Does That ISO 9001 Certificate Cover Your Battery Pack Line?

An ISO 9001 certificate covers your battery pack line only when four things on the document line up: the scope statement names battery pack assembly as a certified activity, the site address printed on the certificate is the address where your packs will actually be built, the certificate is in good standing today, and the issuing certification body is accredited for that kind of work. Certificates miss at least one of those checks far more often than buyers expect. Until all four line up, the PDF is a document, not evidence.

Read the scope statement first. Out loud.

I print it. Paper on the left, browser on the right, and I go down the page a line at a time with a highlighter, because the difference between one word and another word on this document is the entire question.

The scope sentence is where I start, and the activity verb is where I start inside it. "Manufacture," "assembly," "production" — those describe a factory. "Distribution of," "supply of," "sales of," "trading of" — those describe a company that moves product. I have seen certificates with clean layout, correct dates, a real accreditation mark, and a scope line that says, in effect, we warehouse things. That certificate isn't lying. It's answering a different question than the one sitting in your supplier file.

Next, the product noun. What you want somewhere in that sentence is a phrase like "lithium-ion battery packs" or "secondary lithium battery pack assembly." What you often get instead is "electronic assemblies," which may or may not contain your pack depending on who wrote the wording and how the audit was scoped. The scope statement gets drafted by the certification body with the supplier's input, and any sensible supplier pushes for the broadest wording that can be defended. Broad wording isn't fraud. It's normal. It just means the sentence stops proving anything specific, and you have to go ask a follow-up question.

Then the caveats. Design is the one that bites. A certificate that excludes design, or that describes the site as non-design responsible, is telling you that facility builds to a drawing. That's fine if your program already has the drawing. It's a problem if you're expecting joint development, or if you're handing over a rough specification and assuming the supplier's engineers will solve it. Better to find that out during RFQ than in a change-order meeting eight months later.

And then the commas. Long scope statements are lists, and if battery packs are item four of six, I want to know which physical line runs item four and whether the audit sampled it. The certificate won't tell me. The supplier's quality manager will, on a call, if I ask a specific enough question.

A scope statement is a sentence about a management system applied to an activity. It is not a product listing and it is not a capability statement. Most of the disappointment in this whole exercise comes from forgetting that.

Then the address. All of it.

The certificate is issued to a legal entity at a site. I find the address field and read it the way I'd read a shipping label, because that's basically what it is.

The failure mode here is rarely a forgery. It's a mismatch. The certificate belongs to the parent company's headquarters, or to a sister plant two hours away, or to the site that used to run the pack line before it moved. All three of those PDFs look clean. All three are real certificates. None of them is about the building your packs will come out of.

Multi-site certificates make this harder, and they're common in this industry. A corporate certificate with a schedule or annex of addresses means each listed site falls within the certification, but the scope can differ from site to site, and a site can be listed for a narrower set of activities than the main certificate suggests. So I don't just check that my supplier's city appears in the annex. I check what the annex says that site does, reading it with the same suspicion I gave the main scope line.

Then I line the address up against everything else: the QMS documents, the business registration, the shipping paperwork, the address on the quote. When those four disagree, one of them is stale, and stale documents are how you end up auditing the wrong factory.

The mark, the number, and the twenty minutes that make this real

An accreditation mark on the certificate means the certification body that issued it was itself accredited to issue it. That's worth something. It is not a statement about your pack, and it does not make the scope wording true. The mark and the scope are two separate things on the same page, and buyers conflate them constantly.

Verification takes about twenty minutes and it's the part people skip. First, the issuing body's own public certificate search. I enter the certificate number and compare what comes back to the PDF field by field: legal name, site address, exact scope wording, standard, issue date, expiry date, current status. Second, the accreditation body's registry, to confirm the issuing body is accredited for ISO 9001 and, where the registry publishes it, for the technical area your product sits in. A body accredited for food processing and construction is not automatically the right body for electrical equipment.

There is no single global ISO 9001 registry. Every certification body runs its own search, and the accreditation bodies publish the lists of bodies they accredit. That's why you check two places instead of one.

