Why Missing Production Records Can Undo a Certification Audit
A certification audit usually comes apart on the production record, not on the test report. The type-test report and the listing certificate prove that a design was tested and that a factory was found capable of building to it; neither one says anything about the packs that came off the line this month, and that gap is precisely what a follow-up inspector is there to close. If the factory cannot show the auditor, on the spot, that the unit in production matches the certified construction and that build records exist for those specific units, the certificate stops doing the work it was bought to do.
I've sat in that room enough times to know how it sounds. Laminate table, stack of travelers somebody pulled off the line an hour ago, a quality manager with a laptop open to a folder called CERTS. The auditor doesn't ask for the certificate. They brought their own copy. They ask which work order is running today.
That's the hinge. Everything after it is either a paper trail or an apology.
The answer comes back as a model number. The auditor writes it down, then asks for the construction file that matches it — critical component list, cell specification, pack drawing with its revision letter, BMS board revision. Only then do they ask to walk the line. And when they get there, they aren't looking at the product so much as checking that the product and the report describe the same object.
The auditor is running a three-way match
It took me a couple of audits to see the pattern, and once you see it you can't unsee it. The inspector is holding three things up against each other.
The certified construction: the configuration described in the test report and in the certification body's follow-up file. The current bill of material and drawing revision. The production record for the units on the floor — traveler, incoming inspection, serial or lot number.
If all three line up, the audit is boring, which is the goal. When one leg is missing, the auditor genuinely cannot distinguish between "we changed the cell and the notification got lost" and "we changed the cell and hoped nobody would ask." From the other side of the table those look identical. That's the part suppliers underestimate. The failure isn't the change. It's the missing record that makes the change unreadable.
What a test report actually is
UN 38.3 testing is type-based. A representative sample set of a cell or battery type goes through the sequence — altitude, thermal, vibration, shock, external short circuit, impact or crush, overcharge, forced discharge — and what comes out the other end is a test summary and a full report describing that configuration. There is no per-unit record in it anywhere. Nothing in a UN 38.3 report tells you which cell lot went into the pack in front of you, or whether the pack in front of you is even the configuration that was tested.
People read that summary as proof the product is fine. It isn't proof of that either. It's a photograph of a design, taken once, on the samples that were submitted.
UL 2054 and UL 62133-2 work differently on the surveillance side but rest on the same foundation. Those certifications carry follow-up service: the certification body sends an inspector to the factory on a defined schedule to confirm the product still matches the construction that was tested. At the documentation level, that inspector can ask for production records, component certificates, and construction details for units currently in production. Which means those records have to still exist on the day of the visit — not be reconstructable, exist. IEC 62133-2, which a lot of export programs lean on for market access, has the same shape: type-test report plus continued conformity at the factory.
So the certificate answers a question about a design. The inspector is asking a question about a Tuesday.
Where the chain breaks
In my experience it's almost never fraud. It's three departments each doing their job correctly in isolation.
Purchasing qualifies a second cell source because the first one had a nine-month lead time. Incoming inspection updates the part number. The traveler records the new cell. The certification file still describes the old one, because the change never triggered a certification review — there was no gate that would have caught it. Nobody lied. The record just forked.
Other versions of the same thing: a BMS board revision that swaps a protection IC, a tab material change, a wire gauge reduction, a thermal pad substitution, an adhesive that's technically equivalent. Or the harmless-looking one — an approval email from a buyer sitting in an inbox saying the alternate is fine to use, which is true for manufacturing and meaningless to an auditor.
This is structural, not personal. Certification evidence is owned by regulatory or quality engineering and barely gets touched between audits. Production records are owned by the line and change every day. Change control lives between purchasing and design engineering. Three owners, three systems, and no join key unless somebody deliberately built one.
What the request looks like when it lands
The sequence is usually the same. Construction file for the model in production. Critical component list with the certificates for the cells and the protection circuitry. The work order and traveler for the units being built. Incoming inspection records for the cell lot in that work order. A change log going back to the last inspection.
Each of those is easy. The problem is that they live in five places and two of them are a person. When the auditor asks for all five at once, the supplier either produces them or starts a reconstruction exercise — phone calls to a cell vendor for a certificate that should already be on file, a search through a shared drive for a drawing revision that was superseded eight months ago, somebody driving to an offsite storage unit.
I've watched a supplier answer that request in fifteen minutes with a single indexed folder, and I've watched another one take four days and come back with a gap. The difference was not the quality of the packs. It was whether anyone had decided, before the audit, that certification evidence, production records, and change control belonged in the same place with the same revision identifiers.
The index is the deliverable
What actually works is unglamorous. One location, indexed by model and revision, holding the certified construction file, the component certificates with their validity dates, the work order records with serials, the incoming inspection results for the cell lot, and a change log where every entry carries a flag for whether it affects the certified construction. The flag is the whole trick. It converts a silent substitution into a reviewable event, and it means the person answering the auditor doesn't have to remember anything — they just follow the index.
That's also what makes traceability survivable across a cell supplier change, which is the single most common place this falls apart. If the change goes through the log and the log is next to the certificate, the answer is a page. If it doesn't, the answer is a week.
It depends, honestly
None of this guarantees a clean audit, and I'd be lying if I said the record always decides it. Schemes differ in how often follow-up inspections happen and how deep they go. Some visits are largely document reviews with a sampling request; some inspectors walk the line and open panels. A narrow scope can pass on thin records, and I've seen that happen. A supplier with a genuinely conforming product can still get written up because the evidence was in someone's head.
The direction of risk is what matters. The request arrives without much warning and it arrives all at once. When it does, the certificate in the folder proves what was tested. Only the production record proves what was built — and that is the question actually on the table.
