Staying ready for an unannounced audit any week of the year
Unannounced audit preparation is not a project with a start date, because the auditor picks the week and your supplier documents have to hold up whichever week that turns out to be. Certly is built to keep each supplier's required certificates on one status screen computed from the issue and expiry dates you hold, with alert thresholds at 90, 60 and 30 days and a PDF export you can hand over the s
The audit you cannot put in the diary
You know the shape of the morning. Reception calls, the auditor is in the car park, and within the hour someone will ask to see the approved supplier list and the documents behind three or four names on it. Not the names you would have picked. The allergen declaration from the spice blender, a CoA from the packaging supplier, the audit certificate for the dairy ingredient you brought in last quarter.
With a notified audit you get a run-up: a fortnight of chasing suppliers for their certs, a folder rebuilt, a spreadsheet brought back into line. An unannounced visit takes the run-up away. The only version of your supplier document pack that counts is the one that exists on an ordinary Tuesday, while you are covering a line trial and a customer complaint.
The practical risk is narrow and familiar. One out-of-date certificate on file, or one required document that was never collected at all, and you are writing a corrective action instead of finishing the audit clean. Nobody is caught out by the certificate they were already worried about. They are caught out by the expiry date that passed in week three of a busy month while the sheet still read current, because the sheet only ever says what the last person typed into it.
What being ready any week actually requires
Readiness for an unannounced visit is not a bigger push before a date. It is a shorter loop that holds on a day you are not thinking about audits at all. Three things have to be true.
- The list of what each supplier owes you lives somewhere other than your head. The certificate types you require from that supplier specifically, not a generic set you apply to everyone.
- Status is worked out from the dates, not remembered. An expiry that passed last week should read expired the moment you look, without anyone having had to update a row first.
- Evidence is retrievable, not assembled. If pulling the pack together takes an afternoon, you do not have a pack, you have a project.
Certly is a certificate tracking and reminder system built around those three. It does not inspect your documents and it does not tell you whether your plant meets a standard. It tells you, per supplier, which required certificates are current, which are expiring soon, which have expired and which are missing. It is built to chase the supplier contact for a renewal and to log what was sent, when, and what the delivery result was. Judging whether a document is genuine, in scope and acceptable for your approved supplier programme stays with you.
The routine this supports between audits
- Write the requirement down once, per supplier
Add each supplier with its contact details and the certificate types you actually require from it, such as an allergen declaration, a CoA or an audit certificate. That list is what turns a document you never received into a visible Missing row rather than an oversight nobody has noticed.
- Load what you already hold
Upload the certificates sitting in your folders against the supplier and the certificate type, with issue and expiry dates. The dates are the working part, because every status and every alert is worked out from them. The forms validate fields server-side, so a missing expiry date or a malformed contact email comes back as an inline error rather than a silent gap on the board.
- Set the thresholds you want to work to
Expiry tracking runs on configurable thresholds at 90, 60 and 30 days before the date, set plant-wide or per certificate type on the alert settings screen. A 90 day first nudge gives a slow supplier room to renew without you holding the deadline in your head, and you can tighten or loosen it for a certificate type that always takes longer.
- Let the board do the date arithmetic
Certificate status is computed from the issue and expiry dates on the records every time the board loads, so what you read is that day's position rather than what someone last typed into a cell. Looking takes one screen instead of a folder audit.
- Chase without writing the email
Automated chase sequences are built to reach the supplier contact as a certificate approaches expiry or after it has lapsed, carrying a one-click upload link. Every send is logged per supplier with recipient, time and delivery result, so a failed send reads as failed rather than as contact made. You can also fire a chase yourself from a dashboard row or the supplier page. The supplier uploads through a single-use, expiring signed link and needs no login to use it, and the link stops working once it has been used or once it expires.
- Archive the suppliers you no longer buy from
A supplier you have stopped buying from would otherwise sit on the board forever, inflating the expired and missing counts an auditor reads. Archiving keeps its certificate records and chase history, because that trail is still evidence, and stops its reminders so the needs-attention numbers describe the suppliers you actually use.
- Check the one screen, not the folder
The audit-ready dashboard carries all four states, current, expiring soon, expired and missing, per supplier on a single screen. Knowing where you stand becomes a read rather than a reconstruction, which is the whole point of being ready for a week you did not choose.
- Export it when the auditor is in the room
The dashboard exports as a PDF for auditor review, dated with the day it was generated, using the same four status labels and badges as the screen and carrying the same tracking-not-verifying line near the top. You hand over a dated position rather than a stack of printouts assembled while someone waits.
Why this fits the unannounced case specifically
Nothing to rebuild when the week is chosen
The pack is not assembled for a date, it is read from what you already hold. Status comes from the expiry dates on the records and is recomputed every time the board loads, so opening it on an unannounced Tuesday gives you that Tuesday's position rather than the last edit someone made to a shared sheet.
Missing is a visible state, not a gap
A required certificate you have never received reads Missing against that supplier instead of quietly not existing. Missing is the state an auditor finds by asking and a spreadsheet hides by having no row for it, and you can chase it from that row.
