How to Get Supply Chain Certification: A Guide for Companies

As a part of the registration process for the Rainforest Alliance Certification Program, organizations will be asked to submit information that feeds into the Supply Chain Risk Assessment (SCRA). The SCRA considers the organization’s activities, its location and the location of sites, information on the certified product or products, compliance, and social risks, among others. Based on this information, an organization is assigned a verification level which determines whether an audit is needed, and if this is the case, the type of audit and the frequency.

The SCRA is only applicable to those organizations going through the supply chain certification process. Organizations that go through the farm audit process do not have to complete the SCRA. In practice, this means that organizations that include farming in their activities are considered a prospective farm certificate holder and the SCRA does not apply to them. When an organization registers for the Program, it is asked to indicate its activities. If a prospective Certificate Holder is recognized as a supply chain organization, the system will indicate that the SCRA process applies.

After the system has established that an SCRA is needed and the organization has filled out the questionnaire recording each site that they wish included in the certificate, they can confirm their profile and scope.

The complete profile is then reviewed by the Supply Chain team. Once the team confirms the risk for each site within the organization’s profile, the verification levels will be displayed in the organization’s account. Once the verification levels have been calculated, the organization receives an email that includes next steps for supply chain certification.  Please note that an organization can update the scope of their profile any time prior to selecting the ‘calculate my verification levels’ button. Once this process is set in motion, the organization needs to reach out to the Rainforest Alliance to make any changes while under review.

Currently, the review time is estimated at 3 weeks, based on the projected number of requests. It is expected that the review time becomes shorter as requests are processed and fewer requests enter the system.

The verification level refers to how often and what review processes are needed to assess the risk at a specific site. This verification can range from an internal Rainforest Alliance review of the certification profile of an organization, to a site audit carried out by a Certification Body.

The Rainforest Alliance review
The review is a remote method of verification through which the Rainforest Alliance evaluates compliance with the 2020 Sustainable Agriculture Standard by evaluating evidence submitted by the Certificate Holder. This can include looking at the Certificate Holder’s self-assessment, non-conformance history if applicable. The Rainforest Alliance may contact the company to ask for additional information.

The Rainforest Alliance automated check
This method of verification evaluates basic compliance with the program through data collected in the Rainforest Alliance Certification Platform, including up-to-date traceability, submitted seal approvals and valid license agreements.

The CB on-site audit
In this type of audit, representatives of a Certification Body travel to a site to obtain audit evidence and evaluate compliance with the relevant Standard requirements.

The CB desk audit
On this type of audit, the Certification Body works remotely and obtains documentation to evaluate compliance with the relevant Standard requirements.

In the 2015 Rainforest Alliance program and the 2015 UTZ program, supply chain actors could fall under one of four risk scores: very low risk, low, medium, and high risk. The current program, based on the 2020 Sustainable Agriculture Standard, recognizes five levels: A, B, C, D, and E, where A is the lowest risk and E the highest, as can be seen on the table below.

Levels A through E indicate how often an organization needs to present data related to compliance to the Rainforest Alliance, and in what way.

A site that falls under verification level A is considered low risk. Therefore, the Rainforest Alliance considers it sufficient to review information itself, rather than ask the company to undergo an audit from a CB. The Rainforest Alliance conducts a review of an organization’s level of compliance with their applicable requirements and any non-conformance history. A site under verification level A will receive an endorsement, which has the same weight as a CB-issued certificate and allows for the organization to carry out transactions in the Rainforest Alliance platforms.

For all other levels (B-E), third-party (CB) verification is required at least in year one of the three-year certification cycle. The verification becomes more in-depth as the risk increases, from a desk audit to an on-site audit through a Certification Body. If the Certification Body that carries out the audit makes a positive decision, it can issue a Rainforest Alliance certificate. The organization is then allowed to carry out transactions in the Rainforest Alliance platforms.

The following data is collected from organizations when creating their profile in MultiTrace. This data forms part of the SCRA and allows to assess the risk and determine the verification level:

• Site location, specifically country
• Site activity (i.e. trading, processing, warehousing, packing, retailer/brand owner)
• Crops handled or purchased at a site
• Whether the physical handling of product occurs at a site
• Whether only Rainforest Alliance products are handled at a site
• Site volumes per crop
• Site role (i.e. administrator)
• Whether a site is a first buyer
• The type of claim a site is making
• Whether a site has a specific combination of valid certificates to other Chain of Custody/Supply Chain schemes (i.e. organic, fair trade, GFS, ISO, Etc.)

In general, organizations handling volumes below the small volume thresholds (2020 Certification and Auditing Rules, p. 25) and/or not physically handling product and/or only handling Rainforest Alliance products are placed at the lowest risk level. Organizations on the highest risk level are those processing unfinished certified and non-certified products and those that present a potential risk in social topics. Social requirements become applicable to sites that meet the following parameters: They are processing AND they are located in a country where the Corruption Perceptions Index CPI is 57 or lower AND they are located in a country that Rainforest Alliance farm certificate holders. All three parameters need to be met in order for social requirements to become applicable. Social requirements are those listed in Chapter 5 of the Supply Chain Requirements in the Standard.

To ensure a smooth transition to the new Rainforest Alliance program, the SCRA will not be subjected to processing fees during the transition year. The Rainforest Alliance will communicate the SCRA fees applicable on the first full certification cycle after transitioning into the new program in 2022.

Organizations familiar with the current 2017 Rainforest Alliance Certification Program know the SCRA process outlined above as the Chain of Custody Risk Assessment (CRA).  The CRA process was housed in Marketplace, and it was used to evaluate the frequency and type of verification required for supply chain actors to achieve certification. The Supply Chain Risk Assessment, or SCRA, serves the same purpose in the new program although it looks a bit different. The SCRA is housed in MultiTrace and is embedded in the profile completion process for supply chain organizations. Also, the name changed from CRA to SCRA as the Rainforest Alliance no longer refers to organizations that are seeking certification after the farm as ‘Chain of Custody’ organizations, but rather ‘Supply Chain organizations’.

If a company has other certifications recognized by the Rainforest Alliance or show continuous compliance with the Rainforest Alliance Standard requirements, they can potentially lower their risk and therefore their verification level. The verification of both processes will be conducted within the Rainforest Alliance Platform.