GB/T 28952-2024Forest certification in China - Chain of custody (English PDF)

1 Scope

The document sets out the requirements for implementing a chain of custody for forest products.

It applies to conformity assessment in third-party certification of sustainable forest products.

3 Terms and definitions

3.1 Certified content: the percentage that CFCC/PEFC certified material accounts for in a certified product or product group. 3.2 Claim period: a period of time in which a product group has a given certified content; a note adds that the claim period also applies to a single product, a work order or a batch of products.

3.3 Conflict timber: timber traded at any point of the chain of custody by an armed group. Note 1 explains that the armed group may be rebels or regular soldiers, or a civil administration or its representatives involved in an armed conflict, whether the purpose of the trade is to prolong the conflict or to draw personal advantage from it. Note 2 states that conflict timber is not necessarily illegal timber.

3.4 Controversial sources: forest and tree based material or forest products whose acquisition involves any of the following disputed situations. a) Failure to comply with local, national or international law on forest management, including but not limited to forest management, nature and environmental protection, protected and endangered species, ethnic minorities, the property rights, land ownership and use rights of local communities or other affected interested parties, health, labour and safety issues, anti-corruption, and payment of royalties and taxes. b) Failure to maintain the capacity of the forest to supply a range of timber and non-wood forest products and services on a sustainable basis, or harvesting intensity above the level that can be sustained in the long term. c) Forest management that prevents biodiversity from being maintained, protected or enhanced at landscape, ecosystem, species or genetic level. d) Material from places that have failed to identify and protect ecologically important forest areas. e) Material from places where forest conversion has occurred, excluding conversion that at the same time complies with national and regional land use and forest management policy and legislation, has no negative effect on ecologically important forest areas, on areas of cultural and social importance or on other protected areas, does not destroy areas of significant high carbon stock, and contributes to long-term conservation, economic and social benefits. f) Non-compliance with the spirit of the International Labour Organization conventions on fundamental principles and rights at work. g) Non-compliance with the spirit of the United Nations declaration on the rights of indigenous peoples. h) Conflict timber. i) Genetically modified trees.

Note 1 to 3.4 states that plantations established on agricultural land with a rotation of under thirty-five years are not regarded as a controversial source under items b), d) and e). Note 2 states that the restriction CFCC places on the use of genetically modified trees rests on the precautionary principle, and that such trees will not be used until sufficient scientific data show that their effect on human and animal health and on the environment is comparable to, or more positive than, that of trees improved by conventional methods.

3.5 Credit method: a chain of custody method by which the credit obtained from certified material is converted into controlled-source material inside the same product group. 3.6 Due diligence system (DDS): a framework of procedures and measures implemented by an organization, namely information collection, risk assessment and risk mitigation, that reduces the risk of wood-based material coming from controversial sources; a note allows organizations to cooperate with each other and to use external services to run the system, while the organization remains responsible for meeting the requirements of the document.

3.7 Ecologically important forest areas: forest areas with any of the following features. a) They contain protected, rare, fragile or representative forest ecosystems. b) They contain significant concentrations of endemic species on protection lists and habitats of threatened species. c) They contain endangered or protected gene pools of local resources. d) They are large landscapes of global, regional or national importance in which species show natural patterns of distribution and abundance.

3.8 Forest and tree based material: material originating from forests and trees, or material from other sources recognized by CFCC and used for CFCC certification, such as trees outside forests; it also includes recycled material derived from such material, and both wood and non-wood material. A note gives cork, mushrooms and berries as examples of non-wood material, usually called non-wood products.

3.9 Material category: the classification of material according to its characteristics; a note lists certified material, other material, neutral material and controlled-source material. 3.10 Neutral material: material other than forest and tree based material, for instance metal or plastic; it is not taken into account when the certified content of a product group is calculated. 3.11 Other material: forest and tree based material for which the organization has not yet established through its due diligence system whether it carries a negligible risk of coming from controversial sources.

