An ISO 9001 Certificate Does Not Qualify a Pack Supplier

An ISO 9001 certificate does not qualify a pack supplier. It records that a management system at a named address was audited against a written scope — and until that scope line names battery pack assembly, that address matches the plant that will actually build your packs, and the certificate number comes back live on the issuing body's registry, you have confirmed nothing about the supplier sitting across from you.

I want you in the room with me. Small conference room off a plant floor, glass-topped table, three capability decks nobody will read, and the certificate in a black frame on the wall behind the quality manager's chair. He points at it before anyone sits down. That frame has done a lot of work for a lot of suppliers, and I don't argue with it. I ask for the PDF.

That's the whole move. The framed copy is decoration. The PDF is a document, and a document gives me three things to check: a scope paragraph, an address, and a number.

Read the scope line before anything else

The scope statement is where the certificate either says something about your program or says nothing at all. It's usually one sentence, printed small, and it's the part nobody thinks to photograph.

The exact wording differs supplier to supplier, but the shapes repeat. "Design and manufacture of lithium-ion battery packs for industrial equipment" speaks directly to a pack program. "Assembly of battery packs and battery assemblies" is narrow but relevant. "Manufacture and sale of electronic products" is wide enough to cover almost anything, which is another way of saying it covers nothing in particular. "Trading of lithium-ion cells and battery packs" tells you the audited process is buying and reselling, not putting tabs on cells. "Design and development of battery management systems" describes engineering work, and the plant that builds your pack may be an entirely different entity.

Those are illustrative shapes, not quotes from your supplier's file. Open the actual sentence and read it slowly.

None of these are accusations. A trading scope can be perfectly honest. The mismatch is in how buyers read the paper: we treat the certificate as a statement about the product, and it is a statement about a management system operating inside a described boundary. My job in that room is to find out whether the boundary contains the work I'm buying.

Underline the verbs. Design. Manufacture. Assemble. Test. Sell. Distribute. The verbs that appear are the ones that were audited. The verbs that are missing are the ones you'll have to verify another way — a process audit, a sample build, test reports on your own pack.

There's a second line worth reading twice: the exclusions. Some certificates carry a note about what the scope does not include — a design function held at a parent company, a warehouse, a distribution arm. That note is often the most honest sentence in the entire package.

The address problem

This is the one that has burned me.

The certificate looks right. The scope mentions battery pack manufacture. The company name matches the one you're negotiating with. Then I put the address on the certificate into a browser and find it's the corporate office, two hundred miles from the plant that will actually run my build. The certificate belongs to an entity doing engineering and sales. The manufacturing site has its own certificate with its own number, or it has none and is operating under the corporate system on the assurance that it's "covered."

Multi-site certificates make this more confusing, not less. A body can issue a certificate with an annex listing several locations, and the annex may describe one as manufacturing and another as a sales office or a support function. Your plant might be on the list. It might be on the list under a name that doesn't match the purchase order, because the plant is a subsidiary. It might be absent because the site was added after the last audit cycle closed.

Two questions cut through all of it. Which building, by street address, will make my packs? And is that building covered, right now, by a document I have read?

If a supplier moves your program to a different plant after you qualify — and that happens once the first volume commitment lands and capacity gets tight — the evidence you collected is no longer about your product. That's not a certificate problem. It's a change-control problem, and the fix belongs in your supply agreement, not in the quality file.

Then pull the number

Every certificate carries a number, and every number traces to the body that issued it. Most certification bodies publish a searchable registry, and in my experience they generally accept either a certificate number or a company name plus a country.

What I look for on the result page:

• Status. Active, suspended, withdrawn, expired. This single field is the reason to bother doing the search.
• The expiry date as printed, not the date in the supplier's cover email.
• The scope text the registry shows. Compare it word for word with the PDF you were handed. If they differ, you have a document that has drifted.
• The sites listed under the certificate.
• The standard revision. The year on the certificate should match the version currently in force. An older revision isn't fraud — certificates move on their own audit cycle — but it tells you how long it's been since anyone read the document.

The suspended case is the one buyers miss. A suspension does not generate a new PDF. The copy in your inbox still looks flawless, because it's a copy of something that was true last quarter. The registry is the only place that knows.

When the status reads expired, I don't walk away. Plenty of suppliers let a renewal slip a few weeks, and the real question is whether the audit happened and the paperwork is in the queue. Ask for the recertification date, ask who their contact at the body is, and put a written date on the file to check again. If the answer is vague in a way that suggests nobody has a date at all, that's information too.

If the pack goes into a vehicle, ISO 9001 is answering the wrong question

I keep these separate in my head. ISO 9001 is a general quality management system certificate. It says a system exists and was audited to a scope. It does not say the system was built around automotive product development, part approval discipline, or the change control a vehicle program runs on.

Where the pack feeds an automotive OEM program, IATF 16949 is the certificate I expect to see, and it carries the same three properties: a scope, a site, a number checkable in the scheme owner's public database. Same exercise, higher bar. For an industrial pack program — floor equipment, backup power, medical carts, robotics — an ISO 9001 certificate with the right scope at the right plant is a reasonable evidence baseline, and demanding automotive certification for a two-thousand-unit industrial build is a good way to pay for overhead you'll never use.

That tradeoff deserves to be stated plainly rather than papered over: what you should require depends on what the pack does when it fails. Mismatched expectations cut in both directions.

Product listings carry the same address problem

Safety listings on the pack itself — UL 2054 for the pack, UL 62133 for cells and batteries in portable applications — are issued against a specific product built at a specific factory. The file number ties back to a manufacturing location. A listing on a similar pack from the supplier's other plant, or a sister model running a different cell, does not transfer to your part.

When I check a listing, I want the file number, the exact product designation, and the factory name and address as the listing body records them. I also want to know who holds the file — the cell maker, the pack assembler, or the OEM whose name is on the box — because the holder is the party who has to notify the body when something changes. Get those details for your own pack, in writing, before assuming a database entry covers you. Often it doesn't, and the gap is a test program, not an email thread.

What actually goes in the file

I stopped trusting my memory on this years ago. Certificates expire, scopes get amended, and the copy in the folder never tells you which version you were looking at.

So the certification evidence folder for each supplier holds:

• The certificate PDF, saved with the date received.
• A capture of the registry result page with a visible date, or a note of the retrieval date and the status shown.
• The scope text copied verbatim into a note, not summarized.
• The site address exactly as printed, next to the plant address I expect to be served.
• The expiry date, with a calendar reminder that fires before the next order cycle.
• The name and title of the person at the supplier who confirmed which plant covers the program.

Then I re-check the registry at two fixed points: before the first purchase order, and before any production shift to a new site or a new legal entity. Neither takes ten minutes.

None of this is a reason to distrust a supplier. It's a way to ask a better question than "are you ISO certified," which is a question that always gets a yes and never gets an answer. The certificate is not a badge on a wall. It's a document with an address, and the useful conversation starts when you read it as one.