Why is a certificate an access gate?
Customers qualify suppliers. The certificate is often the first gate, and a customer audit is the second. Lose the gate and the sales that required it are not “at risk.” They are already leaving, on a clock the registrar and the customer will set.
Aerospace without AS9100 is build-to-print hope. Medical without ISO 13485 is a different buyer set. Automotive without IATF is usually not on the program. Food without a GFSI scheme is a slotting problem. ISO 9001 is common. It rarely, by itself, jumps a CNC shop into the medical row.
The operations companion — quality systems as diligence — is the binder: last CB audit, NCR aging, Oasis, CAPA, PPAP, GFSI. This page is the valuation move. The research file’s rule of thumb: AS9100, ISO 13485, IATF, SQF are an access premium only if audits are clean and transferable.
Census CBP 2023’s 284,452 establishments (Source: Census) include a large population of uncertified job shops. That is why the Main Street 2.75x SDE median (BizBuySell 2021–2025; Source: Iconic recap) sits below the certified SDE specialty cell of 3.0x–5.0x.
Which certificates move which rows?
On this site’s synthesized table, aerospace AS9100 and medical ISO 13485 occupy the high row at every size band: 3.0x–5.0x SDE under $1M; 6.0x–8.0x EBITDA at $1–3M; 6.5x–9.0x at $3–10M; 7.0x–11.0x at $10M+. Those cells assume the certificate is real. They are advisor-survey / reported-deal ranges, not an appraisal.
IATF shops usually sit nearer the commodity / program-release columns — 4.0x–5.5x at $1–3M EBITDA — because OEM leverage caps pricing power even when the QMS is excellent. Specialty packaging with clean GFSI audits sits nearer plastics and precision cells, not commodity print.
NADCAP special processes are narrower than the building. The process — heat treat, NDT, chemical processing — is what the prime approved. A sale that loses the responsible person can lose the approval even if the certificate on the wall is still in date.
What happens when an audit is lapsed?
You leave the certified row. Customers who required the certificate will stop new awards and, on a clock, current ones. A verbal “we are recertifying in Q2” is a diligence finding. Price the gap: lost sales, registrar cost, bridge audits, and the months without access.
If the lapsed cert was the reason 40% of sales existed, concentration and certification are the same fact. You do not have a 40% customer. You have a certificate customer.
Do not add “a turn for ISO” as a rule. A current ISO 9001 on a commodity fab shop may keep you from a discount. It will not move you to 7.0x–11.0x. GF Data’s 7.2x manufacturing average (Q1 2026 recap) is a larger-EV series, not a prize for hanging a logo.
| System | Typical row on this site | Diligence that keeps the row |
|---|---|---|
| ISO 9001 | General / precision cleanliness | Current CB audit, NCR aging |
| AS9100 / NADCAP | Aerospace high cells | Oasis, customer audits, special processes |
| ISO 13485 | Medical high cells | QMS transfer, CAPA, device listing |
| IATF 16949 | Auto / program columns | Scorecards, PPAP, change control |
| SQF / GFSI | Food / specialty pack | Last audit, recall, allergen program |
| Lapsed any of the above | Discount vs the certified row | Recert plan is a chip, not a cell |
How does transfer work in an asset deal?
Certificates often sit on the legal entity. A stock deal may keep the number. An asset deal may require a new certificate, a registrar conversation, and customer bridge audits. That is counsel, the registrar, and a quality consultant. It is not a broker form.
ITAR and government mix add friction: DDTC notice for foreign-person control of a registrant, novation under FAR 42.12. Premium and friction in the same sentence. The certificate does not erase those clocks.
Deloitte and The Manufacturing Institute estimated as many as 3.8 million manufacturing employees needed 2024–2033, with 1.9 million potentially unfilled (Source: Deloitte / MI). Quality systems fail when the management representative leaves and no one owns CAPA. Labor risk and certificate risk travel together. Price the second chair.
Why “a turn for ISO” is the wrong rule
Turns live inside a published cell. ISO is not a cell. Access is a reason to sit high or low inside the cell your process and size already earned. A tooling shop with current ISO 9001 and a scarce die book may sit high in the tooling row (5.0x–7.0x at $1–3M EBITDA). A shop with a framed certificate and a 41% customer on verbal releases sits low.
IBBA Pulse Q1 2026: 67% of advisors saw no material AI effect on value (Source: IBBA). Software stickers do not replace a surveillance audit. ISM PMI 54.6 (August 2026) does not recertify a lapsed plant.