3.12 Certified material: material and recycled material that carries a CFCC certification claim, or another certification claim recognized by CFCC, at the moment of delivery. Note 1 divides it into two classes: forest and tree based material supplied by a supplier holding a CFCC chain of custody certificate and delivered with an "X % CFCC certified" claim, or delivered with the certification claim of another forest certification scheme mutually recognized with CFCC; and recycled material. Note 2 explains that the other mutually recognized schemes are national forest certification schemes such as the Sustainable Forestry Initiative of the United States (SFI), the Malaysian Timber Certification Council scheme (MTCC) and the Australian Forestry Standard scheme (AFS), all of them, like CFCC, endorsed by PEFC; material certified under those schemes is treated by CFCC as PEFC certified material and is equivalent to CFCC certified material.

3.13 Chain of custody: the process by which an organization handles forest products and the information relating to their material categories, and makes accurate and verifiable claims. 3.14 Claim: the declaration an organization makes about raw material or products in its sales and delivery documents; note 1 gives the two CFCC claims, "X % CFCC certified" and "CFCC controlled sources". Note 2 allows an organization applying physical separation to use the wording "100 % CFCC origin" instead of "100 % CFCC certified", to stress that CFCC certified material has never been mixed with CFCC controlled-source material; an organization receiving material with that claim and applying the percentage or credit method may consider using the wording "100 % CFCC certified" for its own claim.

3.15 Controlled sources: forest and tree based material that the organization has determined, through its due diligence system, to carry a negligible risk of coming from controversial sources. 3.16 Product group: a product or a group of products in the chain of custody of an organization that share the same input material and are distinguished by product name or type, product category, tree species, chain of custody method, material category and claim; the notes cover single products, batches and made-to-order products, allow one or several product groups to be set up for manufacturing or trading carried on at the same time or in succession, and note that a product group may cover several sites in the multi-site case defined in A.2.3 a).

3.17 Percentage method: a chain of custody method that calculates the certified content of a product group for a given claim period from the material put in. 3.18 Physical separation method: a chain of custody method that establishes the claim of a given product group by clearly identifying or separating the different material categories throughout the activities of the organization. 3.20 Rolling percentage: a chain of custody method that calculates the certified content of a product group from the average of the material put into the group over a defined period preceding the claim period, for use in that claim period.

3.19 Recycled material: forest and tree based material from the following sources. a) Material recovered from waste during a production process. b) Material generated by households, by the commercial and industrial sector or by public institutions acting as end users of a product, which can no longer be used for its original purpose, including material recovered from the product distribution chain. Note 1 excludes reused material, for example material or waste reprocessed within the same production process and recoverable in the process that generated it, and excludes by-products of primary production such as sawmill by-products (sawdust, chips, bark) and harvesting residues (bark, branch and root fragments). Note 2 explains that "recoverable in the process that generated it" means material produced in the same production process at the same site and returned to that process for further use, and gives the residues generated on a flat-press wood-based panel line, which enter the same line continuously and therefore cannot be regarded as recycled material. Note 3 states that the definition is based on 7.8.1.1 of GB/T 24021-2001.

3.21 Trees outside forests (TOF): trees growing in areas outside forest land, such as agricultural land, urban land or construction land. Note 1 lists trees along railways and roads, farmland shelterbelt networks, trees in towns, trees on land retained by farmers, and trees beside villages, roads, water and houses. Note 2 divides them by management scale into intensive and extensive management. Note 3 defines intensively managed trees outside forests as trees outside forest land in a continuous area of more than 10 hectares or along a distribution line more than 50 km long, all other trees outside forests being extensively managed. The definition is taken from GB/T 28951-2021, 3.5.

4 Management system requirements

4.1 General. The organization shall implement a management system meeting the document, so that the chain of custody process is correctly implemented and maintained. The management system shall be commensurate with the type, scope and output of the organization and shall cover the outsourced activities and all sites of a multi-site organization referred to in Annex A. The organization shall define the scope of its chain of custody and the product groups to which the requirements are applied, and shall make correct CFCC claims and CFCC related statements only within that scope.

4.2 Documented procedures. The organization shall establish written procedures for the chain of custody. They shall cover at least the organizational structure, responsibilities and authorities of the chain of custody; a description of the flow of material through production or trading, including the definition of product groups; and procedures covering all requirements of the document, namely determination of material categories, physical separation of certified material, controlled-source material and other material, definition of product groups, calculation of certified content, management of the credit account and conversion of quantity credits into products for organizations using the percentage or credit method, sale or transport of products together with the use of claims and marks on or off the product, record keeping, internal audit and control of non-conformities, the due diligence system, complaint resolution, and outsourcing.

