A supplier’s failure is your failure. When a lithium battery catches fire or a batch of steel rusts prematurely, the customer blames the brand on the box, not the factory that made it.
Supplier quality audits are the primary defense against this risk. Unlike a simple product inspection (which checks output), an audit checks the system—the machinery, processes, training, and culture—that produces the output.
For sourcing managers and quality engineers, the challenge isn’t just “doing an audit.” It’s designing a supplier audit program that filters out high-risk vendors and develops good ones into great partners. This guide provides the operational blueprint to plan, execute, and follow up on supplier audits effectively.
Key Takeaways
- Audit the System, Not Just the Product: Inspections catch bad parts; audits prevent them by fixing the process.
- Risk-Based Frequency: Do not audit every supplier annually. Focus resources on high-spend, single-source, or high-risk partners.
- Evidence is Mandatory: “Trust but verify.” If you didn’t see the record, it didn’t happen.
- Traceability Drill: The most critical test. If a factory cannot trace a finished product back to the raw material batch in 4 hours, they fail.
- Triangulation: Verify every claim with three data points: Interview (what they say), Procedure (what is written), and Record (what is done).
- Closing Meeting Matters: Get the supplier to sign and agree to the findings before you leave the building to avoid arguments later.
- CAPA is the Goal: The audit report is useless without a closed Corrective Action Plan.
- Effective Supplier Partnership: Audits should be collaborative, not combative. Use them to help the supplier improve, which reduces your costs.
- Independence: Auditors must be independent of the procurement decision to avoid conflicts of interest.
What Is a Supplier Audit (and What It Is Not)
A supplier audit is a documented, on-site verification of a supplier’s quality management system (QMS), process controls, and compliance capabilities.
Audit vs. Inspection vs. Testing
| Feature | Supplier Audit | Supplier Inspection | Product Testing |
|---|---|---|---|
| Target | The System (Process, People, QMS). | The Batch (Finished Goods). | The Material (Chemical/Physical). |
| Timing | Before contract (Qualification) or Annual. | Before shipment (PSI) or During Production. | Design phase or Random Check. |
| Output | Scorecard (0–100%) & CAPA Plan. | Pass/Fail Report for Shipment. | Lab Report (Lead content, Tensile strength). |
| Goal | Long-term capability & risk reduction. | Short-term quality control. | Regulatory compliance. |
Types of Supplier Audits (Choose the Right One)
One size does not fit all. Sending a detailed QMS auditor to a simple packaging distributor is a waste of time.
1. Quality System Audits (QMS)
- Focus: ISO 9001 compliance. Policies, management review, training, document control.
- Best For: Qualifying new potential strategic suppliers.
2. Process Audits
- Focus: A specific manufacturing line (e.g., the painting line). Detailed check of machine settings, cycle times, and operator discipline.
- Best For: Solving a specific recurring defect (e.g., “Why is the paint peeling?”).
3. Product Audits
- Focus: Re-validating a finished product against the original drawing and Bill of Materials (BOM).
- Best For: Annual re-validation of critical parts.
4. Compliance Audits
- Focus: Social responsibility (SA8000), environmental (ISO 14001), or security (C-TPAT).
- Best For: Retailer requirements (Walmart/Target) and ESG reporting.
Decision Matrix: Which Audit?
| Goal | Recommended Audit Type | Typical Trigger |
|---|---|---|
| New Supplier Qualification | QMS Audit (System) | Sourcing a new critical component. |
| Fix Recurring Defect | Process Audit | Monthly defect rate spikes > 3%. |
| Cost Reduction | Process (Lean) Audit | Supplier requests a price increase. |
| Retailer Compliance | Compliance Audit | Annual requirement from big-box retail. |
When to Audit Suppliers (Risk-Based Prioritization)
You cannot audit everyone. Use a risk scoring model to prioritize.
Supplier Criticality Score (Example)
Score each supplier (1–5) on these factors:
- Spend: High spend = High impact.
- Complexity: Custom parts = High risk (Off-the-shelf bolts = Low risk).
- Single Source: If they fail, does the line stop?
- Quality History: Past defect rate.
