How to Get Supply Chain Certification: A Guide for Companies

As a part of the registration process for the Rainforest Alliance Certification Program, organizations will be asked to submit information that feeds into the Supply Chain Risk Assessment (SCRA). The SCRA evaluates the potential risks of an organization’s operations on individual site level to determine the type and frequency of verification that it will need to comply with Rainforest Alliance requirements. A company’s risk profile is based on the activities, location and crop information captured through this process in combination with other internal and third-party data (volumes, compliance, social risks, and others) specific for each individual site. Based on this information, an organization is assigned a verification level which determines whether an audit is needed, and if this is the case, the type and frequency of the audit.

Retail and foodservice companies that only conduct retail activities receive the lowest risk profile: verification level A, even if they are directly responsible for SD or SI requirements. Companies with verification level A will only need an internal Rainforest Alliance desk review, rather than a (remote) audit. For retailers that also conduct other activities such as importing or manufacturing, other verification levels might apply. For retail specific guidance on the SCRA, please visit our retail webpage.

The SCRA is only applicable to those organizations going through the supply chain certification process. Organizations that go through the farm audit process do not have to complete the SCRA. In practice, this means that organizations that include farming in their activities are considered prospective farm certificate holders and the SCRA does not apply to them. When an organization registers for the Program, it is asked to indicate its activities. If a prospective Certificate Holder is recognized as a supply chain organization, the system will indicate that the SCRA process applies.

After the system has established that an SCRA is needed and the organization has filled out the questionnaire for each site that they wish to include in their certification profile, they can confirm their scope and view their requirements. Once this is complete, the organization can submit the SCRA by selecting the ‘calculate my verification level(s)’ button and confirming that the profile is ready to be reviewed. The final step to submit the SCRA is then to complete payment of the SCRA fee.

The complete profile is then reviewed by the Supply Chain Certification team. Once the team confirms the risk for each site within the organization’s profile, the verification levels will be displayed in the organization’s account. In addition, the organization receives an email that includes next steps for supply chain certification.  Please note that an organization can update the scope of their profile any time prior to selecting the ‘calculate my verification level(s)’ button. Once this process is set in motion, the organization needs to reach out to the Rainforest Alliance to make any changes to sites that are under review. However, new sites can be added at any time.

Currently, the review time is estimated at 3 weeks, based on the projected number of requests. It is expected that the review time becomes shorter as requests are processed, and fewer requests enter the system.

The verification level refers to how often and what review processes are needed to assess the risk at a specific site. This verification can range from an internal Rainforest Alliance review of the certification profile of an organization, to a site audit carried out by a Certification Body.

The Rainforest Alliance review
The review is a remote method of verification through which the Rainforest Alliance evaluates compliance with the 2020 Sustainable Agriculture Standard by evaluating evidence submitted by the Certificate Holder. This can include looking at the Certificate Holder’s self-assessment, non-conformance history if applicable. The Rainforest Alliance may contact the company to ask for additional information.

The Rainforest Alliance automated check
This method of verification evaluates basic compliance with the program through data collected in the Rainforest Alliance Certification Platform, including up-to-date traceability, submitted seal approvals and valid license agreements.

The CB on-site audit
In this type of audit, representatives of a Certification Body travel to a site to obtain audit evidence and evaluate compliance with the relevant Standard requirements.

The CB desk audit
In this type of audit, the Certification Body works remotely and reviews documentation to evaluate compliance with the relevant Standard requirements.

Levels A through E indicate how often an organization needs to present data related to compliance to the Rainforest Alliance, and in what way.

A site that falls under verification level A is considered low risk. Therefore, the Rainforest Alliance considers it sufficient to review information itself, rather than ask the organization to undergo an audit from a CB. The Rainforest Alliance conducts a review of an organization’s level of compliance with their applicable requirements and any non-conformance history. A site under verification level A will receive an endorsement, which has the same weight as a Certification Body-issued certificate and allows for the organization to carry out transactions in the Rainforest Alliance platforms.

For all other levels (B-E), third-party (Certification Body) verification is required at least in year one of the three-year certification cycle. The verification becomes more in-depth as the risk increases, from a desk audit to an on-site audit through a Certification Body. If the Certification Body that carries out the audit makes a positive decision, it can issue a Rainforest Alliance certificate. The organization is then allowed to carry out transactions in the Rainforest Alliance platforms.

The following data is collected from organizations when creating their profile in the RACP. This data forms part of the SCRA and allows to assess the risk and determine the verification level.

Retail specific guidance for this question can be found on our retail webpage.

Data points requested:

• Site location, specifically country
• Site activity (i.e., trading, processing, warehousing, packing, retailer, brand owner)
• Crops handled or purchased at a site
• Whether the physical handling of product occurs at a site
• Whether only Rainforest Alliance products are handled at a site
• Site volumes per crop
• Site role (i.e., administrator)
• Whether a site is a first buyer
• The type of claim a site is making
• Whether a site has a specific combination of valid certificates to other Chain of Custody/Supply Chain schemes (i.e., organic, fair trade, GFS, ISO, Etc.)

Retail and Foodservice Company entities that already received a verification level B, and do not engage in non-retail activities, can get this corrected by reaching out to – supplychaincert@ra.org.

To ensure a smooth transition to the new Rainforest Alliance program, the SCRA will not be subjected to processing fees during the transition period. The Rainforest Alliance will provide guidance around when the SCRA fees will become applicable.

Organizations familiar with the legacy 2017 Rainforest Alliance Certification Program know the SCRA process outlined above as the Chain of Custody Risk Assessment (CRA). The CRA process was housed in Marketplace, and it was used to evaluate the frequency and type of verification required for supply chain actors to achieve certification. The Supply Chain Risk Assessment, or SCRA, serves the same purpose in the new program although it looks a bit different. The SCRA is housed in the RACP and is embedded in the profile completion process for supply chain organizations. Also, the name has changed from CRA to SCRA as the Rainforest Alliance no longer refers to organizations that are seeking certification after the farm as ‘Chain of Custody’ organizations, but rather ‘Supply Chain organizations’.

If a company has other certifications recognized by the Rainforest Alliance or show continuous compliance with the Rainforest Alliance Standard requirements, they can potentially lower their risk and therefore their verification level. The verification of both processes will be conducted within the Rainforest Alliance Platform.