Executive Summary

A supplier audit is a structured assessment of a manufacturer's capability, quality system, compliance, capacity and operational controls.

Audits are most valuable when they are connected to a clear sourcing decision. The objective is not to collect photographs or certificates. It is to determine whether the supplier can consistently deliver the required product, volume, quality and documentation at an acceptable level of risk.

A strong supplier audit follows the real process from incoming materials to production, inspection, packaging, storage and shipment. It compares documented procedures with actual practice, identifies gaps and produces evidence-based corrective actions.

This guide provides a complete supplier audit checklist for buyers, manufacturers, private label brands, procurement teams and international sourcing professionals. It covers audit planning, factory verification, management systems, quality, production, capacity, compliance, business continuity, scoring and corrective-action follow-up.

CORE PRINCIPLE Audit the process that will produce your product - not only the factory's presentation room, certificates or sales presentation.

1. What Is a Supplier Audit?

A supplier audit is a formal review of a supplier's systems, facilities, people and controls.

It may be performed before supplier approval, before a major order, after repeated quality issues or as part of ongoing supplier management.

The audit should produce a clear conclusion: approve, conditionally approve, require corrective action, restrict scope or reject.

Audit TypePrimary PurposeTypical Timing
Prequalification auditVerify basic capability and riskBefore shortlist or RFQ award
Quality-system auditEvaluate documented controls and implementationBefore approval or annually
Process auditReview one product or production processBefore pilot or mass production
Social / ethical auditReview labor, safety and responsible sourcingBefore approval or periodically
Corrective-action auditVerify closure of critical findingsAfter serious nonconformance
Surveillance auditConfirm continued complianceDuring ongoing supply

2. When a Supplier Audit Is Necessary

Not every low-risk purchase requires a full factory audit. Audit depth should reflect product risk, order value, switching difficulty and compliance exposure.

Critical, regulated, customized or high-volume products normally justify deeper verification.

  • The product has safety, legal or regulatory requirements.
  • The manufacturer will produce to a custom specification.
  • The buyer will pay for tooling or large deposits.
  • The supplier will become a single or strategic source.
  • Quality defects could create major customer or warranty impact.
  • Production involves subcontractors or long supply chains.
  • The factory has not previously produced for the target market.
  • Repeated quality, delivery or communication issues have occurred.
BEST PRACTICE Use a risk-based audit plan. Apply deeper verification where failure would create the greatest business or customer impact.

3. Define the Audit Scope

The audit scope should define the legal entity, factory site, products, processes, standards and time period covered.

A broad audit may review the full management system. A focused audit may examine one production line, material or quality problem.

Unclear scope creates incomplete conclusions.

Scope ElementExample
EntityExact legal company being contracted
SiteFactory, warehouse or service location
ProductSpecific product family or model
ProcessMolding, machining, assembly, filling or testing
StandardBuyer requirements, ISO or regulatory criteria
SubcontractingExternal processes included in the review
PeriodRecords and performance history to examine

4. Prepare the Audit Plan

A professional audit plan should be sent in advance.

It should list the objectives, agenda, required participants, documents and areas to be visited. The supplier should not use the plan to stage evidence, but preparation improves efficiency.

Critical documents should be requested before travel.

Preparation ItemRequired Output
Audit objectiveApproval, process validation or corrective action
AgendaOpening, document review, factory tour and closing
ParticipantsManagement, quality, production and engineering
DocumentsCertificates, procedures, records and performance data
Product informationSpecification, drawings and process flow
Previous issuesComplaints, delays and corrective actions
Sampling planRecords, products and processes to verify

5. Build the Audit Team

The audit team should have the technical and commercial knowledge needed to evaluate the supplier.

A quality auditor may understand systems but require engineering support for specialized processes. Procurement can assess commercial risk, while compliance specialists may be needed for regulated sectors.

Team roles should be clear.

