The Certificate Details a Quality Auditor Checks Before Approving a Pack Supplier

Approving a pack supplier on the QMS certificate alone is how unqualified vendors end up in an approved file. The certificate has to be checked against the issuing certification body's own registry before anything else, its scope statement has to name the process actually being bought — pack assembly, not battery distribution or trading — and the address printed on it has to match the building where cells get welded, tested, and packed, not the sales office or a corporate headquarters. Everything downstream, the internal audit reports, corrective actions, calibration records, firmware revision control, end-of-line test data, only means something once those three checks survive.

I keep a tab order for this and it never changes. Registry first. Certificate PDF second. The supplier's website last, and only to figure out which address is which on a multi-site document.

Start with the certificate number, not the seal

The PDF usually arrives named something like ISO9001Certificate2024.pdf, with a gold seal and an accreditation mark tucked in the corner. It looks like a diploma. That's the point. A certificate is a claim about a management system, and claims get verified from the other end.

So I copy the certificate number off the document, then go to the issuing body's verification portal. If I can't find a portal, I go to the accreditation body's directory or a global certificate database like IAF CertSearch and work backward from the certification body's name and the supplier's legal entity name. What I'm looking for is a status field: active, suspended, withdrawn, expired, or nothing at all.

Nothing at all is the answer I've gotten more than once. Not a mismatch — no record. Sometimes it's a typo in the number. Sometimes it's a certificate that was never issued by the body whose logo is on it. Either way, the review stops there until the supplier explains it.

Two things I've learned to expect from this step. First, registry data lags. A small certification body may not update a suspension for weeks, so an active status next to an expiry date that's already passed means you ask a question rather than assume the best. Second, the legal entity on the registry is often not the name on the purchase order. A parent, a subsidiary, a renamed division. That's not automatically a problem, but it's a question, and the answer belongs in the file next to the certificate.

The scope sentence decides everything

This is the part I see buyers skim, and it's the part that matters most.

A scope statement is negotiated between the supplier and its certification body, and suppliers have an interest in making it broad. So you get wording like "distribution of battery products and related components" or "trading of electronic components and assemblies." That is a real ISO 9001 certificate, fully verifiable, and it tells you nothing about the welding, the BMS configuration, the potting, or the end-of-line test you're about to pay for. Distribution quality management is not assembly quality management.

What I want to see is language that names the process: design and manufacture of lithium-ion battery packs and battery management systems, or assembly and testing of battery packs for [end use]. If the word for your process isn't in there, ask which site and which scope covers your build, and get it in writing.

A few scope details worth pulling apart:

• Standard vs. your requirement. ISO 9001, IATF 16949, AS9100, ISO 13485 — these are not interchangeable. Automotive customers usually want IATF 16949 in the supply chain; medical device work may need ISO 13485 in addition to whatever else is held. A supplier holding ISO 9001 alone may be entirely appropriate for your program, and it may not be. That determination is yours to make before you approve anything.
• Exclusions. IATF certificates frequently carry exclusions, and product design is the common one. If your supplier claims to own the BMS design but design is excluded from the certificate scope, that claim and that certificate are describing two different companies.
• Support-location language. Some multi-site certificates list remote or support locations. Support locations do not do production. If pack assembly happens at a building listed as support only, the certificate does not cover the work.

The address is the tell

Certificates print addresses, and the address is where a lot of reviews quietly go wrong.

Corporate headquarters, a registered agent's office, a sales and demo facility, a contract manufacturer's building, a warehouse — all of these can appear on a certificate, and none of them tell you where your packs get built. On a single-site certificate, the address should be the manufacturing site. On a multi-site document, there's usually an appendix listing each site, and you match the appendix against the site your supplier told you would do the work.

Then the follow-on question, which is the one that actually catches problems: does anyone else touch the pack? If a subcontractor does the wire harness prep, the potting, the conformal coating, or the end-of-line testing, that work isn't inside the certified system unless the subcontractor is listed. Some suppliers handle this well and disclose it upfront. Some don't, and you find out on a plant tour when the assembly line you were told about turns out to be a shipping dock and the real work is two buildings over.

I've had that tour. The certificate was genuine and current. The scope was right. The address on it was the office the tour started in. What was missing was the connection between the document and the physical work, and that connection is the entire point of the review.

