Closing out a supplier document non-conformance with dated evidence
If an auditor has raised a non-conformance against your supplier documents, the corrective action response has to rest on dated evidence: which certificates were out of date, who you asked, when you asked, and what is on file now. Certly is a certificate tracking and reminder system built to hold that scope and that chase trail in one place, and to export it dated for the auditor.
The week after the finding is raised
The audit has closed and the finding is in writing against your approved supplier programme, because two allergen declarations and a CoA on file had passed their expiry date on the day the auditor looked. Major or minor, the response window has started, and your certification body wants a corrective action with evidence attached rather than an intention.
You already know the root cause, and it is not that nobody cared about an allergen declaration. The tracker is a spreadsheet. The renewal date sits in a column somebody has to open and read, and the week it mattered, that person was covering the line. The supplier was emailed, probably twice, from an inbox that is now several hundred messages deep. So the one question the auditor asks next, when did you ask them, has no clean answer.
The job in front of you is narrower than the word CAPA makes it sound:
- State the scope exactly: which suppliers, which certificate types, how many documents, as at a date.
- Get the current documents in from the suppliers who owe them.
- Show that you requested them, when, and to which contact, with the delivery result rather than an assumption.
- Show that the same gap will surface before expiry next time, so the preventive half of the action is real.
- Hand all of it over as something an auditor can read without a walkthrough.
That is a document problem, and it is the only problem Certly is built for.
The decision in front of you
Most QA managers close a first documentation finding by tightening the spreadsheet: a conditional format on the expiry column, a reminder in a shared calendar, a line in the procedure saying the list is reviewed monthly. It closes the finding. It is thinner at the follow-up, because the evidence it produces is a screenshot of a file anybody could have edited yesterday, with no record of what it said on the day of the audit.
The alternative is to let the expiry dates and the chase history sit in a system that stamps them itself, and keep the spreadsheet for what it is still good at. Worth naming the trade-off plainly. Certly is scoped to supplier certificates and nothing else. The corrective action record, the root cause analysis and the sign-off stay in your document control system or your CAPA log, where your auditor already expects to find them. The definitions of major, minor, corrective action and closeout are covered on the glossary pages in this section rather than argued again here.
The other trade-off is scope of site. Starter and Professional each cover one site, up to 50 and up to 200 suppliers respectively, and both carry a 14-day free trial. Multi-site covers up to 5 sites under one agreement, with no supplier cap, and lets you add sites and switch between them from one sign-in. If your group runs three or four plants, that is the tier the question lands in.
What Certly is built to supply is the attachment: the certificate status of every supplier against every certificate type you marked as required, the chase trail behind each one, and the documents themselves with their issue and expiry dates.
How a documentation finding closes out in Certly
- Read the scope off one screen
The status view shows every supplier against the certificate types you marked as required, in four states: current, expiring soon, expired and missing. That is the sentence your corrective action needs, with counts you read off the screen rather than estimate, and it keeps genuinely expired documents separate from ones you never received at all.
- Ask the supplier, and have the ask on the record
Chase emails go to the supplier contact you hold against that certificate, carrying a one-click upload link, and every send is logged. The link is single-use and expires on its own, so the supplier does not create an account or learn a portal, they open the link and upload. You can also trigger a one-off chase from the supplier's row when you want the request dated today.
- Check the chase actually landed
The chase log on the supplier's page shows each entry with its send status, sent, failed or opened, rather than assuming delivery. A failed send carries its own badge and a resend action next to it, so a bounced address is something you fix this week instead of a silence you discover at the verification visit.
- Take the renewal in, whichever way it arrives
When the supplier uploads through the link, the document lands against the right supplier and the right certificate type with its issue and expiry date recorded. If the certificate reaches you another way, by post or as an attachment to a reply, your QA team uploads it to the same slot by hand. Where the document carries no printed expiry, which is the usual case for an allergen declaration or a vendor form, you record the issue date and the due date is derived from the renewal period set for that certificate type.
- Set the thresholds so the gap surfaces before expiry
Alerts run at 90, 60 and 30 days before expiry, and the thresholds are configurable per certificate type or as a plant-wide default. A certificate type can also carry its own renewal period for the plant, so a document with no printed expiry date still has a due date to alert against. For the preventive half of your response, that is the control you are describing: a setting somebody can look at, not a promise to review the list.
- Export the status view as the attachment
A PDF export of the status view goes to the auditor or the certification body with your response, carrying the same four status badges the screen shows and the same two-sentence disclaimer. It reports what is on file as at the moment you exported it, which is exactly the claim a closeout should make.
- Keep the trail for the verification visit
Expired certificates, the versions a renewal replaced and the full chase history are kept while your account is open, because that trail is what an auditor asks for at the follow-up. A renewal never deletes the document it replaced.
