Supplier Audit Checklist: What to Verify Before the First Order

Define the audit scope before booking a visit

Start with the product, process, site and order you are evaluating. A factory that makes a similar item may use different equipment, materials, subcontractors or quality controls for your product. State the intended use, critical specifications, required good quantity, target date and consequences of failure. Use those facts to decide whether a remote document review, live video walkthrough, on-site audit or independent specialist is proportionate to the risk.

Agree who will audit, who may answer questions, what records can be viewed, which production areas are in scope and how confidential information will be handled. Use the contract, customer requirements and applicable regulation to set the audit criteria. Do not copy a generic pass mark or treat every supplier as equally risky.

Scope checklist

• Product, drawing or specification revision and intended use
• Supplier legal entity, production site and any subcontracted processes
• Order quantity, delivery window and required quality level
• Critical-to-quality characteristics and acceptance criteria
• Audit method, participants, records and permission boundaries
• Decision owner and criteria for approval, conditional approval or rejection

Review documents before the audit

Request the documents that can be checked before anyone travels: company and site identity, relevant certifications, process flow, quality procedures, inspection plans, equipment list, calibration records where relevant, sample records, capacity assumptions and examples of traceability. Record the issue date, scope, site and issuer for each document. A certificate for another legal entity, site, product scope or expired period does not establish the condition you need to evaluate.

Use independent confirmation where the claim is material and a suitable verification route exists. ISO explains that certification is performed by external certification bodies; ISO itself does not certify individual organizations. Certification can be one input, but it does not prove that the exact product, process, lot or delivery commitment is acceptable. If a record cannot be shared for a legitimate reason, note the limitation and agree what alternative evidence would be adequate.

Pre-audit document pack

• Legal entity and site details that match the contracting party
• Applicable certificates, scope, expiry and issuing body
• Process flow and current work instructions for the product
• Inspection, test, nonconformance and corrective-action records
• Relevant equipment, maintenance and calibration evidence
• Production plan, material sourcing and subcontractor list

Observe the real process, not only the presentation

Walk the process from incoming material through production, inspection, packing and dispatch. Compare what operators actually do with the approved work instructions and process flow. Ask staff to explain the controls in their own words and show the record created at the point of work. A staged demonstration can be useful, but it should not replace observation of routine work where access is authorized.

Look for control of revisions, identification of material, prevention of mix-ups, protection of work in progress, equipment suitability and the handling of rework. If the audit is remote, document which areas, records or operating conditions could not be observed. Do not turn a video call into a claim that the entire facility was independently inspected.

Process observation prompts

• Does the work match the current drawing and approved revision?
• Can operators identify the acceptance criteria and escalation route?
• Are material, tools, gauges and work in progress clearly identified?
• Are rejected, reworked and approved items kept distinguishable?
• Can the supplier show the actual process used for the product in scope?

Check the quality controls at the points that matter

Identify the product characteristics where a failure would affect safety, fit, function, compliance or customer acceptance. Confirm how each characteristic is controlled: incoming checks, in-process measurements, final inspection, functional tests, approved test methods or another suitable control. Ask to see the records and how failed results are contained. The correct controls depend on the product and risk; a generic checklist cannot define every technical requirement.

Ask how measurement equipment is selected and maintained, how staff competence is established, and how a process change is reviewed before use. For outsourced or special processes, establish who owns the control and what evidence returns with the finished item. If the supplier has a quality-management certificate, review the scope and practical controls rather than assuming the certificate guarantees every shipment.

Quality evidence to sample

• Current inspection plan and acceptance criteria
• Recent measurements or test results for comparable work
• Control of nonconforming material and rework
• Gauge suitability and calibration where required
• Change control for process, material and specification revisions
• Competence and authorization for critical operations

Test traceability and record retrieval

Choose a sample of a finished item or lot and ask the supplier to trace it backward to the material, process, inspection and relevant records. Then select a material or batch record and trace it forward to the affected finished goods or shipments where the system supports that. The purpose is to test whether the records connect, not merely whether documents exist in separate folders.

If the supplier cannot connect a product to its source or inspection record, define the gap precisely. It may be a documentation weakness, a system limitation or a product-specific risk; the evidence determines the severity. Ask how long records are retained, who can retrieve them and how the supplier would identify other potentially affected lots if a defect were discovered.

