← Back to home

Complaints Procedure

How to raise a concern about our services, assessments, or conduct.

Last updated: 21 April 2026

Purpose and scope

The Fig Group Limited ("Fig", "we", "us") operates as an IASME-licensed Defence Cyber Certification Body. As a Certification Body operating under the IASME scheme, we are required to maintain, publish, and operate a formal complaints procedure. This document sets out that procedure.

This procedure applies to complaints about any aspect of our services, including:

  • The conduct or outcome of a Defence Cyber Certification (DCC) assessment.
  • The professional behaviour of a Fig assessor, consultant, or member of staff.
  • Administrative handling of an engagement - scheduling, invoicing, communication, or data handling.
  • A certification decision (pass, fail, or conditions attached to a certificate).
  • The way a previous complaint was handled.

Complaints may be raised by any party affected by our services, including the certified organisation, a prospective customer, a third-party buyer relying on a Fig-issued certificate, or any other interested party.

Principles

Every complaint is handled in line with the following principles:

  • Impartial. Complaints are reviewed independently of the individuals involved in the matter complained about. A Fig assessor who conducted a disputed assessment will not review the complaint about that assessment.
  • Confidential. Complaint details are shared only with those who need to know in order to investigate and respond. We treat the identity of the complainant as confidential unless disclosure is necessary to progress the complaint (and we will tell you if it is).
  • Evidence-based. Findings are based on the evidence available - assessment records, correspondence, portal logs, interview notes - not on assertion alone.
  • Proportionate. Response and remedy are proportionate to the nature and materiality of the complaint.
  • Free of charge. We do not charge for raising, investigating, or responding to a complaint.
  • Free of retaliation. Raising a complaint does not and will not prejudice any current or future engagement with Fig.

How to raise a complaint

Complaints should be made in writing so that we have a clear record of what is being raised. You can submit a complaint by any of the following:

  • Email: complaints@figgroup.co.uk (preferred).
  • Post: Complaints Officer, The Fig Group Limited, 167-169 Great Portland Street, London, W1W 5PF.
  • Phone: +44 (0) 203 105 2335 - if you wish to discuss a complaint before submitting it in writing. We will ask you to follow up in writing so we can investigate formally.

To help us investigate quickly, please include:

  • Your name, organisation, and a reliable method of contact.
  • The reference number or identifier of the engagement, certificate, or enquiry concerned (if applicable).
  • A clear statement of what has gone wrong and the impact on you or your organisation.
  • The outcome you are seeking.
  • Any supporting evidence you have - emails, portal screenshots, assessment feedback, invoice, etc.

What happens next - our response timeline

We operate a structured, time-bound complaints process:

  • Acknowledgement: within 2 working days. We confirm receipt of your complaint, assign a unique reference number, name the Complaints Officer handling it, and confirm the expected response timeline.
  • Initial investigation: within 10 working days of acknowledgement. The Complaints Officer reviews the substance of the complaint, requests any further information needed, and speaks to the relevant Fig personnel independently.
  • Formal written response: within 20 working days of acknowledgement. We set out our findings, the evidence reviewed, whether the complaint is upheld (in whole or in part), the reasons for the decision, and any remedy offered.
  • Complex cases: where the complaint is particularly complex, requires external input, or coincides with leave periods, we may extend the response timeline. We will tell you in writing, explain why, and give a revised target date. An extension will not exceed a further 15 working days without your agreement.

Possible outcomes and remedies

After investigation, we will reach one of the following conclusions:

  • Complaint upheld. We accept that something has gone wrong. Depending on the nature of the complaint, remedies may include: a formal apology; correction of records; re-assessment of disputed evidence at no additional cost; refund or partial refund; escalation to a different assessor; change of Fig process or policy to prevent recurrence; and/or referral to IASME.
  • Complaint partially upheld. Some aspects are accepted, others are not. The response explains which and why, and applies proportionate remedy for the upheld parts.
  • Complaint not upheld. We explain the evidence considered, the reasoning, and the rationale for rejecting the complaint.

Where a certification decision is the subject of the complaint, the outcome will be reviewed independently of the original assessor. A reversal of a certification decision following investigation will be made without prejudice and without charge.

Appeals against certification decisions

If you are dissatisfied with a certification decision - pass, fail, conditions, or revocation - you have the right to appeal. Appeals are a specific category of complaint and follow an enhanced process:

  • Appeals must be raised in writing within 20 working days of the certification decision.
  • Appeals are reviewed by a Fig Group senior assessor or director who was not involved in the original decision.
  • The appeal reviewer re-examines the original evidence, the assessor's findings, and any additional material submitted with the appeal.
  • A formal written appeal outcome is issued within 30 working days of the appeal being raised.
  • The certification decision may be upheld, varied, or overturned.
  • Appeal outcomes are notified to IASME where they affect the DCC register entry.

Escalation to IASME

If you are not satisfied with Fig's final written response, or you believe your complaint has not been handled in accordance with the IASME scheme requirements, you have the right to escalate to IASME directly.

IASME administers the Defence Cyber Certification scheme on behalf of the UK Ministry of Defence and oversees the conduct of all licensed Certification Bodies. You can contact IASME at:

  • Website: iasme.co.uk
  • Email: info@iasme.co.uk
  • Telephone: +44 (0) 3300 88 88 74
  • Address: IASME Consortium Ltd, Unit GF2, Malvern Hills Science Park, Geraldine Road, Malvern, Worcestershire, WR14 3SZ

We will cooperate fully with any IASME investigation and share all records relating to the complaint on request.

Further escalation

Separately from the IASME route, you may also:

  • Raise a data protection concern with the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, where the complaint concerns how we have handled your personal data.
  • Seek independent legal advice on any contractual or commercial dispute not resolved through this procedure.

Nothing in this procedure affects any statutory rights or remedies that you have as a consumer, data subject, or commercial counterparty.

Records and continuous improvement

We maintain a formal complaints register recording:

  • Every complaint received, acknowledged, investigated, and closed.
  • The nature of the complaint, the investigation, the outcome, and any remedy applied.
  • Complaint reference numbers, dates, and handling timelines for audit purposes.

Complaints records are retained for a minimum of six years in line with IASME scheme requirements.

We review complaints trends annually as part of our management review cycle. Where a pattern of complaints indicates a recurring issue with a process, training need, or policy gap, we take corrective action and document it in our quality management system. IASME reviews our complaints record as part of its oversight of Certification Bodies.

Confidentiality and data protection

Information shared with us as part of a complaint is held in confidence. We process complaint data under the lawful basis of legitimate interests (complaint handling) and legal obligation (IASME scheme requirements). Please see our Privacy Policy for full details on how we handle personal data.

Complaint records may be shared internally with the Complaints Officer, senior management, and any Fig personnel directly involved in the matter under investigation. External sharing is limited to IASME (where escalation occurs), the ICO (where data protection is concerned), and professional or legal advisors where necessary.

Roles and responsibilities

  • Complaints Officer: first point of contact for all complaints, responsible for acknowledgement, investigation management, and issuing the formal written response. Contactable at complaints@figgroup.co.uk.
  • Managing Director: reviews and signs off complaint outcomes where the complaint concerns a senior member of staff, a certification decision, or a matter of material significance. Has final authority over complaint resolution before external escalation.
  • Quality lead: aggregates complaints data for the annual management review and ensures corrective actions are tracked to closure.

Changes to this procedure

We review this complaints procedure at least annually and update it in response to IASME scheme changes, regulatory changes, or operational improvements. The current version always applies; the "last updated" date at the top of this page reflects the most recent revision.

Contact

To raise a complaint or to ask a question about this procedure: