A folder reaches the audit desk with a valid ISO 22000 certificate on top and, underneath it, an FDA 21 CFR test report naming a laminate nobody in the room is buying. The certificate is genuine. The report is real. The mismatch is what stops the review, and no volume of extra paper fixes it once the bags are on the water. What documents should a flexible packaging supplier provide, and which question does each one actually settle?
System certificates prove how a plant is managed. Test reports prove what a material sample was tested against. Neither is a statement about your finished pouch, and compliance papers are bound to a structure — change the laminate and the paper describes someone else's bag.
A certificate answers a management question; a test report answers a film question
Flexible packaging paperwork comes in three families: management-system certificates, product test reports, and chain-of-custody or social audit documents. A system certificate proves a plant runs a documented process. A test report proves a material sample met a named standard. A chain-of-custody document traces an input from feedstock to finished goods. None of them replaces a specification sheet, and treating the three as interchangeable is where most document packs fall apart.
What a management-system certificate actually certifies
ISO 9001 is a quality management standard: documented procedures, corrective action, records, internal audit. ISO 22000 is a food safety management standard — hazard analysis and controls running from incoming film through lamination, printing, bag making and dispatch. What the certificate does not say is anything at all about a bag.
Read four fields before you read the logo. Legal entity name. Site address. Scope statement. Expiry date. A certificate issued to a trading company at an office address tells you nothing about the plant that runs your film, and that is a common shape for a document pack that looks complete and is not.
Where the film test report and the GRS certificate sit
An FDA 21 CFR test report describes a sample: this film, tested by this method, against this part of the regulation. The Global Recycled Standard (GRS) is different in kind — a chain-of-custody certification that tracks recycled input and requires a transaction certificate for the specific shipment. Neither document is a food-safety statement about your pouch. GRS in particular speaks to recycled content, not to contact safety, and a buyer who forwards it as proof of the latter will be asked for something else.
Is the pouch FDA approved? An ISO 22000 certificate and an FDA 21 CFR test report are not the same paper
No pouch is "FDA approved". The US Food and Drug Administration does not approve food-contact films; it publishes requirements, and materials are tested against them. What you can request is a test report showing a specific film was tested to the food-contact requirements in Title 21 of the Code of Federal Regulations, plus a declaration that the structure meets them.
The standards that come up, and what they cover
ISO 9001 covers quality management. ISO 22000 covers food safety management, and some plants hold BRCGS or FSSC 22000 instead because those are the schemes certain retailers name. GRS covers recycled-content chain of custody. BSCI and SMETA are social audits: labour conditions, working hours, health and safety on site. Not one of those four is a statement about migration from a printed laminate.
Product-level evidence is a separate file: the 21 CFR test report for the film, a declaration of conformity for the structure, a specification sheet, and safety data for inks and adhesives where your market asks for it. YLTPACK attaches its certificates and the PE film's FDA 21 CFR food-contact test report to the quotation rather than holding them until someone asks.
Why "approved" is the wrong word to put in a spec
There is no approval number for a pouch film, so a supplier who answers "yes, FDA approved" has answered nothing you can check. Write the line as a requirement instead: PE sealant film tested to FDA 21 CFR food-contact requirements, test report to be supplied with the quotation, naming the structure. That phrasing gets you a document with a laboratory name, a method, a sample description and a date — not a badge graphic pasted into a brochure.
Food contact compliance documents for pouches are tied to a structure, not to a supplier
A buyer's mental model is usually that the compliance file covers whatever is ordered from that supplier. It does not. The file covers one build, and a flexible laminate has more moving parts than most buyers count when they skim a spec sheet.
The variables that put you outside the report
Structure and layer order come first: PET/AL/PE and PET/PE behave differently in a migration test, and foil changes the barrier and the sealant exposure. Then sealant gauge. Then the ink and adhesive system, including whether the print is surface or trapped between layers. Then the conditions of use the testing was designed around — fatty or aqueous food, hot fill, retort temperature and time.
Change one of those between the sample and the production run and the paper on file describes someone else's bag. This is not a supplier trick. It is how the testing works.
What a declaration of conformity should state
A declaration of conformity is the converting party's signed statement that a named structure complies with a named regulation. It should name the materials and layers covered, cite the compliance basis, state the intended use and any restriction such as "not for retort above X°C" or "aqueous and acidic foods only", carry an issue date, and reference the structure code on the specification. If yours says "all our packaging complies with applicable regulations", it is a sentence, not a document.
Note: File every report against the structure code printed on the artwork-approved spec sheet, not against the supplier name. When that code changes, everything behind it needs re-checking.
Why an old report is not automatically a bad report
A report from several years ago may still be accurate, because nothing about the formulation has moved. What matters is not the age of the PDF but whether the sample it names is the structure you are buying today. Ask one direct question in writing: does this report still cover the current formulation, film supplier and layer order? A dated yes is useful evidence. Silence, followed by a fresh generic PDF, is the answer to a different question.
