Product safety documents: answer an audit in hours

The message arrives on a Saturday. A listing is suspended pending a compliance review, and the platform wants documentation within a stated window. Most brands then spend four days emailing a factory in a different time zone, hunting for a test report that somebody downloaded to a laptop that has since been replaced. The listing stays down. In a peak week, that is the whole quarter for that SKU.

The fix is not more documents. It is the same documents, held in a structure that maps to how a compliance team asks for them. Built once, a listing challenge becomes a two hour job.

Four tiers, because that is how the questions arrive

Organise the pack in four tiers. Entity level, category level, SKU level, batch level. Every request a marketplace or a regulator makes lands in exactly one of them.

Tier one, entity. Certificate of incorporation, PAN, GST registration certificate, Importer Exporter Code where you import, the trademark registration certificate for the brand, and your seller entity details. These change rarely and are shared across every SKU. Keep one folder and never let a team member send a screenshot version.

Tier two, category authorisations. These are permissions to operate in a product class rather than approvals of a specific item. The FSSAI licence for food and nutraceuticals. The CDSCO registration for imported cosmetics, obtained on the SUGAM portal. The drug import licence where the classification demands one. The BIS licence or registration for products under a Quality Control Order or the Compulsory Registration Scheme. WPC Equipment Type Approval for products using de-licensed radio frequency bands, which catches almost anything with Bluetooth or Wi-Fi. TEC certification under the Mandatory Testing and Certification of Telecom Equipment regime for telecom gear. EPR registration numbers for plastic packaging, e-waste and batteries, depending on what you sell and how you pack it.

Tier three, the SKU technical file. This is the tier that decides how fast you can respond, and it is the tier nobody builds until they need it. One folder per SKU containing the test report from an accredited laboratory against the applicable Indian Standard, the declaration of conformity signed by the manufacturer or the importer, the product specification sheet, the artwork approved for that pack, the bill of materials with material grades, the ingredient or component list, the user manual and warranty terms where applicable, and the manufacturing agreement clause that names who is responsible for conformity.

Tier four, batch records. The certificate of analysis for the batch where your category uses one. The batch manufacturing record. The inward goods receipt note that links the batch to a purchase order and an invoice. For imports, the Bill of Entry that links the batch to a specific consignment. This tier is what turns a general claim of compliance into a traceable one.

The importer line and why it anchors everything

For imported goods, the importer identity that appears on the pack has to be the same legal entity that appears on the Bill of Entry, on the purchase invoices, on the category authorisation and on the marketplace seller account. The exact label content requirements sit under packaged commodity rules, which we cover separately, so treat that as a formatting question handled elsewhere.

The point here is structural. When a compliance reviewer opens your pack shot and reads the importer name, then opens your uploaded certificate and reads a different entity name, the review fails, and it fails without a useful reason code. Brands with a group structure trip on this constantly. One entity holds the CDSCO registration, another actually imports, a third sells on the marketplace. Reconcile that before you list, or expect the mismatch to surface at the worst moment.

What to keep per SKU and per category

Use this split when you build the folder tree.

• Per category, kept once: the authorisation or licence, its validity dates, the scope covered by it, the issuing authority reference number, and the renewal owner by name.
• Per SKU, kept forever: test report, declaration of conformity, specification, approved artwork, bill of materials, supplier agreement extract.
• Per batch, kept for the retention period your category requires: certificate of analysis, batch record, goods receipt, Bill of Entry, and the shelf life or expiry data.

Retention periods differ by regulator, and a few require you to hold records well past the product shelf life. Confirm the requirement for your category rather than defaulting to a general rule, and set the retention period in the folder naming so nobody deletes early.

Making it answerable in hours

Structure alone does not produce speed. Four habits do.

Adopt one file naming convention and enforce it: SKU code, document type, issue date, expiry date. A reviewer should be able to read validity from the filename without opening the file. This single change removes most of the search time in an audit.

Maintain a compliance register as a spreadsheet with one row per SKU and columns for every document type, holding the file path, issue date, expiry date and owner. Colour the expiry column by days remaining. Review it in the monthly operations meeting, not annually.

Keep the originals in one place with controlled access. Not a shared laptop, not a WhatsApp thread, not a vendor mailbox. If the only copy of a test report lives with your sourcing agent, you do not have a test report.

Pre-write the response. Draft a standard reply that states the product, the applicable standard, the certificate number, the issuing authority and the validity, with the attachments listed in order. Most compliance teams are reading dozens of these a day. A clean, indexed response is reinstated faster than a folder dump, every time.

Test the system before it is tested for you. Pick three SKUs at random, ask the owner to produce the full pack, and time it. If it takes more than two hours, you have found the gap while it is still cheap to close.