How do you test whether a quality certificate will survive close?
Buying a manufacturing business in aero, medical, auto, or food without this pack is how people buy a logo. The checklist already asked for the certificate pack. This page is how you read it.
The systems and the files that sit under them
| System | Where it shows up | Diligence pack |
|---|---|---|
| ISO 9001 | General manufacturing | Certificate, last CB audit, NCR aging |
| AS9100 / NADCAP | Aero / defense | OASIS, customer audits, special processes |
| ISO 13485 / FDA registration | Medical | QMS transfer, complaint/CAPA, device listing |
| IATF 16949 | Auto | Scorecards, PPAP, change control |
| SQF / BRC / USDA / FDA food | Food / co-pack | Last GFSI audit, recall history, allergen program |
ISO 9001 is the general gate. It does not substitute for AS9100 on an aerospace supplier, ISO 13485 on a medical file, or IATF on an automotive supplier. Food GFSI schemes are their own access conversation.
Ask for the certificate PDF, the last CB report, the open NCR list with ages, internal audit calendar, management-review minutes, and customer-imposed quality agreements. If the quality manager is the seller's spouse and is leaving, the system is a person. Budget a hire.
Transfer mechanics are agency- and registrar-specific. A stock sale may keep the legal entity and the registration. An asset sale often needs a new listing or a CB transfer process. FDA device and food registrations are not "the same PDF with a new logo." Confirm with regulatory counsel. This page will not invent a transfer checklist that pretends to be universal.
How certificates sit in the multiple — and how they do not
On this site, adjusted EBITDA cells for aerospace AS9100 / medical ISO 13485 sit above general fab / print at the same size band: 6.0x–8.0x versus 4.0x–5.5x at $1–3M EBITDA; 6.5x–9.0x versus 5.0x–6.5x at $3–10M. Those cells are advisor-survey and reported-deal ranges, not an appraisal. The premium is an access premium. It exists only if audits are clean and transferable.
Main Street SDE shops in BizBuySell's 2021–2025 set still cleared at 2.75x median SDE (Source: BizBuySell via Iconic). A small certified shop can observe 3.0x–5.0x SDE in the specialty machining band. It is still SDE. It is still small. Do not paste GF Data's 7.2x average (larger-EV series) onto a $400k-SDE cell because the wall has a logo.
Stanford's $16 million / 6.2x / ~25% margin median is a search-fund profile (Source: Stanford GSB). Searchers underwrite certificates harder than they underwrite a contracted services firm. They should. The median is never a job-shop multiple.
IBBA Q1 2026: 83% of deals over $5 million had three or more offers (Source: IBBA). Certified files in that band draw process. A dirty OASIS record is how you lose the process.
Adjacent gates people confuse with quality
ITAR / EAR. A quality certificate is not an export-control program. Foreign-person control of an ITAR registrant needs 60-day DDTC notice under § 122.4(b) (Source: DDTC). Domestic buyers still need registration amendments.
CMMC / DFARS. Versioned. Verify the current level required on the contract vehicles in the backlog. Do not hard-code a level as if it never changes.
Set-asides. 8(a), SDVOSB, WOSB, HUBZone status is not a freely transferable asset. A sale can kill the set-aside overnight. That is not a CB issue. It is a government-contract issue.
People. Deloitte/MI: as many as 3.8 million manufacturing employees needed 2024–2033, 1.9 million potentially unfilled (Source: Deloitte/MI). A quality system without a quality manager is a recertification risk.
SBA 7(a) still caps at $5 million with a 10% injection under SOP 50 10 8 (Source: SBA). Lenders will ask for the certificate pack. They will not recertify you.
A quality of earnings should test scrap, rework, and warranty against the story the certificate tells. The working-capital peg should not include quality-hold inventory as if it were saleable.
Customer-imposed systems that are not on the wall
The wall hanging is the start. Many customers impose their own manuals, portal scores, and process approvals that do not appear on the ISO certificate. Ask for the list of customer-specific quality requirements, the last scorecard packet, and any open chargebacks. A shop can hold AS9100 and still be red on a prime's portal. That is a commercial finding, not a logo finding.
Special processes — heat treat, plating, NDT, welding — may sit under NADCAP or customer approvals that are person- and site-specific. If the approved operator is the seller, the approval may leave with the seller. Budget a requalification. Do not treat a NADCAP certificate as portable furniture.
Calibration and measurement systems are quality evidence. A CMM without current certs is a finding even if the QMS certificate is live. Software seats for inspection programs can be licensed to a person. Ask. Machine-list diligence and quality diligence meet at that bench.
