Answering a customer audit request for supplier certificate evidence

It arrives from a retailer's technical manager, or from a customer's quality team a fortnight before a second-party visit, and it is rarely more than four lines long. Send us your approved supplier list with the current certificates. Allergen declarations for the ingredients in this product. CoAs for the recent deliveries. The audit certificate for the two suppliers we asked about in the spring.

The job is not complicated, it is just unevenly distributed. Some of it sits in a shared drive folder named by supplier, some is in an email thread from last autumn, and the state of the whole thing lives in a spreadsheet that was accurate the last time somebody sat down and worked through it row by row. So the reply takes a day you had allocated to something else, and most of that day goes not on writing the reply but on checking whether the spreadsheet is still telling you the truth.

The question that actually costs the day

Before a word of the reply gets written there is a prior question: what do you hold right now, for the suppliers this request covers, and how much of it would survive the customer reading it closely. That question is the work. Attaching files is the easy part once you can answer it.

There are two ways to answer, and the difference matters more than the hours.

The first is to send what you have and let the customer find the gaps. It is quicker, and under time pressure it is how a lot of these requests get answered. The cost arrives later, as a question you cannot answer in the room, or as a finding against your own supplier approval programme in somebody else's report, raised by them rather than by you.

The second is to audit yourself first, then reply. You pull the suppliers the request covers, read the status of every certificate type you require from each of them, and deal with whatever is expired or absent before you attach anything. Where a document has lapsed you say so, and you say what you have already done about it. A customer who sees a gap you identified and are chasing reads a working document control process. A customer who finds that gap for you reads a different story.

The practical obstacle to the second route is that missing is the hardest state to see. An expired certificate is a date, and a date can be read. A certificate a supplier has never sent at all is an absent row, and an absent row looks like nothing on a spreadsheet.

Worth knowing before you plan a reply around it.

• No customer login. Certly is scoped to a single plant, with plant-scoped data isolation on every query, and people sign in with email and password. A customer never gets an account on your data. What leaves the building is the PDF export, or a stored certificate document itself.
• No authenticity checking. If a supplier sends a certificate that is not what it claims to be, Certly records it and tracks its expiry date like any other document. Judging the document stays with you.
• No questionnaire answers. Supplier approval questionnaires, specifications and the rest of a customer technical pack sit outside what Certly holds. It covers the certificate types you require from each supplier and the status of each one.
• No assurances we have not earned. Certly runs on Amazon Web Services, with certificate documents stored in the product's own Postgres database rather than a shared file store. There is no independent security audit or certification, no single sign-on or two-factor authentication, no data processing agreement ready to countersign and no choice of hosting region. If your customer's own supplier questionnaire asks for those, that is the honest answer today.

A customer request and a certification audit ask for the same underlying evidence, but they are different jobs. A customer wants a reply they can file against your account, usually about a named set of suppliers or a named product. A third-party auditor sits with you and works through the whole approved supplier programme, including the documents that have been superseded along the way. The detail of what the PDF shows an auditor, and what it deliberately does not, is covered on its own page, as is the work of building the document pack before a recertification visit and keeping it current between visits.

If the customer's request turns into a written finding against your supplier approval, the closing-out work is its own exercise: a dated chase, a dated upload, a status that changed, all held against the supplier rather than reconstructed from an inbox months later.

Certly is not open for sign-ups yet. The plans above are the ones it is built to launch on, and the waitlist is where to put your name if you would rather not spend another day proving what you already hold.