Audit Frequency Guide
| Tier | Risk Level | Audit Frequency | Audit Type |
|---|---|---|---|
| Tier A | Critical / Strategic | Every 12 Months | Full QMS + Process Audit. |
| Tier B | Key / High Spend | Every 24 Months | Simplified QMS Audit. |
| Tier C | Commodity / Low Risk | None | Rely on Incoming Inspection / Certs. |
This approaches supplier quality management strategically, allocating budget where it protects the business most.
The Audit Process (Step-by-Step)
A professional audit process prevents “tourism auditing” (just walking around and looking at things).
1. Define Scope & Criteria
What standard are we auditing against? ISO 9001? Your company’s specific “Supplier Manual”? Send this to the supplier 2 weeks in advance.
2. Pre-Audit Document Request
Ask for the Quality Manual, Org Chart, and Process Flow Map before booking travel. If they can’t provide these, don’t go.
3. On-Site Execution
- Opening Meeting: Set the tone. “We are here to verify compliance and find opportunities to improve.”
- Floor Walk: Follow the material flow (Receiving -> Warehouse -> Production -> Shipping).
- Interviews: Talk to operators, not just managers. Ask: “Show me how you measure this part.”
4. Traceability Drill (The “Acid Test”)
Select a finished box from the warehouse. Ask the supplier to trace it back to the raw material batch within 4 hours. They must show:
- Production date & shift.
- QC inspection records for that batch.
- Raw material lot number.
- Incoming invoice from their supplier.
5. Closing Meeting
Review findings. Ensure the supplier understands the non-conformances. Get a signature of acknowledgement.
6. Report & CAPA
Issue the formal report within 48 hours. Require a CAPA plan within 10 business days.
Supplier Audit Checklist (Master + Quick Checklist)
A good supplier audit checklist is not just Yes/No questions; it requires evidence.
Master Checklist Sections
1. QMS & Document Control
- Is the Quality Policy communicated to employees?
- Is there a procedure for controlling documents (versions, approvals)?
- Evidence: Check 3 SOPs for correct version numbers.
2. Training & Competency
- Are training records maintained for all operators?
- Is there a skills matrix defining who is qualified for which machine?
- Evidence: Pick 2 operators and ask to see their training files.
3. Incoming QC & Supplier Controls
- Are raw materials inspected upon arrival?
- Are “Approved Samples” available for comparison?
- How are sub-suppliers monitored?
- Evidence: Review last month’s incoming inspection log.
4. Process Controls & SPC
- Are Work Instructions (WI) visible at every station?
- Is “First Piece Inspection” performed at shift start?
- Are machine parameters (temp, speed, pressure) monitored?
- Evidence: Check machine settings against the Control Plan.
5. Equipment Calibration
- Is there a Master Calibration Schedule?
- Do gauges have valid stickers?
- Evidence: Check the sticker on a random caliper.
6. Non-Conforming Material (NCM)
- Is there a locked “Red Box” or quarantine area?
- Is there a procedure for rework authorization?
- Evidence: Look inside the Red Box. Are items tagged?
7. Final Inspection & Packaging
- Is 100% or sampling inspection performed before packing?
- Are cartons labeled and stacked correctly?
8. Traceability
- Can finished goods be linked to raw material lots?
Quick Checklist (The “Walk-Through” 30)
- Is the factory clean (5S)?
- Are exits unlocked?
- Do operators wear PPE?
- Are material bins labeled?
- Is the “Golden Sample” visible?
- Are measurement tools calibrated?
- Is the rework area segregated?
- Are work instructions in the local language?
- Is the warehouse organized (FIFO)?
- Is the roof leaking?
Scoring, Findings, and Pass/Fail Decision Rules
Findings Classification
- Critical (0 points): Safety hazard, child labor, total system failure, bribery. -> Automatic Fail.
- Major (-5 points): Absence of a required system (e.g., “No calibration system exists”).
- Minor (-2 points): Lapse in discipline (e.g., “One gauge was overdue for calibration”).
