How to track supplier certificate expiry dates

Every workable system does the same three things, whatever it runs on.

• It holds one record per supplier and per certificate type, with the date that record falls due on it.
• It turns that date into a status, rather than asking somebody to keep a status column honest by hand.
• It raises the ones getting close on a rhythm you do not have to remember, and turns that signal into a message to the supplier contact who can actually send the new document, early enough that a slow certification body does not become your problem.

Most plants already have the first part. The record exists somewhere, usually a spreadsheet on a shared drive with a column for expiry. What fails is the second and third. The sheet only speaks when somebody opens it, and the chase depends on a QA manager having a quiet Tuesday. That is why certificates expire on file rather than in reality: the supplier was recertified in March, and nobody asked for the new PDF until the auditor did.

So the real decision is not how to store dates. It is how much of the looking and the chasing you are prepared to carry personally, and what happens to that work in the week you are on holiday or covering a line trial. The four methods below are in rising order of how little you have to remember.

Three kinds of document land in the same folder and behave completely differently. Mixing them is the first reason a tracker drifts.

Certificates with a hard expiry

Third party audit certificates, product liability insurance, organic and religious certification. These carry a printed valid-to date. They are the easiest to track and the most uncomfortable to be caught without, because you cannot produce one at short notice. The supplier has to be audited, and their certification body sets the date.

Documents with a review date rather than an expiry

Supplier allergen declarations, vendor forms and specifications often carry no printed expiry at all. Your approved supplier programme gives them one, usually annual, sometimes three years from the date on the form. The tracker still needs a date, so the cleanest arrangement is to record the issue date that the document does carry and hold a renewal period per certificate type, so the due date is derived rather than typed from memory. The sibling page on renewal periods for documents with no printed expiry goes through how that works in practice.

Documents tied to a consignment

A Certificate of Analysis belongs to a batch, not to a year. Chasing a CoA is goods-in work, not calendar work. If you put CoAs into the same rolling expiry list, you will generate reminders nobody can ever close, and the list stops being trusted. Track them per delivery and keep the expiry list for documents that renew.

Sort your required documents into those three groups before you build anything. The first two belong on the expiry tracker. The third belongs to receiving.

This is how most plants start and it deserves more credit than vendors give it. A sheet with supplier, certificate type, expiry date, file location and last chased is free, needs no approval, and every person who covers for you can read it without training. Conditional formatting on the date column turns cells amber inside ninety days and red past expiry, and a filter on that column gives you a working week's task list in one click.

What it cannot do is anything on its own. The sheet has no way of telling you that something turned amber overnight, so the control is not the formatting, it is your habit of opening the file. Habits break during a recall, a new line commissioning, or annual leave, and that is precisely when a certificate lapses. The other weaknesses are quieter: copies of the file multiply, the last chased column decays because updating it is nobody's favourite job, and there is no evidence trail showing you asked a supplier three times before their certificate ran out.

If you stay with a spreadsheet, do two things. Put a recurring thirty minute review in your diary and treat it as a scheduled task with a named deputy, and keep a dated note of every chase you send, because that record is what turns a lapse into a managed non-conformance rather than an oversight. If you have already decided the sheet has run out of road, the sibling page on retiring the supplier certificate spreadsheet covers what moving the records across actually involves, so this guide stays on the comparison.

The second common approach is to push each date into a calendar or task list: an appointment ninety days before the audit certificate expires, a recurring task for the annual allergen declaration, a mailbox rule filing supplier replies into a folder. It has one real advantage over the spreadsheet, which is that it comes to you rather than waiting to be opened.

The costs show up quickly. Each certificate needs its own entry, created by hand, and every renewal shifts the date, so maintaining the calendar becomes a job of its own. Entries live in one person's account, which means cover during absence is guesswork. There is no overview at all, so you can answer the question "what is due next month" but not "how many suppliers are currently non-compliant with our own document requirements", which is the question that matters when someone senior asks how exposed the plant is.

And a calendar is not showable. An auditor sampling three suppliers wants current documents and a defensible process, not a screenshot of Tuesday. Calendar reminders work best as a thin safety net over the top of a real record for your highest risk suppliers, not as the record itself.

The category above spreadsheets is the broad food safety and quality platform, where supplier documents are one module beside HACCP plans, internal audits, CAPA, specifications and traceability. If your plant is already running those processes in one of these systems, adding certificates there is usually the right answer, because the supplier record already exists and your auditor already knows where to look.

The trade-off is proportion. These platforms are built for programmes with procurement teams, multiple sites and technical managers who own configuration, so the implementation is a project rather than a task: data mapping, user roles, workflow decisions and often a consultant. The pricing and the contract length follow that scope. For a mid-market plant whose actual problem is one hundred and twenty suppliers and a folder of PDFs, most of what you buy sits unused, and unused configuration tends to get abandoned rather than maintained.

Worth asking honestly before you commit: are you solving certificate expiry, or are you replacing your whole quality system? Those are different budgets, different timelines and different internal conversations. If it is genuinely the whole system, the platform route is sound. If it is certificates, you will get there faster with something narrower and can always migrate the document records later, because they are only suppliers, types, dates and files.

