Conformity Assessment & Audit Rules
Version 2.0 · Publication Date: 2026-09-22 · Status: Published / Effective
Document ID: DV-F-33-v2.0
© 2026 DraftVerify™ Standards Initiative. All rights reserved.
1. Purpose
F-33 establishes a repeatable method for assessing conformity with applicable DraftVerify requirements.
Assessment shall be based on objective evidence rather than marketing claims, reputation, or commercial value to DraftVerify.
2. Assessment planning
Before assessment, DraftVerify shall define:
- applicant;
- requested certification scope;
- applicable F-Series requirements;
- sites or systems sampled;
- evidence required;
- assessment method; and
- assessor or audit personnel.
3. Evidence
Evidence may include:
- physical inspection;
- registry records;
- verification events;
- controlled documents;
- training or competence records;
- system maps;
- change records;
- incident records;
- interviews;
- demonstrations; and
- photographs or other records where appropriate.
Evidence shall be sufficient to support the finding made.
4. Critical gates
A scoring result shall not override a critical failure.
The following are critical unless an applicable certification profile defines a stricter rule:
- product identity cannot be reliably traced through the in-scope pathway;
- a known or unresolved alcoholic/NA identity mismatch exists;
- a material record used for certification has been falsified;
- an unauthorized party has materially altered a controlled identifier or certificate record;
- the organization continues to claim active certification after withdrawal or suspension; or
- a condition designated critical by another applicable F-Series requirement remains open.
An applicant with an open critical nonconformity shall not receive active certification for the affected scope.
5. Nonconformity classes
Critical
Defeats a core control or creates unacceptable uncertainty. Certification shall not be active for the affected scope until closed.
Major
Material failure of a required control without an open critical condition. Corrective action and verification are required within the period set by DraftVerify.
Minor
Limited failure that does not materially defeat the control objective. Corrective action may be accepted with follow-up.
Observation
Not a nonconformity; identifies an improvement opportunity or emerging risk.
6. Scoring
Where DraftVerify uses a numerical score, the scoring model shall:
- be published or disclosed to the applicant;
- identify category weights;
- distinguish critical gates from score;
- be applied consistently to materially similar scopes; and
- not be the sole basis for certification when unresolved mandatory requirements exist.
A program profile may establish a passing threshold, but all critical requirements remain independent gates.
7. Findings
Each nonconformity shall identify:
- requirement reference;
- evidence;
- finding;
- classification;
- responsible scope;
- required corrective action or response; and
- due date where applicable.
8. Corrective action
For major or critical findings, the organization shall identify:
- immediate containment where applicable;
- cause or contributing condition;
- corrective action;
- implementation evidence; and
- verification of effectiveness where required.
9. Certification decision
The decision record shall identify:
- evidence reviewed;
- open findings;
- closed findings;
- scope;
- Standard version;
- decision;
- decision maker; and
- effective date.
10. Audit frequency
Assessment frequency shall be risk-based and defined by the applicable certification program or contract.
DraftVerify may require additional assessment following a material incident, scope change, suspected misuse, or evidence integrity concern.
11. Confidentiality
Non-public information obtained during assessment shall be handled according to applicable confidentiality, privacy, and contractual requirements.
12. Impartiality
Commercial pressure, customer size, payment amount, or business relationship shall not change the meaning of a requirement or permit an open critical nonconformity to be ignored.
Known conflicts of interest shall be recorded and controlled.
13. Records
DraftVerify shall maintain sufficient assessment and decision records to explain how the certification decision was reached.