Supplier Audit

A food importer depends on a factory to keep production hygienic. A certificate or sales promise may help, but the importer may need to check how controls work in practice, so a supplier audit sets criteria and examines evidence.

Start by defining the purpose: a quality audit might examine production checks, traceability and handling of defects, while a software vendor audit might focus on access, incident response and subcontractors. Auditing rights should be understood before a visit or remote review, since the contract may specify notice, scope, confidentiality and access to records, and a buyer cannot assume it may inspect every document or employee without permission.

Select suppliers based on risk, weighing criticality, customer impact, past failures and the ease of replacement; a low-risk stationery vendor may not need the same depth of review as a sole-source ingredient supplier. ASQ describes supplier quality management as a continuing effort, from supplier selection through the relationship, with an audit as one tool alongside performance monitoring and corrective action, so a single visit is not a complete supplier programme.

Set criteria before asking questions, using the purchase specification, relevant contract terms and applicable standards, and avoid marking a finding against a rule that the supplier never agreed to and that law does not require. Gather more than one type of evidence by reviewing procedures, logs and training records and comparing them with work on site or a sample of transactions, because a well-written policy does not prove that staff follow it.

Remote audits can work for records and interviews but may be less effective for observing a production line or physical storage, so choose the method to fit the risk and access available, not merely the cheapest option. Auditors should understand the process and stay objective, since someone who approved the same work may struggle to challenge it, and a qualified internal reviewer or specialist should be used when the subject demands technical expertise.

Keep a clear trail of what was sampled: an audit rarely reviews every order or every day of production, so state the period, locations and records covered and avoid claiming that the whole supplier is safe from one sample. Classify findings by consequence and evidence, because a missing signature on one low-risk form differs from repeated failures of a critical control, and define severity criteria rather than giving every item the same label.

Agree on corrective actions with an owner and due date, ask for root cause, not merely a promise to retrain staff, and recheck that the fix was implemented and works before closing a significant finding. A repeated issue may require a wider decision such as increased inspection, an improvement plan, an alternate supplier or paused orders, balancing continuity needs with risk.

Communicate findings clearly and fairly, letting the supplier correct factual misunderstandings while keeping supported observations in the record, because good relationships improve when both sides know what must change and how success will be checked. An illustrative audit pass rate divides suppliers meeting defined criteria by suppliers audited in a period, so seventeen passes among twenty audits is 85%, but this can be misleading if the hardest suppliers were deliberately selected or criteria changed.

Track more useful measures too, such as repeat critical findings, overdue actions, defect rates and supplier delivery performance, because a high pass rate is not a goal if it encourages weak tests, so define the sample before celebrating the number. A certificate may show that a system was assessed to a standard at a point in time, so check scope, validity and whether it covers the relevant site and service, and remember that audit depth should follow the harm of failure, with the value lying in better assurance and decisions, not the number of visits.