The fourth option does one job: it holds suppliers and their required certificate types, stores the documents against them, watches the dates, and chases the supplier contact when one approaches. There is correspondingly little to decide when you set it up, because there are only three things to configure: the suppliers you actually buy from, the certificate types each one owes you, and the thresholds at which chasing starts. The value sits in the part a spreadsheet cannot do, which is acting on a date rather than waiting to be read.

What you should expect from anything in this category:

• Status derived from the date on the record and recomputed every time the list is read, rather than a status column somebody types and forgets, so the screen is right the first time you open it after a fortnight away.
• A way to handle documents with no printed expiry: an issue date captured on upload and a renewal period held per certificate type, so the due date follows your own programme rather than a guess.
• Thresholds you can set per certificate type, with a plant-wide default behind them, so an audit certificate gets a longer runway than a signature.
• Chase emails sent to the supplier contact for certificates approaching expiry or already lapsed, each send logged with its result, so a bounce reads as a bounce and not as contact made, with a resend to hand.
• A manual chase on any row for the week you want to push one supplier now, and a way to copy that supplier's upload link and send it yourself when email is not the route that works with them.
• Your own site's name on the chase email and the PDF header, so the supplier knows who is asking and the auditor knows whose records they are reading.
• Superseded documents kept rather than overwritten, so a renewal does not erase the version that was valid last spring.
• A single screen showing every supplier's position as current, expiring soon, expired or missing, and an export you can hand over without assembling anything. The sibling glossary page on the four certificate states sets out what each one means and when it changes.

Be clear about the limits too. A tracker of this kind is not a quality management system. It will not hold your HACCP plan, run your internal audit schedule or manage corrective actions, so you will be running it alongside whatever you already use for those. Practical limits matter as well: documents go in as PDF, PNG or JPEG, and a file over 4 MB has to be compressed first, which a long multi-page scanned audit certificate sometimes needs. And it cannot tell you whether a certificate is genuine or whether its scope actually covers the material you buy. That judgement stays with QA. What it removes is the remembering and the chasing, which is where the hours go. The sibling pages on supplier certificate tracking software for QA managers go further into what that daily use looks like at a desk, and the page on the chase log covers reading each send as sent, opened or failed per supplier.

Thresholds are the part people set carelessly and regret. Work backwards from how long a renewal genuinely takes at the supplier's end, not from how much notice feels polite.

Ninety days. This is the only threshold that gives you options. If a supplier's recertification audit has not been booked yet, ninety days is roughly the window in which they can still book it, and it is also the window in which you can start qualifying an alternative supplier if the answer is vague. A first contact here is informational: your certificate expires on this date, please confirm your renewal audit is scheduled.

Sixty days. The message gets specific. You are now asking for a date, and recording the answer. Most certificates that eventually lapse were already ambiguous at sixty days, and the tell is usually a contact who has left, so this is also the point to check you are writing to a person who still works there.

Thirty days. This is escalation, not reminder. Copy the commercial contact, and decide internally what happens at goods-in if the date passes: quarantine, additional testing, a sourcing switch, or an accepted and documented risk with a defined review. Deciding that in advance is what keeps a lapse from becoming a scramble.

Different certificate types deserve different sets. An allergen declaration only needs a signature, so a shorter lead is fine, and where its due date comes from a renewal period rather than a printed expiry, the lead should sit inside that period comfortably. An audit certificate depends on a third party's diary, so ninety days is the minimum useful warning. The point of thresholds you can configure per certificate type is that you tune the noise down to the level your team will keep reading, and the plant-wide default covers everything you have not thought about yet. Whatever you choose, change the numbers once and check the counts move: a threshold set is only real if the list in front of you reflects it.

Auditors rarely ask to see your tracker. They sample. They pick two or three suppliers off your approved list, ask for the current documents you said you hold, and then ask the question that decides how the rest of the visit goes: how do you know when these expire, and show me what happened last time one did.

That is a question about process, not storage. A folder of correct PDFs answers half of it. The other half needs a record of dates, thresholds and requests, which is why the chase log matters more than the filing structure. If you can show that the system flagged a certificate ninety days out, that three emails went to the supplier on dates you can read out, that each one was delivered, and that the renewed document is on file, a late certificate becomes evidence of a working control rather than a gap. The sibling page on whether chase emails reach supplier inboxes goes into how you would know that rather than assume it.

The awkward follow-up is historical: which allergen declaration was valid in March, when you made the batch under review. Any system that overwrites the old file in place cannot answer that, so decide early that renewals are kept as versions rather than replacements, that expired certificates and chase history stay while the account is open, and that archiving a supplier you no longer buy from keeps its records while stopping its reminders.

The scheme owners publish their own supplier approval and monitoring requirements, and those documents, not a software vendor, are what your certification body audits you against. Read yours, decide what your programme requires per supplier, and then pick the lightest method that can hold it without depending on your memory. A spreadsheet that gets reviewed every week beats a platform nobody maintains. A tracker that chases on its own beats both, mainly because it keeps working during the weeks you have something more urgent than certificates in front of you.