4.3 Responsibility and authority. The management of the organization shall commit itself in writing to implementing and maintaining the chain of custody according to the document, and shall make that commitment public to staff, suppliers, customers and other interested parties. The management shall appoint one of its members with overall responsibility and authority for the chain of custody. The organization shall identify the persons who implement and maintain the chain of custody activities and shall define their responsibilities and authorities for the procedures listed under 4.2.2 c) items 1) to 8).

4.4 Record keeping. As evidence of conformity the organization shall establish and keep at least the following records for the product groups covered by the chain of custody: records of all suppliers of input material carrying a CFCC/PEFC claim, including evidence of their CFCC/PEFC certification status; records of all input material, including the CFCC/PEFC claims and documents accompanying delivery and, for recycled material, information showing that the definition of recycled material is met; records of the calculation of certified content, of the transfer of the certified percentage to output products and of credit account management, where applicable; records of the sale or transport of products, including the CFCC/PEFC claims and documents relating to the movement of output products; records of the due diligence system, including risk assessment and the management of supplies rated as significant risk, where applicable; records of internal audits, of the periodic management review of the chain of custody, and of non-conformities and improvement measures; and records of complaints and of how they were settled. The records shall be kept for at least five years.

4.5 Resource management. The organization shall ensure and demonstrate that all persons implementing and maintaining the chain of custody are competent for their work, competence being acquired through training, education and the accumulation of skill and experience. The organization shall also identify, provide and maintain the infrastructure and technical equipment needed for the chain of custody to work effectively.

4.6 Inspection and control. The organization shall carry out an internal audit at least once a year and before the initial certification audit. The audit shall cover all requirements of the document, including outsourced activities, and corrective and preventive measures shall be established where needed; a note refers to GB/T 19011 for internal audit guidance. The management shall review the results of the internal audit and the chain of custody at least once a year.

4.7 Complaints. The organization shall establish a procedure for handling complaints about the chain of custody from suppliers, customers and other parties. On receiving a complaint the organization shall formally acknowledge receipt to the complainant within ten working days; collect and verify all necessary information, assess and verify the complaint and take a decision; formally inform the complainant of the decision and of the handling process; and ensure that appropriate corrective and preventive measures are taken where necessary.

4.8 Non-conformities and corrective measures. Where an internal or external audit finds non-conformity with the document, the organization shall respond to the non-conformity and, as appropriate, take action to control and correct it and deal with its consequences; assess whether action is needed to eliminate the cause so that the non-conformity does not recur or occur elsewhere, by reviewing the non-conformity, determining its cause and determining whether similar non-conformities exist or could arise; take all necessary action; review the effectiveness of the corrective measures; and change the management system where necessary. Corrective measures shall be proportionate to the effects of the non-conformity. The organization shall keep documented information as evidence of the nature of the non-conformity and of all subsequent corrective action, and of the results of that action.

4.9 Outsourcing. The organization may outsource activities covered by its chain of custody to another organization. It remains responsible for the whole outsourced process and shall ensure that all outsourced activities meet the requirements of the document and of the management system. A written agreement shall be concluded with every outsourcing partner, ensuring that the forest and tree based material or forest products covered by the chain of custody are physically separated from other material or products, and that the organization may enter the premises of the partner to carry out internal and external audits of the outsourced activity. An internal audit of the outsourced activity shall be carried out before the activity starts and at least once a year.

4.10 Social, health and safety requirements. The requirements cover the rights of workers and health, safety and labour matters, and are based on national law and on the International Labour Organization conventions signed by China. The organization shall adopt a policy committing itself to observe them and shall demonstrate that it meets the following: the right of employees to join and form trade unions in accordance with the law, to choose their own representatives and to bargain collectively with the employer; a prohibition on forced or disguised forced overtime, overtime pay being due under national rules where overtime is unavoidable; a minimum employment age of sixteen; a working time system of no more than eight hours a day and an average of no more than forty-four hours a week; fair employment opportunity and fair treatment, distribution according to work, equal pay for equal work, and wage levels rising progressively with economic development; wages not below the local minimum wage; establishment of a sound occupational safety and health system, strict application of national occupational safety and health rules and standards, safety and health education for employees, prevention of accidents and reduction of occupational hazards; provision of working conditions and personal protective equipment meeting national rules, with periodic health examinations for employees exposed to occupational hazards; statistics, reporting and handling of occupational accidents and occupational disease in accordance with the law; the possibility of setting up supplementary insurance for employees; and the possibility of setting up a labour dispute mediation committee made up of employee, employer and trade union representatives and chaired by the trade union representative, agreements reached through mediation being binding on the parties. Where the organization has infringed the lawful rights of an employee by withholding or delaying wages without cause, refusing to pay for extended working hours, paying below the local minimum wage, or failing to give statutory compensation after termination of the labour contract, it shall pay the wages and economic compensation due together with damages. Employees and the organization may conclude a collective contract on remuneration, working time, rest and leave, occupational safety and health, and insurance and welfare; the draft shall be adopted by the employee representative assembly or by all employees, and where no trade union exists the higher-level trade union guides the representatives recommended by the employees in concluding it.