Three chances at an expiry, not one
Thresholds at 90, 60 and 30 days are there to surface a renewal while there is still time to get the document in. They can be set per certificate type when a particular document always takes a supplier longer to turn around.
Evidence of chasing, not just of certificates
Every chase email is logged against the supplier with its delivery result, and a bounce or failure shows as a distinct status with a resend action beside it. When you are asked how you manage a supplier who is late, you have a record of what went out and what happened to it rather than a recollection.
The document that was valid last March is still there
A renewal never deletes the certificate it replaces. Superseded versions are kept with their own issue and expiry dates while your account is open, which is what lets you answer an auditor asking for the declaration that was in force on a past date.
One screen you can read under pressure
A single-screen status view per supplier is built for the moment there is an auditor beside you, not for a quarterly report. The PDF export is the same view with the same labels and badges, so what you hand over matches what you just read on the screen.
Your plant's data stays your plant's
Certly is scoped to a single plant, with plant-scoped isolation on every supplier and certificate query, hosted on Amazon Web Services, and people sign in with email and password. A supplier contact's name and email can be erased on its own from the supplier page, and unused upload links sent to that contact stop working at the same moment.
Honest about where judgement stays with you
Certly tracks dates and reminds people. It does not verify that a certificate is authentic, in scope or acceptable, and it does not guarantee regulatory compliance. The dashboard and the PDF both say so, so nobody mistakes a green badge for an approval decision you have not made.
The same jobs, two ways of doing them
| The job | Spreadsheet and a shared folder | Tracked status board |
|---|---|---|
| Knowing today's position | Open the sheet and trust whoever last updated it | One screen per supplier: current, expiring soon, expired, missing |
| Noticing an expiry | Somebody has to read the dates in time | Status computed from the expiry dates on every load, with thresholds at 90, 60 and 30 days |
| Getting the renewal in | An email you write, then a reminder you meant to send | Chase emails built to go out on your thresholds with a single-use upload link, each send logged with its delivery result |
| Keeping the numbers honest | A supplier you dropped stays on the sheet or gets deleted with its history | Archive the supplier: records and chase history kept, reminders stopped |
| Showing the auditor | Printing from folders while they wait | PDF export of the status view, dated, same labels and badges as the screen |
| Judging the document itself | Your call | Still your call; the product tracks and reminds, it does not verify |
Questions
How do I prepare supplier documents for an unannounced audit?
The preparation that works for an unannounced visit is not a push before a date, because there is no date to push towards. It is holding three things continuously: a written record of which certificate types each supplier owes you, a status computed from the issue and expiry dates rather than remembered, and evidence you can read and export rather than assemble. Certly is built for that loop: supplier records with required certificate types, uploaded certificates with their dates, alert thresholds at 90, 60 and 30 days, a four-state status screen per supplier, and a PDF export of that screen for auditor review.
What does the auditor actually see?
A PDF export of the certificate status view, per supplier, dated with the day it was generated. It uses the same four status labels and badges as the on-screen dashboard, and it carries the line that Certly tracks and reminds on expiry rather than verifying authenticity or guaranteeing compliance. What that document does and does not stand for is covered on the page about handing the auditor the PDF.
Does Certly prove my plant is compliant?
No. It is a certificate tracking and reminder system. It records which documents you require, when they expire and what you have chased, and it shows that position on one screen. It does not check whether a certificate is genuine, whether its scope covers the material you buy, or whether your programme meets a scheme's requirements. Those judgements stay with you and your certification body, and the product states this on the dashboard and on the export.
What happens to a certificate when the supplier sends a renewal?
The new document is held with its own issue and expiry dates, and versions replaced by a renewal are kept while your account is open, because an auditor asking which declaration was valid last March needs the document that was valid then. The page on keeping superseded supplier certificate versions goes into that in detail.
A supplier we no longer buy from is still on the board. What do I do with it?
Archive it. Archiving keeps the supplier's certificate records and chase history, so the trail an auditor might ask about survives, and it stops the reminders, so a supplier you stopped using no longer inflates the expired and missing counts on the dashboard and the PDF.
Do suppliers need an account to upload a certificate?
No. The chase email carries a one-click upload link, and the supplier uploads through a single-use, expiring signed link with no login. The link stops working once it has been used or once it expires. If the contact's personal data is erased from their supplier page, unused links sent to them stop working at the same moment.
Can I change the 90, 60 and 30 day alert points?
Yes. The alert settings screen lists each certificate type with its days-before-expiry thresholds. You can add, edit or remove a threshold per certificate type, or set a plant-wide default. A certificate type that a supplier always takes two months to reissue can carry an earlier first nudge than one that comes back the same week.
What does it cost, and is there a trial?
Starter is $3,228 a year for a single plant tracking up to 50 suppliers. Professional is $5,388 a year for up to 200 suppliers at one site. Multi-site is $10,788 a year for up to 30 sites under one agreement. All are billed annually, which works out at 10 percent off the monthly rate for paying up front. Starter and Professional include a 14-day free trial, and no card is needed to start it.