How many months before a recertification audit should you start on supplier certificates?

Count back four months from your audit due date. That is when supplier certificate work should start, not the month before. The 120-day mark is for fixing your register, 90 days is the first chase wave, 60 days is where you separate slow suppliers from stuck ones, and by 30 days out you should be closing known exceptions rather than finding new ones. If the first time you look at expiry dates is four weeks before the auditor arrives, you are not preparing, you are discovering.

Four months rather than four weeks, because almost none of the work is yours. This holds whether you are preparing for a BRCGS Food Safety recertification audit, an SQF recertification or an FSSC 22000 visit, since all three ask you to show that supplier approval rests on current documents, and none of them care why a document is late. A renewal moves at the speed of the supplier's technical manager answering an email, their lab issuing a fresh certificate of analysis, or their own certification body issuing an audit certificate after their audit. None of that sits inside your control, and each step can quietly consume three or four weeks on its own. The 90, 60 and 30-day windows are not three copies of the same reminder. They are three different conversations, and they only work if the first one happens early enough that the third one is a formality.

Fix the date you are counting back from

Before you subtract anything, get the date right. Your existing certificate carries an expiry date, and your certification body works to an audit due date with a window around it, which is not always the same thing. If you hold an unannounced option, the practical date to plan against is the earliest day in that window, not the last. Take both dates from your certificate and confirm the window with your certification body in writing, then put the earliest plausible arrival date in the calendar and count back from that.

The second date worth writing down is the audit date plus a margin. A certificate that expires the week after your audit is technically valid on the day, but it invites a question about how you control renewals, and that question is harder to answer than handing over a current document. Setting your horizon a month or two past the audit date costs you nothing at 120 days out and saves an awkward conversation later.

120 days out: fix the register, not the certificates

The first pass is not about documents at all. It is about whether your list of suppliers and required certificate types matches what the plant actually buys, and whether you can reach anyone.

• Reconcile the supplier list against this year's purchasing. Suppliers you stopped buying from inflate every count you will later show an auditor. Suppliers added in the last six months are often the ones with no documents on file at all.
• Set the required certificate types per supplier deliberately. An allergen declaration, a certificate of analysis and a third-party audit certificate are three different renewal cycles with three different owners at the supplier's end. A type ticked by mistake becomes a permanently missing row.
• Check the contact. One named person, one working email, and a quick test: has anything arrived from that address in the last twelve months? Contacts leave, mailboxes get retired, and a chase sent to a dead address looks identical to a chase ignored.

This pass is dull and it is where the multi-week delays come from. Doing it at 120 days means every later reminder lands on a real person.

90 days out: the first chase is informational

At 90 days the message is simple and easy to action. Name the certificate type, state the expiry date you hold, say where to send the new one, and ask for a date if they cannot send it yet. No escalation, no tone. Most suppliers are not withholding anything, they simply have not been asked by anyone with a date attached.

The arithmetic matters here. Flag everything expiring between today and your audit date plus a margin, not just everything expired today. At 90 days out, a certificate that expires in five months is still inside the window you care about if the audit lands late in its window.

Also record the send. A chase you cannot evidence is, for audit purposes, a chase that did not happen, and the question "when did you last ask them" comes up as often as "where is the document".

60 days out: separate slow from stuck

Thirty days after the first wave, sort what is left into three piles.

1. Renewed. Document received, filed against the right supplier and type. Check it, do not just archive it.
2. In progress with a date. The supplier has answered and named a day. Write the day down and diarise it. This pile is fine.
3. No response. This is the pile that decides your audit, and at 60 days it is usually a contact problem rather than a document problem.

For the third pile, stop emailing the same address. Phone. Go through purchasing, who has leverage you do not, or the account manager, who wants the order to continue. One call at 60 days replaces four emails at 20 days.

The hardest case surfaces here too: the supplier whose own recertification audit has not happened yet, so the certificate you need does not exist and cannot be produced early. You need their audit date, in writing, plus their certification body, and an honest view of whether the certificate will be issued before your auditor arrives. If it will not, you are managing an exception, and the time to write down how you are managing it is now, not on the day.

30 days out: no new discoveries

At 30 days the register should be closed apart from exceptions you can already explain in one line each: who, what document, why it is late, what the date is, what you are doing in the meantime. That line is the difference between a question and a finding.

This is also when you check the documents rather than the dates, which is the part no system does for you. Does the audit certificate cover the site you actually buy from, or a sister site? Is the scope the right product category? Is the allergen declaration signed, and does it match the current specification? Does the certificate of analysis reference the batch or the product you receive? A document can be current and still be the wrong document, and only a person who knows the supply reads that correctly.

Then build the pack once, as a dry run, and see what an outsider sees. If a status reads current and you cannot immediately say why, fix it while you still have a month.

Audit week

Regenerate the status view on the day, because statuses move. Bring the chase history for anything outstanding, because evidence of a controlled process is the answer when the document itself is late. Keep the exception notes with the pack rather than in your head.

Where the automation fits, and where it does not

The 90, 60 and 30-day structure is a calendar problem, which is the kind of problem software is good at. Certly is built to hold the supplier list with its required certificate types and contact details, track expiry dates, and compute alert thresholds at 90, 60 and 30 days before expiry on a scheduled job, with those thresholds configurable per certificate type when it launches. From each threshold it is built to send an automated chase to the supplier contact with a one-click upload link, logged per send, so the chase history exists without anyone keeping notes. Suppliers upload through a single-use, expiring link with no login and no account, and your team can upload documents directly when a certificate arrives by email instead. There is a chase-now action for the one supplier you need to push today, and the chase log shows whether a send succeeded or failed so a bounce does not pass for contact made.

For the audit itself, the dashboard shows one screen of per-supplier status in four states, current, expiring soon, expired and missing, and exports to PDF for an auditor to read. Data is scoped to a single plant.

What it does not do is judge the documents. Certly tracks and reminds. It does not verify that a certificate is authentic, that its scope covers what you buy, or that your plant is compliant, and the dashboard and the export both say so. The reading and the judgement stay with you, which is exactly why the calendar matters: the earlier the chasing starts, the more of your remaining time goes on the part only you can do.

The calendar, written out

For an audit due date of 2 March:

• 2 November, 120 days. Reconcile suppliers, set required certificate types, verify every contact email.
• 2 December, 90 days. First chase on everything expiring before the audit date plus your margin. Log every send.
• 1 January, 60 days. Sort into renewed, dated, and silent. Phone the silent ones. Capture supplier audit dates for certificates that do not exist yet.
• 31 January, 30 days. Close the register. Check scope and signatures, not just dates. Dry run the export.
• Week of 2 March. Regenerate the pack, bring the chase history and the exception notes.

If you only adopt one date from that list, adopt the first one. Everything that goes wrong at 30 days was decided at 120.