EDGE Data Protection Trustmark: separate consultant and certifier evidence

An EDGE Data Protection Trustmark project has two different professional workstreams: capability building by a suitable consultant and independent assessment by an accredited conformity assessment body. Combining them in one vague scope makes it difficult to test independence, price and completion. The applicant should keep the advisory trail, operating evidence and certification decision distinct from the first quotation onward.

Define the certification scope and current gap

Name the applicant entity, sites, personal-data activities, systems, processors and exclusions intended to fall within the project. Record the current policies and actual operating controls, then identify the gaps that require work. Use the current EDGE Data Protection Trustmark activity to check the stated deliverables and application documents.

Do not treat a privacy policy as proof that controls operate. Sample consent, access, retention, breach response, vendor oversight and staff practice. A clear baseline lets management judge whether the consultant has improved capability instead of merely producing new templates.

Keep consultant and certification roles separate

Map gap assessment, control design, training and implementation support to the consultant. Map independent testing, findings and the certificate decision to the conformity assessment body. Verify the required SS 680 and accreditation evidence through the relevant issuing bodies, then preserve the dated verification.

Use separate quotations, deliverables, invoices and acceptance decisions. Investigate ownership, referral or fee relationships that could affect independence. The EDGE FAQ explains that the approved consultant and certification body must satisfy the activity requirements and be reflected in the approved project.

Build claim evidence from operating practice

Create an evidence index for each control, with an owner, source, period and test. Preserve training attendance, access reviews, processor checks, incident exercises, retention actions and corrective work. A consultant report can explain the project, but it should not replace the applicant’s own operating records.

Before claim submission, reconcile the Letter of Offer, consultant report, assessment findings, certificate, invoices and full payment. Keep unresolved findings visible with owners and dates. The certificate is a completion output, while continued data-protection accountability remains an operating responsibility.

Turn the decision into a controlled file

Use a dated decision record that identifies the applicant, business need, current official source, chosen route, responsible owner, costs, milestones and evidence. Separate facts already verified from forecasts and assumptions. A catalogue listing, supplier statement, consultant recommendation or portal acknowledgement does not establish approval. The company remains responsible for its declarations and commercial decision.

Give each quotation, contract, invoice, payment and deliverable a stable reference. Preserve earlier versions and explain material changes instead of silently replacing them. Where the authority, tax adviser, auditor or another professional must decide a point, record the open question and obtain the required view. Do not convert uncertainty into a confident eligibility statement.

Review before commitment and again before closeout

Run four reviews: suitability, authority, implementation and closeout. At suitability, test the entity, activity and business outcome. Before commitment, freeze the proposed scope, vendor and financial assumptions. During implementation, compare actual work with approved terms. At closeout, reconcile deliverables, accepted results, invoices, full payment, operating evidence and obligations that continue.

Name the person who may approve each stage and the records that person must see. Procurement should not treat a draft application as permission to contract. A project team should not treat supplier completion as company acceptance. Finance should not treat a submitted claim as cash received. Clear status words prevent accidental commitments and weak reporting.

Handle exceptions without rewriting history

Maintain an exception log for changed facts, delayed milestones, supplier variations, cost movements, missing records and failed tests. State the effect on scope, eligibility, timing and expected value. If an authority decision or formal variation is required, use the published route before relying on the change. Silence and helpdesk receipt are not approval.

If a material defect appears, pause the affected acceptance, filing or claim item. Keep original evidence, assign corrective action and set a review date. Do not backdate records, move costs between categories or adjust a baseline after seeing the result. A candid exception with an owned resolution is more credible than a clean-looking file that cannot explain what happened.

Plan handovers before the original project team disperses. The handover should identify the current version, source locations, system access owner, next review date, open exceptions and any condition that continues after payment or filing. Restrict personal, financial and commercially sensitive records to authorised users, while giving each responsible owner enough information to perform the assigned control. Record the external event that should trigger an earlier review, such as a changed programme page, revised authority letter, supplier failure or material business change.

Verify the final outcome independently

Ask someone who did not prepare the final pack to compare the decision, current official source, approved terms, deliverables, payments and operating evidence. Recalculate totals and sample source records. The reviewer should be able to reproduce the conclusion without relying on the preparer’s memory. Record unresolved points with named owners and dates.

Use the EDGE standards cost guide for the wider decision and keep this article as the narrower operating guide. After submission, preserve the receipt and reconcile questions, adjustments and the final registered or paid outcome. Continue any reporting, retention, asset-use or other condition that survives closeout.

Practical review checklist

• Scope fixed
• Current gap sampled
• Roles separated
• Accreditation checked
• Operating evidence reconciled

The file is defensible when an independent reviewer can see who advised, who certified, what the company changed, how controls operated and how every approved cost reached the final claim.