Complaints and appeals

Appeals

An appeal is a request to reconsider a certification decision: a refusal to certify, the classification of a nonconformity, or a decision to suspend, reduce the scope of, or withdraw a certificate.

How to appeal

1. Submit the appeal in writing through the contact form within 30 days of the decision, stating the decision being appealed and the grounds.
2. We acknowledge receipt within three business days and confirm who is handling the appeal.
3. The appeal is reviewed by a panel of people who were not involved in the audit or the original decision. The panel may ask for further information from you or from the audit team.
4. We aim to notify you of the outcome, with reasons, within 30 days of receipt. Complex appeals may take longer, and we will tell you if so.

Submitting an appeal does not result in any discriminatory action against the appellant. Where a certificate has been suspended, the suspension remains in place while the appeal is considered unless the panel decides otherwise.

Complaints about RiskZero

A complaint is an expression of dissatisfaction with any aspect of our service: auditor conduct, scheduling, reporting, invoicing, or anything else.

1. Send the complaint through the contact form with enough detail for us to investigate.
2. We acknowledge within three business days.
3. The complaint is investigated by someone not involved in the matter complained about. We may contact you for more information.
4. We aim to respond with our findings and any action taken within 20 business days.

Complaints about a certified organization

If you believe an organization certified by RiskZero is not meeting the requirements of ISO/IEC 27001 within its certified scope, or is misusing its certificate or our mark, we want to know. Send details through thecontact form.

We will confirm whether the organization is certified and whether the matter falls within the certified scope. Where it does, we investigate, which may include an unscheduled audit. We will tell you the outcome to the extent confidentiality allows. Complaints of this kind are treated as inputs to the organization's next audit in any event.

Escalation

If you are not satisfied with how RiskZero has handled an appeal or complaint, you may refer the matter to RiskZero's management, independent of the engagement, through the contact form, marked for escalation, and to the impartiality committee once it is constituted.

Records

We keep records of all appeals and complaints, the investigation, and the outcome. These are reviewed by management and, once constituted, by the impartiality committee.