R2v3 Documentation Requirements: Complete Guide

If there is one area that consistently separates first-time R2 audit passers from those who face corrective action requests, it is documentation. A facility can have excellent physical processes, proper downstream management, solid worker protections, and strong data security practices, and still stumble on audit day because the paper trail (or digital trail) doesn't align with what the standard requires.

This guide is designed to change that outcome for your facility. We'll walk through every core documentation requirement in R2v3, explain the "why" behind each, and give you a practical framework for building and maintaining a records system that holds up under scrutiny.

What Is R2v3 and Why Does Documentation Matter So Much?

R2v3, the third version of the Responsible Recycling standard, is administered by Sustainable Electronics Recycling International (SERI) and is the globally recognized certification standard for electronics recyclers. As of 2024, there are more than 900 R2-certified facilities operating across 30+ countries, making it the most widely adopted responsible recycling certification in the world.

The standard is structured around ten Core Requirements (CR1–CR10) plus Process Requirement Appendices (A–G) that address specific activities. Every applicable requirement carries its own documentation obligations, and those obligations are cumulative, meaning a mid-size ITAD operation certified for several appendices must maintain records across every applicable requirement simultaneously.

Here's why documentation carries disproportionate weight in an R2 audit: the R2 standard is a management system standard, not just a technical operations standard. Auditors cannot observe every downstream shipment, every employee training session, or every data destruction event that occurred over the prior 12 months. Documentation is the auditor's proxy for everything they couldn't directly witness. If it isn't written down, it didn't happen, that is the operative logic of every accredited certification audit.

The Two Categories of R2 Documentation: Controlled Documents vs. Records

Before diving into specific requirements, it's important to understand the distinction R2v3 draws between two types of documentation:

Feature	Controlled Documents	Records
Definition	Policies, procedures, work instructions, and plans that describe how processes should work	Evidence that processes did work (completed forms, logs, reports)
Examples	EHS Policy, Legal Requirements Register, Downstream Due Diligence Procedure	Training attendance logs, equipment calibration reports, audit findings
Version Control Required?	Yes, must show revision history and approval	No, but must be legible, retrievable, and retained per defined schedule
When Created	Before or concurrent with process implementation	During or immediately after a process activity
Auditor Focus	Are they current, approved, and implemented?	Are they complete, accurate, and consistent with procedures?

Understanding this distinction helps you build the right infrastructure. Controlled documents live in your document management system with version control. Records live in your evidence repository, physical files, a shared drive, or a dedicated compliance platform, and must be retrievable on demand during an audit.

Core Documentation Requirements (R2v3 Core Requirement Sections)

Legal Requirements Register (Core Req. Section 3)

R2v3 Core Requirement Section 3 requires that certified facilities identify, document, and maintain a register of all applicable legal and regulatory requirements. This is not a one-time exercise. It must be reviewed and updated at defined intervals or whenever regulatory changes occur.

What auditors look for:

A written register (spreadsheet, database, or document) listing each applicable law or regulation
Jurisdiction coverage (federal, state/provincial, local)
Linkage showing how each requirement maps to your operational procedures
Evidence of periodic review (dated review records or a change log)

Common gap I see: Facilities list federal EPA regulations but omit state-specific requirements, particularly state universal waste rules, extended producer responsibility (EPR) laws, and state OSHA standards that are more stringent than federal OSHA. Auditors catch this quickly.

Environmental Health & Safety (EHS) Management (Core Req. Section 4)

Section 4 is one of the most documentation-intensive areas in the entire standard. It encompasses hazard identification, risk assessment, worker protection, emergency preparedness, and EHS program management.

Required documented elements include:

A written EHS Policy signed by top management
Hazard identification and risk assessment records for all relevant job tasks
Written emergency response procedures (with evidence of drills/exercises)
Employee EHS training records, including dates, topics, trainer credentials, and employee signatures
Records of EHS incidents, near-misses, and corrective actions
Equipment inspection and maintenance logs (e.g., fork trucks, fire suppression systems)

Under R2v3 Core Requirement Section 4, facilities must maintain documented evidence of EHS training for every worker whose role involves exposure to focus materials. This includes subcontractors and temporary staff, not just full-time employees.

A statistic worth knowing: SERI's annual surveillance data consistently shows that EHS-related documentation deficiencies, particularly incomplete training records and missing emergency drill documentation, appear in approximately 35–40% of initial certification audits as minor or major nonconformances.

Data Security Plan (CR7: Data Security)

If your operation processes IT equipment containing storage media, you must have a documented Data Security Plan (DSP). This is one of the most scrutinized documents in the entire R2 audit, particularly for ITAD-focused operations.

