Certigna: Delay in reporting an audit finding
Certigna disclosed an incident involving a delay in reporting an audit finding. The incident ticket related to a finding identified during the 2026 ETSI audit was not created within the deadlines in the CCADB Incident Reporting Guidelines v3.2. Certigna stated that no impact on certificates was identified and that no certificates had been affected. Certigna attributed the issue to procedures for managing audits and non-conformities not being updated in 2025 to reflect changes in the CCADB Incident Reporting Guidelines for reporting an audit finding. Certigna reported remediation actions including updating its procedures and guidelines for monitoring/documentation management, aligning reporting of audit findings with the CCADB guidelines, and raising awareness among the compliance team. Certigna requested closure after completing the action items, and CCADB indicated it would close the incident report unless substantial additional matters were raised; it was then closed on approximately 2026-06-16.
- Certigna noted updates to the CCADB guidelines regarding reporting audit findings.
- An auditor identified a finding during Certigna’s annual audit.
- The assessment body published the attestation letter and a preliminary incident report was created.
- A third party commented that Certigna had not met the CCADB incident reporting deadlines.
- Certigna created a new preliminary incident report and responded to the third party’s comment.
- Certigna updated procedures and guidelines to align with the CCADB incident reporting requirements.
- Certigna raised awareness among the compliance team regarding the updated reporting guidelines.
- Certigna updated the ticket with the full incident report.
- Certigna submitted a report closure summary and requested closure after completing action items.
- CCADB closed the incident report unless substantial additional matters were raised.
- Dhimyotis representative — Opened a preliminary incident report stating the ETSI audit finding ticket was not created within CCADB Incident Reporting Guidelines deadlines, citing a third party comment in bug 2041368.
- Dhimyotis representative — Provided the full incident report with a timeline, stating no certificate impact and describing contributing factors and remediation actions.
- Dhimyotis representative — Submitted a report closure summary, describing remediation and requesting closure after action items were completed.
- CCADB representative — Issued a final call for comments/questions and stated the report would be closed around 2026-06-16.
- Cht representative — Noted the 'Related Incidents' section was missing and provided four bug links for reference.
- Dhimyotis representative — Acknowledged the additional information and said no similar tickets were found in their search.
- CCADB representative — Closed the report and said it would only reopen if substantial additional relevant matters arose.