Scoring Formula
Score=Total Possible PointsTotal Points Earned×100
Supplier Status Decision
| Score | Status | Consequence |
|---|---|---|
| 90–100% | Approved | Preferred Supplier status. |
| 75–89% | Conditional | Approved, but CAPA must be closed in 30 days. |
| < 75% | Not Approved | New business hold. Re-audit required in 90 days. |
This supplier audit process ensures that decisions are data-driven, not based on “feelings.”
CAPA & Supplier Development (Turn Audits Into Continuous Improvement)
The audit is wasted if nothing changes. Drive continuous improvement through CAPA.
The CAPA Cycle
- Containment (24 hours): Quarantine suspect stock immediately.
- Root Cause (5 days): Use “5 Whys” or Fishbone diagram. Don’t accept “Worker error” as a root cause.
- Corrective Action (14 days): Implement the fix (e.g., install a sensor, update the mold).
- Preventive Action: Update the FMEA or Control Plan to prevent recurrence elsewhere.
- Verification (30-60 days): Auditor reviews evidence (photos, logs) to close the finding.
How to Build a Supplier Audit Program (Annual Operating System)
Don’t just audit randomly. Build a structured supplier audit program.
1. Segmentation
Divide suppliers into Tier A, B, and C based on risk.
2. The Calendar
Create an annual schedule. Share it with suppliers in Q1 so they can prepare.
3. The Dashboard
Track your program health:
- Schedule Adherence: % of audits completed on time.
- Findings Closure Rate: % of CAPAs closed within 60 days.
- Repeat Findings: Are we finding the same issues every year? (Bad sign).
4. Integration
Feed audit scores into the broader quality management system. A supplier with a low audit score should be blocked from receiving new RFQs (Requests for Quotation).
Common Mistakes (and How to Avoid Them)
- Auditing the Wrong Supplier: Spending budget auditing a bolt supplier while the complex electronics vendor goes unchecked.
- Checklist Zombies: Checking “Yes” because the document exists, without verifying if the shop floor actually does it.
- No CAPA Follow-up: The most common failure. Collecting reports but never forcing the supplier to fix the issues.
- Subcontractor Blindness: Failing to ask, “Do you make 100% of this here?” (Many suppliers secretly outsource).
FAQ
How do we conduct supplier quality audit?
Start by defining the standard (audit criteria), requesting documents, planning the agenda, visiting the site to verify processes/records, and issuing a report with required corrective actions.
What is a supplier audit checklist?
A tool used by auditors to ensure all critical areas (Quality, Manufacturing, HR, etc.) are reviewed. It provides a structured way to gather evidence.
How often should suppliers be audited?
High-risk (critical) suppliers should be audited annually. Medium-risk suppliers every 2–3 years. Low-risk suppliers may never need an on-site audit.
What happens if a supplier fails an audit?
They are usually placed on “New Business Hold” or “Probation.” They must submit a CAPA plan and pass a re-audit before full status is restored.
Supplier audit vs factory audit?
They are often used interchangeably. “Supplier Audit” implies a focus on the business relationship and quality system, while “Factory Audit” often implies a broader check of capacity and capability.
Who should be on the audit team?
Ideally, a certified Lead Auditor supported by a technical expert (engineer) who understands the specific manufacturing process (e.g., plastics, casting).
What is the difference between a desk audit and an on-site audit?
A desk audit reviews documents remotely (certificates, manuals). An on-site audit verifies that the factory actually follows those documents in real life.
Can we use third-party auditors?
Yes. Using firms like Intertek, SGS, or specialized consultants is common, especially for overseas suppliers where travel costs are high.
What is “audit evidence”?
Facts that can be proven. “The manager said they check quality” is hearsay. “Here is the logbook showing quality checks for June 1st” is evidence.
How do you handle a supplier who refuses an audit?
This is a major red flag. It usually means they are hiding something (subcontracting, bad conditions). If they refuse, you should consider finding a new supplier.
What is a “process audit” vs “system audit”?
A system audit checks the whole company (HR, Training, Mgmt). A process audit drills deep into one manufacturing line (temperature, speed, pressure settings).
Why is the opening meeting important?
It establishes authority, sets the timeline, and calms the supplier’s nerves, making the audit run smoother.