Traceability test

• Select a sample, lot or serial number and record the selection
• Trace material and process records back to their source
• Trace the same identifier forward to inspection, packing or shipment
• Check that dates, quantities, revisions and identifiers reconcile
• Record missing links and the evidence needed to close them

Assess capacity, delivery and supplier dependencies

Quality capability is not enough if the supplier cannot deliver the required quantity by the required date. Review the relevant production steps, bottlenecks, available shifts, material lead times, current commitments, expected yield, changeovers and any subcontracted operation. Ask for the evidence behind capacity claims and distinguish actual recent output from theoretical machine capacity or a sales estimate.

Discuss how shortages, equipment failure, staff absence or a rejected batch would affect the order. A backup plan is useful only if its assumptions are realistic and approved. If the supplier relies on a critical subcontractor, the audit scope may need to include that process or require additional evidence. Do not promise a delivery date based only on the supplier's verbal confidence.

Delivery-readiness checks

• Evidence of comparable recent output and good-unit yield
• Capacity available during the actual order window
• Material availability and supplier lead times
• Maintenance, changeover and staffing constraints
• Subcontracted steps and their control evidence
• Escalation plan for shortages, delays or failed inspection

Record findings with evidence and clear owners

Write findings as an observed condition compared with a stated requirement. Include the evidence reference, site or process, affected product, risk, owner and required follow-up. Separate a missing document, a process deviation and a potential product failure instead of combining them into a vague statement such as poor quality. Define severity using your own quality system or contract; labels such as critical, major and minor need clear criteria before they are applied.

Agree the response date according to the risk and the supplier relationship. A correction may address an individual issue, while corrective action should address a supported cause and include an effectiveness check where appropriate. Keep unresolved findings open. A supplier's promise to fix something is not evidence that the fix was implemented or effective.

Finding record fields

• Requirement and source document or revision
• Observed condition and evidence reference
• Risk, affected scope and any immediate containment
• Severity criteria, owner and response date
• Required action and completion evidence
• Effectiveness test and closure approver

Make the approval decision explicit

Use a documented gate rather than relying on the general impression from the visit. A supplier may be approved for a defined product and volume, approved conditionally after specific evidence is received, held for re-audit or rejected because a mandatory requirement failed. State which conditions must be closed before production or shipment and who is authorized to release the hold.

The audit result should be proportionate to the evidence. A good visit does not guarantee future performance, and a limited remote review should not be represented as a full on-site audit. For regulated, safety-critical or high-value products, use the appropriate quality, regulatory, engineering and legal review rather than treating this general checklist as a substitute for the required specialist process.

Decision gate

• Mandatory requirements passed or failed with evidence
• Open findings and their owners listed
• Conditional approval conditions and due dates recorded
• Sample, pilot run, inspection or re-audit requirements defined
• Final decision owner and release authority identified

Worked example: audit a packaging supplier

Illustrative example: a buyer is considering a supplier for custom cartons. The audit scope includes board specification, print revision, adhesive or joining process where relevant, dimensions, compression or other required tests, lot identification, packing and dispatch. The auditor selects a recent production record, checks that the approved artwork revision was used, traces a finished batch to its board lot and reviews how rejected cartons were segregated. The buyer also compares the planned output with the order quantity and due date.

If the supplier cannot show revision control or trace a finished batch, the decision is not automatically to reject it. The buyer records the gap, evaluates the risk, requests specific evidence or a corrective action, and decides whether a sample or pilot order is appropriate before approving full production. The details and tests must be adapted to the actual carton specification and customer requirements; this example is not a universal packaging standard.

Turn the audit into the next Needo task

Needo can help turn a product brief, supplier documents and known risks into a structured audit plan, question list, evidence register and decision template. Give it the product, site, order size, critical requirements and the evidence already available. Ask it to distinguish confirmed records from supplier claims, identify missing evidence and prepare follow-up questions that are specific enough to resolve the risk.

Review the checklist with the responsible quality or procurement owner before using it. Needo should not invent audit observations, certify a factory, claim that an audit was performed or approve a supplier without evidence. The useful outcome is a reviewable plan and decision trail that records what was checked, what remains unknown and what must happen next.