What does each system demand in the data room?
AS9100 / NADCAP on aerospace: Oasis, customer audits, special processes. The process — heat treat, NDT, chem film — is what the prime approved. Losing the responsible person can lose the approval.
ISO 13485 / FDA facts on medical: QMS transfer, complaint and CAPA files, device listing or registration as applicable. Counsel and a quality consultant read FDA issues. Jason Taken will not.
IATF 16949 on automotive: customer scorecards, PPAP, change control. This is program admission, not a medical-style scarcity premium. The published auto cells sit nearer commodity columns — 4.0x–5.5x at $1–3M EBITDA.
SQF / BRC / USDA / FDA food on food / co-pack: last GFSI audit, recall history, allergen program.
A lapsed certificate is not paperwork. It is a customer-access problem. You leave the certified row.
How should buyers test whether the QMS is real?
Walk CAPA. Age the NCRs. Match customer scorecards to the OTD and scrap extract. Ask who the management representative is and whether that person transfers. Deloitte / Manufacturing Institute: as many as 3.8 million manufacturing employees needed 2024–2033, 1.9 million potentially unfilled (Source: Deloitte / MI). Quality systems fail when the owner of CAPA leaves and no deputy exists.
IBBA Pulse Q1 2026: 67% of advisors saw no material AI effect on value (Source: IBBA). A software sticker does not replace a surveillance audit. Census CBP 2023’s 284,452 establishments (Source: Census) include a large uncertified population — that is why Main Street 2.75x SDE (BizBuySell 2021–2025; Source: Iconic recap) sits below certified specialty SDE cells.
How does transfer work on stock versus asset deals?
Certificates often sit on the legal entity. Stock may keep the number. Asset deals often need a registrar conversation, a new certificate, and customer bridge audits. ITAR and government mix add DDTC and novation clocks. Premium and friction in the same sentence. Counsel runs that. The broker flags it.
| System | Room exhibits | Transfer friction |
|---|---|---|
| ISO 9001 | Cert, CB audit, NCRs | Usually lower |
| AS9100 / NADCAP | Oasis, customer audits, special process | High; process-person risk |
| ISO 13485 | CAPA, complaints, listings | High on asset deals |
| IATF 16949 | Scorecards, PPAP, change control | Customer consent |
| SQF / GFSI | Audit, recall, allergen | Slotting / retailer clocks |
| Lapsed any | Recert plan, customer letters | You left the certified row |
What sellers should not do
Do not schedule a surveillance audit for the week of the buyer tour. Do not hide a major NCR. Do not claim “we are recertifying” without a registrar date. Do not let the only quality engineer be the owner without a deputy.
Published aerospace/medical cells — 6.0x–8.0x at $1–3M EBITDA, 6.5x–9.0x at $3–10M, 7.0x–11.0x at $10M+ — assume the binder is current. GF Data’s 7.2x average (Q1 2026 recap) can rhyme with those institutional cells. It does not recertify a lapsed plant.
Buyers: buy a manufacturing business. The valuation pillar keeps the rows. Jason Taken is a business broker, not a registrar. Educational information only. No value is guaranteed.
How to read a certification-body report without being a registrar
Look at the date. Look at majors versus minors. Look at whether majors closed. Look at process areas that repeat. Look at whether the management representative is still employed. Look at the next surveillance date relative to a hoped-for close. A report that is fourteen months old on a twelve-month cycle is not current.
Customer audits can be harsher than the CB. Put both in the room. A clean CB and a failed customer audit is the real file.
Special-process and validated-process people
NADCAP and customer-validated medical processes attach to named people and to specific equipment. The building is not the approval. If the responsible metallurgist or the validation owner is the seller, you have owner dependence inside the QMS. Price a deputy or a consulting tail. Do not assume the approval survives a weekend.
Aerospace and medical hubs exist so you ask this before you claim the high row. Automotive PPAP owners are the IATF cousin.
What a recert project looks like in a CIM footnote
Registrar, gap analysis, training, internal audits, stage 1 / stage 2, customer notices, estimated months, estimated cost, sales at risk during the gap. If you cannot foot those items, you do not have a plan. “We are recertifying” is not a plan.