What documents should a flexible packaging supplier provide at quote stage, not at audit stage?
Ask at RFQ stage for the system certificates, the film test report, a declaration of conformity for your structure, the specification sheet, and chain-of-custody paperwork if recycled content is claimed. Requested with the enquiry, they arrive as attachments alongside the price. Requested after the purchase order, they arrive as a delay you cannot bill to anyone.
The requests that arrive six weeks after the PO
Retailer onboarding portals are where this surfaces. A listing form asks for a food-contact declaration and the manufacturer's food safety certificate, the importer's broker asks for a statement on the packaging materials, and a private-label customer sends a compliance questionnaire with forty rows. Artwork has long since been approved. Film may already be printed. Now every answer has to travel back through a factory that is running other jobs, and the schedule absorbs the wait.
The question of what certificates do packaging manufacturers need to send with a quote has a short answer: the ones your target market requires, for the exact structure you are buying. Not every certificate the plant holds.
How to fold the document request into the RFQ
One short paragraph in the enquiry does the work. Name your market, name the structure or the product going into the bag, and list the papers your customer or portal will ask for. A supplier who knows at quotation stage that a German retailer needs a declaration of conformity for a specific laminate will price and prepare accordingly; the same supplier, told after the PO, is guessing at what you need and sending everything.
Tip: Ask for the report that names your structure and your sealant gauge, not the one that happens to sit on the website. A generic film report forwarded to a retailer usually comes back with a request for the real one.
The packaging supplier audit documents checklist, and what each one proves
The working file is shorter than most buyers expect. Five or six papers, each doing one job, checked against each other rather than read in isolation.
System and product documents
- ISO 9001 certificate — a documented quality system exists; check the site address, the scope and the expiry date before anything else.
- ISO 22000 certificate — a food safety management system is in place; the scope line should name flexible packaging or the process the plant actually runs.
- FDA 21 CFR test report for the film — a specific material was tested to food-contact requirements; the sample description must match your sealant, not just your category.
- Declaration of conformity and specification sheet — the structure, layers, grammage and compliance basis in one place; every other paper gets checked against the spec sheet.
Social, environmental and chain-of-custody documents
- Social audit report — BSCI or an equivalent programme; labour conditions and site safety, nothing about the bag.
- GRS scope certificate and transaction certificate — the scope certificate lists what the site may sell as recycled-content; the transaction certificate ties a shipment to it.
- Film certificates for eco structures — compostable or mono-PE documentation, supplied when that structure is on the order and not before.
The details auditors check before the wording
Name against name. The legal entity on the certificate, the entity on your purchase order and the entity on the invoice should connect without a verbal explanation. Address against address: the site on the certificate should be a production site, and if the goods ship from somewhere else, expect the question.
Dates next. An expired certificate is not evidence, whatever it proves. Then the match that gets missed most often — whether the product named on the report is the bag in the carton. An auditor who finds a report for a three-layer foil laminate attached to a two-layer clear pouch will read the rest of the pack with more suspicion than it deserves.
Send the document list with the RFQ and the audit becomes a filing task
Keep five items in the order folder beside the approved artwork: the spec sheet with its structure code, the declaration of conformity for that structure, the test report the declaration points to, the system certificates currently in date, and any transaction certificate if recycled content was claimed.
Re-request rather than reuse at four moments — a certificate expires, the formulation or film source changes, the destination market changes, or the bag structure changes. Then check the structure code on the spec sheet you were last sent against the code on the report in your folder. If they differ, you already know what the auditor is going to ask, and you can answer before the question is put to you.
FAQ
Do I need the original certificates or are scans acceptable?
Scans are what most onboarding portals accept, and a PDF issued by the certification body with a verifiable certificate number is normally enough. Auditors sometimes check the certificate through the issuer's online register rather than trusting the file. Keep the scan in the order folder and the register reference in your notes.
What if the supplier sends a certificate in a different company name?
Group structures and separate trading arms produce this constantly. What resolves it is a short letter on the certificate holder's letterhead confirming that the named entity manufactures for, or is the production site of, the company quoting you. A matching production address on the site line does the same job.
Does a test report expire?
Food-contact test reports usually carry a date and no formal expiry. What ages them is a change of formulation, film supplier or process, not the calendar. Ask whether the report on file still covers the current structure and get the answer in writing.
What if the supplier cannot produce a report for my exact structure?
Then you are choosing between a different structure, testing at your own cost, and general declarations your retailer may reject. Better to find that out at RFQ than inside a portal review. A supplier who says so plainly is easier to plan around than one who forwards a certificate for something else and lets you discover the gap later.