The DSP must document:

Chain of custody procedures from client intake through final disposition
Data sanitization methods applied (aligned with NIST SP 800-88 Rev. 1 guidelines)
Personnel background check requirements and procedures
Physical security controls at your facility
Downstream data security requirements imposed on subcontractors

Key records that support the DSP:

Individual certificates of data destruction (serialized to each device or lot)
Sanitization logs with method, tool, operator, and pass/fail result per device
Background check records for all employees with access to data-bearing equipment
Visitor logs and facility access records

R2v3 requires that data destruction certificates be issued for every storage device processed, and those certificates must include at minimum: the serial number (or unique identifier), the sanitization method applied, the date of destruction, and the name of the responsible party.

Core Requirement and Appendix Documentation Requirements

CR8: Focus Materials

CR8 governs how a facility identifies, handles, and manages R2 focus materials. The categories of electronics and components that carry elevated environmental or health risk. Documentation requirements here include:

A written Focus Materials List identifying all focus materials your facility handles
Processing and handling procedures for each category of focus material
Records of how focus materials are routed (reuse, downstream recycling, final disposition)
Downstream vendor qualification records (see Appendix A below)

CR2: Hierarchy of Responsible Management Strategies

CR2 establishes the hierarchy of responsible management options (reuse > repair > refurbishment > recycling > responsible disposal) and requires facilities to document how they apply this hierarchy in their operations.

Required documentation:

Written procedure describing your facility's application of the NORM hierarchy
Records demonstrating material routing decisions and rationale where deviations from preferred hierarchy options occur

Appendix A — Downstream Recycling Chain (Vendor Qualification Records)

This is arguably the most paperwork-intensive requirement in R2v3. Appendix A requires certified facilities to qualify, document, and periodically re-evaluate every downstream vendor that receives R2 focus materials.

The DVD file for each vendor must include:

Document	Description	Frequency
Vendor Qualification Questionnaire	Completed assessment of vendor's legal compliance, EHS practices, and certifications	Initial + every 3 years
Third-Party Certification Copies	R2, e-Stewards, ISO 14001, or equivalent (where applicable)	Annual verification
Contractual Requirements	Signed agreement imposing R2-aligned downstream requirements	Initial + upon renewal
Facility Audit or Site Visit Records	Evidence of direct verification (required for non-certified vendors)	Per risk-based schedule
Shipment Records / Bills of Lading	Evidence of actual material transfers	Per shipment
Certificate of Recycling / COD	Confirmation of final disposition from vendor	Per shipment or lot

Under R2v3 Appendix A, facilities must maintain a complete downstream vendor qualification file for 100% of vendors receiving focus materials, and auditors will request transaction-level evidence (bills of lading, certificates of recycling) to verify that documented vendors are the actual recipients of your focus material shipments.

I cannot overstate how thoroughly auditors probe Appendix A downstream files. In my experience, incomplete DVD files are the single most common reason an otherwise well-prepared facility receives a major nonconformance on a first certification audit.

Appendix C — Test and Repair

If your operation includes reuse, repair, or refurbishment of electronics, Appendix C imposes additional documentation requirements:

Functionality testing records for each device or lot tested prior to resale
Grading/classification records
Written procedures for cosmetic and functional grading standards
Warranty and disclosure documentation provided to downstream customers
Records of items failing reuse criteria and their subsequent routing

CR7: Data Security (with Appendix B — Data Sanitization)

As noted above, Appendix B documentation requirements are built on top of the CR7 Data Security Plan requirements. Additional Appendix B records include:

Chain of custody logs tracking each data-bearing device from client receipt through final disposition
Subcontractor data security agreements
Audit or assessment records for downstream data destruction subcontractors

CR6: Sorting, Categorization, and Processing (Testing & Removal of Harmful Components)

These requirements apply to facilities exporting used electronics for potential reuse. Required documentation includes:

Documented testing protocols for devices being exported for reuse purposes
Testing records per device or lot, showing pass/fail results
Records of packaging and labeling for export shipments
Export documentation compliant with applicable laws (e.g., Basel Convention requirements, EPA CRT export rules)

CR9: Facility Requirements (Financial Responsibility & Closure Plan)

CR9 requires facilities to demonstrate financial responsibility sufficient to cover the cost of a responsible facility closure and the proper management of materials on-hand. Documentation requirements include:

A written Financial Responsibility Mechanism (FRM): which may take the form of insurance, a surety bond, a letter of credit, a trust fund, or a corporate guarantee
Evidence that the FRM is current, valid, and in the required amount
A documented Closure Cost Estimate calculated using a defensible methodology

The FRM documentation must be updated at least annually and whenever there are material changes to facility operations or inventory levels that affect closure cost estimates.