A lapsed cert on a commodity fab may be a cleanliness issue. A lapsed cert on a medical molder is an access issue. The certs-and-value page will take you out of the certified row in the second case. This page is why.
ITAR and Oasis logins should transfer with counsel and the responsible officers. Do not leave them on a personal email the seller will turn off.
How a quality lead who is not the seller should run the first buyer meeting
Open with the certificate dates and the next surveillance. Open the last CB report and walk majors. Open the last customer audit and walk the response. Open CAPA aging. If those four artifacts are not in the room, the meeting is a lobby tour. Lobby tours do not keep you in the aerospace or medical row.
Then walk the special-process or validated-process people. Ask who is named on the approval. Ask who is the deputy. Ask what happens if that person takes a job across town. Approvals attach to people and equipment more than to drywall. A consulting tail can be honest structure. A shrug cannot.
If the deal is an asset deal, put the registrar project on a one-page Gantt: gap, training, internal audits, stage dates, customer notices, months without new awards, sales at risk. Price it. If 40 percent of sales are certificate-gated, you are also in a concentration conversation. The two pages should cross-link in the data room, not only on this website.
Close by matching scorecards to the OTD and scrap extract. A clean certificate and a red scorecard is the real file. Buyers will notice. So will the next surveillance.
A registrar-project footnote that belongs on asset deals before the LOI
If the structure is an asset deal, the certificate often sits on the selling entity. Write the registrar name, the gap analysis date, the training plan, the internal-audit plan, the stage dates, the customer-notice plan, the months without new awards, and the sales that are gated. Foot the cost. Foot the sales at risk. If you cannot foot those items, you do not have a plan, and you should not claim the certified row.
Stock deals are not automatic safety. Customer audits, Oasis logins, and named special-process owners still move. ITAR officers still move. Put the responsible people on a stay or consulting tail if the approval attaches to them. Drywall does not hold NADCAP.
Match this footnote to the concentration page when the gated sales are large. A certificate customer is a customer. Losing the gate is losing the account on a clock. Earn-outs on named accounts can bridge a recert. Hoping cannot. The valuation page will take you out of the aerospace or medical row if the paper is lapsed. This footnote is how you show a path back in without pretending you never left.
A closer read on quality meeting
Open with dates, not logos. Walk majors on the last certification-body report. Walk the last customer audit and the response. Walk CAPA aging. Walk the named special-process or validation owner and the deputy. If those artifacts are missing, the meeting is a lobby tour and lobby tours do not keep a scarce row. Asset deals need a registrar Gantt with months and sales at risk. Stock deals still move Oasis logins, ITAR officers, and people named on approvals. Match gated sales to the concentration page. A certificate customer is a customer. Earn-outs can bridge a recert. Hoping cannot. Scorecards must match the OTD extract. A clean certificate and a red scorecard is the real file. Put plaques in a different folder from AS9100. GFSI on food is an access gate. Treat it that way.
How a last-surveillance report should be walked in the first meeting
Open the certification-body report, not the plaque. Walk majors and whether they closed. Walk minors that aged. Walk the last customer audit and the written response. Walk CAPA aging. Walk the named special-process or validation owner and the deputy. If those artifacts are missing, the meeting is a lobby tour. Lobby tours do not keep a scarce row on the publishing table.
Asset deals need a registrar project with months and sales at risk before anyone argues about the aerospace or medical cell. Stock deals still move Oasis logins, portal passwords, ITAR officers, and people named on approvals. Match gated sales to the customer-concentration page. A certificate customer is a customer. Earn-outs can bridge a recert. Hoping cannot.
SQF or another GFSI scheme on a food plant is an access gate the way AS9100 is an access gate. Treat it that way. ISO 9001 on a general CNC shop is not an access gate to aerospace. It can support the high end of the published SDE cell for general CNC under one million of seller discretionary earnings when the system is lived-in. It does not add a free turn.
A clean certificate and a red on-time-delivery pack is the real file. Put the pack in the same meeting. Scorecards that contradict the registrar are not a “quality is fine” story. They are the story.