A supplier audit is a planned check, by the buyer or on the buyer's behalf, of whether a supplier is meeting what it promised. Plan it by risk, agree the scope in writing, test records instead of taking statements on trust, and follow findings through to closure. Audit the suppliers whose failure would hurt you most, not all of them equally.
Last reviewed: 17 October 2026. Facts checked. A web search found that ISO 9001 clause 8.4 (externally provided processes, products and services) does not explicitly mandate supplier audits, and that clause 8.4.2 sets the type and extent of control, in proportion to the risk. It also found that ISO 19011 is guidance, not requirements, and is used for internal and external audits including of suppliers. The sources were mainly vendor and training blogs. The search found no source defining second-party versus third-party audits, so we describe them in our own words. We did not open ISO 9001 or ISO 19011, which are paid documents.
Kinds of supplier audit
| Type | Who does it | Typical use |
|---|---|---|
| Desk review | You, from documents | Low-risk suppliers, first screening |
| On-site audit by the buyer | Your staff | Critical suppliers |
| Audit by an appointed firm | An outside auditor on your behalf | Many sites, far locations |
| Supplier's own certificates | The supplier's certification body | Evidence you read, not an audit you run |
The terms "second-party" and "third-party" are used differently by different people, so define them in your audit letter. Reading a supplier's ISO certificate is not a supplier audit. See ISO 27001 vs SOC 2 for how to read such reports.
Step 1: Decide which suppliers to audit
You cannot audit everyone. Rank suppliers by risk using plain questions:
- If this supplier failed, what would stop in our business?
- Does it handle our data, money, product quality or safety?
- Can we replace it quickly?
- Has it had problems before?
Audit the high-risk group on a schedule. Cover the rest by questionnaire or desk review. This matches the risk-based approach the sources describe for clause 8.4.2.
Step 2: Agree the scope and the rules
Write a short audit letter covering the purpose, the sites, the areas, the dates, the people needed, the confidentiality terms and the criteria. Check the contract first: does it give you the right to audit? If it does not, get the supplier's agreement before you go. Share the plan in advance so the right people are present.
Step 3: Choose the criteria
The criteria are what you measure against. They may be a standard, such as ISO 9001, the contract terms, your own supplier requirements, or applicable law. State which one applies. For an ISO-based approach, see how to run an internal audit under ISO 19011 guidance, which transfers well to supplier audits.
Step 4: Build the checklist
Tailor it to the supplier's work. A useful skeleton:
| Area | Sample question |
|---|---|
| Contract and requirements | Does the supplier know and record what we require? |
| Process control | Are critical steps documented and followed? |
| Records and traceability | Can they trace a delivered item or entry back to its inputs? |
| People | Are staff trained for the work they do for us? |
| Subcontractors | Does the supplier pass work on, and how does it control those parties? |
| Data and security | How is our information protected? |
| Problems | How are defects and complaints handled and closed? |
| Continuity | What happens to our service if their site is down? |
You can start from our audit checklist generator and adapt the questions.
Step 5: Run the audit
Open with a short meeting to confirm scope. Then collect evidence in three ways: ask, observe and inspect records. A statement is not evidence until a record or observation supports it.
Practical habits:
- Pick samples yourself. Do not let the supplier choose which records to show.
- Follow one order, batch or transaction from start to finish.
- Ask the person doing the work, not only the manager.
- Note facts exactly, with record numbers and dates.
- Keep the tone factual. You are testing a system, not accusing people.
Close with a meeting where you share your initial findings so there are no surprises in the report.
Step 6: Report with graded findings
State each finding with the requirement, the evidence and the gap. Grade them by their effect on you. Our guide on major vs minor nonconformities gives a method that works for supplier reports too. Send the report within an agreed time and ask for a corrective action plan with owners and dates.
Step 7: Follow up and decide
Check that corrective actions were done, with evidence, not just promised. Then decide: continue, continue with conditions, increase monitoring, or phase out. Record that decision and the date of the next review.
Common mistakes
- Auditing the cheap, easy suppliers and skipping the critical ones.
- Using a generic checklist that ignores what the supplier does.
- Accepting a certificate as proof of everything.
- Writing findings that cannot be checked.
- Never closing the loop on corrective actions.
Frequently Asked Questions
Does ISO 9001 require supplier audits?
According to the sources we found, it does not explicitly require them. It requires controls over external providers that match the risk, and audits are one way to apply those controls.
Can we rely on a supplier's ISO certificate instead?
It is useful evidence, but check the scope, the date and the certification body. It does not replace your own checks for critical suppliers.
What if the contract has no audit right?
Ask the supplier to agree to an audit before you proceed, and add the right at the next contract renewal.
How often should we audit a supplier?
We did not find a fixed interval. Set it by risk: more often for critical suppliers, and sooner after a serious failure or a major change.
Can a supplier audit be done remotely?
The training sources mention remote audit techniques. Remote work suits document and process checks. For physical conditions you may still need to visit.
Related Articles
Statutory facts on this page are checked against their sources, and the page says where it relied on secondary reporting. How we verify · Report an error