Expiry, surveillance, and one word you don't want to see

ISO 9001 certificates run on a three-year cycle with surveillance audits along the way. So a certificate can be perfectly valid-looking and still be headed off a cliff, or already past one.

What I check:

• The expiry date against today. Obvious, and still missed when a certificate gets filed and never looked at again.
• Whether the last surveillance audit actually happened. If a certificate was issued in March two years ago and there's no evidence of any surveillance activity since, ask. Sometimes the client moved certification bodies. Sometimes there's a gap.
• The status word. Suspended is temporary and usually tied to an unresolved nonconformity. Withdrawn is a decision. Expired is a lapse. These are different situations with different conversations attached, and a supplier whose certificate was suspended three months ago for a major nonconformity is a supplier with an open corrective action you should know about.

A short summary of the most recent surveillance report is a reasonable ask. I don't need the full audit package. I need to know whether the audits happened and whether anything major came out of them.

What the certificate can never tell you

Here's the thing that trips up otherwise careful buyers: a QMS certificate is evidence that a documented system exists and has been sampled by a third party. It is not a product safety approval. It is not a cell-level certification. It is not UN 38.3 transport testing, UL 1973, UL 2054, or IEC 62133. Those are separate documents with separate scopes, and conflating them leads to a file that looks complete and isn't.

It's also worth saying plainly: the auditor who certified the QMS may never have opened a BMS firmware repository. That's normal. A management system audit samples process control, not your specific pack design. So the certificate is a floor, not a ranking. Some certified factories are mediocre. Some uncertified shops are excellent. The certificate gets a supplier into the conversation; the records decide whether they stay.

The records that back the certificate up

Once the registry, scope, and address line up, the certificate becomes a pointer to a set of records I want to see. Not the whole binder — a sample, chosen to be hard to fake.

Internal audit reports and schedule. Are internal audits actually happening on a cadence, and are findings closed? An internal audit program that only produces clean reports tells me the auditors aren't looking hard.

Corrective action records. The CAPA log with open and closed items and aging. A supplier carrying a corrective action from eleven months ago with no movement is telling you something.

Management review minutes. Dated, with attendees and actions. It confirms the system is being run rather than maintained for the certificate.

Calibration records. Torque drivers, hipot and insulation resistance testers, the end-of-line test bench, temperature chambers. Calibration is boring right up until the day it isn't.

Then the pack-specific set, which is where a generic ISO 9001 review stops being enough:

• BMS firmware revision control. Which firmware revision ships with which pack part number, how the production line confirms it, and what happens when a revision changes. If the answer is "the engineer loads the latest file," that's a finding.
• Workmanship standards. A named standard the operators are trained against and inspected to — for example an IPC class for the PCBA and a wire-harness standard for the cable assembly. The standard matters less than the fact that there is one, that it's written into the work instructions, and that operators can tell you what it is.
• End-of-line test records with serial-number traceability. The real test of all of this is a single question: pull the EOL record for a specific serial number shipped six months ago. If they can produce it in a few minutes with the test values attached, the system is real. If it takes a day and a half, the system exists on paper only.

Where this lives after approval: the register

The certificate you verified today is aging the moment it lands in the approved supplier folder. That's why the last piece of this isn't a document check at all — it's a register.

Nothing elaborate. A row per supplier, per certificate: what it is, who owns it internally, the current revision, the certificate number, the scope as written, the site addresses covered, the expiry date, and which of your part numbers or programs depend on it. The part-number linkage is the field people skip, and it's the one that makes the register useful — when a certificate lapses, you want to know instantly which builds are affected, not which suppliers are certified.

Two rules make it work. Reminders at 90 and 30 days before expiry, sent to the owner, not to a shared inbox. And an automatic status flip: when a certificate expires and the renewed one hasn't been verified, the supplier's status in your system goes to conditional rather than staying at approved. Otherwise you have a supplier shipping on a lapsed certificate, and the only thing that noticed is a spreadsheet nobody opened.

That's the whole review, really. Verify the claim at the source, make sure the claim covers the work you're buying, confirm the work happens where the document says it does, and then keep the record alive so it can't quietly rot. The certificate gets you started. The register is what keeps you honest.