Audit RoleResponsibility
Lead auditorScope, evidence, scoring and final report
Technical expertProcess capability and engineering controls
Quality specialistInspection, traceability and corrective action
ProcurementCommercial and supplier-risk context
Compliance specialistLegal, ethical or regulatory requirements
Translator / local adviserLanguage and local context where needed

6. Opening Meeting Checklist

The opening meeting establishes the scope, confirms participants and explains how findings will be handled.

The auditor should confirm that access to facilities, records and employees will be available.

Restrictions should be documented.

  • Confirm the legal entity and site being audited.
  • Review the audit scope and agenda.
  • Confirm products and processes included.
  • Identify management and process owners.
  • Explain evidence, scoring and finding categories.
  • Confirm access to records, production areas and staff.
  • Review safety and confidentiality requirements.
  • Confirm the closing-meeting time.
Audit QuestionEvidenceRisk Signal
Does the legal entity match the contract?Registration and licensesDifferent name or unexplained structure
Is the factory address verified?Official records and site evidenceInconsistent addresses
Who owns and controls the company?Ownership recordsHidden or unclear owners
Does the business scope include manufacturing?Registration scopeTrading-only registration
Are permits current?Operating and environmental permitsExpired or missing approvals
Do bank details match the entity?Bank letter and contractThird-party or personal account

8. Management Responsibility Checklist

Leadership commitment influences whether systems are followed when production pressure increases.

The audit should review organization, responsibilities, management review, objectives and resource allocation.

Audit QuestionGood Evidence
Are responsibilities documented?Organization chart and job descriptions
Does management review quality performance?Meeting records and actions
Are measurable objectives defined?Quality, delivery and improvement targets
Are resources adequate?People, equipment and budget
Are customer requirements communicated?Internal reviews and controlled documents
Are major risks escalated?Risk register and management action

9. Document Control Checklist

The factory should use current, approved documents at the point of work.

Outdated drawings, uncontrolled instructions and informal changes are common causes of defects.

Audit QuestionEvidenceTypical Finding
Are specifications approved and current?Revision-controlled filesOld drawing at production line
Are work instructions available?Controlled instructionsOperator relies on memory
Are changes authorized?Change requests and approvalsUnapproved material change
Are external standards controlled?Current standards registerExpired customer standard
Are records protected and retained?Retention policy and backupMissing traceability records

10. Supplier and Incoming Material Control

The manufacturer's own suppliers may determine product quality and continuity.

The audit should review supplier approval, incoming inspection, certificates, traceability and handling of nonconforming materials.

Audit QuestionGood Evidence
Are critical suppliers approved?Approved supplier list and evaluations
Are purchase requirements clear?Specifications and quality clauses
Are incoming materials inspected?Inspection records and sampling plans
Are certificates verified?Material certificates and review
Are materials traceable?Lot identification and system records
Are rejected materials controlled?Segregation and disposition

11. Production Planning Checklist

Production planning should connect customer demand, material availability, capacity and delivery commitments.

The auditor should review planning methods, order release, bottlenecks and schedule control.

Audit QuestionEvidence
How are orders planned?ERP, planning board or production schedule
Are materials confirmed before release?Availability checks
Are bottlenecks identified?Capacity analysis
How are urgent orders controlled?Priority and approval process
How is schedule performance measured?On-time production data
How are delays communicated?Escalation and customer notification

12. Production Process Control Checklist

Process control is the heart of the audit.

The auditor should observe actual production and compare it with instructions, parameters and quality records.

Audit QuestionEvidenceRisk Signal
Are process parameters defined?Setup sheets and control plansSettings depend on operator judgment
Are operators trained?Training and authorization recordsUntrained temporary workers
Are first-piece checks completed?Approval recordsProduction starts without validation
Are in-process checks performed?Inspection recordsChecks completed after production
Are defects controlled immediately?Stop, segregate and escalateDefective units mixed with good stock
Are rework instructions approved?Controlled rework processInformal repair methods

13. Equipment and Maintenance Checklist

Audit QuestionGood Evidence
Is equipment suitable for the process?Capability data and machine specifications
Is preventive maintenance planned?Schedule and completed records
Are breakdowns analyzed?Downtime and root-cause records
Are critical spare parts available?Spare-parts list and stock
Is backup equipment available?Contingency plan
Are safety devices functional?Inspection and test records

14. Measurement and Calibration Checklist

Measurements are reliable only when equipment is suitable, calibrated and used correctly.

