Handing supplier certificate records over to the next QA coordinator

Handovers in QA rarely arrive with a quiet month around them. Someone gives three weeks' notice, moves to another site or covers a leave, and the supplier certificate work crosses a desk in whatever state it is in.

What usually moves is not a system. It is an approved supplier list in a spreadsheet, a folder of PDFs named by whoever happened to save them, a run of email threads where suppliers promised the renewed allergen declaration was coming, and a set of renewal dates that only made sense to the person leaving. The CoA for one ingredient supplier sits in a mailbox the successor cannot open. Two certificate types were only ever required because an auditor asked for them once, and nobody wrote that down.

The next coordinator's first real test is not the handover meeting. It is the first audit, announced or unannounced, where an out-of-date certificate on file reads as a non-conformance regardless of who was in post when it lapsed. The leaver is gone and the finding is the plant's.

The decision in front of you

It is narrow and practical: what do you write down for your successor, and what do you move into something that holds the dates itself so they do not have to be remembered at all.

The arithmetic is worth saying out loud. A Starter plant tracks up to 50 suppliers, and with three certificate types on each one that is as many as 150 issue and expiry dates, each of which wants attention at 90, 60 and 30 days before it lapses. A Professional plant at 200 suppliers is four times that. Nobody reconstructs those dates from a folder of PDFs in their first fortnight, and nobody should be asked to.

A written briefing is fast and costs you an afternoon, but it decays from the day it is written, because the thing that changes is the dates. Moving the records into a tracker costs typing time while you still have the outgoing coordinator in the room, and it is the only version of the handover that keeps working after they leave. Certly is built for the second option: suppliers, the certificate types each one owes you, the documents on file with their issue and expiry dates, and a status per supplier that is computed rather than recalled.

A handover page that only lists strengths is not much use in handover week, so here is the honest shape of it.

What comes with the account

The supplier records, the certificate types each supplier owes you, the documents on file with their issue and expiry dates, your site's name and alert settings, the sending account you connected, and the log of every chase email with its recipient, time sent, delivery result and opens are all kept while the account is open. Uploaded certificate documents sit in the product's own Postgres database on Amazon Web Services rather than in a shared file store. That is what turns a handover into a transfer of records rather than a verbal briefing with attachments.

The history an auditor asks for

A renewal never deletes the document it replaces. Certly keeps expired certificates, the versions superseded by a renewal and the chase history for the life of the account, precisely so the question an auditor actually asks, which declaration was valid last March, has an answer on file rather than a shrug and a note that the previous coordinator handled it. Archiving a supplier keeps its records and stops its reminders, so a supplier you have stopped buying from does not take its paperwork with it.

What you will do by hand

Suppliers go in one at a time through the form, so arriving with 50 or 200 suppliers in a spreadsheet is an evening or two of typing rather than an upload. It is worth doing while the outgoing coordinator is still in the building to say which certificate types each supplier genuinely owes, and what renewal period your plant applies to the documents with no printed expiry, because that judgement is the part of the handover nobody else can reconstruct. The sibling pages on moving a spreadsheet in and on how long setup takes cover that work in detail.

Taking a copy, and closing the account

Account settings, under Site details, downloads a JSON file of your data, so a handover that also has to satisfy a document control policy can start with an offline copy of the records rather than with the PDF alone. The same screen deletes the account, confirmed with your email address: sites, suppliers, certificate documents, chase history, settings and sign-in details go at once and any live subscription is cancelled. That is the right path when the handover is really a move to another system rather than a change of seat.

What is not in place

Sign-in is an email address and a password: there is no single sign-on and no two-factor authentication today, which is why changing the password belongs on the handover checklist. There is also no independent security audit or certification, no standard data processing agreement ready to countersign, no published backup and disaster-recovery schedule and no choice of data residency region. If your group's IT or legal team gates new tools on any of those, raise it before you plan the handover around the product.

Erasing a contact who has moved on

When a supplier's contact leaves their company, that contact's name and email can be erased on their own from the supplier's page, behind a confirmation that spells out what is removed, the contact name and email, and what remains, the certificate records. That is the behaviour an erasure request needs: the person goes, and the supplier's documents and dates stay where the next coordinator and the next auditor can find them.