Supplier Documentation: Tracking Certificates of Conformance Without a Filing Cabinet

A purchase order says the supplier will provide a certificate of conformance referencing revision D of the specification, signed by an authorized quality representative, for each lot shipped.

What arrives is a one-page PDF that says the goods conform to specification, without naming a revision, signed by someone in sales, covering the shipment rather than the lot. Somebody in receiving files it. The line closes. Nobody compares the document to the requirement, because the requirement is in a purchase order in one system and the document is an attachment in another.

Six quarters later an audit samples that lot and asks for the certificate. It is there, which feels like a win right up to the moment someone reads it.

Collection is solved and verification is not

Supplier portals are good at getting documents in. Upload a certificate, tag it to a PO, notify the buyer, chase the supplier who has not sent one. That workflow has been productized many times and it works.

What it does not do is read the document against the requirement. The portal knows a file exists and which PO it is attached to. It does not know that the PO demanded revision D and the certificate cites revision B, that the specification was superseded eight months ago, or that the signature belongs to someone without quality authority.

So the completeness metric is green - every line has a certificate - and the accuracy of those certificates is unmeasured. That is the same failure as a vendor portal showing insurance as current because the expiry date is in the future, which we wrote about in what a certificate of insurance actually proves. Different document, identical mistake: checking that paper arrived rather than what it says.

The five things that go wrong

Wrong revision. The certificate references a specification revision that is not the one the PO called out. It is the easiest of these to miss, because both documents look correct in isolation and nothing about either one signals that they disagree.

Wrong document type. The contract required a certificate of analysis with measured values and acceptance ranges. What arrived asserts conformance without data. A conclusion has been substituted for the evidence behind it.

Wrong scope. The certificate covers the shipment when the requirement was per-lot, or covers a part number without the serial or lot range that ties it to what you received.

Wrong signatory. Signed by a commercial contact rather than the authorized quality representative the agreement specified. This matters precisely when the certificate is being relied on.

Stale currency. The supplier's own upstream qualification - a registration, a lab accreditation, the calibration status of the equipment that produced the measurement - has lapsed or gone past its due date, which leaves the certificate present but the basis for relying on it gone. FDA takes this position explicitly for drug components: under 21 CFR 211.84(d)(2) a manufacturer may accept a supplier's report of analysis in place of its own testing only if it runs at least one identity test itself and validates the supplier's results at appropriate intervals. A supplier certificate is not self-validating, and the regulation says so.

Why it sits between functions

On paper this is owned. Any certified quality system has a documented receiving-inspection or supplier-verification procedure with a name attached to it, and the buying organization, not the supplier, carries responsibility for establishing that what arrived conforms.

In practice the work splits. Procurement owns the supplier and the PO terms. Quality owns the specification and its revisions. Receiving handles the physical goods and the paperwork that arrives with them. Compliance discovers problems during an audit.

Each of those functions is doing its job. The comparison that would catch the defects lives between them, and it requires holding two documents from two systems side by side at the moment the goods arrive. So the certificate is filed by the function least equipped to evaluate it, and evaluated by the function furthest from when it arrived. The gap is not between assigned ownership and nobody. It is between assigned and operative.

Healthcare adds a layer, though the triggers are narrower than they are usually described. Insurance requirements come from the agreement. Exclusion screening against the OIG's List of Excluded Individuals and Entities and the SAM.gov exclusions attaches when the counterparty furnishes items or services payable by a federal health care program, not merely because it has a loading dock badge - OIG updates the LEIE monthly and recommends screening before hire or contract and periodically after. A business associate agreement is needed when the counterparty creates, receives, maintains or transmits protected health information on your behalf, which incidental facility access does not by itself do. Where a supplier does cross those lines, the requirements live in the vendor compliance system while the certificates live in the quality system, and the fact that they concern the same counterparty is knowledge held only by people.

What verification actually requires

Start from the contract and the purchase order, because that is where the requirement is defined. Which specification, at which revision. Which document type - conformance or analysis. What scope - lot, batch, serial, shipment. What signature authority. What supporting currency, like accreditation or calibration.

That set is the specification for the document. Then each incoming certificate gets checked against its own requirement rather than against a generic template, and the failures above become detectable rather than latent.

Harper does this the same way it handles any other contractual obligation. It reads the agreement and the purchase order terms, extracts what document each deliverable requires and with what attributes, then checks what arrives against that specific requirement - revision, scope, signatory, currency. Missing or non-conforming documents surface as gaps with the clause that created the requirement shown alongside. Suppliers get chased at the source, and every check leaves a record of what was requested, what came back and what it was tested against.

The economics we see are the same ones that make this work at all: the same requirement recurs across hundreds of POs and dozens of suppliers, so it is extracted once and referenced everywhere it applies. Volume becomes the cheap part.

A sample worth pulling

Take twenty certificates of conformance received in the last quarter, from at least five suppliers.

1. For each, find the purchase order or contract clause that required it.
2. Does the certificate reference the specification revision the requirement named?
3. Is it the document type the requirement asked for - conformance where conformance was required, analysis where analysis was?
4. Does its scope match - lot where lot was required?
5. Is the signatory the role the agreement specified?

Question 2 is the one most likely to matter later, because a superseded revision is the defect an auditor can demonstrate without needing to interpret anything. Whatever rate you get, the useful output is not the number. It is finding out whether anyone in the process was in a position to catch it.