The auditor should trace selected gauges from the production floor to calibration records.

Audit QuestionEvidenceTypical Finding
Is equipment identified?Unique calibration IDUnmarked gauges
Is calibration current?Certificate and due dateExpired calibration
Is the range appropriate?Measurement capabilityInstrument lacks required accuracy
Are damaged tools controlled?Inspection and quarantineDamaged gauge still in use
Are out-of-calibration results assessed?Impact reviewNo review of affected product

15. In-Process and Final Inspection Checklist

Audit QuestionGood Evidence
Are inspection criteria defined?Control plan and specification
Are inspectors trained?Competence records
Are sampling plans appropriate?AQL or risk-based plan
Are results recorded in real time?Completed inspection reports
Are failed lots controlled?Hold, review and disposition
Is release authority defined?Authorized final approval

16. Nonconforming Product Control

Nonconforming product must be identified, segregated and dispositioned.

The auditor should select a recent defect and trace how it was handled.

Audit QuestionEvidence
Is defective product clearly identified?Labels and physical segregation
Who can approve rework or use-as-is?Defined authority
Are customers informed when required?Communication records
Is root cause investigated?Corrective-action report
Are repeated defects analyzed?Trend data
Is scrap controlled?Destruction and quantity records
WARNING A clean factory without visible rejected material may indicate strong quality - or that defects are not being identified. Verify records and actual disposition.

17. Corrective and Preventive Action Checklist

Corrective action should remove root causes rather than only replace defective units.

The audit should review recent complaints and whether actions were effective.

Audit QuestionGood Evidence
Is the problem clearly defined?Data, scope and affected lots
Is containment immediate?Stock, production and customer actions
Is root cause evidence-based?Structured analysis
Are actions assigned and dated?Action plan
Is effectiveness verified?Follow-up data
Are lessons applied elsewhere?Horizontal deployment

18. Traceability Checklist

Traceability allows the supplier to connect finished product to materials, process conditions, inspection and shipment.

The required depth depends on product risk.

A practical test is to select one finished unit and trace backward, then select one raw-material lot and trace forward.

Traceability ElementEvidence
Raw materialSupplier, lot and receipt
ProductionDate, line, operator and parameters
InspectionResults and equipment used
PackagingLabel and batch information
ShipmentCustomer, quantity and date
RetentionRecords kept for required period

19. Warehouse and Inventory Checklist

Audit QuestionGood Evidence
Are materials identified and protected?Labels, locations and packaging
Is FIFO / FEFO used where required?System and physical practice
Are shelf-life materials controlled?Expiry monitoring
Are nonconforming goods segregated?Locked or clearly marked area
Are conditions monitored?Temperature and humidity records
Is inventory accuracy measured?Cycle counts and reconciliation

20. Packaging and Shipping Checklist

Packaging should protect the product, support traceability and meet customer or legal requirements.

The audit should review packaging materials, artwork control, carton strength, labeling and shipment release.

Audit QuestionEvidence
Are packaging specifications controlled?Approved drawings and materials
Is artwork revision controlled?Approval and file access
Are labels accurate and traceable?Print verification
Are products protected in transport?Drop, compression or transport testing
Are carton quantities verified?Packing records
Is loading controlled?Container inspection and seal record

21. Capacity and Scalability Checklist

The supplier should be able to support current demand and realistic growth.

Capacity should be evaluated at the bottleneck, not only at total machine count.

