You look after safety for eleven locations. Somewhere in the shared drive is a spreadsheet with every worker's B-VCA number and expiry date, colour coded, maintained by someone who is genuinely good at it. It is a useful document. It is also why a lot of QHSE managers walk into an audit believing they are covered and walk out with two non conformities.
This guide is about the gap between that spreadsheet and what the scheme actually asks for, and about how to close it across many sites and subcontractors without inventing a training department you do not have.
"Everyone has their VCA" is not a compliance statement
Start with what VCA is. VCA is not legislation. It is a contractual requirement imposed by clients. The law is the Arbowet in the Netherlands and the Welzijnswet plus the Codex over het welzijn op het werk in Belgium. VCA is the mechanism clients use to check whether you comply with those. That distinction matters, because a diploma is a scheme artefact while the underlying duty is a legal one, and the two are satisfied by different things.
While we are drawing lines: BeSaCC is not a synonym for VCA. It is a separate, lighter system aimed at limited risks. Treating the two as interchangeable in a tender response is an easy way to lose credibility with a client's prevention department.
The personal diplomas are B-VCA for operational staff, VOL-VCA for operational supervisors and VIL-VCU for coordinators at agencies. Each is valid for ten years, after which the holder sits the full exam again, not a refresher. Everything that spreadsheet tracks is necessary. It is simply not the part of the scheme that fails in audits.
Chapter 3 has two halves, and most companies hold only one
Chapter 3 of the VCA checklist is titled "Opleiding, voorlichting en instructie" (training, information and instruction). Read the must questions next to each other:
- 3.2: a valid B-VCA for operational employees.
- 3.3: a valid VOL-VCA for operational supervisors.
- 3.5: the company's own health, safety and environment information and instruction programme, including an onthaal (structured reception and induction) for new and reassigned workers.
- 3.6: instruction on the internal rules and procedures at clients' sites, including for temporary workers and subcontractors, before work starts at that location, demonstrable, with attendance lists.
- 3.7: communication without language barriers.
The scheme did not write 3.5 and 3.6 as guidance under 3.2. It wrote them as separate must questions. That structure is the scheme's own statement that generic certification and site-specific instruction are different obligations. An auditor who is shown a complete diploma register and nothing else records a deviation on 3.5 and 3.6, and it is not a technicality: it is the section describing what your people were told about the building they are standing in.
Chapter 2 repeats the pattern one level up. 2.1 is the RI&E, 2.2 the taakrisicoanalyse (task risk analysis, TRA), 2.3 the Last Minute Risk Analysis before work starts. All three are must questions, and all three are by definition tied to a specific task at a specific place. Nothing a worker did in a classroom two years ago touches them.
What sits underneath, and it is not VCA
Strip the scheme away and the duty does not disappear. In Belgium, Codex art. I.2-21 requires every worker to receive sufficient and appropriate training relating to welfare at work, directed at their werkpost (workstation) or function, on entry into service, on a change of function and when new work equipment or technology is introduced, repeated and adapted as risks evolve, during working hours and not at the worker's expense.
Art. I.2-20 is the sharper one. It requires the employer to take the necessary measures so that only workers who have received appropriate instructions have access to zones with serious and specific hazards. Appropriate instructions. Not a diploma, not a card in a wallet.
In the Netherlands, Arbowet art. 8 lid 1 requires that workers are effectively informed about the work to be carried out and its risks, and lid 2 that instruction is effective and adapted to their distinct tasks. Lid 4 is the one that quietly decides most inspections: the employer supervises compliance with the instructions and rules given. A single session, delivered once, with no follow-up on whether people are actually working to the instruction, does not meet lid 4. Neither does a signature on a folder nobody read.
The version most online guidance still has not caught up with
VCA 2026/6.1 has applied to company certification since 1 July 2026, replacing VCA 2017/6.0. It concerns company certification only. Personal diplomas are unaffected and remain valid.
Practically, a good deal of the VCA advice circulating online, including internal procedures copied between sites years ago, still describes the previous version. If your rollout rests on a document nobody has revisited since 2017, check that first.
Toolboxmeetings: a floor, and two lists
VCA question 4.1 is a must question. It requires toolboxmeetings (short workplace safety talks) spread across the year, covering relevant health, safety and environment topics, changes to rules and procedures, and findings from incident investigations. The minimum frequency is four per year for VCA*, ten per year for VCA** and ten per year for VCA Petrochemie. Those are floors, not targets, and the word "toolbox" appears in no Dutch or Belgian statute at all: it is a scheme and industry term.
What the auditor asks for is literal, and worth writing on the wall of your office: the list of dates and topics discussed, and the attendance lists. If you run twelve sessions across eleven sites and can produce dates, topics and attendance for six of them, you have run six.
Making site-specific instruction actually work across many locations
The reason most companies fall back on the diploma register is that the alternative sounds impossible: a different instruction for every address, delivered before work starts, evidenced per person. It is manageable if you split the content properly.
Separate the company layer from the site layer. Your own rules, your onthaal, your PPE policy and your incident reporting route are the same everywhere. Build them once. Everything that changes with the address (site entry rules, traffic routes, permit systems, assembly points, the client's specific prohibitions) belongs in a short site pack that only people going to that site receive. Keep the site pack ruthlessly small: five things a worker must know before crossing the gate, not a forty page document.
Time it against 3.6, which says before work starts. Instruction delivered on the Thursday after the job started is a record of the wrong date. The practical consequence is that instruction has to be deliverable at the moment the assignment is confirmed, wherever the worker happens to be, which in most field and logistics work means on a phone.
Treat language as a scheme requirement, not a courtesy. Question 3.7 asks for communication without language barriers. A Dutch site pack handed to a crew reading Polish or Romanian is a document, not an instruction, and it also undermines your I.2-20 position, because you cannot argue someone received appropriate instructions in a language they do not read.
Pull subcontractors inside the same system. 3.6 names temporary workers and subcontractors explicitly. If your subcontractor's instruction lives in their filing cabinet and yours in a shared drive, you have no consolidated attendance list to hand over, which is the one thing you will be asked for.
Close the loop back into the toolbox cycle. Incident findings and changed procedures are required content under 4.1. That means your incident investigations and your instruction library need to be connected, so a finding at site three becomes a topic at all eleven within the same month.
The site pack, delivered before the gate
Aristotl takes the documents you already maintain, the onthaal checklist, the site rules a client sent through, the work instruction, the outcome of the last incident investigation, and turns them into courses of three to five minutes that a worker completes on their own phone, with no laptop and no app to install. Courses can be assigned per site, so the crew going to that plant receives that plant's rules. Content is translated per worker, which is what 3.7 is asking about. Completion is recorded per site, per role and per version, with a knowledge check attached, and the records export.
That produces exactly the two artefacts an audit asks for: what was covered and when, and who completed it, per person, before work started.
Start with the site you are audited on next
Pick one location and one real document: its site rules, its onthaal checklist, or the topic of your last toolbox. In a demo we build it into courses for that crew and show you what the attendance record looks like the following morning.