Chain of Custody Certification

The models form a spectrum, trading physical rigour against practical feasibility. At one end the physical material is tracked; at the other only the claim is. Neither end is the "right" answer — the appropriate model depends on whether the chain can physically segregate at reasonable cost, and on what claim the scheme wants to support.

Identity preserved

The product from a single certified source is kept physically separate and identifiable throughout. The strongest claim: this material came from that source. Costly, and only workable in chains that do not bulk.

Segregation

Certified product is kept physically separate from non-certified product, but material from multiple certified sources may be mixed. The claim: this material is certified — though not from any identified farm.

Mass balance

Certified and non-certified material may be physically mixed, with certified volumes tracked administratively so that no more is sold as certified than was bought. The claim is about volumes in the system, not about the contents of a package.

Book and claim

The claim is decoupled from the physical product entirely: certificates are traded separately from material. The claim: certified production was supported somewhere, in this volume. Nothing is asserted about any physical goods.

It is tempting to conclude that identity preservation is best and everything else is a compromise to be tolerated. That reading misses the economics. Many agricultural chains physically cannot segregate at acceptable cost: cocoa and palm oil are bulked at collection points, shipped in shared vessels, and refined in shared plant. Requiring segregation in such a chain does not produce a better claim — it produces no claim at all, because the certified volume never reaches a buyer willing to fund the parallel infrastructure.

Mass balance and book and claim exist so that certified demand can reach producers in chains where physical separation is impractical. A farmer who receives a premium for certified production benefits identically whether the buyer took the physical beans or merely the certified volume — the money arrives either way. The trade-off is that the consumer-facing claim weakens as the mechanism becomes more abstract, and the honest response is disclosure rather than pretending the models are equivalent.

Chain of custody is audited at each handling step rather than at the farm. Supply-chain actors — traders, processors, manufacturers — are certified against the scheme’s custody requirements, and the audit examines receipts, volumes, conversion factors, records, and claims. The core check is arithmetic: could this operator have sold the certified volume it sold, given what it bought and what its process yields? That is mass balance verification, and it is the same reasoning that underpins organic integrity control.

This is also where the chain is weakest, and the vulnerability is structural rather than incidental. Every custody model except identity preservation relies on records rather than on anything inspectable in the product, so an unbroken documentary chain is the whole of the assurance. Where a claim commands a premium and cannot be tested in the goods, the fraud pressure falls on the paperwork — and custody failures, in practice, look like accounting problems rather than agricultural ones.

• Says nothing about production — it carries a claim, it does not establish one
• Not a quality or safety mechanism — it tracks claims, not condition
• Not a single standard — each scheme operates its own custody rules
• Not equivalent across models — the same word "certified" asserts different things
• Not a guarantee of physical content, except under identity preserved and segregation

The first point is the one worth ending on. Chain of custody is a transmission mechanism, and a transmission mechanism cannot improve the signal it carries. If the underlying farm certification is weak, an impeccable custody system carries a weak claim faithfully to a consumer. Custody integrity and production integrity are separate questions, and a scheme can be strong on one and weak on the other.