5 Determination of material and product claims

5.1 Determination of input material. On every receipt of material for a product group in the chain of custody the organization shall obtain from the supplier the identification of the supplier, the identification of the product, the quantity delivered of each product, and the date, period or accounting period of receipt. For input material carrying a CFCC/PEFC claim the accompanying documents shall also give the name of the organization to which the material is delivered, the claim for each product within the scope of the contract, and the chain of custody certificate number of the supplier. Note 1 states that the certificate number is a number, or a combination of letters and numbers, that identifies the certificate uniquely; note 2 states that an invoice or delivery note counts as a supply document. The organization shall verify on the CFCC/PEFC website whether a supplier delivering material with a CFCC/PEFC claim holds a CFCC/PEFC certificate, and shall classify the material purchased for each delivery into a certified product group.

5.2 Claims on output products. When products carrying a CFCC claim are delivered to a customer, the organization shall supply for each delivery the identification of the customer, the name of the organization as supplier, the identification of the product, the quantity delivered of each product, the date, period or accounting period of delivery, the CFCC claim for each product within the scope of the contract, and the certificate number of the organization. The organization shall state the type of document on which the claim is made at the time of output.

5.3 Use of the mark. Use of the CFCC mark shall comply with the CFCC rules on the use of the mark. In order to use the mark under those rules the organization shall obtain a valid licence from CFCC or from a body authorized by CFCC.

5.4 Content of recycled material. For recycled material used in products within the scope of the chain of custody, the organization shall calculate the content of recycled material in accordance with GB/T 24021 and shall report it on request.

6 Chain of custody methods

6.1 General. There are three methods of implementing the chain of custody: the physical separation method, the percentage method and the credit method. The organization shall choose the appropriate method according to the material put in and the characteristics of the process. It shall apply the chosen method to the specific product group. Products made from the same input material and using the same unit of measurement, or using several units of measurement that can in practice be converted into a single one, shall be placed in the same product group. Only certified material and controlled-source material shall be put into a product group.

6.2 Physical separation method. An organization using physical separation shall ensure that materials of different kinds and materials with different certified content are distinguished, or can be clearly identified, at every stage of production and trading. A note lists separate storage, distinguishing marks, and separation by product characteristics or production time as ways of achieving this. Where material with different certified content is used in the same product group, the lowest certified content among the input material shall be declared as the certified content of the output product; the worked example puts material of 100 %, 75 % and 70 % certified content into one product group and declares the output as 70 % CFCC certified. Where certified material and controlled-source material are used together in the same product group, the output shall be declared as CFCC controlled sources.

6.3 Percentage method. The percentage method may be used to calculate the certified content of the certified material and the controlled-source material in a product group. The certified content of each product group in a given claim period is obtained from a formula whose symbols are defined as follows: Cc is the certified content, Vc is the quantity of certified material, and Vcm is the quantity of controlled-source material, the result being expressed as a percentage. A note states that neutral material does not enter the calculation. All material used in the calculation shall be expressed in the same unit of measurement; where conversion is needed a recognized conversion factor and method shall be used, and where none is available the organization shall establish and use a conversion factor that is reasonable and credible. Where only part of the input material is certified, only the quantity corresponding to the certified content may be counted as certified material and the remainder is counted as controlled-source material; the worked example puts one tonne of material claimed as 70 % CFCC certified and one tonne claimed as 100 % CFCC certified into a product group and arrives at a certified content of 85 % over the total of two tonnes. The certified content calculated for a CFCC product group shall be expressed in the claim as a percentage, in the form "X % CFCC certified"; the example takes a product group whose certified content is calculated as 54 % and states that all products in that group may be sold or transferred during the claim period with a 54 % CFCC certified claim. A note records that the document sets no minimum certified content for products carrying an X % CFCC certified claim, but that the CFCC rules on the use of labels do set a minimum certified content for putting the CFCC mark on a product.

