Skip to main content
CCSACouncilv0.2Search
v0.2 draft -> v1.0
Quality assurance & trust

QA & Trust

The quality-assurance program: random ROC sampling, peer review, sanctions up to revocation of accreditation. A CCSA mark must mean real security.

1 —QA & Trust

Why hard QA matters

If a CCSA certificate does not mean real security, the standard is worthless. So the Council builds hard quality mechanisms from day one, not after a major incident.

Critical

Target, 2013 — PCI DSS compliant, yet breached.

Critical

FTX, 2022 — Proof-of-Reserves attested, yet collapsed.

Critical

The DAO, 2016 — a “successful” Solidity audit, yet exploited.

One lesson: a certificate without quality control is an empty mark. CCSA verifies audit quality, not merely its existence.

2 —

Six QA mechanisms

01

Random ROC Sampling

The Council reviews 10% of each CCSAC’s ROCs annually (lottery selection). The Council Lead QA Team conducts the review together with engaged Lead Auditors from other CCSACs, within a 30-business-day window. Outcomes: Pass, Pass with observations, Conditional (90-day remediation), Fail (re-audit at the CCSAC’s cost), Critical fail (suspension and investigation).

02

Cross-CCSAC Peer Review

An anonymized ROC is reviewed by a Lead Auditor from another CCSAC. It is voluntary and earns QA Credit; the aim is consistent application of the standard and sharing of best practice across firms.

03

Annual CCSAC Process Audit

The Council audits the firm’s whole QMS each year: independence, document retention, internal QA, training, CoI disclosure, insurance, financial health. A desk review plus interviews, about 3 days.

04

Client Feedback Loop

An anonymous complaint form, public ticket tracking and a 30-day investigation. Typical complaints: rubber-stamp audit, conflict of interest, over-auditing, lateness.

05

Incident-Based Investigation

Triggers: a breach with client losses, a smart-contract exploit with TVL > $1M, sanctions enforcement, regulatory action. 24 hours — notification and flag; 7 days — the CCSAC’s working papers; 30 days — verdict (audit adequate and incident out of scope: flag removed; inadequate: sanctions and product suspension; tampered evidence: CCSAC termination and civil/criminal referral).

06

Anti-Fraud Detection

ML analysis of ROCs for anomalies and plagiarism, cross-checks with public sources (on-chain data, GitHub, regulatory filings), periodic sting operations and a whistleblower-protection program.

Random ROC Sampling

Random sampling depends on level: Level 2 — a 10% sample annually, Level 3 — 100%.

3 —

Sanction ladders

Sanctions escalate from observation to full revocation. Suspension and revocation are public — a signal of trust to the market.

CCSAC (audit firms)

Critical
1
Observation — a note in the track record, no public consequence (minor procedural errors).
2
Warning — a written warning, visible to other CCSACs (repeated errors).
3
Remediation Plan — a 90-day corrective plan (systematic quality problems).
4
Probation — 6 months under enhanced monitoring (serious breaches after a warning).
5
Suspension — accreditation paused for 6–12 months; public in the CCSAC registry.
6
Revocation — full loss of accreditation; public, with a press release and regulator notice (fraud, systematic forgery).

Individual auditors

Critical
1
Undisclosed conflict of interest — 6-month suspension.
2
Systematically low-quality ROCs — suspension until remediation training is completed.
3
Client-data leak — 1-year suspension and civil liability.
4
Insider trading on client information — revocation, publication and criminal referral.
5
Forged ROC — certificate revocation and a 5-year reapply ban.
6
Bribery — revocation, public notice and criminal referral.

Certified products

Critical
1
Unpaid maintenance fee — status expired (90-day grace).
2
Badge misuse — warning and removal of the offending use.
3
False scope claim — suspension until corrected.
4
Material product change without re-certification — suspension until re-audit.
5
Forged audit inputs — listing revocation, a 3-year ban and publication.
Out of scope

Sanctions escalate from observation to full revocation. Suspension and revocation are public — a signal of trust to the market.

4 —

Council QA Team

Indicative values

A Chief QA Officer; 3–5 Senior QA Reviewers (former Lead Auditors) by 2027; 5–10 QA Analysts; 1 Forensic Investigator; an external pool of peer reviewers under NDA (paid 10–30 thousand RUB per ROC). Headcount figures are targets.

target
5 —

Annual State of CCSA Compliance Report

Once a year the Council publishes an industry-wide report (no client identification): the top-5 weakest domains, lessons learned from investigations, best practices and standard changes driven by feedback.

Annual State of CCSA Compliance Report

One lesson: a certificate without quality control is an empty mark. CCSA verifies audit quality, not merely its existence.

QA Index ->CCSAC registry ->
QA Index ->For auditors (CCSA-QSA) ->For audit firms ->