Open your Drive. Find the folder. It probably looks something like this:
/Compliance
/CoAs
/2024
/2025
/2026
Supplier CoA March.pdf
CoA - ascorbic.pdf
Scan_20260114_0003.pdf
turmeric coa NEW.pdf
IMG_4471.jpg
CoA (1).pdfEverything is there. Nothing is missing. You are, by the standard of most brands your size, well organised.
You are also going to fail an audit, and the reason has nothing to do with tidiness.
What a CoA actually is
A Certificate of Analysis is a supplier's statement that a specific lot of a specific material was tested against a specific spec and produced specific results, on a specific date.
Every word in that sentence is load-bearing, and the one that matters most is lot.
A CoA is not a document about turmeric extract. It is a document about this batch of turmeric extract, from this supplier, tested on this date. The next shipment gets a different CoA with different values. They are not interchangeable, and a folder full of them is not evidence of anything unless each one is connected to the material lot it describes and the finished goods that lot went into.
Storage is not the job. Linkage is the job.
A Drive folder is storage. It has no idea what any file means.
What an audit actually looks like
Founders imagine an audit as a document review — someone flips through your files and confirms they exist. That is not how it works.
An auditor picks one thing and pulls the thread.
They point at a finished product on the shelf. They read the lot code. Then:
"Show me the batch record for this lot."
You find it. It is a PDF from your co-packer, or a page in the production spreadsheet.
"This batch record lists eleven inputs. Show me the certificate of analysis for each one, matching the input lot numbers on this record."
Here is where it begins.
You go to the folder. You are looking for eleven specific CoAs. But the filenames do not contain lot numbers, so you open them one at a time. Four are correct. Two are for the right material but the wrong lot — the shipment before. One is a duplicate. One is a photograph of a printed CoA taken at an angle. Two are not in the folder at all and are somewhere in a supplier's email thread. One is for a material that was substituted mid-run and nobody updated the batch record.
The auditor writes that down.
"Your spec for this material requires heavy metals under a defined limit. This CoA doesn't report heavy metals. Show me the current approved spec for this material."
You have a spec. It is from 2023. The supplier changed their testing panel in 2025 and you have been accepting a different set of results for a year without anyone comparing them against the spec on file.
"You changed suppliers for this material in March. Show me the supplier approval documentation, the updated spec, the revised hazard analysis, and the batch record template revision."
Silence.
"Your HACCP plan identifies this ingredient as a control point with a supplier verification programme. Show me the verification records for the new supplier."
That is the audit. It is not eleven separate questions. It is one question, asked recursively, and each answer either produces the next document or produces a finding.
Notice that at no point did the auditor ask "are your files organised?" They asked whether the chain holds.
The chain, and where it breaks
The chain is straightforward to describe:
Supplier → approved spec → purchase order → received lot → CoA for that lot → batch record referencing that lot → finished lot → shipment → customer
Nine links. Every one has to hold under a pull from either direction, and it has to hold for a specific lot, not in general.
In a Drive-and-spreadsheet setup, five of those links exist only in someone's head:
- Which CoA goes with which received lot (filename doesn't say)
- Which received lot went into which batch (batch record may or may not record it accurately)
- Whether the CoA meets the current spec (nobody compares)
- Whether the spec is current (nobody versions it)
- Which finished units went to which customers (3PL data, separately)
Those five gaps are the entire cost. Everything else — messy filenames, inconsistent folders — is cosmetic and auditors do not care.
The three costs, and their sizes
The visible cost: reconstruction time.
When a request comes, someone spends three to ten days assembling. This is the cost founders think about. It is real and it is the smallest of the three.
The medium cost: what you cannot do.
Retailer onboarding questionnaires increasingly ask for documented traceability capability. Some certifications require it. A brand that cannot produce a lot history in hours rather than days is quietly excluded from accounts it never learns it was considered for.
There is also the deal-diligence version. Anyone buying, investing in, or lending against a food brand will test the document chain. Findings do not usually kill deals — they adjust terms.
The large cost: the recall.
This is the one that determines whether the company survives.
If a contamination issue is identified in a raw material lot, the scope of your recall is determined entirely by how precisely you can identify what that lot touched.
With a working chain: input lot → three production batches → 4,200 units → these fourteen retail accounts. You recall 4,200 units.
Without one: you know you bought that material sometime in Q1. You cannot prove which batches used it. You cannot prove which units shipped where. So you recall everything from Q1 — or the retailer does it for you, at your cost, across every SKU containing that ingredient.
The difference between those two scenarios is not a compliance metric. It is whether a bad quarter becomes a closed company.
I want to be careful here: I cannot give you a reliable figure for average recall costs. Published numbers vary enormously by category, scope, and methodology, and most of the widely circulated statistics trace back to surveys with unclear samples. Treat any specific dollar figure you see quoted on this topic with suspicion, including in vendor marketing. The mechanism above holds regardless of the number.
What "good" looks like
Not more folders. Three structural changes.
1. The CoA attaches to the lot, not to a folder.
A received material lot is a record. The CoA is an attachment on that record. You cannot receive the lot without one. Finding the lot finds the certificate — there is no searching, because there is no folder.
2. Specs are versioned and enforced at receipt.
Each supplier-material pair has a current spec with a version and a date. When a CoA is logged, its values are checked against the current spec. Out-of-spec or missing parameters are flagged at the loading dock, not at the audit.
3. Change propagation is automatic.
When you switch suppliers or change a formulation, the system produces the list: which specs need reissuing, which batch record templates reference the old component, which HACCP steps mention it, which finished SKUs are affected, which labels may need revision.
This is the one that matters most and the one no folder structure can ever provide. A change is not an event that happens to one document. It is an event that ripples through a dozen, and in a Drive folder the ripple is entirely invisible.
A test you can run this week
Do not audit your folder. Test the chain.
Pick one finished lot from four months ago. Set a timer. Using only your systems — no calling the ops manager, no supplier emails — produce:
- The batch record
- A CoA for every input lot listed on it, lot numbers matching
- The approved spec current at the time of production, for each material
- The list of customers who received units from that lot
Then check two things: how long it took, and how many of the CoAs were for the wrong lot.
The second number is the one that will surprise you. In most brands that run this test honestly, it is not zero.
The point
Your compliance documentation is probably complete. That is not the same as being defensible.
A Google Drive folder is an excellent place to keep files and a terrible place to keep a chain of custody, because it stores documents and the requirement is relationships. The gap between those two things is invisible right up until the moment someone external asks a question that only relationships can answer.
The files are there. The connections are in someone's head. Audits do not accept that as an answer, and neither do recalls.
This article is general operational guidance, not regulatory or legal advice. Requirements vary by product category, jurisdiction, and certification scheme — verify against your own applicable standards.
Custom Mango builds operational software for growing food, supplement and beauty brands. If this article hit close to home, book a free discovery call — the first conversation is about your business, not about software.