Veiligheidscertificaat: What It Proves and What It Doesn't

A certificate records a day, not a year

A veiligheidscertificaat proves one thing precisely.

It proves that on a given date, an accredited auditor looked at a defined scope of your organisation, held it against a published scheme, and concluded that what they saw met the requirements. That is a real and useful statement. It is also a narrower statement than the way the certificate gets used, which is usually as a general claim that the organisation is safe.

The gap between those two readings is where most of the trouble sits. Not in the audit day itself, but in the months around it.

The certificates that come up most in the Netherlands

People search for "veiligheidscertificaat" and mean quite different things. Roughly, there are three categories, and they behave differently.

Company certification for contractors (the VCA family). VCA, from VGM Checklist Aannemers, is the scheme most Dutch contractors are asked for by clients. VCA* covers the organisation working directly on site. VCA** adds requirements on the safety management system itself, including how you handle incidents, inspections and improvement. VCA Petrochemie adds requirements aimed at petrochemical work. VCU is the equivalent for staffing organisations. The certificate runs for a period of years with an interim audit in between, so it is designed to be checked more than once.

Personal certification (the VCA diploma). A B-VCA or VOL-VCA diploma belongs to a person, not to the company, and it is the thing most often meant when a site asks someone at the gate for their veiligheidscertificaat. Keeping a register of who holds which diploma and when it expires is an administrative task that quietly turns into an access problem the week it slips.

Management system certification (ISO 45001). This is not a contractor pass. It is a certification of your occupational health and safety management system: your policy, your risk assessment, your objectives, your operational control, your internal audits, your management review, your corrective actions. It runs on a cycle of an initial audit, surveillance audits in the intervening years, and a recertification audit at the end. The Safety Culture Ladder sits nearby, looking at behaviour and awareness rather than documents, and increasingly appears as a procurement requirement in Dutch infrastructure.

What is not a certificate

Worth saying plainly, because it causes real confusion in tenders: some of the heaviest safety obligations in the Netherlands produce no certificate at all.

Seveso-III and ARIE are legal duties under supervision, not schemes you pass. There is no certificate at the end. There is an inspection, a report, and sometimes a finding. PGS guidance works the same way. An organisation can hold a wall of certificates and still receive findings from the Nederlandse Arbeidsinspectie or from a regional environmental service such as DCMR, because those inspectors are not checking your certificate. They are checking the installation and the system behind it. If that distinction matters for your site, it is worth reading why generic safety management software falls short for Seveso-III companies.

What an auditor actually asks for

Across schemes, the questions converge on the same small set. Almost none of them are about intention.

• Show me the risk assessment for this activity, and show me when it was last reviewed.
• Show me that the people doing this work were trained for it, and show me the record.
• Show me the last workplace inspection on this installation, and show me what came out of it.
• Show me the finding you raised in that inspection, who owned it, what was done, and when it closed.
• Show me an incident investigation, and show me the measure that came out of it being verified afterwards.
• Show me your internal audit, your management review, and the decisions that followed from them.

Notice the shape. Every one of them is a request for a chain: a finding, an owner, an action, a date, and evidence that the loop closed. Organisations rarely fail on the first link. They fail three links in, where the action was done but nobody wrote down what changed, or the measure was implemented but never checked for effect.

The months nobody is watching

The honest version of certificate maintenance is that the system drifts between audits and the drift is invisible while it happens.

A procedure is updated but the training that referenced it is not. A line is modified and the risk assessment still describes the old one. A checklist is four pages long and the person walking the site has two hours, so it gets printed and ticked rather than walked. An improvement action from the last audit was closed in a spreadsheet that three people can edit and nobody owns. None of this is non-compliance in any dramatic sense. It is the slow separation of what you wrote from what you do, and it only becomes visible when someone external asks for the chain and a link is missing.

Then the audit arrives, and the four weeks before it become an evidence hunt. That hunt is the cost most organisations actually pay for certification, and it is not on the invoice from the certification body.

What to do about it, practically

Nothing here requires a system change. It requires deciding a few things on purpose.

1. Write down your scope and keep it honest. Which sites, which activities, which legal entity. Scope creep between audits is a common and avoidable finding.
2. Give every finding one owner and one closing condition. Not a status. A condition: what has to be true for this to be closed, written at the moment the finding is raised.
3. Separate closing from verifying. The action being done and the measure working are two different events. Schemes ask about the second one. Most registers only record the first.
4. Make the inspection match the time available. A four page checklist walked in two hours produces ticks, not observations. Split it by installation or by theme and run it more often.
5. Keep one register of who holds which diploma and when it expires. Review it on a fixed date, not when somebody is refused at the gate.
6. Date everything, including the review that concluded nothing needed changing. "Reviewed, no change required, 12 March" is evidence. Silence is not.
7. Read your last audit report before you plan the next year, not the month before the auditor returns. Repeat findings are read by auditors as a system signal, not as bad luck.

The useful question

A certificate on the wall answers the question your client asked in the tender. It does not answer the question you need answered, which is whether the chain from finding to verified improvement still holds today, in a part of the organisation nobody has looked at since spring.

Those are different questions, and only one of them has a renewal date.

We work on this at Capptions, mostly with organisations where the evidence is real but scattered across inspections, actions, documents and people. If you are heading into a certification or recertification audit and want to compare notes on how others keep that chain intact between audits, send me a message. Happy to share what we see, with no demo attached.