Food plants add recall, allergen, and environmental-monitoring files. A last GFSI audit that is clean still needs a recall test you can watch. Medical files add complaint aging and CAPA effectiveness, not only a 13485 PDF. Automotive files add change-control discipline: a buyer who "improves" a process without customer approval can lose the release.
How to put quality into the LOI and the first 90 days
The LOI should require cooperation on CB notices, customer quality notifications, and access to portals after a scripted introduction. It should not promise you will keep every certificate if the legal structure is an asset sale that the registrar will treat as a new entity. State the intended structure. Then confirm.
SBA 7(a) still caps at $5 million with a 10% injection (Source: SBA). Lenders will ask for the certificate pack. They will not call the CB for you. A lapsed certificate on a file you intend to lever is a credit issue because customers can leave.
Quarter one is a recertification risk window. Keep the quality manager. Do not rewrite the manual in week two. Do not skip internal audits because you are "integrating." The first 90 days page already said this. Quality is where people ignore it.
Census CBP 2023: most establishments are small (Source: Census CBP). Small certified shops can still hold real access. They can also hold a certificate that is one audit from suspension. Read the last report. Age the NCRs. If majors are older than the seller's explanation, believe the dates.
ISM PMI 54.6 (Source: ISM) does not recertify you. Fed utilization 76.0% (Source: Fed G.17) does not either. Customers do. Treat the pack as access, and treat access as value only when it is live.
A certificate pack you can actually finish in a week
Day one: PDFs, expiry dates, CB names, last audit dates. Day two: open NCR aging and internal-audit calendar. Day three: customer scorecards and portal screenshots the seller is allowed to show. Day four: special-process and NADCAP files if they exist. Day five: transfer memo from counsel and the registrar's stated process for your intended APA or SPA.
If day one already shows a lapse, stop the week and decide recert versus walk. If day three shows a red portal on the hero customer, structure or walk. If day four shows the approved operator is leaving, budget requalification in the 90-day plan.
SBA 7(a) still caps at $5 million with a 10% injection (Source: SBA). A lapsed cert on a levered file is a credit issue. Combined 7(a)+504 can reach $10 million (Source: SBA). Same issue. Main Street 2.75x SDE shops (Source: BizBuySell via Iconic) can hold ISO 9001 that is real. They can also hold a PDF that expired in March. Stanford's $16 million / 6.2x / ~25% margin median (Source: Stanford GSB) often sits on cleaner systems. It is never a job-shop multiple and never a reason to skip day one.
IBBA's 83% three-offer statistic (Source: IBBA) rewards a complete pack. Deloitte/MI 3.8 million / 1.9 million (Source: Deloitte/MI) is why the quality manager's stay is part of the pack. Fed utilization 76.0% (Source: Fed G.17) will not recertify you.
Jason Taken is a business broker, not a certification-body auditor. Educational information only. Confirm transfer with the registrar and counsel. No outcome is guaranteed.
Questions the certificate PDF cannot answer alone
What did the last CB report actually say. How old are open majors. What does the customer portal show. Which approvals are person-specific. Will an asset sale force a new listing. If the PDF is the only file, you have a logo. You do not have access.
Customer-imposed manuals and chargebacks do not appear on the wall hanging. Special processes can leave with the approved operator. Calibration benches are quality evidence. Food, medical, and automotive clocks do not pause for your first quarter. Keep the quality manager. Do not rewrite the manual in week two.
A lapsed certificate on a levered file is a credit issue because customers can leave. Treat access as value only when it is live.
HedgeStone will ask whether the certificate is live before treating an access premium as real. A wall hanging that expired in March is not a moat. Portal color on the hero customer is a commercial finding. Person-specific approvals leave with the person.
How to read majors, minors, and observations on the last CB report
A wall hanging does not tell you whether the last CB visit closed with majors, aging minors, or observations the quality manager promised to fix by a date that has already passed. Ask for the report, the open NCR aging, and the internal-audit calendar. Then ask what the hero customer's portal shows. Customer-imposed manuals and chargebacks do not appear on the certificate PDF. Special processes can leave with the approved operator. Calibration benches are quality evidence. Food, medical, and automotive clocks do not pause for your first quarter. Keep the quality manager. Do not rewrite the manual in week two. A lapsed certificate on a levered file is a credit issue because customers can leave. Treat access as value only when it is live. If the PDF is the only file, you have a logo.