CR4 & CR10: Legal Export Compliance and Transport

CR4 (Legal and Other Requirements) and CR10 (Transport) address the specific legal and documentation requirements for exporting used electronics under the various applicable international frameworks. Required documentation includes:

Export classification records
Transaction-specific export documentation (commercial invoices, packing lists, certificates of conformance)
Records demonstrating compliance with importing country legal requirements
Downstream qualification records specific to export destinations

CR8: Focus Materials: Batteries

These focus-material requirements apply to facilities that process battery-containing equipment or battery modules. Documentation requirements include:

Written battery handling and storage procedures
Battery identification and sorting records
Downstream qualification records for battery recyclers (subject to the same Appendix A requirements)
Records of battery-related incidents or near-misses

Building an Audit-Ready Document Management System

Having the right documents is necessary but not sufficient, they also need to be organized, accessible, and demonstrably current. Here is the framework I recommend to every new client:

1. Create a Master Document Register

Maintain a single register listing every controlled document in your management system. For each entry, include: document name, document number, current revision, approval date, document owner, and next review date. This is the first thing I ask to see in a readiness review, and it tells me immediately how mature a facility's documentation system is.

2. Implement a Records Retention Schedule

R2v3 does not prescribe a universal retention period for all records. It requires that you define retention periods appropriate to each record type and comply with any legal retention requirements. A practical baseline:

Training records: 3 years minimum (longer if state law requires)
EHS incident records: OSHA requirements (minimum 5 years for 300-series logs)
Data destruction certificates: 3 years minimum, or per client contract
Downstream vendor records: 3 years after last transaction
Financial responsibility documentation: Duration of certification + 3 years

3. Separate Documents from Records in Your File Structure

Whether you use SharePoint, Google Drive, a dedicated QMS platform, or physical binders, maintain a clear structural separation between your controlled documents (procedures, policies, plans) and your operational records (completed forms, logs, reports). Commingling these two categories creates confusion during audits and makes it harder to demonstrate version control.

4. Conduct Internal Documentation Audits Quarterly

Don't wait for your annual surveillance audit to discover that your DVD files are incomplete or that your training records have a six-month gap. Build a quarterly internal audit schedule that specifically checks documentation completeness across each requirement. Use a checklist mapped directly to the R2v3 standard requirements.

The Most Costly Documentation Mistakes (and How to Avoid Them)

Outdated legal requirements registers: The regulatory environment changes constantly. If your register hasn't been reviewed in over 12 months, it's almost certainly incomplete.
Training records that don't cover temporary or contract workers — R2v3 makes no distinction. If someone works in your facility, their training must be documented.
DVD files that exist for initial qualification but have no evidence of re-qualification — Appendix A requires periodic re-evaluation. A vendor file with documents from 2019 and nothing since is a nonconformance waiting to happen.
Data destruction certificates that omit required fields — Missing serial numbers, undated certificates, or certificates that don't identify the destruction method will be flagged.
Financial Responsibility Mechanisms that lapse or are under-funded — Financial-responsibility nonconformances under CR9 can trigger certification suspension. Keep your FRM current and reviewed annually.
No documented management review — R2v3 requires top management to conduct and document periodic reviews of the management system. This is easy to overlook and frequently cited in audits.

How Certify Consulting Approaches R2 Documentation Support

At Certify Consulting, our documentation support process begins with a structured gap analysis mapped directly to the R2v3 standard. We assess your current document library against every controlled document and record type required across your applicable focus areas, then build a prioritized remediation plan.

For facilities starting from scratch, we provide template libraries, procedure writing support, and records system design. For facilities preparing for surveillance audits, we conduct mock document reviews that replicate the auditor experience, because knowing that you have the right documents is very different from being certain they'll hold up under scrutiny.

If you're ready to build a documentation system that passes the first time, connect with our team at certify.consulting to schedule a readiness assessment.

For a deeper look at how the R2v3 requirements interact with each other in practice, see our guide to the R2v3 Core Requirements, explained clause by clause.

Summary: R2v3 Documentation Requirements at a Glance

R2v3 Area	Key Documents	Key Records
Core. Legal Requirements	Legal Register	Review logs
Core. EHS (Sec. 4)	EHS Policy, Emergency Response Plan	Training logs, incident reports, drill records
Core. Data Security (Sec. 6)	Data Security Plan	CoD certificates, chain of custody logs
CR8: Focus Materials	Focus Materials List, Handling Procedures	Material routing records
CR2: Responsible Mgmt Hierarchy	NORM Procedure	Routing decision records
Appendix A — Downstream Vendors	Vendor Qualif. Procedure	DVD files, BOLs, CoRs
Appendix C — Test/Repair	Grading Procedures	Testing/grading records
CR7/Appendix B — Data Security	Subcontractor Agreements	Chain of custody, audit records
CR6: Testing & Harmful Removal	Testing Protocols	Test records, export docs
CR9: Facility Requirements (Financial Responsibility & Closure Plan)	FRM Documentation	Closure Cost Estimates, annual reviews
CR4/CR10: Export & Transport	Export Procedures	Export transaction records
CR8: Focus Materials: Batteries	Battery Handling Procedures	Sorting records, incident logs

Last updated: 2026-03-27