Where we work · DR Congo
ISO and GRC certification consulting in DR Congo
Achieve ISO and GRC certification in DR Congo with Sterling: 8,100+ client engagements in 60+ countries, 20+ years.
- 20 standards, one team
- Accredited certification route
- Casablanca office team
- Effivity and Academy included
Sectors that ask for certification in DR Congo
Clients include
ISO and GRC certification in DR Congo at a glance
Certification demand in DR Congo is pulled by product regulators, mining and finance. ACOREP, the pharmaceutical regulatory authority, also controls foods, cosmetics and medical devices, and an April 2026 circular asks food, beverage and cosmetics firms to register with it before inspection campaigns begin. The Banque Centrale du Congo supervises banks, mobile-money issuers and payment systems, ARPTC licenses telecom and IT operators, and the 2002 Code minier, as modified in 2018, frames a mining sector whose contractors register with ARSP under the 2017 subcontracting law. OCC, a public establishment, runs import and export quality control, laboratory testing and standards work, and ANAPI approves investment projects, including in the Maluku special economic zone. French is the official language. SADCAS, a regional accreditation body, states that DR Congo has no national accreditation body, so management-system certificates often carry accreditation from SADCAS or another economy. Sterling's Casablanca office serves DR Congo organisations, backed by 8,100+ client engagements in 60+ countries, with Effivity and Sterling Academy included with the engagement.
ISO and GRC standards Sterling delivers in DR Congo
Each card opens Sterling's guide to the standard: what it requires, how certification or compliance works and what sets the time and cost.
Quality & operational excellence
Information security, cyber & cloud
Privacy & data protection
AI governance & digital trust
Environment, energy & climate
Health & safety
Governance, risk & resilience
Financial services, payments & AML
Food safety & agriculture
Healthcare, medical devices & life sciences
Laboratories, inspection & accreditation
Automotive, aerospace, rail & defence
Construction, energy, oil & gas
Regulators and laws that drive certification in DR Congo (8)
| Law or regulator | What it asks for | Standards it cites |
|---|---|---|
| Autorité Congolaise de Réglementation Pharmaceutique (ACOREP), a public administrative, scientific and technical establishment under the Minister of Public Health Medicines, foods, cosmetics, medical devices and other health products | ACOREP's site says it was created by Décret n° 20/002 du 05 mars 2020 and instituted by Loi n° 18/035 du 13 décembre 2018 on the organisation of public health. Its missions include proposing rules on the quality and safety of medicines, foods, medical devices, herbal products and cosmetics; authorising and controlling their import, export, manufacture, labelling, storage, promotion, sale and distribution; granting marketing authorisations; and inspecting pharmaceutical establishments against good pharmaceutical practices. An April 2026 circular on its site invites manufacturers, importers, exporters and distributors of cosmetics, foods and beverages to register with it before control and inspection campaigns start. The pages do not name ISO 22000, HACCP or ISO 13485. | |
| Office Congolais de Contrôle (OCC), a public establishment of a scientific and technical character Conformity control of imports and exports, laboratory testing, metrology and national standards work | OCC's site cites Décret n° 09/42 du 03 décembre 2009 as its statutes and lists quality control of goods on import and export at the single window, testing and analysis of samples, verification and calibration of measuring instruments, and technical controls among its activities. The site reports that OCC has been an affiliate member of the IEC since 23 August 2012 and is moving to associate status, and its 14 October 2026 message for World Standardization Day speaks of consolidating the national standardisation system. The pages do not make a management-system certificate a condition of any control. | |
| Banque Centrale du Congo (BCC) Banks, microfinance, electronic-money issuers and payment systems | BCC's site groups the legal and regulatory texts for credit institutions, electronic-money institutions and payment systems by category, and cites Loi n° 18/019 du 9 juillet 2018 and BCC instructions for payment systems. It says the bank regulates, organises and oversees payment infrastructures and their participants to keep payment services secure, resilient and continuous and to control technological and cyber risks. Its register of electronic-money institutions shows mobile-money issuers. The pages do not name PCI DSS or ISO/IEC 27001. | |
| Autorité de Régulation de la Poste et des Télécommunications du Congo (ARPTC) Telecommunications and information technology operators | The national investment promotion agency states that a company that wants to operate in telecommunications or information technology needs a licence or authorisation from ARPTC, after review of its technical, administrative and financial capacity, followed by a ministerial order published in the Journal Officiel. The procedure page does not name ISO/IEC 27001 or ISO/IEC 20000-1. | |
| Ministry of Mines and the Cadastre Minier (CAMI) Mining | CAMI lists as principal texts Loi n° 007/2002 du 11 juillet 2002 portant Code minier, as modified and completed by Loi n° 18/001 du 09 mars 2018, the Règlement minier of 2003 as modified in 2018, and Décret n° 18/042 du 24 novembre 2018 declaring cobalt, germanium and coltan strategic mineral substances. The Ministry of Mines presents environmental protection, site rehabilitation requirements, corporate social responsibility norms and monitoring of environmental and social mitigation plans among its missions. Neither site names an ISO management-system standard. | |
