When QSA Accreditation Lapses: What Happens to Clients
Suspension, revocation, and quiet non-renewal — what each means for companies mid-assessment, and how to protect your ROC.
How accreditation ends
QSA accreditation ends three ways: suspension (temporary, while the Council investigates or the firm remediates), revocation (the Council terminates the accreditation for program violations or quality failures), and non-renewal (the firm simply doesn't requalify — sometimes a business decision, sometimes a quiet exit after problems). The first two are disciplinary; the third is ambiguous, which is why it deserves the same scrutiny.
Suspension vs revocation vs non-renewal
| Suspension | Revocation | Non-renewal | |
|---|---|---|---|
| What | Temporary halt | Terminated | Expires unrenewed |
| New ROCs | Cannot be issued under accreditation | Cannot be issued | Cannot be issued |
| Reversible | Yes, if remediated | Effectively no | Only by re-accrediting |
Turn reading into quotes. Get scoped, comparable quotes from accredited QSA companies — free, 2 minutes, no obligation.
Request quotesWhat it means mid-assessment
This is the nightmare scenario: you're in fieldwork, and your firm's accreditation lapses. A ROC signed by a non-accredited firm is not a valid ROC — your acquirer won't accept it. Your options are finishing with a firm whose report may be rejected, or restarting with an accredited one and paying twice. Prevention beats cure, which is why the engagement letter should address what happens if the firm's status changes mid-engagement.
Protecting yourself
- Verify at signing, not at research. Status changes annually; check the listings when the letter is in front of you.
- Put continuity in the letter. What happens to fees and timelines if the firm's accreditation changes mid-engagement?
- Watch for distress signals. Mass QSA departures, acquisition by a non-assessment business, or evasiveness about current status.
- Keep your evidence. Your documentation package is yours — if you must switch firms, exported evidence shortens the restart.
Keep reading
What Is a QSA Company? QSAC, QSA, and ISA Explained
The three credentials buyers confuse — what a Qualified Security Assessor Company is, how it differs from an individual QSA, and why only one combination can sign your ROC.
How Firms Become QSA Companies: The Accreditation Process
What the PCI Security Standards Council actually requires before it lets a firm sign ROCs — company vetting, qualified people, exams, and independence.
How to Verify a QSA Company's Status (Walkthrough)
The exact five-minute check: PCI SSC listings, Visa registry cross-check, reading the engagement letter, and the red flags that end the conversation.
Questions
How often do firms actually lose accreditation?
Public revocations are rare — the Council doesn't publish a running tally. Non-renewals are quieter and harder to track, which is exactly why you check current status rather than history.
Is our old ROC still valid if the firm later loses status?
A ROC validly issued while the firm was accredited stands on its own; the problem is new and in-flight assessments, not historical reports.
Turn reading into quotes
Get scoped, comparable quotes from accredited QSA companies — free, 2 minutes.
How it works: tell us once (4 questions, 2 min) → we match accredited QSA companies to your size and scope → they send scoped quotes directly. Free, no obligation.