Three levels of compliance language explained. When each is sufficient, why certificate ownership matters, and 10 questions to ask every supplier.