What a closeout pack is asked to show, and where it comes from
| What the auditor asks | The evidence | Where it sits in Certly |
|---|---|---|
| Which supplier documents were out of date, and how many | Certificate status per supplier and type: current, expiring soon, expired, missing | The single-screen status view |
| That no supplier on the approved list was overlooked | Every supplier against each certificate type marked required, including slots with nothing on file | Required certificate types on the supplier record |
| What you did about it, and when | Each chase email with its recipient, time sent and delivery result | The chase log on the supplier's page |
| That the correct current document is now on file | The uploaded certificate with its issue and expiry dates | The supplier's certificate slot |
| How a document with no printed expiry is kept current | The issue date recorded on upload, with the renewal period for that certificate type deriving the due date | Certificate type settings for the plant |
| Something to attach to the corrective action response | A dated export of the status view with the same badges and disclaimer as the screen | PDF export of the status view |
| How the gap will be caught next time | Alert thresholds at 90, 60 and 30 days, per certificate type or plant-wide | Alert settings |
What this changes for the QA manager writing the response
Scope stated as a count
Current, expiring soon, expired and missing per supplier and certificate type, on one screen, so the first line of your corrective action is read rather than reconstructed from an inbox.
The request is dated for you
Every chase send is logged with its recipient and time, so the question of when you asked the supplier has an answer that does not depend on anybody's sent items.
Bounces stop being silence
Sent, failed and opened are shown per chase entry, with a resend action beside a failure, so a wrong contact address surfaces while the response window is still open.
Nothing for the supplier to sign into
A single-use, expiring link takes the supplier contact straight to an upload page for the certificate you asked for. No portal, no account, no password to reset on their side.
The preventive action is a setting
90, 60 and 30 days before expiry, adjustable per certificate type, plus a renewal period for the types that print no expiry date, is a control an auditor can be shown rather than a sentence in a procedure.
One dated attachment
The status view exports as a PDF that matches the screen badge for badge and carries the same disclaimer, so the pack you attach and the screen you work from say the same thing.
The history is still there at the follow-up
Expired certificates, superseded versions and chase history are retained while the account is open, which is the window the verification visit falls in.
One plant, one account
Data is scoped to the plant on every query, so a supplier list and its certificate documents sit under that plant's account. We also say what is not in place: no SOC 2 or ISO 27001 certification, no single sign-on or two-factor sign-in, and no standard data processing agreement ready to countersign yet. If your group needs those before a supplier contact's email is stored, read the data handling page first.
Wording the response so it stays accurate under review
A documentation finding is usually closed on paper before it is closed in practice, which means the wording carries more weight than the tooling does. A few habits keep a response defensible, and they are worth writing into your procedure whether or not you ever use Certly.
- Claim only what the attachment proves. A dated export states what was on file at the moment it was produced. It is not a statement about any other date, and it is not a statement about whether a certificate is genuine.
- Keep missing and expired separate in the text. A document that lapsed and a document you never received have different root causes and different corrective actions, and an auditor who sees them merged will ask why.
- Name the preventive control concretely. "Reviewed monthly" is an intention. A threshold set at 90, 60 and 30 days before expiry on a named certificate type, with a renewal period behind the types that print no expiry, is a configuration somebody can be shown.
- Avoid the word verified unless you did the verifying. Certly tracks expiry dates and sends reminders. It does not authenticate a certificate or guarantee regulatory compliance, and your response should not imply that a tool did work a person has to do.
- Say who holds the CAPA record. The finding, the root cause and the sign-off belong in your document control system. Point the auditor at the certificate evidence as an exhibit, not as the whole response.
Questions
Does Certly close out the non-conformance for me?
No. Certly is a certificate tracking and reminder system scoped to supplier documents. It is built to supply the evidence a documentation finding asks for: the certificate status per supplier and type, the chase log behind each request, the uploaded document with its issue and expiry dates, and a dated PDF export. The corrective action record, the root cause analysis and the sign-off stay in your document control system or CAPA log.
What exactly is in the PDF export I attach to the response?
The single-screen certificate status view for your site, per supplier and certificate type, in the four states current, expiring soon, expired and missing, using the same badge labels, colours and icons as the screen. It carries the two-sentence statement that Certly tracks and reminds and does not verify authenticity or guarantee compliance. It reports what is on file at the moment you export it.
Can I show when I asked the supplier, not just that I asked?
Yes. Every chase email is logged per send against the supplier, and the chase log on the supplier's page shows each entry with its send status, sent, failed or opened, rather than assuming delivery. A failed send gets its own badge and a resend action next to it.
Does the supplier need an account to send the certificate back?
No. The chase email carries a one-click upload link that is single-use and expires on its own, and it takes the contact to an upload page tied to that supplier and certificate type. There is no login and no portal for them to learn.
What if the renewed certificate arrives by post or as an email attachment?
Your QA team uploads it by hand against the same supplier and certificate type, with its issue and expiry date, so the status view and the export stay accurate regardless of how the document reached you.
What about an allergen declaration with no printed expiry date?
Record the issue date on upload and set a renewal period for that certificate type at your plant; the due date is derived from the two, so the slot carries a date the alerts can work from instead of sitting outside the tracking altogether.
Can I change the 90, 60 and 30 day alerts?
Yes. Alert thresholds are configurable: you can set them per certificate type or set a plant-wide default, and the days-before-expiry values are editable from the alerts settings screen.
What does it cost, and is there a trial?
Starter is $3,228 a year for one site and up to 50 suppliers, with a 14-day free trial. Professional is $5,388 a year for one site and up to 200 suppliers, also with a 14-day free trial. Multi-site is $10,788 a year for up to 5 sites under one agreement with no supplier cap. All three are billed annually, which is 10 percent off the equivalent monthly rate for paying up front.