R2v3 Facility Moves – What You Need To Know

What do you need to know about facility move audits?

Facility moves represent the relocation of certified processes and systems from one address to another, not to be confused with the addition of new facilities or sites to an existing certificate. According to the current version of the Code of Practices (COP) for R2v3-certified organizations, facility moves require an audit of the new address before a revised certificate can be issued.

Since R2v3 is a facility-based certification, the cessation of operations to move facilities invalidates the certificate. For this reason, the COP requires the R2 certificate be suspended if a move verification audit is not conducted within 60 days of the effective date of the move.* If applicable, the suspension will remain in effect until the move audit has been performed, any NCs resolved, and a revised certificate issued.

*The effective date represents the earliest date that cessation of processing began in order to facilitate the move, rather than the latest date the organization occupied the facility/address. For example, an organization might cease data sanitization or testing efforts to transport their processing equipment to the new facility. Since the associated deadlines for auditing, suspension activities, and potential withdrawal are all based on this date, it is critical that it is relayed to the CB in an accurate and timely manner.

• Suspension, if required, is limited to a maximum of 6 months from the effective date of the move. If not resolved by this deadline, the R2v3 certificate is required to be withdrawn. The client organization would require a new registration to pursue R2v3 certification anew.
• If a revised certificate cannot be issued within 6 months of the effective date of the move*, the R2v3 certificate is required to be withdrawn. The client organization would require a new registration to pursue R2 certification anew.
• In instances where a move may take longer than the 6-month limit, an alternative option provided by the COP is to temporarily add the new location to the existing certificate as a Campus scheme. Full audit requirements would apply to both certified facilities in the interim, including prerequisite QEHS certification (as applicable). Subsequently, upon closure of the previous facility, the scheme could be changed once more to remove the facility from the certification. (An audit would likely be required to verify this before revising the certification again.)
• The move verification audit(s) can either be performed as a separate audit activity or done in conjunction with the annual audit, dependent upon the timing of the move in comparison to all applicable deadlines. However, the COP requires time be added to the annual audit for move verification activities, if that is the case.

What do you need to do in preparation for a move?

Organizations are expected to reference and utilize the current revision of the COP, specifically section 13.1, in order to ensure fulfillment of all move requirements. PJR must be promptly notified in advance of a planned move. Please include all relevant details, such as the effective date of the move*, the new facility address (if known at the time of communication), whether the move will also result in any changes to the scope of certification, certificate scheme/structure, etc.

R2 Facilities can be proactive in reporting the move to SERI as well, to avoid any delays in certificate approval and issuance, or the lifting of the suspension in the SERI Directory. After successful completion of a move audit and resolution of any NCR, SERI will require the SERI License be updated to reflect the new address. SERI will not approve the
certificate issuance (and associated lifting of the R2 certificate suspension), until the matter is resolved.

What do move audits entail, and can they be conducted virtually?

• Any and all portions of a facility move audit are potentially eligible for virtual auditing techniques, if the client facility(ies) can support virtual audits effectively. However, a fully virtual move audit requires an on-site audit also be conducted within six months of the effective date of the move*.
• An audit of the previous facility is no longer required by the COP. Instead, CBs/auditors are required to obtain a written declaration from the R2 Facility as to the status of the old facility, such as whether it was closed, remains open but outside of the scope of certification, has had a change in business scope, etc.
• The new location’s audit will include (at a minimum):
1. Verification that there have been no changes to the scope of business/processes,
2. Validity of QEHS certifications (as applicable),
3. Validity of a SERI License Acknowledgement (which is permitted to reflect the previous facility/address during the move audit),
4. Environmental aspects & health/safety risks identification has been updated (with any relevant operational control implemented),
5. Identification of applicable legal/compliance requirements,
6. Insurance policies (as applicable) have been updated,
7. Closure Plan and financial instrument(s) have been updated,
8. A legal compliance audit has been conducted for the new facility (with any NCs corrected),
9. An internal audit has been conducted for the new facility (with any NCs resolved), and
10. Downstream due diligence sampling (only if the approved downstream vendors have changed since the last audit).
• All support documentation, prerequisite QEHS certifications (as applicable), and advertising (e.g. website) must be revised to reflect the new address.

Download a copy of this White Paper here