Never get caught by an expired supplier certificate

Why an expired certificate is a silent failure

Nothing breaks when a supplier certificate expires. Parts keep arriving, invoices keep clearing, and the person who set up that supplier three years ago may not work here anymore. The certificate is a piece of paper with a date on it, and a date in a spreadsheet has no clock attached. It does not raise its hand. That is the whole problem in one sentence.

The failure surfaces somewhere expensive. An assessor samples your approved supplier list and asks for current evidence on three of them. A customer runs a supply chain audit before releasing a new program. A recall investigation traces a nonconforming lot back to a heat treater whose approval lapsed eleven months ago. In each case the work was probably fine. What you cannot show is that you were controlling it, and control you cannot show is control you do not get credit for.

Where the spreadsheet gives out

Almost every small and mid-size manufacturer starts here, and for a while it is the right answer. A tab called Approved Suppliers, a column for the certificate expiry, a folder of PDFs beside it. It stops working in predictable ways.

• No clock. The sheet knows the date. It just never tells anyone. Somebody has to remember to open it, sort by expiry, and act, every month, forever.
• One owner. The list is usually maintained by one person who knows which rows are stale and which supplier is mid-renewal. When they change roles, that knowledge leaves with them.
• No history. Typing over a cell erases the state before it. Ask who moved a supplier from conditional to approved, when, and on what evidence, and the honest answer is a memory rather than a record.
• The file drifts from the row. The expiry date in the sheet and the date on the actual certificate stop agreeing, usually because a renewal arrived by email and got filed but not entered.
• Scope is not modeled. A supplier is not approved in general. They are approved for something. A shop cleared for machining is not automatically cleared for the special process on the next print, but a single Approved column cannot say that.
• Copies multiply. A second site keeps its own version. Purchasing keeps a third. All three are slightly different, and the one the assessor is handed is whichever was easiest to find.

None of that is a discipline problem. It is a tooling problem. A spreadsheet is a very good way to hold a list and a very poor way to hold a schedule with consequences attached to it.

Why we are the ones building it

Axiospec already makes calibration management software. That product is live today, and it exists to answer one question under pressure: can you prove this instrument was in tolerance when it was used. It is built around ISO 9001, ISO/IEC 17025, AS9100, IATF 16949, and ISO 13485 requirements, and it is built for the person supplier records usually land on: a small quality team with a lot of ground to cover and no appetite for another system to babysit.

Calibration records and supplier approvals have the same shape. Both are a decision, made by a person, on a date, supported by evidence, valid until something expires. Both are worthless in an audit unless the history behind them survived. So the machinery we would build for supplier records is the machinery we already run for calibration records.

The specific piece worth naming is the ledger. Calibration events in Axiospec are written to an append-only, tamper-evident ledger with maker and checker review, so a result cannot be quietly edited after the fact. A correction is recorded as a correction, with the original still visible and the person who made it attached. Supplier approvals would be recorded the same way: adding a supplier, changing a status, renewing a certificate, and recording a re-evaluation all become ledger entries rather than overwritten cells.

That is also the reason we are validating this with a list instead of a launch. We would rather find out now that the real pain is somewhere else, and build that instead.