6.3 Rolling percentage. The organization may use the rolling percentage method. An organization doing so shall calculate the certified content of the product group for a given claim period from the quantity of material put in during the material input period preceding that claim period. As a rule the claim period shall not exceed three months and the material input period shall not exceed twelve months. An organization choosing a claim period of three months and a material input period of twelve months may calculate the rolling percentage of certified content for the following three months from the quantity of material put in over the preceding twelve months.

6.4 Credit method. The credit method may be used to transfer the certified credit obtained from certified material to controlled-source material in the same product group. The organization shall establish and manage a credit account in which the certified credit obtained from certified material is entered. A uniform unit of measurement shall be used for the calculation of certified credit, and a conversion factor may have to be established where the unit changes between input material and output product. The certified credit accumulated in the account may not exceed the total credit entered into it over the past twenty-four months; where the organization can show that the production cycle of the product is longer than twenty-four months this limit may be extended, and for an average production cycle of thirty-six months the maximum accumulation period may be extended from twenty-four to thirty-six months. Where a single claim is used the organization shall use the credit method. Where a consignment carries both a CFCC claim and the claim of another certification scheme, the organization may calculate the certified credit from all the claims or choose one of them; where the consignment carries the claims of two forest certification schemes, the organization may decide to set up one credit account under one specific claim, or to enter them in separate credit accounts under their respective claims. The organization shall calculate the certified credit either from the certified content and the quantity of output product, or from the input material and the input-output ratio. In the first case the credit is the product of the quantity produced in the claim period and the certified content of the material in that period; the example takes a product group of 100 tonnes of output with a certified content of 54 % and gives a credit of 54 tonnes of output product. In the second case, where the organization can show a fixed ratio between input material and output product, the credit is obtained by multiplying the quantity of certified material put in by the input-output ratio; the example takes 70 cubic metres of certified material put in, that is 100 cubic metres of material with a 70 % CFCC certified claim, and an input-output ratio of 0.60, that is 0.6 cubic metres of sawn timber per cubic metre of log, and gives a credit of 42 cubic metres of sawn timber. The organization shall allocate the credit in the account to the output products covered by that account, either as products of 100 % certified content or of less than 100 %, according to its own needs; the quantity of certified product multiplied by its certified content shall equal the credit drawn from the account, and the example states that seven units of credit can be used to sell either seven units of 100 % CFCC certified product or ten units of 70 % CFCC certified product.

7 Requirements for the due diligence system (DDS)

7.1 For all material put into a CFCC product group other than recycled material, the organization shall carry out due diligence in accordance with the due diligence system, so as to avoid material from the controversial sources set out in Annex B. The organization shall therefore establish for the material put into a CFCC product group that the risk of it coming from a controversial source is negligible and that it meets the definition of controlled-source material.

7.2 Where the material put into a CFCC product group is supplied by a supplier holding a CFCC/PEFC certificate and carries a single CFCC/PEFC claim, the organization shall implement the due diligence system through the following measures. a) So that certified and non-certified organizations can operate a due diligence system throughout the supply chain, the organization shall on request pass on the transfer information listed in B.2 for material carrying a CFCC claim; where the organization does not hold the information requested, it shall pass the request on to the supplier concerned. b) Where a substantiated concern is raised internally or externally about input material coming from a controversial source, the organization shall take further action on that concern in accordance with B.4. c) For forest and tree based material or products not included in the scope of the chain of custody, the organization shall raise, establish and implement commitments and procedures ensuring that, where it knows of or has received a substantiated concern, it does not place such material or products from illegal sources, as referred to in 3.4 a), on the market until the concern has been resolved in accordance with B.4.

A Annex A (normative) Implementation of the chain of custody by multi-site organizations

A.1 The annex guides organizations with several sites in implementing the requirements of the chain of custody standard, so that the certification audit gives sufficient confidence in conformity while remaining economically and operationally practicable, and it allows the chain of custody to be implemented and certified across a group of typically small independent companies. It applies only to organizations with several production sites.

