What auditors reject on the CO₂ Performance Ladder

What counts as a deviation, and when is it major?

The certification scheme for version 4.0, the Certificatieregeling, classifies deviations in two different ways depending on which part of the handbook you fail. That detail gets skipped a lot and it changes the whole assessment.

Part 1 (Deel 1) holds the general management system requirements: organisational boundary, key personnel, publication, projects, internal audit, management review. There the scheme says the certification body "volgt de omschrijving van een belangrijke afwijking zoals staat in ISO 17021-1 §3.1.2", meaning it follows the ISO 17021-1 definition of a major nonconformity, and §3.1.3 for a minor one. Nothing is scored there.

Part 2 (Deel 2) holds the requirements per angle and per step. There it is arithmetic. A deviation is major "wanneer de CI naar aanleiding van een afwijking op een eis, onvoldoende punten toekent voor het behalen van de trede van het handboek", so when the certification body awards too few points to reach the step, and minor when it still awards enough.

Note the last row. The scheme states plainly: "Geconstateerde afwijkingen van de eisen aan CO2-Prestatieladderprojecten zijn altijd belangrijke afwijkingen." There is no mild variant for projects.

How many points did you need to pass?

Handbook 3.1 says it exactly, and that still matters while 3.1 audits are still allowed:

"Een organisatie voldoet pas aan de eisen van een bepaald niveau indien voldaan is aan de algemene eisen van de CO2-Prestatieladder (zie §6.1), en voldaan is aan de minimale eisen voor A, B, C en D van desbetreffend niveau (20 punten) en aan de eisen van alle onderliggende niveaus, en de som van de gewogen scores per niveau minstens 90% (22,5 punten) van de maximale score (25 punten) is."

In English: you meet a level only if you meet the general requirements, the minimum requirements for angles A, B, C and D at that level (20 points), all requirements of the levels below, and reach at least 90% (22.5 of 25 points) of the weighted score. Minimums apply per angle, so excelling on one angle does not cover a gap on another, and 90% is a narrow pass. What the handbook does not give is the weighting factors themselves. SKAO records only that each angle has "een eigen wegingsfactor" and publishes no per-angle percentages.

Assessment stays human judgement inside a frame. Handbook 3.1 has the certification body score each requirement proportionally using "de eisen uit de auditchecklijsten, de toelichtingen en zijn 'expert judgement'". The terms LadderCI, auditchecklijst and expert judgement belong to 3.1. Under 4.0 it is simply the CI, the certification body.

Handbook 4.0 sets a different starting point: "De positie van een organisatie op de CO2-Prestatieladder wordt bepaald door de hoogste trede waarop de organisatie aan alle eisen voldoet." Your position is the highest step at which you meet all requirements. Points do not disappear, because the certification scheme still counts them for Part 2. Which step matches your current level is set out in why there are now three steps instead of five levels.

What do auditors reject most often, by angle?

First, a vocabulary point that gives you away. Under 3.1, angles C and D are called Transparantie and Participatie. Under 4.0 they are Communicatie and Samenwerking. Auditors hear that difference, in the same way they hear whether you say step (trede) or level (niveau).

The four angles are also the delivery format. Practitioners describe a gap between "we answered all the questions" and "we produced the four documents the auditor actually wants", and they report that their deviations come from that gap. The last column below therefore does not come from published audit reports. It is what practitioners report.

On angle D, SKAO's own documents contradict each other, and you should know that before you delete anything. SKAO's launch announcement for version 4.0 presents mandatory participation in collaborative initiatives as dropped. Handbook 4.0 step 1 nevertheless requires, in §7.1, "capaciteit en budget voor deelname aan vereiste initiatieven en samenwerkingen", capacity and budget for participation in required initiatives and collaborations. The list of changes describes the requirements as amended rather than removed. Follow the handbook.

Angle A holds the most underrated point. The certification scheme ties completeness directly to reliability in requirement 1.A.2. A correct calculation over an incomplete dataset does not satisfy it.

Angle B holds a second pattern. A document that has already been reviewed elsewhere does not automatically cover every requirement of this framework. A climate transition plan assured externally for a different reporting purpose does not by itself meet what the Ladder asks of it. Two certifications flag gaps in the same document and those gaps only partly overlap. Write one plan that satisfies all frameworks at once.

Why does evidence fail more often than policy?

You write policy once. Evidence is created again every day.

