Compliance documents customers ask for, drafted for the person who signs them.

Three kinds of paper in one reply. Standards bodies sort these documents by who stands behind them. ISO/IEC 17000, the vocabulary standard for conformity assessment, calls an attestation first-party when it comes from whoever provides the product, second-party when it comes from someone with a user interest such as a buyer, and third-party when it comes from a body independent of both. It adds that the labels describe roles, not the parties to a contract, and that an outside firm working for one side and under its control takes that side's label. An MTR, an SDS or a producer's COA is the maker speaking for its own material. A supplier questionnaire is the buyer's own check. A GFSI audit certificate or a kosher agency's letter comes from a certifier outside both companies, and a lab report can sit in any of the three, depending on who ran the test and for whom. Most replies mix all three, so a draft has to keep straight who said what.

A document is a promise, not an attachment. For anyone selling goods, section 2-313 of the Uniform Commercial Code turns an affirmation of fact, or a description of the goods, that becomes part of the basis of the bargain into an express warranty that the goods will match it, and the seller needs no formal words such as "warrant" or "guarantee" for that to happen. The values printed on a spec sheet, a COA or an MTR can become exactly that. Federal buyers write the idea down. Under FAR 52.246-15, a contractor allowed to ship on a certificate of conformance instead of source inspection signs a statement that the supplies meet the contract's specifications, drawings, packaging, marking and part identification, and that certificate rides on the top copy of the receiving report bound for the payment office. The Government still keeps its right to reject supplies that turn out not to conform. A certificate reused from last month's shipment makes a fresh promise about this one.

The issuer answers for the claim, not the name it cites. A calibration certificate that says "NIST traceable" is the lab's own claim. NIST's policy says it does not define, specify, assure or certify the traceability of measurement results it didn't provide: backing a traceability claim is the job of whoever provides the result, and judging it is the job of whoever uses it. The same holds for a grade printed on a mill cert, a standard named on a closeout submittal or a list cited in a regulatory statement. Each document is worth what its issuer and its date make it worth. So the drafts never strengthen a claim. Every attachment is listed with who issued it, what it says and the file it came from, and anything a customer asked for that goes beyond the source is left for your reviewer.

A signature is a decision. Under the federal E-SIGN Act, a signature or record can't be denied legal effect only because it is electronic, so a signature applied to a PDF certificate is no weaker for it. Where FDA's electronic records rule applies, 21 CFR 11.50 asks more: a signed electronic record shows the signer's printed name, the date and time of signing, and what the signature means, such as review, approval, responsibility or authorship. Whoever signs is saying they checked. That is why the proof of concept stops short of every signature and certification in these five industries, whether it is a QC lead accepting steel, a regulatory manager signing a statement, a lab signatory issuing a report or a balancing supervisor's stamp. It drafts and flags, and nothing it drafts reaches a customer.

What changes from desk to desk. Three things. The key that ties a document to what shipped: a heat number in a fab shop, a lot at a chemical distributor or a food plant, a sample ID or instrument serial in a lab, an equipment tag and spec section on a mechanical job. Who asks: a customer's QC inspector, a plant's EHS manager, a retailer's food safety team, an engineer of record, a GC's project manager. And the clock: certificate expiry dates, SDS revision dates, the receipt and test dates on a lab report, warranty start dates set at turnover. Each card above opens an industry page with its own detail, what to send, how its test is scored and its one hard limit.