Check it in the scheme owner’s public directory instead of trusting the PDF you were sent. Every major programme runs a searchable register. Match the legal entity, the site address, the certificate number, the scope, the audit date and the expiry against the document in your hand, and confirm the certification body is accredited for that scheme.
The six fields that must agree
- **Legal entity.** The name on the certificate, the name on the invoice and the name on the contract should be the same company.
- **Site address.** Production, freezing and storage can sit at three different addresses. Each needs cover.
- **Scope.** Product category and process. A certificate for dried fruit does not cover an IQF line.
- **Certificate number and issue date.** These are what you search the directory with.
- **Validity.** An expired certificate with a “renewal in progress” email attached is not a valid certificate.
- **Certification body.** Accredited for the scheme, in the country concerned.
What to ask for beyond the certificate
Request the audit report summary or at least the non-conformity list, and ask when the last unannounced audit took place. A grade tells you the outcome; the non-conformity list tells you where the site is weak, which is what you need for your own risk assessment.
Record the date you verified the certificate and the directory entry you saw. That record is what a customer audit of your own supplier approval process will ask for.
Checklist and file structure: the supplier approval pack.