Version 5 Effective Date: March 2026

1. Moderation and Quality Review of Assessments

IASME audits at typically 2% of all Cyber Essentials and Cyber Essentials Plus assessments to ensure quality and accuracy. These audits are called “Moderations” if they are audited after the certificate has been issued or “Quality Reviews” if the check is before the certificate has been issued. IASME conducts a Quality Review on all assessments of organisations that are “Enterprise” sized. These Quality Reviews will be expanded over the next year to include assessments from other sizes of organisation.  IASME also Moderates assessments where concerns are raised by parties that include, but not restricted to, IASME staff, Certification Bodies, or clients. 

The results of these Moderations and Quality Reviews are categorised as follows: 

• Green: No issues with the marking. 

• Green with Advisory: Minor issues that do not affect certification. 

• Red: Issues with the marking where the certificate may not have been correctly issued in the case of moderations or may cause issues with certification in the case of quality reviews

• Purple: Issues arising from overmarking, leading to the possibility of a failure being given when a pass should have been awarded. 

In the case of a Moderation, the Assessor is notified after a Moderation has been completed and informed which category the result fell under, and feedback is provided where necessary.

In the case of a Quality Review, the Assessor is notified if the assessment is a pass or fail. In the event of a fail, feedback will be provided to the Assessor.

2. In situations where the certificate has already been issued.

In all cases where the Moderation result is classed as red or purple, IASME will notify both the Assessor and the Lead Assessor of the Certification Body.  IASME reserves the right to notify other employees of that Certification Body and also to suspend the Assessor at any time in this process. 

2.1 Certification Body Actions for Red Moderations

1. The Certification Body must acknowledge the red Moderation result with IASME within 3 working days of the date of IASME’s notification. This is the ‘initial notification’. 

2. The Certification Body must submit a plan of action to address the Moderation result with the client to IASME within 5 working days of IASME’s initial notification. 

3. The Certification Body must complete the actions and fully resolve the incorrect assessment with the client within 10 working days of IASME’s initial notification. 

4. If this is not going to be achievable for any reason the Certification Body must discuss the situation with IASME as soon as possible. 

5. If the client does not meet the Cyber Essentials requirements after investigation and remediation, IASME reserves the right to revoke the certificate. 

6. If the Certification Body does not meet any of these timelines, IASME reserves the right to contact the client directly and may request that they address the issue with the Certification Body. 

2.2 Certification Body Actions for Purple Moderations 

1. The Certification Body must acknowledge the purple Moderation result with IASME within 3 working days of the date of IASME’s notification. This is the ‘initial notification’ 

2. If it is deemed that the assessment was marked as a Fail but should have been a Pass, the Certification Body must submit a plan of action to address the Moderation result with the client to IASME within 5 working days of IASME’s initial notification. 

3. The Certification Body must complete the actions and fully resolve the incorrect assessment with the client within 10 working days of IASME’s initial notification. 

4. If this is not going to be achievable for any reason the Certification Body must discuss the situation with IASME as soon as possible. 

5. If the Certification Body does not meet any of these timelines, IASME reserves the right to contact the client directly and may request that they address the issue with the Certification Body. 

3. In situations where the certificate has not yet been issued 

In all cases where the Quality Review result is classed as red or purple, IASME reserves the right to notify other employees of that Certification Body and also to suspend the Assessor at any time in this process.

3.1 Certification Body Actions for Red or Purple Quality Reviews

1. The Certification Body must acknowledge the Quality Review result with IASME within 3 working days of IASME’s initial notification. 

2. The Certification Body must address any feedback on the Quality Review with the client.  The client will need to resubmit the assessment with any required changes and it will need to be signed again by a board member.   

3. Once IASME is content that the assessment has been marked correctly, the Assessor can choose to issue the certificate.  The responsibility for certification remains with the Assessor and Certification Body. 

The results of all Moderations and Quality Reviews will be saved and noted against the Assessor record. 

4. IASME Actions for Red or Purple Moderations 

Further to any red or purple Moderation result, IASME will moderate 2 assessments completed by that Assessor in the prior 6 months.  IASME reserves the right to do this for any red or purple Quality Reviews too.  If the Assessor has not completed 2 in this period, assessments will be chosen from up to 18 months previously. If neither prior assessment moderated are red or purple, the next assessment will be quality reviewed before certification is issued. 

If any of these assessments are also classed as red or purple, an investigation will be conducted. 

An investigation will consider a number of factors including the severity of the marking failures and the past performance of the Assessor.  The outcome may involve Assessor re-training or engaging in coaching with IASME, both at their own expense.  The outcome may also result in suspension. 

Following any re-training or suspension the 3 following assessments will be quality reviewed before certification is issued and if any are classed as red or purple a further investigation will be conducted. 