A.2 Criteria for recognition. A multi-site organization has one clearly identified centre, usually called the central office, and several local offices or branches, called sites; the central office establishes, controls and manages the relevant activities and the local offices carry them out. A multi-site organization need not be a single legal entity, but all sites shall have a legal or contractual relationship with the central office, belong to the same chain of custody and be subject to surveillance audit by the central office; where necessary the central office has the power to require any branch to take improvement measures, and this is best recorded in the contract signed between the central office and each site. A multi-site organization may be an organization with subordinate units or several branches, whose sites are linked by common ownership, a common management system or another organizational relationship, or a group of separate independent legal entities formed for the purpose of chain of custody certification, that is a producer group; a note states that a management system or other organizational relationship does not include membership of an association. A producer group is a body formed by a number of typically small independent enterprises that join together to obtain and maintain chain of custody certification collectively; the central office may be a suitable trade association, any other legal entity with relevant experience jointly recommended for that purpose by the units wishing to join, or a legal entity that consistently meets the objectives of the group and provides group management services in accordance with the standard. A note records that the central office of a producer group is also called the joint certification representative body and that the branches are also called members of the group. A site is a place where the organization carries out chain of custody activities. Only organizations registered in the same country may join a producer group, and each of them shall have no more than fifty full-time employees and an annual turnover of no more than eighty million yuan.

A.3.1 General requirements. The chain of custody of the organization shall be managed and reviewed by the central office. All sites concerned, the central office included, shall be subject to the internal audit programme of the organization and shall be audited under that programme before the certification body starts its assessment. The multi-site organization shall demonstrate that its central office has established a chain of custody management system in accordance with the document and that the whole organization, all sites included, meets the requirements of the document; Table A.1 divides the responsibilities for the requirements between the central office and the participating sites. The organization shall demonstrate that it is able to collect and analyse data from all sites including the central office and, where needed, to improve the operation of the chain of custody at those sites.

A.3.2 Responsibilities of the central office and internal audit procedure. The central office shall act as the representative of the multi-site organization during certification and communicate with the certification body; submit the certification application and the scope of certification, including a list of the participating sites; maintain the contractual relationship with the certification body; submit requests to extend or reduce the scope of certification, including changes in the number of participating sites; commit itself, as representative of the whole organization, to establishing and maintaining a chain of custody in accordance with the document; provide each site with the information and guidance needed to implement and maintain the chain of custody, namely a copy of the document and the relevant implementation guidance, the documents and guidance on the use of the forest certification mark, the management procedures for multi-site organizations drawn up by the central office, the contractual terms concerning the rights of the certification body, including use of the documents and facilities of each site by the certification body or the accreditation body for assessment and surveillance and the disclosure of site information to third parties, an explanation of the principle of shared responsibility among the sites in multi-site certification, the results of internal audits and of the assessment and surveillance audits of the certification body together with the improvement and preventive measures concerning each site, and the multi-site certificate with its scope and participating sites. A note explains that shared responsibility means that a non-conformity found at one site or at the central office may oblige all participating sites to take improvement measures, or may lead to more internal audit activity or to withdrawal of the multi-site certificate. The central office shall also establish an organizational or contractual relationship with all participating sites, all of which shall commit themselves to establishing and maintaining a chain of custody in accordance with the document; the written contract or other written agreement shall give the central office the right to take any improvement or preventive measure, or to exclude certain sites from the scope of certification, when a non-conformity occurs. The central office shall draw up written procedures for managing the multi-site organization, keep records of conformity of the central office and of each site, run the internal audit procedure, and review the conformity of the central office and of the sites against the results of internal audits and of the audits and surveillance of the certification body, establishing improvement and preventive measures where necessary and assessing their effectiveness. The internal audit procedure shall include an on-site audit of all sites, the central office included, before the certification body starts its audit, or a remote audit where that is feasible, and an audit of every newly added site before the certification body extends the scope.

A.3.3 Role and responsibilities of the sites. Each site shall establish and maintain the chain of custody in accordance with the document; establish a contractual relationship with the central office and undertake to comply with the chain of custody and the other applicable certification requirements; respond effectively to requests for data, documents or other information from the central office or the certification body, whether in a formal audit, a review or another activity; cooperate fully with the internal audits carried out by the central office and the audits carried out by the certification body, including the use of the facilities of each certified site; and implement the improvement and preventive measures drawn up by the central office.