Read the operations quality page for the binder. Read multiples by sub-sector for the rows. Sellers: sell my manufacturing business. Jason Taken is a business broker, not a registrar and not an appraiser. Educational information only. No value is guaranteed.
What “current” means on the day of the teaser
It means the certificate is in date, the last surveillance happened, major NCRs are closed or aged honestly, and the registrar has a next date. It does not mean “we have a binder.” It does not mean a logo file in the marketing folder.
If a major NCR is open, put it in the room. A buyer who finds it later will assume there are more. If a customer audit failed, put the response letter in the room. Silence is a second finding.
Asset-deal transfer as a project plan, not a vibe
Name the registrar. Name the gap analysis. Name the customer bridge audits. Name the months without new awards. Price that project. If the project is six months and 40% of sales are certificate-gated, you have a structure problem as well as a quality problem. Earn-out on named accounts can bridge it. Hoping cannot.
Quality systems diligence is the exhibit list. This page is the cell consequence. Read both before you claim the aerospace or medical row.
Certificates that impress the website and not the buyer
ISO 14001 and ISO 45001 can matter to a strategic’s sustainability questionnaire. They rarely move a Main Street multiple. ITAR registration is access and friction, not a decoration. A city’s “manufacturer of the year” plaque is not a certificate. Do not put plaques in the same table as AS9100.
Food GFSI schemes are closer to access gates than ISO 9001. Treat them that way. A failed GFSI audit is a slotting problem, not a paperwork delay.
What current means on the day you send the teaser, in operational words
Certificate in date, last surveillance happened, majors closed or aged honestly, registrar next date known. A binder in a cabinet is not current. A logo file is not current. An open major NCR belongs in the room. A failed customer audit belongs in the room with the response letter.
Asset-deal transfer is a project: registrar, gap, bridge audits, months without new awards, sales at risk. If 40 percent of sales are gated, you also have concentration. ISO 14001 plaques and city awards are not AS9100. GFSI on food is closer to an access gate than ISO 9001. Treat it that way.
A current-paper test you can finish before you claim a scarce row
Certificate in date. Last surveillance happened. Majors closed or aged honestly. Next registrar date known. Customer audits in the room. Named special-process or validation owners and deputies named. If any of those fail, you do not keep the aerospace or medical row for free. Asset-deal transfer is a project with months and sales at risk. ISO 14001 plaques are not AS9100. GFSI on food is an access gate. Do not add a turn for ISO as a rule. Add the sales that die if the paper dies.
A closer read on current paper
Certificate in date, last surveillance happened, majors closed or aged honestly, next registrar date known, customer audits in the room, named process owners and deputies named. If any fail, you do not keep the scarce row for free. Asset-deal transfer is a project with months and sales at risk. ISO 14001 plaques are not AS9100. GFSI on food is an access gate. Do not add a turn for ISO as a rule. Add the sales that die if the paper dies. A verbal recert plan is a diligence finding. Put it in the room with a registrar date or take the discount.
When a plaque is an access gate and when it is lobby art
AS9100 current, Oasis login live, and last customer audit closed can keep a shop in the aerospace-and-defense row of the publishing table. A plaque in the lobby with a lapsed date cannot. ISO 13485 current with a named management representative and a validation owner can keep a shop in the medical-device row. A “we used to do medical” sentence cannot. IATF 16949 with live PPAP and a customer portal password the quality lead actually knows can keep an automotive row. A faded banner cannot.
ISO 9001 alone does not move a general CNC shop under one million of seller discretionary earnings into a scarce row. It can support the high end of the 2.0–3.6 times SDE general-CNC cell when audits are current and deputies exist. It does not add a free turn. ISO 14001 and safety plaques live in a different folder. They matter to some buyers. They are not AS9100.
Asset deals need a registrar Gantt with months and sales at risk. Stock deals still move people named on approvals, ITAR officers if the file is a registrant, and portal logins. ITAR section 122.4(b) still wants a sixty-day DDTC notice when a foreign person would control a registrant. That clock is not a quality-system detail, but it sits next to the same certificate customers.
A verbal recert plan is a diligence finding. Put a registrar date on it or take the discount. Scorecards that contradict a clean certificate are the real file. Believe the scorecard. Earn-outs can bridge a recert. Hoping cannot.