| Centre d'Expertise, d'Evaluation et de Certification des Substances Minérales Précieuses et Semi-Précieuses (CEEC) Mineral origin, traceability and export documents | CEEC's site describes it as the state authority with legal competence over the mechanisms and procedures that establish the nature, origin and lawful provenance of mineral substances, including monitoring and traceability along the supply chain, and lists the export certificates it handles. The site does not name an ISO management-system standard. | |
| Ministry of Agriculture and Food Security Agriculture, coffee, cocoa and other farm value chains | The Ministry's site reports a meeting held on 6 October 2026 on setting up a national system for geolocation, environmental compliance and traceability of agricultural value chains, held alongside coffee and cocoa day, to meet international environmental standards and secure the origin of products. The report does not name a certification standard. | |
| Agence Nationale pour la Promotion des Investissements (ANAPI), a public institution under the Ministry of Planning Investment approval and promotion | ANAPI describes itself as the public institution that attracts and facilitates investment, and its approval procedure rests on the Code des investissements, with an approval council that examines projects. Its procedure pages cover mining, agriculture, banking, insurance, microcredit, transport and information and communication technology. The pages do not make a management-system certificate a condition of approval. |
Accreditation and recognition
- Southern African Development Community Accreditation Services (SADCAS), a multi-economy accreditation body based in Gaborone: Regional accreditation body serving DR Congo, which has no national accreditation body.
Look for a certification body whose accreditation scope covers your standard and sector, from a national accreditation body recognised under the international arrangements of Global ACI (Global Accreditation Cooperation Incorporated, formerly the IAF MLA). Sterling does not certify.
Tenders and procurement
- Registration of subcontractors in the private sector (Autorité de Régulation de la Sous-Traitance dans le Secteur Privé (ARSP)): ARSP presents itself as the technical body of the Government for regulating subcontracting, created under Décrets n° 18/018 and 18/019 of 24 May 2018, and its site dates Loi n° 17/001 fixing the rules for subcontracting in the private sector to 8 February 2017. It states that registration is compulsory for any company that wants to carry out subcontracting activities, offers an approval step that validates a subcontractor's expertise and technical conformity, publishes calls for subcontracting tenders and runs compliance inspections of principal contractors. It does not name an ISO standard as a condition; individual tender documents and principal contractors set their own quality criteria.
Economic zones
- Maluku special economic zone and the special economic zones agency (AZES): agro-industry, construction materials, packaging, metal processing
Sterling in DR Congo
Sterling delivers in DR Congo from its Casablanca office: one team from scoping to certificate, with Effivity ISO & GRC software and Sterling Academy access included. Sterling does not certify; certification decisions stay with independent bodies.
Questions DR Congo clients ask
Which body accredits ISO certification for organisations in DR Congo?
SADCAS, a regional body in Gaborone, serves DR Congo because the country has no national accreditation body. Its DR Congo page lists accredited laboratories and an inspection body, but no management-system certification body, so ISO certificates for DR Congo organisations often carry accreditation from SADCAS or from another economy. Ask the certification body for its accreditation certificate and confirm your buyer accepts it.
Do audits in DR Congo have to be conducted in French?
French is the official language, and official texts and regulator notices appear in French, so it is the safe default for documents and reports. The national languages are Kikongo, Lingala, Swahili and Tshiluba, which many teams use on site. When you apply, settle the audit language, any interpreter and the language of controlled documents with the certification body.
Who regulates food, cosmetics and medical devices in DR Congo?
ACOREP, the pharmaceutical regulatory authority, whose missions include authorising and controlling the import, export, manufacture, storage and sale of medicines, foods, cosmetics and medical devices. A circular on its site asks cosmetics, food and beverage firms to register before control and inspection campaigns begin. An ISO certificate does not replace that registration.
What is OCC, and is it the same as an accreditation body?
No. OCC is a public establishment that runs quality control of imports and exports, laboratory testing, calibration and standards work, and it is an IEC affiliate. Accreditation of laboratories and inspection bodies comes from SADCAS, which names OCC as its national focal point. Management-system certificates come from certification bodies that are themselves accredited.
Do mining contractors in DR Congo need to register as subcontractors?
Under the subcontracting law, ARSP states that registration is compulsory for any company that wants to carry out subcontracting activities in the private sector, with a separate approval step that checks technical conformity. The Code minier sets the wider mining framework. Confirm with ARSP or your counsel which duties reach your contract.
Which body supervises banks and mobile-money issuers in DR Congo?
