ISO certification consultancy in Cambodia

Who asks for certification in Cambodia

Certification in Cambodia is a response to a demand rather than an initiative. The demand comes from a buyer, a tender, a regulator or a group head office, and the first useful thing to establish on any project is which of them you are answering — the scope follows from it, and the cost follows from the scope.

ISO 9001 is asked of organisations in Cambodia whatever they do. Beyond that, what you are asked for depends on your sector, and the sections below set out what each of the industries that drive certification in Cambodia is actually asked to hold.

• Food and Food Products
• Manufacturing
• Hotels, Restaurants and Leisure
• Textile
• Import and Export
• Chemicals
• Information Technology
• Telecommunication
• Banking and Finance

Food and Food Products in Cambodia

Retailers and export buyers set the terms here, and they set them above what food law requires. A domestic licence lets you trade; a retailer scheme is what gets you onto the shelf.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO 22000 — ISO 22000 Food Safety Management System
• SEDEX — Sedex and SMETA Audit Readiness
• SA8000 — SA8000 Social Accountability
• BRC — BRC Global Standards
• FSSC 22000 — FSSC 22000 Food Safety System Certification
• HACCP — HACCP Food Safety System
• ISO 45001 — ISO 45001 Occupational Health and Safety Management System

Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.

More on this sector: Food and Food Products.

Manufacturing in Cambodia

A factory is usually pushed into certification by its customers rather than by a regulator. The first serious buyer sends a supplier questionnaire, the second sends an auditor, and by the third it is cheaper to hold the certificate than to keep hosting audits.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO 45001 — ISO 45001 Occupational Health and Safety Management System
• ISO 14001 — ISO 14001 Environmental Management System
• SEDEX — Sedex and SMETA Audit Readiness
• SA8000 — SA8000 Social Accountability
• ISO 22000 — ISO 22000 Food Safety Management System
• ISO 41001 — ISO 41001 Facility Management System
• IATF 16949 — IATF 16949 Automotive Quality Management System

The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.

More on this sector: Manufacturing.

Hotels, Restaurants and Leisure in Cambodia

Guests do not audit, but tour operators, corporate travel buyers and insurers do. Food safety and fire precautions are where they look first.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO 22000 — ISO 22000 Food Safety Management System
• ISO 41001 — ISO 41001 Facility Management System
• HACCP — HACCP Food Safety System
• PCI DSS — PCI DSS Compliance
• ISO 45001 — ISO 45001 Occupational Health and Safety Management System
• ISO 14001 — ISO 14001 Environmental Management System
• ISO 50001 — ISO 50001 Energy Management System

These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.

More on this sector: Hotels, Restaurants and Leisure.

Textile in Cambodia

The buyer is the regulator in this sector. Retail brands publish supplier requirements and enforce them with their own auditors.

What an organisation in this sector in Cambodia is typically asked to hold:

• SEDEX — Sedex and SMETA Audit Readiness
• SA8000 — SA8000 Social Accountability
• ISO 26000 — ISO 26000 Social Responsibility Guidance
• ISO 45001 — ISO 45001 Occupational Health and Safety Management System
• ISO 14001 — ISO 14001 Environmental Management System
• ISO 50001 — ISO 50001 Energy Management System

The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.

More on this sector: Textile.

Import and Export in Cambodia

Two sets of rules apply at once — the destination market's and the buyer's — and the destination's are not negotiable. Certification is usually the cheapest route through both.

What an organisation in this sector in Cambodia is typically asked to hold:

• SEDEX — Sedex and SMETA Audit Readiness
• SA8000 — SA8000 Social Accountability
• ISO 22000 — ISO 22000 Food Safety Management System
• ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
• BRC — BRC Global Standards
• CTPAT — CTPAT Supply Chain Security
• FSSC 22000 — FSSC 22000 Food Safety System Certification

Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.

More on this sector: Import and Export.

Chemicals in Cambodia

Handling, storage and discharge are all watched, and the customers are usually manufacturers with their own audit programmes. Certification answers both audiences with one system.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO 45001 — ISO 45001 Occupational Health and Safety Management System
• ISO 14001 — ISO 14001 Environmental Management System
• ISO/IEC 17025 — ISO/IEC 17025 Testing and Calibration Laboratories
• ISO 14064 — ISO 14064 Greenhouse Gas Quantification and Reporting
• ISO 50001 — ISO 50001 Energy Management System

These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.

More on this sector: Chemicals.