Handbook 3.1 defines the audit portfolio as a "verzameling van auditbewijsmateriaal", a collection of audit evidence consisting of "registraties en beweringen op basis van feiten of andere informatie welke relevant zijn voor de auditcriteria en verifieerbaar": records and statements based on facts, relevant to the audit criteria, and verifiable. Verifiable is the operative word.

What actually goes wrong is rarely dramatic:

• The evidence exists, but nobody remembers where it lives. The version that reaches the auditor is often not the version someone edited last.
• The same document has to be attached again to every question that touches it, and by the third time it does not happen.
• Evidence disappears quietly between platform changes, and nobody notices until the auditor asks.
• The history sits in one spreadsheet with dozens of tabs going back years, too messy to find a number in quickly.

A sustainability lead put the standard more sharply than any handbook does: "If we can have a disclosure, all the evidence locked to the data point, and the text with evidence where it got it from, then I think we already won the discussion with the auditor beforehand." Traceability down to the exact page and sentence is the difference between answering and demonstrating.

How do you justify an allocation key you invented yourself?

Meters sit on locations. Carbon accountability sits on business units. One building, three business units. You split the meter 33/33/33, or 70/30, or 40/60, based on headcount, floor area, a sub-meter or an equal split. At that moment you have created a number that is not directly traceable to a source document. The invoice says one thing, your footprint says three things.

A practitioner asked exactly the question the auditor asks: "If you have an audit, how will you then keep track of it? Because in the end we will have a value which is not very traceable."

No requirement forbids allocation keys. The requirement is that your emission inventory is complete, current and reliable. The auditor's question is about the reasoning behind the key: is it recorded, is it dated, and does it give the same result next year. What works:

• Fix the method once a year, with a date and an owner, and do not change it within the year.
• If the ratio shifts by less than five percent, leave it. Small corrections cost more comparability than they add accuracy.
• Collect fine, report coarse. You can always go from a lower collection level to a higher reporting level, never the other way.
• Avoid keys based on cost or revenue. They shift every year, and your history shifts with them. As one practitioner described it, there is no key linking the legal entity to the business unit, and if one has to be built it ends up based on cost or revenue.

The deeper reason is set out in our piece on organisational boundaries in groups with multiple entities: you are running two overlapping systems at once, statutory accounting on legal entities and operational accounting on business units, and the Ladder asks for reporting on a boundary that cuts across both.

Why are project files the most dangerous category?

Because every deviation there is major by definition, and so has to be resolved within three months.

Handbook 4.0 defines a Ladder project as "een aanbesteed project waarbij bij de inschrijving de CO₂-Prestatieladder een rol speelt en/of waarbij de opdrachtgever een voordeel verleent bij het bezit of het behalen van een CO2-Prestatieladdercertificaat": a tendered project where the Ladder played a role at bid submission and/or where the client grants an advantage for holding or achieving a certificate. If you received tender advantage, the project falls under it. The definition sets no test of whether that advantage was decisive.

For each such project you keep documented information separately. Part of it is shared digitally with the client and the certification body through the Mijn CO₂-Prestatieladder platform, at project start, at completion, and at least annually on multi-year projects.

Two things make this risky. The administration sits with the project team rather than the sustainability function, so it falls outside the view of whoever prepares the audit. And the auditor can turn up unannounced: the certification body retains "het recht om onaangekondigd op een projectlocatie langs te komen". For the audit as a whole, "een audit enkel op basis van een desk review is onvoldoende en daarom niet aanvaardbaar".

What does the auditor look at differently under handbook 4.0?

The burden of proof moved. The list of changes records that at organisation level "de invulling van 29 eisen" must be documented and "de gedeeltelijke invulling van 11 eisen" published, and at project level 10 requirements documented and 7 shared with the client.

New subjects auditors probe, all from handbook 4.0 step 1:

• The climate transition plan (klimaattransitieplan), with long and medium term targets.
• Other influenceable emissions (OBE, overige beïnvloedbare emissies), qualitatively from step 2.
• Non-CO₂ greenhouse gases in scope 1 and 2, with a five percent materiality threshold and an assessment "voorafgaand aan iedere initiële audit en driejaarlijks", before every initial audit and then every three years.
• Key personnel (sleutelpersonen). The organisation must identify them "en zorgen dat zij de benodigde competenties hebben voor hun rol", with at least one permanent employee designated. The evidence is about those people themselves.
• The organisational boundary. You choose the top-down or the lateral method plus one consolidation approach from the GHG Protocol. The handbook notes: "De combinatie van de top-down methode en operational control heeft de voorkeur." You publish the chosen method on your organisation page.