The Banque Centrale du Congo supervises credit institutions, electronic-money institutions and payment systems, and publishes the legal texts and registers on its site. It says it oversees payment infrastructures so that services stay secure, resilient and continuous. Its pages do not name PCI DSS or ISO/IEC 27001, so card brands and partners decide those requirements.
Start with a free discovery call
A Sterling consultant goes through your entities, your regulators and your target date with you. No proposal until the scope is agreed.
Sources
- ACOREP's site says it was created by Décret n° 20/002 du 05 mars 2020 and instituted by Loi n° 18/035 du 13 décembre 2018 on the organisation of public health. Its missions include proposing rules on the quality and safety of medicines, foods, medical devices, herbal products and cosmetics; authorising and controlling their import, export, manufacture, labelling, storage, promotion, sale and distribution; granting marketing authorisations; and inspecting pharmaceutical establishments against good pharmaceutical practices. An April 2026 circular on its site invites manufacturers, importers, exporters and distributors of cosmetics, foods and beverages to register with it before control and inspection campaigns start. The pages do not name ISO 22000, HACCP or ISO 13485. — acorep.gouv.cd (accessed 18 Oct 2026)
- OCC's site cites Décret n° 09/42 du 03 décembre 2009 as its statutes and lists quality control of goods on import and export at the single window, testing and analysis of samples, verification and calibration of measuring instruments, and technical controls among its activities. The site reports that OCC has been an affiliate member of the IEC since 23 August 2012 and is moving to associate status, and its 14 October 2026 message for World Standardization Day speaks of consolidating the national standardisation system. The pages do not make a management-system certificate a condition of any control. — occ.cd (accessed 18 Oct 2026)
- BCC's site groups the legal and regulatory texts for credit institutions, electronic-money institutions and payment systems by category, and cites Loi n° 18/019 du 9 juillet 2018 and BCC instructions for payment systems. It says the bank regulates, organises and oversees payment infrastructures and their participants to keep payment services secure, resilient and continuous and to control technological and cyber risks. Its register of electronic-money institutions shows mobile-money issuers. The pages do not name PCI DSS or ISO/IEC 27001. — bcc.cd (accessed 18 Oct 2026)
- The national investment promotion agency states that a company that wants to operate in telecommunications or information technology needs a licence or authorisation from ARPTC, after review of its technical, administrative and financial capacity, followed by a ministerial order published in the Journal Officiel. The procedure page does not name ISO/IEC 27001 or ISO/IEC 20000-1. — anapi.cd (accessed 18 Oct 2026)
- CAMI lists as principal texts Loi n° 007/2002 du 11 juillet 2002 portant Code minier, as modified and completed by Loi n° 18/001 du 09 mars 2018, the Règlement minier of 2003 as modified in 2018, and Décret n° 18/042 du 24 novembre 2018 declaring cobalt, germanium and coltan strategic mineral substances. The Ministry of Mines presents environmental protection, site rehabilitation requirements, corporate social responsibility norms and monitoring of environmental and social mitigation plans among its missions. Neither site names an ISO management-system standard. — cami.cd; mines.gouv.cd (accessed 18 Oct 2026)
- CEEC's site describes it as the state authority with legal competence over the mechanisms and procedures that establish the nature, origin and lawful provenance of mineral substances, including monitoring and traceability along the supply chain, and lists the export certificates it handles. The site does not name an ISO management-system standard. — ceec.cd (accessed 18 Oct 2026)
- The Ministry's site reports a meeting held on 6 October 2026 on setting up a national system for geolocation, environmental compliance and traceability of agricultural value chains, held alongside coffee and cocoa day, to meet international environmental standards and secure the origin of products. The report does not name a certification standard. — agriculture.gouv.cd (accessed 18 Oct 2026)
- ANAPI describes itself as the public institution that attracts and facilitates investment, and its approval procedure rests on the Code des investissements, with an approval council that examines projects. Its procedure pages cover mining, agriculture, banking, insurance, microcredit, transport and information and communication technology. The pages do not make a management-system certificate a condition of approval. — anapi.cd (accessed 18 Oct 2026)
- Southern African Development Community Accreditation Services (SADCAS), a multi-economy accreditation body based in Gaborone — sadcas.org (accessed 18 Oct 2026)
- Registration of subcontractors in the private sector — arsp.cd (accessed 18 Oct 2026)
- Maluku special economic zone and the special economic zones agency (AZES) — anapi.cd
Talk to a consultant
Plan your certification with the Casablanca team.
Tell us your goals, locations and target date. We’ll help you define the scope, timeline and next steps.
southafrica@sterling-grc.com+1 201 263 4443 (global headquarters) · the Casablanca office replies by e-mail within one working day
What would you like to achieve?
Choose a starting point. The enquiry form takes about a minute.
Book my free discovery callContinue to the enquiry form to share your details. Please do not include passwords, sensitive personal information or confidential files. A Sterling consultant replies within one working day. Privacy notice