Where ISCC Audits Actually Fail — and Why Your Auditor Is Barred From Preparing You

If your company holds an ISCC certificate — or is about to apply for one — there is a clause in the scheme’s contract with your certification body that ought to change how you plan the next twelve months. It is not in the standard you were sent. It is in the agreement ISCC signs with the auditor.

Read what it names as prohibited: ‎, execution, evaluation and documentation of audits. The body that audits you cannot prepare you for the audit. That is not a market quirk or a commercial preference — it is a contractual obligation ISCC imposes on every certification body it recognises, and it is mirrored in the scheme’s own standards for auditors.

The twelve-month clock nobody schedules for

ISCC certification is not a milestone you pass. It is a clock you restart every year:

“ISCC certificates are valid for twelve months which means that a certification audit is required at least every twelve months. System Users should arrange for audits to be conducted in a way that avoids a gap between two certificates.” — ISCC EU 201 System Basics v4.2, §4.2.1

The consequence of a gap is sharper than most operators expect, and the ISCC PLUS standard states it plainly: if a gap occurs, “certified raw materials, intermediates, and final products cannot be considered certified and the use of ISCC PLUS logos and claims is not allowed anymore.” The material itself loses its status. You cannot backfill it — a gap of under five years is closed by a retrospective audit, but the tonnes you moved in the meantime do not retroactively become sustainable.

There is one small mercy in the drafting: a certification body may issue a certificate up to seven calendar days before the validity period begins, precisely so the join is clean. Certificates must be issued no later than 60 days after the audit — a window that has to contain the 40-day correction period as well. Plan backwards from that, not forwards from your last audit date.

Your auditor is contractually barred from preparing you

The consultancy bar appears in every scheme document, not just the contract:

“Auditors are not permitted to carry out any activities which may affect their independence or impartiality, and specifically must not carry out consultancy activities for the ISCC System Users whom they audit for compliance with ISCC requirements.” — ISCC EU 103 v4.2, §5.1

It reaches backwards, too. Under ISCC EU 103 §3.3, having “acted as a consultant or advisor for the same scope or activity” is a disqualifying conflict of interest, and there is a three-year cooling-off period: auditors who worked for or with a company “shall not be allowed to perform audits for that company for at least three years after the work relation has terminated.” Worth noting for precision — that three-year clause sits in the ISCC EU and CORSIA documents, but not in ISCC PLUS 103 v1.1.

Thai companies will recognise the shape of this immediately. It is the same separation that governs TGO CFO verification: the organisation that checks your numbers cannot also produce them. What is different is that ISCC writes the word ‎ into the prohibition.

And here is the part we would rather say ourselves than have you discover: this is an independence rule, not evidence that you need to hire anyone. ISCC publishes its auditors’ own checklists and audit procedures for operators to use, describes their use as “voluntary for System Users but recommended”, provides self-declaration templates in more than thirty languages, and charges nothing for its integrity assessments. Nowhere in any ISCC document is external consultancy required, recommended, or even mentioned. Plenty of operators do this in-house and pass.

The internal audit ISCC calls advisory — and its own rules call mandatory

ISCC’s public certification-process page says an internal audit before the certification audit is “strongly advised.” Its own standards say something considerably firmer:

Not advised — must. Annually. Documented, and signed by management. Handed to the auditor. ISCC EU 203 §3.2.5 repeats the obligation for chain-of-custody requirements and adds that service providers and subcontractors must be covered, with the report reviewed by management at least once a year. The list of records an operator must retain includes, at item 9, the records of those internal audits and the corrective actions arising from them.

The practical consequence is easy to miss: a missing, undated or unsigned internal assessment is itself an audit finding — before anyone has looked at a single tonne of feedstock.

Where audits actually fail: the management system

ISCC publishes aggregated audit findings every year in its report to the European Commission, which EU law requires to be published in full. The 2025 edition is unusually candid about what goes wrong, and it is not what most operators brace for:

“In 2025, the majority of major non-conformities identified by CBs were related to the System User’s management system, followed by non-compliance with requirements on the traceability of materials and chain of custody.” The critical non-conformities, meanwhile, “are related to training of employees, mass balance calculation, fulfilment of the EU reporting obligation”, and the ISCC Principles.

Documented procedures. Defined responsibilities. Training records. Bookkeeping. Audits fail on administration, not on sustainability performance.

The correction window is tighter than the law requires, which surprises operators who have read the regulation rather than the scheme:

Miss the 40 days and it is not a deferral. Under ISCC EU 201 §4.2.3 the audit “must be considered as a failed audit” — the certificate cannot be issued and the audit must be repeated in full.

The English rule inside the audit

There is a language rule inside ISCC, added in the May 2025 release, and almost nobody outside the certification bodies has read it:

Be precise about what this does and does not require, because the distinction is commercially significant. Nothing obliges your own records to be in English. Your mass balances, weighbridge tickets, contracts, invoices and self-declarations may be kept entirely in Thai, and ISCC deliberately supplies farm- and point-of-origin templates in over thirty languages so that evidence works in the local language. The EU implementing regulation imposes no language requirement at all.

