Seven bodies: three standing committees, three expert councils and a research and practice centre. Each has its own rules of procedure, membership and area of responsibility.
The committees take decisions and answer for them. The expert councils supply industry depth. The centre provides the evidence base. The Accreditation Committee sits in a separate legal entity — impartiality requires it.
The committees take the decisions, but cannot know every industry to the same depth. That is the work of the expert councils: they prepare the industry substance of requirements, which is then put to a vote.
The research arm of the Association. It carries out applied work at the intersection of security disciplines — where the industry councils work separately, and a threat arrives across the boundary between them.
The centre prepares methodological material, consolidates practice in the application of assessment schemes and provides the evidence base for the requirements adopted by the committees. Its work answers to a simple fact: corporate security does not divide into isolated functions.
The structure of the Association looks more complex than it might be. There is one reason: combining these functions in the same hands strips the assessment result of its meaning.
The Association neither certifies organisations nor advises them. Certification is carried out by accredited certification bodies — independent participants in the market. The Association is responsible for the rules under which this is done, and for making public who works under those rules and on what basis.