B Annex B (normative) Due diligence system (DDS)

B.1 General requirements. To help ensure that the activities the organization carries out within the scope of the document comply with all applicable law on the legality of timber and with trade and customs law, and to keep to a minimum the risk of buying material from controversial sources, the organization shall implement a due diligence system in accordance with B.1.2 to B.1.4 and B.2 to B.6. The system shall be applied to all forest and tree based material put into the CFCC chain of custody and product groups, recycled material excepted; a note records that an organization is able to apply the system to material produced by the forests it manages itself. The system shall be implemented in three steps: information collection, risk assessment, and management of supplies rated as significant risk. Where the material purchased comes from a species listed in Appendices I to III of the Convention on International Trade in Endangered Species of Wild Fauna and Flora, the organization shall comply with the applicable international and national law relating to that convention.

B.2 Information collection. To operate the due diligence system the organization shall obtain from its suppliers the identification of the tree species contained in the forest and tree based material or forest product, including the common name and, where applicable, the scientific name of the species; and the country in which the material was harvested and, where necessary, the specific region of that country or the harvesting concession. Note 1 requires the Latin name to be used where the common name could lead to misidentification. Note 2 allows the trade name or common name to be used where all the species covered by that name carry the same risk of coming from a controversial source. Note 3 requires information on the specific region of origin where different regions of a country carry different risks. Note 4 explains that a harvesting concession means a harvesting contract for a defined geographical area.

B.3 Risk assessment. The organization shall assess the risk that all forest and tree based material covered by the due diligence system comes from a controversial source, except that certified material or products carrying a CFCC/PEFC claim and supplied by a supplier holding a CFCC/PEFC certificate need no risk assessment and may be regarded as carrying a negligible risk in respect of controversial sources. After the assessment the organization shall classify material as negligible risk or as significant risk. The assessment shall be based on the source and supply chain risk indicators listed in Tables B.1 to B.3. Where the assessment points to an indicator in Table B.1, the organization may rate the material as negligible risk as the outcome of the assessment, without considering the indicators in Tables B.2 and B.3. Where it does not point to an indicator in Table B.1, the assessment shall continue against Tables B.2 and B.3; if any indicator in those tables applies, the material shall be regarded as significant risk, and if none applies the material may be rated as negligible risk. Table B.1 lists three negligible-risk indicators: supply certified under a forest certification scheme not mutually recognized with CFCC/PEFC and holding a forest management, chain of custody or fibre sourcing certificate issued by a third-party certification body; supply recognized under a verification or licensing mechanism run by government or by a non-governmental body against controversial sources outside forest certification schemes; and supporting documents that clearly show all of the following, namely a high integrity rating of the government of the harvesting country given by an international organization recognized by the Chinese government, the trade name and kind of the product and the common name of the species with the full Latin name where applicable, all suppliers in the supply chain, the forest area at the head of the supply chain, and documents showing that the product does not come from a controversial source, including contracts, agreements and self-declarations or other reliable information. Table B.2 lists source risk indicators corresponding to the elements of the definition of controversial sources in 3.4, with detailed indicators such as a low integrity rating of the government of the source country given by an international organization recognized by the Chinese government, countries or regions recognized as having weak forest governance and law enforcement, species commonly associated with the activities described in 3.4 a) or b), sanctions imposed by the United Nations or the Chinese government restricting the import or export of forest products, an annual harvest of industrial roundwood above annual growth according to publicly available data such as the Food and Agriculture Organization forest resources assessment, an environmental performance index score for biodiversity and habitat below fifty, evidence that the country does not observe the International Labour Organization conventions on fundamental principles and rights at work, evidence that it does not observe the United Nations declaration on the rights of indigenous peoples, widespread armed conflict in the source country or region according to public international data, and public data showing that the source country or region produces and markets genetically modified trees and tree-based organisms. A footnote to Table B.2 states that where an element carries more than one detailed indicator, all of them shall be applied, and a second footnote records that the environmental performance index is compiled by Yale University and Columbia University together with the World Economic Forum. Table B.3 lists three supply chain risk indicators: the trading country or region of the timber and timber products is unknown; the species contained in the product is unknown; and there is evidence that an organization in the supply chain has been involved in illegal activity relating to controversial sources. A risk assessment shall be carried out for every supplier making a first delivery, and for several different suppliers for which the information listed in B.2 is the same and all the indicators of Tables B.1 to B.3 apply in the same way; a note allows a single assessment to be made for a whole region where different suppliers from that region deliver products with the same information under the same indicators. For all material covered by the assessment the organization shall keep continuously updated records, against the content of B.2 and the indicators of Tables B.1 to B.3, of the successive consignments of each individual supplier and of collective suppliers with the same characteristics. The risk assessment shall be reviewed and, where necessary, revised at least once a year, and shall be revised whenever the information listed in B.2 changes.

