Audit-ready evidence pack
An audit-ready evidence pack is the set of supplier documents, with their issue and expiry dates and their current status, that you can put in front of an auditor without leaving the room to look for anything. This page defines the term as QA teams in food plants actually use it, and sets out what belongs in a pack and where packs fall apart.
What an audit-ready evidence pack is
An audit-ready evidence pack is the set of supplier documents, with their issue and expiry dates and their current status, that you can hand an auditor without going looking for anything. It is not a defined term in any certification scheme, it is the working phrase QA teams use for the folder, spreadsheet or export that answers the supplier approval part of an audit in one pass.
The term exists because of the way the question gets asked. An auditor rarely wants a tour of your filing system. They take a supplier off your approved list, ask for the allergen declaration, the certificate of analysis or the copy of that supplier's own third-party audit certificate you hold, and look at the date. Then they pick another supplier and do it again. A pack is whatever lets you answer that sequence at the speed it is asked. What usually breaks it is not the absence of a system, it is one certificate that lapsed in March while everyone was busy, and a chase email nobody sent.
An example
Say a plant buys from sixty suppliers and requires three documents from each: an allergen declaration, a CoA and a copy of the supplier's audit certificate. That is one hundred and eighty documents, each with its own expiry date, arriving by email from sixty contacts who have no reason to remember your renewal schedule. An audit-ready evidence pack for that plant is a single view that says, per supplier and per document type, whether the document you hold is current, expiring soon, expired or was never received at all, together with the documents themselves.
What a pack has to carry
| Part of the pack | What the auditor is checking | Where packs usually break down |
|---|---|---|
| The list of suppliers and what each must supply | That the requirement was defined, not decided after the fact | The required document types live in one person's head |
| The document itself | That the certificate exists and relates to the material supplied | The file is in an inbox thread, not in the pack |
| Issue and expiry dates | That what you hold was valid on the day it mattered | A date is recorded once and never looked at again |
| Status per supplier and document type | That you know, without checking, which documents are lapsed or absent | Nothing distinguishes expired from never received |
| Evidence of chasing | That a gap was being worked, not ignored | Reminders were verbal, so there is no trail |
What an evidence pack does not prove
A pack shows what you hold and when it expires. It does not make a certificate genuine, it does not confirm that the certifying body is accredited, and it does not stand in for the judgement a QA manager applies when approving a supplier. Those checks stay with you.
This matters for how you talk about tooling as well. Software that collects dates and sends reminders is a tracking and reminder system. It reduces the chance that a document lapses unnoticed; it cannot read a PDF and tell you the audit behind it was real, and it cannot guarantee a scheme outcome. Keep that line clear in your own procedures, because an auditor who finds a tool being treated as an assurance will treat the whole approach as weaker than it is.
Related terms
- Document control. The wider discipline of knowing which version of a document is current and who may change it. An evidence pack is document control applied to one category, supplier certificates.
- Approved supplier list. The register of suppliers you have accepted and the conditions of that acceptance. The pack is the evidence behind each entry.
- Non-conformance. The finding an auditor raises when the evidence is not there. An expired certificate on file is a common and entirely avoidable one.
- Corrective action. What you commit to after a finding, and the close-out evidence that follows. A pack that shows dates and chase history makes that close-out shorter to write.
- Unannounced audit. An audit with no date to prepare for, which is the test of whether your pack is current all year or assembled the week before.
- CoA, allergen declaration, audit certificate. The three documents most often requested from a food supplier, each with its own renewal cycle.
Questions
Is an audit-ready evidence pack the same thing as document control?
No. Document control is the broader practice covering every controlled document in the plant, including your own procedures and specifications. An evidence pack is the supplier certificate slice of it, assembled so it can be shown on demand.
Can a spreadsheet be an audit-ready evidence pack?
It can, as long as the dates in it are true on the day of the audit and the documents themselves can be produced. The weakness of a spreadsheet is not its format, it is that nothing in it tells you a date has passed unless somebody opens it and reads every row.
Does the pack need expired certificates in it?
Keeping superseded versions is usually worth it, because an auditor may ask what you held on a date in the past rather than what you hold today. A pack that only ever shows the latest document cannot answer that question.
Does certificate tracking software make a plant compliant?
No, and no honest tool will say otherwise. Tracking software records expiry dates, shows status and sends reminders. Verifying that a certificate is authentic and deciding whether a supplier is acceptable remain the QA team's work.
How often should the pack be reviewed?
Often enough that no certificate reaches its expiry date without somebody having seen it coming. In practice that means a view you can check in minutes rather than a review you schedule, which is why thresholds set months ahead of expiry are more useful than an annual sweep.