How Certification
Works

MSPO and ISO certification follow the same shape with different cycles: five years for MSPO, three for ISO. Peer review and stakeholder consultation apply to MSPO only.

MSPO scheme: steps and timelines

  1. Application, quotation and agreement

    You tell us your scope, sites and operations on our Client Application Form. We review the application, work out the audit time your scope needs, and send a quotation and certification agreement.

  2. Stage 1 audit, on site

    At your facilities we confirm that the key management system requirements are in place and documented: your significant aspects and legal requirements, policies, objectives and targets, internal audits, corrective action, resources and the scope for certification. The Stage 1 report shows any major deficiencies to fix before Stage 2, and opportunities to improve.

    • Stage 1 report with deficiencies to fix
  3. Stakeholder consultation

    At least 30 days before an initial or recertification audit we notify the relevant stakeholders, including government agencies, NGOs, local and indigenous communities, workers' unions and contractors, and invite their views in confidence. Notifications are published on this website.

  4. Stage 2 audit

    Once the Stage 1 findings are resolved, you confirm you are ready, ideally sending your proposed actions to the Audit Team Leader at least two weeks ahead. The team evaluates how well your system is implemented and how effective it is against MS 2530, and classifies findings as major or minor nonconformities.

    • Major NC: corrective action within 3 months
    • Minor NC: action plan within 30 days
  5. Independent peer review

    The draft Stage 2 report goes to independent peer reviewers appointed for your audit. They review it within seven days, the Audit Team Leader answers every comment, and all issues are resolved before the report is finalised.

  6. Certification decision and certificate

    The certification panel decides whether to grant certification. The MSPO certificate is issued once all payments under the certification agreement are complete, and a public summary of the audit report is published.

  7. Annual surveillance

    A surveillance audit at least once every calendar year confirms the system still works: progress against the objectives in your policy, evaluation of legal compliance, internal audits, corrective and preventive action, external communication, management review, and any changes to the system or its scope.

    • At least once per calendar year
  8. Recertification

    At the end of each cycle we reassess your whole management system, including a site assessment. Recertification follows the requirements of the initial Stage 2 and takes about two-thirds of the time of the initial assessment.

    • Every 5 years MSPO, 3 years ISO

ISO management systems: steps and timelines

  1. Application, quotation and agreement

    You tell us the standard, scope and sites you want certified. We review the application, work out the audit time, and send a quotation and certification agreement.

  2. Stage 1 audit, on site

    We confirm that the key requirements of the standard are in place and documented, and agree the scope for certification. The Stage 1 report lists anything to fix before Stage 2.

    • Stage 1 report
  3. Stage 2 audit

    Within six months of Stage 1, the audit team verifies that your management system is fully implemented and effective. Any major corrective action request must be addressed within an agreed time of no more than three months.

    • Within 6 months of Stage 1
    • Major CAR: up to 3 months
  4. Technical review

    The draft audit report goes to a technical reviewer, who reports back within two weeks. We incorporate the comments and share the draft with you for yours.

    • Technical review within 2 weeks
  5. Certification decision and certificate

    The final report goes to our decision maker, who agrees to award certification within one month. A public summary of the final audit report is made available.

    • Valid 3 years (ISO)
  6. Annual surveillance

    A surveillance audit at least once every calendar year confirms the system is still effective.

    • At least once per calendar year
  7. Recertification

    Every three years we reassess the whole management system, following the requirements of the initial Stage 2.

    • Every 3 years

MSPO Scheme in Detail

Every Step, and Who
Acts on It

Rebuilt from the MSPO certification process chart. Colours show who is responsible for each step.

OrganisationCertification bodyPeer reviewers

  1. 1

    Organisation

    Prepares standard operating procedures, trains its people, carries out an internal audit and holds a management review of the internal audit findings.

  2. 2

    Organisation

    When ready for the main audit, contacts an MPOCC-listed accredited certification body, submits an application for MSPO certification and agrees a date for the main audit.

    Not ready yet: continue preparing.

  3. 3

    UGG (certification body)

    Conducts the Stage 1 audit.

  4. 4

    UGG (certification body)

    Conducts the Stage 2 audit within six months of Stage 1.

    Not ready for Stage 2: the organisation addresses the Stage 1 findings first.

  5. 5

    UGG (certification body)

    If a major corrective action request (CAR) is raised: issues the CAR form. The organisation takes corrective action within the agreed time, no more than three months, and informs the certification body, which verifies it within two weeks. Minor CARs need a corrective action plan, verified at the next surveillance audit.

    Major CAR not closed: corrective action continues.

  6. 6

    UGG (certification body)

    Prepares the draft audit report within one month of Stage 2, or within two weeks of verifying the major CAR corrections.

  7. 7

    UGG (certification body)

    Submits the draft report to the peer reviewers for comment.

  8. 8

    Peer reviewers

    Submit their report to the certification body within two weeks.

  9. 9

    UGG (certification body)

    Incorporates the peer reviewers' comments within one week, and makes the draft available to the organisation.

  10. 10

    Organisation

    Sends any comments to the certification body within two weeks.

  11. 11

    UGG (certification body)

    Incorporates the organisation's comments and prepares the final report with a recommendation for certification within one week.

  12. 12

    UGG (certification body)

    Presents the final report to its certification committee, which agrees to award the certificate within one month.

  13. 13

    UGG (certification body)

    Awards the organisation the MSPO Certificate for Oil Palm Management.

  • The certificate is valid for five years, with annual surveillance audits.
  • The certification body makes a public summary of the final audit report available.
  • To use the MSPO logo, the certified organisation applies to MPOCC for a logo usage licence and signs a logo usage license agreement with MPOCC.

Get in Touch

Looking to Get Certified?
Request a Call Today

Tell us about your estate, mill or organisation and we will prepare a quotation.

Auditor speaking with harvesters in safety helmets among oil palm at a PPPNP estate
ACB 059Accredited by the Department of Standards Malaysia