Expired certificate on file
An expired certificate on file is a supplier document sitting in your records with a validity date that has already passed on the day the auditor opens the folder. Auditors raise it as a non-conformance because the document is evidence of nothing current, and it is harder to spot than a gap, since the paperwork looks complete until someone reads the date.
What an expired certificate on file means
An expired certificate on file is a supplier certificate that is present in your records but past its expiry date, so the approval it was meant to evidence is no longer supported for the period the auditor is looking at. The certificate is usually an allergen declaration, a certificate of analysis, a third party audit certificate or an insurance or accreditation document. Nothing is lost and nothing was ever refused by the supplier; the date simply moved past while the file stayed where it was.
The reason it keeps happening is structural. Certificates arrive once, by email, often from a different person at the supplier than the one you deal with day to day, and they are filed in the state they arrived in. Nothing in a folder or a spreadsheet row changes on the day a certificate lapses, so the record keeps presenting as complete.
A worked example
A packaging supplier sends a twelve month audit certificate issued on 12 March. It is saved to the approved supplier folder and the row is marked complete. The certificate lapses on 11 March the following year. Your unannounced audit falls on 20 April. The folder contains a certificate, the spreadsheet says the supplier is approved, and the auditor reads the date and writes a non-conformance against a document you had held for thirteen months.
Why it is written up as a non-conformance
The main food safety certification schemes, including BRCGS, SQF and FSSC 22000, require a supplier approval and monitoring programme supported by records. An expired certificate on file does not satisfy that, because the record is no longer evidence of the thing it was collected to prove. Document control adds a second angle: records held as current evidence are expected to actually be current.
Whether it lands as a minor or a major finding is the auditor's judgement, shaped by the scheme, how many suppliers are affected, whether the certificate relates to a control you rely on such as an allergen declaration, and whether you could show that anyone had noticed. One lapsed insurance certificate reads differently to eleven lapsed allergen declarations with no chase trail behind them.
The part that costs the most time is the close out. A renewed certificate answers the instance, not the root cause. Auditors commonly ask what will stop it recurring, which means describing a method for seeing expiry dates in advance and a record of the chasing you did, and then having the same answer hold at the next visit.
Expired, missing and expiring soon
| Status | What the record holds | What it looks like at audit |
|---|---|---|
| Current | A document whose expiry date is still ahead | Evidence of approval for the period being examined |
| Expiring soon | A document still valid, inside your chase window | Acceptable now, and a question about what happens next month |
| Expired | A document present but past its expiry date | A non-conformance on a file that looked complete |
| Missing | No document at all for a required certificate type | A visible gap, usually easier to spot before the auditor arrives |
Related terms
- Non-conformance (NC): a finding raised at audit where practice or evidence does not meet a clause of the standard, graded by the auditor, typically minor, major or critical depending on the scheme.
- Corrective action and CAPA: the response to a finding, covering the immediate fix, the root cause and the preventive change, which is what gets closed out before certification is confirmed.
- Approved supplier list: the register of suppliers cleared to supply you, and the document an auditor samples from when asking for certificates.
- Missing certificate: a required certificate type with no document at all, distinct from expired because there is nothing on file to mislead you.
- Document control: the discipline of knowing which version of a record is current and who holds it, the clause family an expired certificate often falls under alongside supplier approval.
- Unannounced audit: an audit with no agreed date, which removes the pre-audit week most plants use to catch lapsed certificates.
If you are deciding how to prevent the finding rather than define it, our comparison of four ways to track supplier certificate expiry dates sets out what a spreadsheet, a calendar, a shared inbox and a tracking tool each cost you. The chase log page covers the evidence side, showing what was actually sent to a supplier and whether it was delivered.
Questions
Is an expired certificate on file a major or a minor non-conformance?
That is the auditor's call, against the scheme being audited. The factors that usually push it upward are the number of suppliers affected, whether the document supports a control you depend on such as an allergen declaration, and whether there is any evidence you had noticed and acted. We cannot tell you how a specific auditor will grade a specific finding.
What is the difference between an expired and a missing certificate?
A missing certificate means no document exists for a required type, so the gap is visible in your own records. An expired certificate means the document is there and the date has passed, which is why it survives a quick pre-audit check: the file looks complete and only the date disagrees.
Can I fix it during the audit by getting the supplier to send a new certificate?
Sometimes an auditor will accept a current certificate produced on the day, and sometimes the finding stands because the record was not current at the time of sampling. Either way the close out normally asks for a root cause and a preventive method, not just the replacement document.
How far ahead should I start chasing a renewal?
Reasoning from how renewals actually work, a supplier's third party audit certificate may be reissued only after their own audit, which they may not have booked, so a 30 day warning can be too late. A first reminder around 90 days, with follow ups at 60 and 30, leaves room for the supplier's own timetable to slip.
Does an expired certificate mean the supplier is no longer approved?
It means your evidence of approval has lapsed, which is not the same as the supplier having lost their accreditation. Often the certificate was renewed on time and simply never reached you. Your record is the thing the auditor is examining, so the record is the thing that needs to be current.
Can Certly tell me whether a certificate is genuine?
No. It is built to track what you hold, when it expires and who was reminded. Verifying that a certificate is authentic, and judging whether it satisfies your standard, stays with your QA team and your certification body.