What the rule does impose is a schedule risk. The audit report goes to ISCC in English — that is the certification body’s obligation, not yours. But if your auditor does not work in your site’s language, an independent translator is mandatory, and the documents the auditor needs “must be translated independently, ideally in advance of the audit.” A Thai-only document pack in front of a non-Thai-speaking auditor becomes a translation project on the critical path of a 40-day clock.

It is the second regime this month to write English into its operative text. The EU’s carbon border mechanism now requires that the operator’s emissions report be submitted in English as a matter of law. Different regulators, different purposes — converging on the same practical point about which version of your documentation actually gets read.

Thailand’s real ISCC position — and the SAF claim to stop repeating

Two things are worth correcting about how the Thai ISCC market is usually described, because both are repeated widely and neither survives contact with the source.

First, Thailand does not have a SAF blending mandate. You will read almost everywhere that Thailand “mandated a 1% sustainable aviation fuel blend from 1 January 2026, rising to 8% by 2036.” The instrument that took effect on 1 January 2026 is a Department of Energy Business fuel-quality specification, published in the Royal Gazette on 14 October 2025. It defines what may lawfully be sold as jet fuel, and it sets SAF content as a maximum — the Thai text reads ไม่สูงกว่า, “not higher than” — at 5% for co-processed and 50% for neat blends. That is a ceiling, not a floor. No Thai instrument obliges anyone to blend 1%. The ladder toward 8% is a roadmap in the national energy plan, not law, and CAAT’s own published plan describes Phase 1 as voluntary, delivered through a memorandum of understanding signed with eight airlines in November 2025. The demand is real and coming. The legal obligation is not there yet — and saying otherwise in front of a refiner will cost you the room.

Second, the market is smaller and stranger than the headlines suggest. A direct query of ISCC’s public certificate database on 19 August 2026 returns 197 valid Thai certificates across 148 organisations — 102 ISCC PLUS, 65 ISCC EU and 30 ISCC CORSIA. Thailand ranks fifth in ASEAN, behind Indonesia (878), Malaysia (752), Singapore (469) and Vietnam (244).

The interesting number is the third. Thailand holds about 1.2% of the world’s valid ISCC certificates but 3.7% of all ISCC CORSIA certificates — it is over-indexed on aviation fuel roughly threefold. The scope mix tells you who these operators are: 101 processing units, but also 74 collecting points and 72 traders with storage. A large share of Thailand’s ISCC population is small used-cooking-oil collectors and traders recently pulled into a certified chain — precisely the operators least likely to hold a documented management system, which is exactly where the major non-conformities land.

One feedstock note with real commercial consequence: eleven Thai certificates list PFAD. Under ReFuelEU Aviation Article 4(5), palm fatty acid distillate and palm-derived materials are excluded from the calculation of the EU’s minimum SAF shares, while used cooking oil sits in Annex IX Part B and counts toward them. Two barrels of HEFA leaving the same refinery can carry entirely different regulatory value depending on what went in. And every Thai certificate is issued by a foreign certification body — SGS Germany, Control Union Poland and Bureau Veritas Polska among them. There is no ISCC-recognised certification body domiciled in Thailand.

What honest preparation looks like

Keep the numbers in proportion. 138 withdrawals against 8,549 certificates issued is about 1.6% — the overwhelming majority of operators are certified without drama, and any pitch built on fear of failure is misreading the data. ISCC’s integrity assessments did find non-conformities in roughly 88% of cases in 2025, but those assessments are deliberately risk-targeted, with 92.8% aimed at sites handling waste and residues; it is a hit rate for suspicion, not a pass rate for the industry.

The honest case for preparation is narrower, and stronger for being narrow:

ISCC’s own architecture separates the two roles and says so in writing. The operators who find that comfortable are the ones who built the internal assessment, the mass balance and the document pack before the auditor asked for them — and who treated the twelve-month clock as an operating rhythm rather than an annual surprise. Compare ISCC EU, PLUS and CORSIA → · CORSIA and aviation fuel → · Track the 2026–27 regulatory calendar →

Sources, verified verbatim against primary ISCC documents on 19 August 2026: ISCC 251-02 General Terms of Certification v2.0 (22 May 2026), cl. 4.10; ISCC EU 201 System Basics v4.2, §§4.2.1–4.3; ISCC EU 103 Requirements for Certification Bodies and Auditors v4.2, §§3.3, 4.3, 5.1 and fn 13; ISCC EU 203 Traceability and Chain of Custody v4.2, §§3.2.2, 3.2.5, 4.4; ISCC PLUS 201 v1.1 §3.2 and ISCC PLUS 103 v1.1; ISCC Report to the European Commission, Calendar Year 2025; Commission Implementing Regulation (EU) 2022/996. Othello provides preparation, training and audit-support only.