One published account of an early audit against 4.0 (De Duurzame Adviseurs, September 2025) reports that the auditors sampled scope 3 and pressed on the follow-up question: how are you going to improve this data. The same account describes them testing whether there were sufficient resources and people to actually carry out the planned measures. It is one audit at one organisation, so not a pattern, but it is the only public account of its kind.

If you are still preparing the switch, read what you can reuse and what you have to rewrite. For the value chain side, see value chain analysis in practice.

Few contractors have migrated, there are barely any reference implementations to copy, and no sector templates exist. Practitioners invent their own format and do not know whether it matches what the auditor expects.

How much time does the auditor actually have?

Less than you think, and that explains a lot. The audit day table for version 4.0 has two size categories and gives gross duration for an initial audit:

The table assumes one entity at one location. A reduction is possible, but "de maximale korting op de in de tabel genoemde bruto tijdsduur mag echter nooit meer dan 30 procent bedragen", never more than 30 percent off the gross duration. An annual audit runs at "minimaal 75% van de netto initiële audit", with a floor of one audit day.

Work it through for step 2, large: 5.5 gross days, 30 percent off at most, so 3.85 net. An annual audit is at least 75 percent of that, roughly 2.9 days. That matches what practitioners describe, about three days a year, with no room to talk something through with the auditor in advance. There is one assessment and no round for polishing.

Inside that time the auditor samples. For the emission inventory the certification body follows "de ISO 14064-3, §A.4.3.2.3. bij het bepalen van de omvang van de steekproef", runs a risk analysis, and examines "alle emissies ten minste eens in de driejaarlijkse certificatiecyclus", every emission at least once in the three year cycle. Your worst documented line escapes for two years at most.

What happens after a deviation is recorded?

A major deviation gives you three months to take corrective action. The certification scheme: "Als de organisatie de termijn van 3 maanden bij een jaarlijkse audit en hercertificatieaudit overschrijdt, schorst de CI het CO2-Prestatieladdercertificaat en geeft de CI mogelijk een CO2-Prestatieladdercertificaat af op een trede waarop de organisatie wel aan de eisen uit het handboek voldoet."

Miss the term at an initial audit and a completely new initial audit is required. Miss it at an annual or recertification audit and the certificate is suspended, with the possibility of a certificate at a step you do meet. That second half matters commercially: in a live tender the difference is between holding nothing and holding a certificate at a lower step, which means a smaller tender advantage rather than a contractual sanction.

A minor deviation runs until the next audit. The list of changes states that "de termijn voor het oplossen van minder belangrijke afwijkingen is verhoogd naar 12 maanden (was 3 maanden)". On 11 December 2025 a second layer arrived. Harmonisatiebesluit 2 rules: "Organisaties moeten binnen 3 maanden nadat een minder belangrijke afwijking is vastgesteld een plan voor corrigerende maatregelen opstellen en indienen bij de CI." The plan is due with the certification body within three months; the fix itself can wait until the next audit. Two terms, one deviation.

How do you win the discussion before the auditor arrives?

Five things, in this order.

Finish one data point end to end before you scale. From source to figure to evidence to publication. If that one data point survives the internal audit, the method works. Otherwise you are scaling a mistake.

Run the internal audit as a real audit. Handbook 4.0 requires the organisation to examine whether the energy and CO₂ management system meets the requirements of the certification scheme, with an independent auditor reporting objectively, plus a management review. Both sit in Part 1 of the handbook, where ISO 17021-1 governs classification.

Publish in the right place. Handbook 4.0 requires that information covering the whole organisation is partly published "op de organisatiepagina op de website van de CO2-Prestatieladder", on your organisation page on the Ladder's own website. Your own site is not a substitute for it.

Plan around the holidays. Most deadlines fall in December, March and the first quarter, and the Benelux construction shutdown wrecks preparation. Three weeks away on one side, three on the other, and you next speak at the end of August.

Assume quiet colleagues are unsure rather than unwilling. As a practitioner put it: "They seem to be not engaged, but in truth they are embarrassed because they do not have the answers." A targeted two minute question gets more than an hour long tutorial.

What the audit itself costs in day rates and SKAO contribution is set out in what the CO₂ Performance Ladder costs in 2026.

How Palau handles this

Palau's Vault is the evidence and document management module, so the evidence sits with the reporting it belongs to instead of in a separate folder structure beside it. The organisational structure module consolidates across entities, so the path from location and business unit to the certified entity is recorded. Those are the two questions the auditor asks: where is the evidence, and how did you get from the meter to the figure.

Request a pilot.