B.4 Substantiated concerns. Where the due diligence system of the organization finds that material may come from a controversial source, the organization shall ensure that the concern is investigated promptly, the investigation starting no later than the tenth working day after the concern is confirmed. Where the investigation cannot resolve the concern, the risk of the material coming from a controversial source shall be rated as significant and managed in accordance with B.5.

B.5 Management of significant risk supplies. The organization shall require a supplier rated as significant risk to provide additional information and evidence, so that its supply can be rated as negligible risk. It shall require the supplier to provide the information needed to identify the forest management area of origin and the whole supply chain, and to allow the organization to carry out second-party or third-party verification of its own operations and those of its upstream suppliers; a note states that this is achieved through a contract or a written self-declaration by the supplier. The organization shall establish a second-party or third-party verification procedure for suppliers rated as significant risk, covering the identification of the whole supply chain and of the forest management area at its head, on-site verification where necessary, and the improvement measures required. The organization shall require a significant risk supplier to provide detailed information on the whole supply chain and on the forest management area at its head; where a link in the supply chain is rated as negligible risk under an indicator of Table B.1 the organization need not trace the whole chain back to the forest management area, unless a substantiated concern arises, in which case B.4 applies. The information provided shall be sufficient for the organization to plan and carry out an on-site verification. The verification procedure shall include on-site verification of significant risk suppliers, carried out either by the organization itself as second-party verification or by a third party acting on its behalf; where the documents supplied are sufficient to show that the material does not come from a controversial source, a document review may replace the on-site verification. The organization shall demonstrate that the persons carrying out the verification have adequate knowledge and competence in local commercial, cultural and social practice and in the applicable treaties, conventions, law, governance and enforcement relating to the origin of significant risk material and to risk determination. The organization shall determine the sampling to be applied when the verification procedure is run on the significant risk supplies of a given supplier; several identical deliveries from the same supplier count as one supply. The annual sample size is fixed by a formula relating it to the number of significant risk supplies received in the year, and a reduced sample size is allowed by a second formula where earlier on-site verifications have effectively met the objectives of the document; both results are rounded to a whole number. The on-site verification shall cover verification of the direct supplier and of all upstream suppliers in the chain, to assess whether they conform with the declarations the supplier makes about the origin of the material, and verification of the forest management area at the head of the supply, or of the parties responsible for the forest management activities, to assess whether they conform with the applicable law. The organization shall draw up written procedures for corrective measures to remedy the non-conformities of suppliers found through the verification procedure. The scope of the corrective measures shall be set according to the scale and severity of the risk that the material or product comes from a controversial source, and shall include at least one of the following: clear communication of the identified risk to the supplier concerned together with a requirement to deal with it within a set time, so that material or products from controversial sources are not supplied to the organization; a requirement that the supplier draw up risk mitigation measures ensuring that the forest management unit complies with the law and improving the efficiency of information exchange within the supply chain; or cancellation or suspension of all contracts or orders for the material or products until the supplier can show that appropriate risk mitigation measures have been implemented.

B.6 Prohibition on placing on the market. The organization shall not include forest and tree based material or forest products of unknown origin or from controversial sources in the product groups covered by its CFCC chain of custody. Where the organization knows that forest and tree based material or forest products not covered by its CFCC chain of custody come from an illegal source, as referred to in 3.4 a), it shall not place them on the market. Where the organization receives a substantiated concern indicating that material or products outside the scope of the chain of custody may come from an illegal source, as referred to in 3.4 a), it shall not place them on the market until the concern has been resolved in accordance with B.4.