Third-party audit certificate
A third-party audit certificate is the document a supplier gives you to show that an independent certification body audited its site against a food safety standard and issued a result. For a QA manager it is usually the first document an auditor asks to see in the approved supplier file, and the one most often found out of date.
What a third-party audit certificate is
A third-party audit certificate is the document a certification body issues to a supplier after auditing that supplier's site against a food safety standard, stating which site was audited, which standard and version it was audited against, what result was given, and the date the certificate stops being current.
The word third-party carries the meaning. A first-party audit is the supplier auditing itself. A second-party audit is you, the customer, auditing the supplier. A third-party audit is carried out by an independent certification body, which is why the certificate is the piece of paper a scheme auditor treats as evidence rather than as a claim.
Usually printed on the certificate
- The certificated site, by name and address
- The standard and its version or issue, for example schemes such as BRCGS, SQF or FSSC 22000
- The scope of the audit, meaning the products and processes covered, and anything excluded
- The result, grade or score the audit returned
- The audit date, the issue date and the expiry or recertification date
- A certificate number and the name of the issuing certification body
An example
A spice supplier emails you a one-page PDF. It names a site in a different town from the head office on your purchase orders, it covers dried herbs and spices but not the blending line your product uses, and it expires in eleven weeks. All three details are things you would want recorded against that supplier rather than left in the attachment, because each one changes what you can show an auditor who asks about that ingredient.
Why the expiry date is the part that bites
An audit certificate is only evidence about the day it was issued. It carries its own expiry or recertification date, and once that date passes the document on your file is a historical record, not current evidence of certification.
That is where supplier files tend to fail. The certificate was collected properly during onboarding, filed properly, and then nothing happened for a year while the certification body reaudited the site and issued a new one that nobody asked for. An auditor opening the folder finds a document that reads as complete until they look at the date in the corner. A non-conformance raised on an expired certificate is an administrative finding with a real cost, because closing it out means chasing the supplier under time pressure and, depending on the finding, paying for the auditor's time again.
The practical answer is not a better folder. It is a date you are reminded about before it arrives, and a named contact at the supplier who gets asked for the renewal while there is still time to send it.
What to read on a certificate before you file it
| Field | What to read it for |
|---|---|
| Certificated site | Certification covers a site, not a company. Check it is the site your deliveries actually come from. |
| Standard and version | The scheme and issue recognised by your own standard, recorded so you can answer which version applied. |
| Scope and exclusions | The products and processes audited. An exclusion that covers your ingredient is the detail most often missed. |
| Result or grade | Recorded as the outcome of that audit on that date, not as a verdict on the material you buy. |
| Issue and expiry dates | The expiry date is what your reminder schedule should be built from. |
| Certificate number and body | What you quote if you want to confirm the certificate directly with the issuing certification body. |
Related terms
A third-party audit certificate sits alongside several other documents in a supplier file, and they are frequently confused with each other.
- Certificate of analysis (CoA), a lab result for a specific batch or lot of material, not a statement about the site. One supplier produces many of them.
- Allergen declaration, the supplier's own statement of which allergens are present, handled or cross-contact risks at the site. It is first-party, which is why it is treated differently from an audit certificate.
- Supplier approval questionnaire, the form you send the supplier to collect information you cannot get from a certificate.
- Approved supplier list, the register of suppliers you have approved and the evidence behind each approval, which an audit certificate feeds into.
- Non-conformance, the finding raised when the evidence an auditor asks for is missing, expired or out of scope.
- Document control, the discipline of knowing which version of a document is current and who holds it.
The sibling pages in this glossary cover the CoA, the allergen declaration, the approved supplier list and the approval questionnaire in their own right, and the documents guide sets out the full set to collect from a new supplier.
Questions
Is a third-party audit certificate the same as a certificate of analysis?
No. An audit certificate is about the supplier's site and is issued by an independent certification body after an audit. A certificate of analysis is a test result for one batch of material, produced by or for the supplier. You normally hold one audit certificate per site and a CoA per delivery or lot.
Who issues a third-party audit certificate?
A certification body, independent of both you and the supplier, which audits the site against a published standard and issues the certificate with its own name and a certificate number on it. The supplier does not issue it, which is the point of the word third-party.
How often do I need to collect a new one?
The certificate states its own expiry or recertification date, so that date sets the schedule rather than a fixed rule of yours. The practical pattern is to ask the supplier for the renewal a few weeks before expiry, because the new certificate is often issued close to the end of the cycle.
Does a current certificate on file mean the supplier is compliant?
It means an independent body audited that site on a date and issued that result for that scope. It is evidence you hold, not a running guarantee about the material delivered to you this week, and your own supplier approval procedure decides what else you need alongside it.
What if a supplier is not certificated at all?
Then there is no audit certificate to collect, and the approval rests on whatever other evidence your procedure accepts, such as a completed approval questionnaire, your own second-party audit, or a documented risk assessment. The gap itself is worth recording so it is visible rather than silently empty.
Can software confirm a certificate is genuine?
Not on its own. Checking authenticity means going back to the issuing certification body or its register. Certly is built to track which certificate types you require, store the documents, and remind you before an expiry date passes; it does not verify authenticity or guarantee compliance.