What is the difference between a product certificate and a factory audit?

A product certificate such as Matter certification confirms that a specific design conforms to a standard at the time it was tested. A factory audit examines the organisation that keeps producing that design — its quality system, labour practices, environmental controls and traceability — so a brand can judge whether every box off the line matches the certified sample.

What does a social-compliance audit check?

A social-compliance audit checks that a factory respects labour fundamentals: lawful working hours and wages, no child or forced labour, safe conditions, and freedom of association. Common frameworks include the BSCI and SA8000 families, and a credible audit produces a graded report with corrective actions, not just a pass stamp.

Why does a security brand need to audit its ODM, not just trust the certificate?

A security product sits on a wall for years inside a contract the brand sold to someone else. The certificate proves the design; it does not prove the line will keep building that design consistently, or that the workplace behind it will survive a customer's own supply-chain review. An audit is what lets the brand make those promises.

What does the brand own versus what the factory proves in an ODM relationship?

The factory proves it can build the certified design consistently and ethically, and it owns the line, tooling, firmware and volume production. The brand owns the customer relationship, the market-access marks, the supply-chain narrative it tells its own customers, and the decision of whether the factory's audit evidence meets the brand's sourcing policy.

Factory Audits and Social Compliance for a Matter Security ODM: What a Brand Should Verify Before It Commits

An audit is not the same as a certificate

A factory audit examines the organisation that keeps producing a certified design — its quality system, labour practices, environmental controls and traceability — so a brand can judge whether every box off the line matches the tested sample, not just the one unit that went to the lab. A Matter or regional radio certificate is a statement about a design at a point in time; an audit is a statement about the system that reproduces that design every day. A brand that confuses the two discovers the gap only when a customer's procurement team asks for the factory's audit report and finds there is none.

Because the certificate and the audit answer different questions, both belong in the same due-diligence file, and a brand that buys only the certificate is buying half the assurance it needs. The prudent move is to treat the certificate as proof of conformity and the audit as proof of continuity, and to request both before the purchase order, not after a problem surfaces in the field.

The quality-management audit

A quality-management audit verifies that the factory runs a documented system — most commonly aligned to ISO 9001 — that controls incoming components, in-process checks, end-of-line testing and corrective action, so conformance is a process outcome rather than a lucky batch. For a security sensor, the audit should specifically follow how the radio module is handled, how firmware is flashed and locked, and how the device-attestation credentials are written and recorded, because those are the steps where a certified design can quietly diverge from a shipped box.

The audit is most useful when it traces a single defect back through the line, because that exercise reveals whether the factory's records, calibration and training are real or merely written, and a factory that owns its tooling and its line can usually show that trail more completely than one that sub-contracts the build. The depth of that traceability is the difference between a factory you can scale with and one that becomes a liability at volume.

Social compliance: labour and ethics

A social-compliance audit checks that a factory respects labour fundamentals — lawful working hours and wages, no child or forced labour, safe conditions, and freedom of association — and common frameworks include the BSCI and SA8000 families, which grade performance and demand corrective action rather than a simple pass. For a brand selling into markets where customers run their own supplier codes of conduct, this evidence is not optional; it is the document that lets the brand answer a questionnaire truthfully.

The audit's value is in the graded report and the closure plan, not the certificate on the wall, because a single pass stamp can hide recurring gaps while a managed corrective-action trail shows the factory is actually improving. A brand should read the findings, not just the headline result, and should ask how the factory handles the issues the audit raised — the answer tells you more than the score.

Environmental and chemical controls

An environmental audit — often aligned to ISO 14001 — and the chemical-restriction discipline behind marks such as RoHS check that a factory controls hazardous substances, waste and energy in its process, so the product it ships meets the substance limits its customers' markets require. This matters for security hardware because the same sensors cross many borders, and a substance finding in one market can block a whole shipment.

The discipline is only as good as the incoming-material evidence, so a factory that can show material declarations and test reports for its key components gives the brand a defensible position, whereas a factory relying on supplier assurances it cannot reproduce leaves the brand exposed. For a brand building a long-lived security line, that paper trail is part of the product's marketability.

On-site verification beats paperwork

On-site verification means the brand or its appointed auditor physically visits the line, watches the build, and checks that the documented system matches the floor — because a certificate file can be assembled without the factory it describes ever existing in that form. A factory confident in its own operation welcomes the visit; one that stalls, limits access, or insists everything be reviewed remotely is signaling something worth heeding.

The visit also settles a question no document answers: does this factory actually own the tooling, the firmware and the volume line, or is it a trading desk reselling someone else's boxes under a different label? For a security brand that must defend its supply chain to customers, that distinction is the whole point of the audit.

What a build-and-certify factory should show

A build-and-certify factory should be able to show its quality-management certificate, its social and environmental audit history, its in-house tooling and line ownership, its end-of-line test and traceability records, and a willingness to host the brand or its appointed auditor on-site, because the ability to host verification is itself a signal of confidence. At Shenan Yangguang we own the schematic, the tooling, the firmware and the volume line for the Matter security hardware we produce, and we expect to be audited as part of a serious ODM engagement — the questions above are the ones we prepare for, not the ones we fear.

If you are choosing a Matter security ODM and need to verify the factory before you commit, tell us your sourcing policy and your customer's audit requirements; we will open the line, the records and the corrective-action history so your decision rests on evidence, not a brochure. A security brand is only as trustworthy as the factory behind it, and the audit is how both of you prove it.