Handing the auditor the PDF: what it shows, and what it does not
If you want one file that shows an auditor where every supplier certificate stands, that is the PDF export of Certly's certificate status view, and this page answers the questions QA managers ask about it. Certly is in build with a waitlist open, so read what follows as what the export is built to do: what it lists, what its disclaimer says, and what it deliberately does not claim.
The file you hand the auditor
Certly is built around one screen that shows, per supplier, whether each required certificate is current, expiring soon, expired or missing. That screen is built to export as a PDF for auditor review, made to be the file you hand across the table rather than a screenshot cropped at the desk.
The export is a status report, not a document bundle. It is headed with your site's name and the date it was generated, then lists each supplier with the certificate types you marked as required for them and the state of each slot. Each state is computed from the dates recorded with the upload: the printed expiry date where the document carries one, or the issue date plus the renewal period you set for that certificate type where it does not, which is how allergen declarations and vendor forms get a due date at all.
It carries a two-sentence line near the status badges saying plainly that Certly tracks and reminds on certificate expiry and does not verify certificate authenticity or guarantee regulatory compliance. That line is built to sit on the screen and on the paper in the same words, because an auditor reading the PDF should see exactly what you see.
The status badges are built to match too: the same four labels, the same colours, the same icons as the dashboard and the supplier row. If you talk an auditor through the screen and then hand them the PDF, nothing is renamed between the two.
The questions below are the ones that come up once the file is in the auditor's hands.
What the auditor is testing when they ask for this
An auditor looking at your approved supplier programme is rarely trying to catch one lapsed document. They are testing whether a system exists, whether it was current on the day they asked, and whether someone acted when a date came round.
That is why a status report tends to land better than a folder of PDFs. A folder answers one supplier at a time and says nothing about the eighty you did not print. A status view answers coverage first, which is the order the questions usually arrive in.
- Does a system exist. One screen per plant, listing each supplier and the certificate types you marked as required for them.
- Was it current. Each slot resolves to one of four states, computed from the expiry date recorded with the upload, or from the issue date and the certificate type's renewal period where no expiry is printed.
- Did anyone act. Alert thresholds at 90, 60 and 30 days before expiry, automated chase emails to the supplier contact with a one-click upload link, and a log of every send.
- Where does the tool stop. The disclaimer names that boundary on the report itself, rather than leaving you to explain it from memory.
If you are assembling the wider pack around this file, the sibling pages on the audit-ready evidence pack and on preparing the supplier document pack before recertification cover what else sits alongside it. The feature page on exporting the certificate status view as a PDF covers the export itself, the page on supplier certificates by expiry status covers reading the board on screen, and the page on keeping superseded supplier certificate versions covers the older document an auditor asks for by date.
Questions
What exactly is on the audit-ready PDF?
It is the export of the single-screen certificate status view, headed with your site's name and the date it was generated. Below that sits each supplier, each certificate type you have marked as required for them, and the status of that slot as current, expiring soon, expired or missing. The four-state badge is built to use the identical labels, colours and iconography as the dashboard, so the auditor is reading the same thing your QA team reads daily, and the same two-sentence disclaimer appears near the top. It is a status report across your supplier base, not a merged bundle of the certificates themselves.
Does the PDF prove my certificates are genuine?
No, and it says so on its own face. The disclaimer states that the platform tracks and reminds, and does not verify authenticity or guarantee compliance. Certly reads the dates that were entered with the upload and computes a status from them; it does not contact a certification body, check a certificate number against a register, or confirm the scope on the document matches what you buy from that supplier. That judgement stays with you, which is where an auditor expects it to sit.
Why would I show an auditor a disclaimer at all?
Because an auditor is going to ask what the tool does and does not do, and it is better that the answer is printed than improvised. Naming the boundary makes the rest of the report more credible: this is our tracking record, here is what it covers, here is where our own verification applies. A report that implies more assurance than a tracking system can give is the thing that turns into a finding when someone probes it. Certly keeps the line short, two sentences near the status badges rather than a wall of small print.
What do the four statuses actually mean?
Current means a document is on file and its due date has not passed. Expiring soon means the due date falls inside one of your alert thresholds, which Certly computes at 90, 60 and 30 days before expiry. Expired means the due date has passed and no renewal has been uploaded against that slot. Missing means no document has ever been supplied for a certificate type you marked as required for that supplier, which is a different conversation at an audit and reads differently on the report.
What happens with a certificate that has no printed expiry date?
Allergen declarations and vendor questionnaires often carry only the date they were signed, which is why uploads record an issue date as well as an expiry date. Where no expiry is printed, Certly is built to derive the due date from the issue date plus a renewal period you set per certificate type for your plant, so a declaration signed three years ago does not sit on the report as current forever. That keeps the same four states on the PDF for documents the supplier never dated for you. It is your renewal period, recorded and visible, rather than a rule the tool invents.
Does the auditor still need to see the certificates themselves?
Almost always, yes. The PDF answers the question of coverage, which suppliers have what and what lapses when, and that is usually where an audit of your approved supplier programme starts. When the auditor picks a supplier to examine in depth, they will want the document itself: the scope, the certification body, the issue date, the signature. Certificate documents are held against the supplier and the certificate type, with versions replaced by a renewal kept rather than overwritten, so the document for the slot they are asking about is where the question points. Treat the export as the index to the evidence, not the evidence.
Does the PDF show that I chased a supplier for a lapsed certificate?
It carries the date of the last chase recorded against each row, so the auditor can see the dates were not left alone. Read that alongside the chase log on the supplier's page before you lean on it, because the printed date is the last chase recorded rather than the last chase delivered. The log is where delivery sits: every chase email listed with its outcome, sent, failed or opened, with a failed send badged as such and a resend action beside it. A bounce is not contact made, and an auditor who asks will want the log, not the date. If you are building a corrective action out of it, the sibling page on closing out a supplier document non-conformance with dated evidence deals with the chase log rather than the status report.
How do I get this report, and what does Certly cost?
Certly is in build and the waitlist is open, so joining it is how you hear when the trial opens. The plans are declared: Starter at $3,228 a year for a single plant tracking up to 50 suppliers, Professional at $5,388 a year for up to 200 suppliers, and Multi-site at $10,788 a year for groups running up to 5 sites under one agreement, each billed annually. Starter and Professional each carry a 14-day free trial. The audit-ready dashboard and its PDF export are listed in Starter, and Professional and Multi-site each include everything in the plan below them.