Information Technology in Cambodia

Software buyers stopped taking assurances some years ago. What they ask for now is evidence held by somebody who is not you — which is why a certificate closes a deal that a well-written policy does not.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
• SOC — SOC 1 and SOC 2 Readiness
• ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
• ISO 41001 — ISO 41001 Facility Management System
• CMMI — CMMI Appraisal Readiness
• PCI DSS — PCI DSS Compliance
• ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System

Not all at once. Most organisations start with the one the customer named and add the others as they are asked for, which is both cheaper and easier to sustain than a programme that tries to do everything in one year.

More on this sector: Information Technology.

Telecommunication in Cambodia

Operators are asked for two things at once: that the network stays up, and that what crosses it stays private. Licence conditions cover some of it, enterprise customers and their own audit departments cover the rest.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
• ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
• CMMI — CMMI Appraisal Readiness
• SOC — SOC 1 and SOC 2 Readiness
• ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
• ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System
• ISO 22301 — ISO 22301 Business Continuity Management System

The order matters more than the list. Take the one that is currently blocking something, build the system once, and the second and third certificates cost a fraction of the first because the system is already there.

More on this sector: Telecommunication.

Banking and Finance in Cambodia

Financial services buy certification because their own supervisors and their payment partners each ask for evidence, and because an outsourcing arrangement transfers the work but not the accountability.

What an organisation in this sector in Cambodia is typically asked to hold:

• ISO/IEC 27001 — ISO/IEC 27001 Information Security Management System
• PCI DSS — PCI DSS Compliance
• ISO 41001 — ISO 41001 Facility Management System
• ISO/IEC 27701 — ISO/IEC 27701 Privacy Information Management System
• SOC — SOC 1 and SOC 2 Readiness
• ISO 20000-1 — ISO/IEC 20000-1 IT Service Management System
• ISO/IEC 42001 — ISO/IEC 42001 Artificial Intelligence Management System

These overlap more than their titles suggest. A single management system can carry several of them, audited together, which is the difference between one annual audit and three.

More on this sector: Banking and Finance.

Choosing a certification body in Cambodia

This is the decision most often made on price alone, and the one where price tells you least. What you are buying is somebody else's credibility, and credibility is what a cheap certificate does not have.

Accreditation is the first question and it has a local edge to it. A certificate is issued by a certification body, but the body is itself accredited by an accreditation body, and it is that second name the buyer's procurement team checks. Where an accreditation body is a signatory to the IAF Multilateral Recognition Arrangement, certificates issued under it are intended to be recognised in the other signatory countries — which is what matters if you are in Cambodia and selling abroad, or selling into Cambodia from outside it.

After that: sector competence, because an auditor who has audited your industry asks better questions and wastes less of your time; whether the party that triggered this names particular bodies, which is worth asking before you shortlist rather than after; and the diary and the travel, which in a market the size of Cambodia can decide the timetable more than the audit itself. Audit days are set by your headcount and scope, so quotes should be comparable — if one is far cheaper, look at the audit days before you look at the price.

Among the bodies most widely recognised, in no particular order: BSI, TÜV, SGS, SIS Certifications, Intertek, DNV, BVQI.

MSCi works with a pool of accredited certification bodies rather than one, and it is worth being plain about why that helps you: bodies differ in audit-day rates, in what it costs to get an auditor to your site, in how soon they can get one there, and in the sectors they are accredited for. Having several to approach means your scope goes to the ones that actually fit it and you get comparable quotes back, rather than taking the first number offered.

What it does not change is the audit. We cannot influence a finding and would not try — the body's independence is the entire value of the certificate, and a consultancy offering otherwise is selling something worthless. We prepare you so the audit is uneventful, and the body decides. Accreditation rules also prohibit the organisation that builds your management system from being the one that certifies it, which is why we prepare and never certify.

Where to start in Cambodia

The sequence below is the one that survives the audit. It is deliberately not "buy a set of documents", which is where most projects begin and the reason most of them take twice as long as they should.

• Find out precisely what has been asked for, and by whom. A tender in Cambodia naming a standard, a customer's security annex and a regulator's requirement are three different jobs.
• Fix the scope in writing — which sites in Cambodia, which activities, which products. Scope drives cost more than any other single decision, and widening it after the audit is booked is re-work.
• Score yourself against the standard with the free readiness assessment on this site, then have the gaps confirmed on evidence rather than on a questionnaire.
• Close the gaps in the work before closing them on paper. A procedure written to satisfy an auditor, rather than to describe what the people doing the job actually do, is the gap an auditor finds.
• Choose the certification body with the accreditation your buyer recognises, and book the audit against a date the closure plan can actually meet.

We work across Cambodia onsite, remotely and as a mix of the two, and the choice is usually decided by where your sites are rather than by preference.