Audit QuestionEvidence
What is current utilization?Output and available capacity data
Where is the bottleneck?Process-capacity analysis
Can shifts be added?Labor and management plan
Are critical tools duplicated?Tooling and backup
How are peak periods managed?Seasonal plan
What expansion is planned?Investment timeline

22. Workforce and Training Checklist

Audit QuestionGood Evidence
Are skills requirements defined?Competence matrix
Are new employees trained before independent work?Induction and authorization
Are refresher trainings completed?Training records
Are temporary workers controlled?Supervision and restricted tasks
Is turnover monitored?HR data and actions
Are critical roles backed up?Succession and cross-training

23. Health, Safety and Working Conditions

Worker safety and ethical conditions affect compliance, continuity and reputation.

The audit should observe actual working conditions, not only policies.

Audit QuestionEvidenceRisk Signal
Are emergency exits clear?Inspection and observationBlocked or locked exits
Is PPE used correctly?Training and observationMissing protection
Are chemicals controlled?SDS, labels and storageUnlabeled chemicals
Are accidents investigated?Incident recordsRepeated incidents
Are working hours controlled?Time recordsExcessive overtime
Are workers treated lawfully?Contracts and interviewsCoercion or withheld documents

24. Environmental Compliance Checklist

Audit QuestionGood Evidence
Are permits current?Environmental licenses
Is waste segregated and documented?Waste records
Are hazardous materials controlled?Storage and disposal
Are emissions or discharges monitored?Test records
Are spills managed?Response plan and equipment
Are improvement targets tracked?Energy, water or waste data

25. Product Compliance Checklist

The supplier should understand the standards and documentation required for the target market.

The auditor should verify that certificates and test reports apply to the actual product, site and material.

Audit QuestionEvidence
Are applicable standards identified?Compliance matrix
Do test reports match the exact model?Model, material and revision
Are laboratories credible?Accreditation and scope
Are declarations controlled?Authorized and current documents
Are changes assessed for compliance impact?Change review
Are market-specific labels correct?Approved artwork

26. Subcontractor Control Checklist

Subcontractors can create hidden quality, compliance and continuity risk.

The supplier should disclose outsourced processes and demonstrate control.

Audit QuestionGood Evidence
Which processes are subcontracted?Approved process map
Are subcontractors qualified?Audit and approval records
Are requirements flowed down?Purchase specifications
Is incoming output inspected?Verification records
Are changes disclosed?Approval process
Are critical subcontractors backed up?Continuity plan
WARNING Undisclosed subcontracting is a major red flag, especially for regulated, safety-critical or custom products.

27. Information Security and Confidentiality

Audit QuestionGood Evidence
Are customer drawings access-controlled?Permissions and logs
Are confidential files separated?Controlled storage
Are backups maintained?Backup and recovery tests
Are cyber incidents managed?Response plan
Are employees bound by confidentiality?Agreements and training
Are files returned or deleted after termination?Documented process

28. Business Continuity Checklist

The audit should test whether the supplier can continue operating after disruption.

Critical scenarios include equipment failure, fire, flood, cyber incidents, power loss, material shortages and loss of key staff.

Continuity AreaEvidence
Risk assessmentIdentified critical scenarios
Emergency planResponsibilities and communication
Backup equipmentAlternative capacity
Alternative suppliersQualified sources
Data recoveryTested backups
Customer communicationEscalation and notification
Plan testingDrills and lessons learned

29. Financial and Commercial Risk Checklist

Audit QuestionEvidence
Can the supplier finance materials and payroll?Financial statements or credit review
Is customer concentration high?Revenue distribution
Are major debts or disputes known?Disclosures and records
Are payment terms sustainable?Working-capital analysis
Is pricing based on realistic cost?Quotation breakdown
Could urgent cash pressure affect quality?Liquidity indicators

30. Interviewing Employees During the Audit

Employee interviews help confirm whether procedures are understood and followed.

Questions should be open, respectful and relevant to the person's role.

Answers should be compared with records and observation.

  • What are the critical steps in your work?
  • Which drawing or instruction do you use?
  • What do you do when you find a defect?
  • How do you know the equipment is ready?
  • Who approves a change or rework?
  • When were you last trained?
  • What happens if production is delayed?