Comparing the PDF against a registry entry sounds like busywork until you actually do it. Page two of the scan missing. A scope line that picked up a phrase somewhere between the registry and the photocopy. A certificate number that doesn't match the numbering pattern of everything else that body has issued. None of that is common, but all of it is visible in a side-by-side comparison and invisible if you just open the attachment and nod.

And then the thing the PDF can never show you: status. A suspended certificate still prints with a future expiry date. A withdrawn certificate still looks like a certificate. If the answer matters to an award decision, I email the certification body's office with the number and the site and ask for current standing in writing, then put that reply in the file. It's a five-minute message, and it is the difference between a document and a verified fact.

Dates, surveillance, and the fact that this expires on you

ISO 9001 certificates run on a three-year cycle, with surveillance audits at least annually and a recertification audit before the expiry date. So three dates matter: issue, expiry, and the most recent surveillance. A certificate past its expiry date is expired until a new certificate appears. A certificate with a future expiry date can still be suspended, withdrawn, or placed on a shortened surveillance schedule after a nonconformity.

The other thing I've learned the hard way is that the document in the sales folder is often older than the certificate that exists. Suppliers get recertified, the number changes, and the old PDF keeps circulating because updating the marketing packet isn't anybody's job. Ask for the current certificate, with the current number, every time you start a new program.

Then put the re-check into your own system, because the supplier's system won't do it for you. Certificate number, issuing body, site address, expiry date, next surveillance window, and a reminder thirty days before expiry. Your supplier's certificate will expire somewhere in the middle of your production ramp. It always does, and the failure is almost never the supplier's fault. It's the buyer's file with no trigger in it.

Where IATF 16949 changes the question

If your packs end up on a vehicle manufacturer's production line, IATF 16949 enters the conversation and the request changes shape. It's written for automotive production and service parts, it sits alongside ISO 9001 rather than replacing it, and it's certified per site with its own scope statement. It also separates design-responsible sites from non-design sites more explicitly than ISO 9001 does, which matters if your program leans on the supplier's engineering.

For an e-mobility program, the certificate usually isn't there. E-bikes, scooters, and a lot of light electric vehicles don't sit inside the automotive definition that drives IATF, and an honest supplier in that world says, we hold ISO 9001, here's the number. A supplier who answers an e-mobility RFQ with an IATF claim but no certificate number and no site is telling you something about how they'll handle harder questions later. For industrial programs — stationary storage, medical carts, floor equipment — the driver is usually the end market's regulatory scheme or your own customer's requirement, not IATF at all.

Neither certificate replaces a factory audit. Not ISO 9001, not IATF. A certificate says a third party examined a management system at a named site within a defined window and found it conforms to a standard. It says nothing about whether the pack line's process controls are current, how incoming cells get verified, what traceability exists from cell lot to shipped pack, or what happens when a cell lot is recalled. That's the audit, and it's still yours to run.

The three documents that come in wrong, and what I do

A parent-company certificate: I reply and ask for the certificate issued to the site that will build my packs, with its number and issuing body. If they can't produce it, I have my answer about how the relationship would go.

An expired certificate: I ask when recertification is scheduled and whether a surveillance audit is currently open. Being mid-cycle is normal and not disqualifying. A PDF that lapsed eighteen months ago with nobody noticing is a different kind of signal, and I want it explained in writing before I spend another hour on the supplier.

A certificate issued to a trading entity: a perfectly legitimate arrangement, but the certificate describes the trading company's management system, not the factory floor. I ask for the factory's own certificate, and if there isn't one, I ask who audits the factory on my behalf and against what standard.

What actually goes in the file

One page per supplier. Certificate number, issuing body, accreditation reference, certified site address, the scope wording copied exactly as printed, issue date, expiry date, the date I verified it, and the name of the person at the issuing body who confirmed status if I went that far. That page turns a stack of PDFs into something re-checkable in ninety seconds, and it survives the sales contact who moves to a different company next quarter.

The certificate isn't the deliverable. The deliverable is four questions you now ask at RFQ stage, in writing, before tooling money leaves the building: what is the exact scope wording, what site address will build this, what is the current certificate number and standing, and which accreditation body stands behind the one that issued it.