If an Assessor is suspended for more than 2 weeks they will be able to appeal via the appeals process. 

5. Concerns raised by IASME or Third Party 

Where a concern regarding the marking of an assessment (including concerns regarding over-marking) or general assessment quality is raised, IASME will conduct a high-level review of the assessment and the Assessor’s marking.  If they judge that the marking is satisfactory, the third party will be reassured if appropriate and there will be no further action. 

If the marking is seen to be potentially problematic, the assessment will be submitted for a full moderation, and the process above will be followed. 

6. Appeals against Moderation or Quality Review decisions

Assessors, Certification Bodies, or clients may raise queries relating to a decision made about a moderated assessment or Quality Review. IASME personnel (Moderations Team) will attempt to resolve these queries directly in the first instance. In most cases, this initial resolution will address the concerns raised. To raise an appeal against a decision, the following steps should be followed:

6.1 Submission of Appeal

1. The Assessor, Certification Body or client must contact IASME’s Moderation Team via their Jira ticket or by emailing [email protected], providing a detailed explanation of the specific parts of the Moderation or Quality Review feedback or requirement they believe incorrect.

2. IASME will acknowledge and log the appeal within 2 working days of the original Moderation outcome being sent to the Assessor.

6.2 Initial Liaison

1. IASME will liaise directly with the Assessor, Certification Body or client to resolve the issues identified.

2. This communication will occur via email, telephone call or virtual meeting within 3 working days of the original Moderation outcome being sent to the Assessor.

3. If a discussion is required, and the Assessor, Certification Body or client cannot attend a discussion within this timeframe, they must email IASME to explain the reasons for the delay.

4. A new date for the discussion will be agreed upon, which must not exceed 5 days from the original Moderation outcome decision.

5. If the Assessor, Certification Body or client is unable to meet within the 5-day timeframe, IASME reserves the right to:

   1. Liaise with a colleague of the original Assessor,

   2. Contact the client, if necessary, to request that they encourage the Assessor or a colleague to liaise with IASME.

If the appeal has not been resolved, and there is no fixed date for discussion after 10 working days, the appeal will be classed as closed and the appeal will not be upheld.

6.3 Independent review

1. If the issues remain unresolved after initial liaison, the appeal will be reviewed by an individual from the Moderation Team who had no connection with the original assessment, Moderation or Quality Review.

2. This review must occur within 7 days of the original Moderation outcome being sent to the Assessor.

6.4 Final Decision

1. If the independent reviewer agrees with the original Moderation or Quality Review, the decision is final, and the original Moderation or Quality Review stands.

2. If the independent reviewer disagrees with the original Moderation or Quality Review:

   1. The appeal will be escalated to an appropriate third person for a final decision,

   2. This escalation must occur within 2 days of the independent review.

The Assessor will be informed of the final outcome.

6.5 Post-Appeal Outcomes

1. If the Assessor’s appeal is unsuccessful, they must remediate any actions raised in the original Moderation or Quality Review within the 10-day timeframe specified in this Schedule.

2. If the appeal results in changes to the Moderation or Quality Review, IASME will communicate the updated decision to all relevant parties.  

7. Revocation of Certificate

There may be circumstances where the revocation of an issued certificate may be considered.

7.1 Circumstances for revocation include:

1. Revocation of CE through CE+ Failure.

   1. If a CE+ assessment fails due to unpatched software, the associated CE Certificate will be revoked if associated with the Danzell question set.

2. If the Certificate is issued in error.

3. In cases where a moderation finds the client is required to undergo a new CE/CE+ assessment.

4. In cases where a client is found to have obtained a certificate through inaccurate answers or tests and this can be proven.

7.2 Any recommendation for revocation will be subject to the following:

1. The situation has been reviewed and approved by a senior manager within IASME

2. That the Assessor, Lead Assessor and the client are informed of the revocation action being taken and the date the revocation will take place from. If the client is a direct client of IASME, they will be informed by IASME. If the client is a direct client of a Certification Body we will require the Certification Body to inform them.

3. That (if appropriate) a moderation investigation has been conducted fully and without bias.

4. That, after revocation, the certificate is no longer visible in the certificate search.

8. Certification Body performance

If multiple Assessors from the same Certification Body are being or have been investigated, the Certification Body may be deemed underperforming. 

Failure to demonstrate improvement in the quality of assessment from all Assessors may result in suspension or termination of the Certification Body’s status. 

9. Responsibilities

Assessors: Ensure compliance with IASME standards, acknowledge issues within the required timelines, and complete remediation as required. 

Certification Bodies: Monitor the performance of their Assessors and ensure timely resolution of issues. 

IASME: Conduct audits, provide feedback, and take appropriate actions to maintain quality and compliance.