31. Collecting Objective Evidence

Audit conclusions should be based on observable facts, records and interviews.

One isolated example may not represent the full system, but it can reveal where deeper sampling is needed.

Photographs should be permitted and handled according to confidentiality rules.

Evidence TypeExample
ObservationActual production practice
RecordInspection, training or maintenance data
InterviewEmployee explanation of process
DocumentProcedure, drawing or standard
SamplePhysical product or material
Data trendQuality, delivery or downtime history

32. Classify Audit Findings

Finding categories should be defined before the audit.

A critical finding indicates immediate unacceptable risk. A major finding indicates a significant system failure. A minor finding is a limited lapse that does not yet represent systemic failure. Observations identify improvement opportunities.

Finding LevelDefinitionTypical Action
CriticalImmediate safety, legal, fraud or severe quality riskStop approval or shipment
MajorSignificant system failure or repeated nonconformanceCorrect before approval or within short deadline
MinorIsolated lapse with limited immediate riskCorrect within agreed period
ObservationPotential weakness or improvement opportunityMonitor or improve

33. Score the Supplier Audit

Audit CategoryWeight
Management and document control8
Supplier and material control8
Production process control15
Quality and inspection15
Equipment and calibration8
Traceability and warehouse8
Capacity and workforce8
Compliance, safety and environment10
Subcontracting and continuity10
Commercial and information security10
ScoreDecision
90-100Approved
80-89Approved with minor corrective actions
70-79Conditional approval; major actions required
60-69Restricted approval or pilot only
Below 60Not approved
BEST PRACTICE Use both the weighted score and mandatory go/no-go gates. A high average score should never cancel a critical legal, safety or compliance failure.

34. Mandatory Go/No-Go Audit Gates

GateMinimum Requirement
Legal identityVerified entity and operating authorization
Product complianceRequired standards and valid evidence
Critical processDemonstrated control and capability
TraceabilitySufficient for product risk
Fraud preventionVerified bank and ownership structure
Safety / ethicsNo unacceptable critical condition
Change controlWritten approval before critical changes
SubcontractingFull disclosure and control

35. Closing Meeting Checklist

  • Restate the audit scope.
  • Summarize positive evidence.
  • Present each finding clearly.
  • Explain finding severity.
  • Confirm factual accuracy with process owners.
  • Agree immediate containment where necessary.
  • Confirm corrective-action deadlines.
  • Explain the approval decision and next steps.

36. Corrective Action Plan

The corrective action plan should address root cause, not only the visible symptom.

Each action should have an owner, due date and evidence requirement.

Critical and major findings should be verified before full approval.

CAPA FieldRequired Content
FindingClear factual statement
ContainmentImmediate risk control
Root causeEvidence-based analysis
Corrective actionPermanent system change
OwnerNamed accountable person
Due dateAgreed completion date
EvidenceDocument, record, photo or re-audit
EffectivenessProof the issue does not recur

37. Follow-Up and Re-Audit

Closing findings on paper is not enough when risk is significant.

Verification may include document review, video evidence, sample inspection, remote audit or on-site re-audit.

The supplier's speed and quality of corrective action is itself an important performance indicator.

Verification MethodBest Use
Document reviewProcedure or training update
Photo / video evidencePhysical segregation or installation
Product sampleQuality or packaging correction
Remote auditFocused process confirmation
On-site re-auditCritical, systemic or repeated findings

38. 30-Day Supplier Audit Plan

PeriodMain ActionsOutput
Days 1-5Scope, risk review and document requestAudit plan
Days 6-10Desk review and question preparationFocused checklist
Days 11-15On-site or remote auditEvidence and findings
Days 16-20Report and supplier responseCorrective-action plan
Days 21-30Verification and approval decisionFinal supplier status

39. Common Supplier Audit Mistakes

  • Auditing the wrong legal entity or site.
  • Using a generic checklist without product context.
  • Reviewing certificates without observing production.
  • Allowing the factory to control the entire tour.
  • Failing to sample real records.
  • Ignoring subcontractors.
  • Scoring findings without mandatory gates.
  • Accepting corrective actions without root cause.
  • Failing to verify closure.
  • Treating one successful audit as permanent approval.

