the events or intervals that should trigger reassessment.
CONNECTED TO EVERYDAY WORK
Evidence behind
every material finding.
Zebsoft provides an operational record across documents, activities, risks, audits and improvement actions. That record forms the foundation for the assessment.
The intended ACert process connects material findings to their supporting sources. AI-assisted analysis can help identify patterns and gaps, while the recorded assessment explains how those findings affect the outcome.
Traceability does not mean unrestricted public access. Report sharing and access to underlying evidence should reflect agreed permissions and confidentiality requirements.
ASSURANCE OVER TIME
A dated conclusion.
An ongoing responsibility.
A certificate records an assessment outcome. Continuing confidence depends on whether the supporting conditions remain in place.
Keep evidence current
Maintain the operational records and reviews required by the agreed assessment scope.
Respond to change
Consider whether changed activities, significant incidents or failed controls affect the existing conclusion.
Update the outcome
Define how revised conclusions, restrictions or withdrawal will be recorded and communicated to relevant parties.
USING AN ACERT REPORT
Match the assurance
to the requirement.
Before commissioning an assessment, establish what the intended recipient needs to know and what evidence they will accept.
ACert assurance is non-accredited. The certificate and report describe the agreed assessment; acceptance depends on the requirements of the organisation relying on them.
Reading a certificate or report?
Check that the named organisation and assessed scope match the service you are considering. Read the dates, findings and limitations together.
Where confirmation is needed, contact ACert with the certificate or report reference. Avoid relying on an isolated logo or an undated copy.
START WITH THE REQUIRED OUTCOME
What do your customers
need to know?
Discuss your scope, the evidence available and how a certificate and supporting report could communicate the assurance your customers need.
This page describes the intended ACert certificate and reporting model. Service availability, final document format, assessment methods and review arrangements are agreed before engagement.