40. Practical Example: Audit Before Supplier Approval

A buyer planned to source a custom industrial sensor housing from a new factory. The supplier presented strong certificates and competitive pricing.

During the audit, the team found that machining was controlled well, but surface treatment was outsourced to an undisclosed subcontractor. Traceability between raw material, machining and finishing was incomplete. Final inspection records were also completed at the end of the shift rather than in real time.

The supplier received conditional approval. It disclosed and qualified the subcontractor, introduced lot-based traceability and revised inspection recording. A focused re-audit confirmed the changes.

The buyer then released a pilot order rather than full annual volume. This staged decision reduced risk without rejecting a technically capable supplier.

41. Complete Supplier Audit Checklist

  • Confirm the legal entity and factory site.
  • Define the audit scope and product risk.
  • Request key documents before the visit.
  • Build a qualified audit team.
  • Confirm access during the opening meeting.
  • Verify ownership, permits and bank details.
  • Review management responsibility and objectives.
  • Check document and change control.
  • Evaluate upstream supplier controls.
  • Review production planning and bottlenecks.
  • Observe actual process controls.
  • Inspect equipment and maintenance records.
  • Trace calibration records.
  • Review in-process and final inspection.
  • Verify control of nonconforming product.
  • Test corrective-action effectiveness.
  • Perform backward and forward traceability tests.
  • Inspect warehouse and inventory controls.
  • Review packaging and shipment release.
  • Validate capacity and scalability.
  • Check training and workforce controls.
  • Review safety and working conditions.
  • Verify environmental permits and controls.
  • Validate product-compliance evidence.
  • Review subcontractor disclosure and approval.
  • Check information security and confidentiality.
  • Review business-continuity capability.
  • Assess financial and commercial risk.
  • Interview employees and collect objective evidence.
  • Classify findings consistently.
  • Apply weighted scoring and mandatory gates.
  • Agree corrective actions and deadlines.
  • Verify closure before full approval.

42. Frequently Asked Questions

What is a supplier audit?

It is a structured assessment of a supplier's capability, systems, facilities, controls and risks.

When should a factory audit be performed?

Before approving critical, customized, regulated, high-value or strategically important suppliers.

Can a supplier audit be remote?

Yes, for limited scopes or follow-up. High-risk processes may still require an on-site visit.

What should be checked first?

Confirm the legal entity, site, scope and actual production process.

Are ISO certificates enough?

No. Certificates are useful evidence, but actual implementation and product-specific capability must be verified.

How are audit findings classified?

Common categories are critical, major, minor and observation.

What is a supplier audit scorecard?

It is a weighted system used to compare performance across audit categories.

What is a go/no-go gate?

It is a mandatory requirement that cannot be offset by a high average score.

How should corrective actions be verified?

Through records, evidence, samples, remote review or on-site re-audit depending on risk.

How often should suppliers be re-audited?

Frequency should depend on risk, performance, changes and regulatory requirements.

Can XibUp help identify suppliers to audit?

XibUp can support discovery and networking with manufacturers, suppliers and other international partners.

Who should perform the audit?

A qualified lead auditor supported by technical, quality, procurement or compliance specialists as needed.

Conclusion

A supplier audit converts assumptions into evidence.

The strongest audits follow the real product process, test records, interview employees and connect findings to sourcing risk. They do not rely only on certificates, presentations or appearance.

Companies that use structured audits, mandatory gates and verified corrective actions are better positioned to protect quality, compliance, continuity and customer trust.

XIBUP PERSPECTIVE XibUp helps companies discover and connect with manufacturers and suppliers across international markets. A disciplined supplier audit framework helps convert those connections into reliable and controlled supply relationships.