Key takeaways
- Write the scope, the criteria and the scoring model before the audit date, or the result is not comparable with the next supplier.
- Follow one part from goods-in to dispatch; the records on that route show more than a presentation.
- Remote audits are strong on documents and weak on material flow, housekeeping and gauge handling.
- A finding is closed when the cause is removed and the evidence shows it, not when a corrective action is promised.
What the audit is for
An audit is a structured check that a supplier's system and process meet a defined standard or contract. It is not a tour and not a relationship visit. The output is a set of findings, a score and a decision about whether the supplier can be approved, kept on watch or removed.
Audits are expensive for both sides. The value comes from comparing evidence against criteria, not from collecting impressions. A well run audit leaves the buyer with a short list of risks and the supplier with a short list of actions, both tied to the same evidence.
Set the scope and the criteria first
The scope should name the site, the product family, the processes, the standard and the part numbers. It should also name what is out of scope, so a later argument about an unseen process does not reopen the result. Approval of a machining site is not approval of the plating line next door.
Share the document request in advance: certificate and scope, organisation chart, process flow, PFMEA, control plan, calibration list, complaint log, capacity data, business continuity plan and sub-supplier list. A supplier that cannot produce these before the visit will rarely produce them during it.
Agree the scoring model at the same time. Weights published before the audit make the score defensible and comparable. Weights invented afterwards turn the audit into a negotiation.
The desk review that saves a day
Read the certificate scope, then read the process flow against the control plan. Look for steps in the flow that have no control and controls that reference no drawing characteristic. Check the PFMEA for failure modes that the control plan does not address.
Check the calibration list for gauges that are overdue or missing, and read the last audit report and the customer complaint history. Note the questions that need the floor, and keep them specific: a request to see the setting sheet for a named press is easier to answer than a request to explain process control.
Remote document review can be done well with a shared folder and a video call. Ask for the actual documents, not screenshots pasted into a presentation. A screenshot cannot be checked for revision, signature or cross-reference.
On site: follow the part, not the tour
Follow a part from goods-in to dispatch. Start at receiving, pick a lot, and follow the material through stores, cutting, forming, plating or the sub-supplier, inspection and packing. At each step ask for the record: material certificate, work order, setting sheet, first-off approval, in-process check and any nonconformance.
Look at the floor as well. Identification, segregation of conforming and suspect material, calibration stickers, tool storage, cleanliness and the gauges actually in use all tell you whether the documented process is the real one. Ask the operator to explain the check without prompting. If the explanation does not match the control plan, that is the finding.
Interview beyond the quality manager. Ask maintenance how a breakdown is recorded, ask stores how a mixed lot is prevented, and ask an inspector what happens when a result is out of limit. The answers show whether the system reaches the people who run it.
Remote audits: where they work and where they fail
Remote audits work for document review, management system clauses, follow-up on a specific finding and sites that are impractical to reach. They are weaker for material flow, housekeeping, gauge handling and the informal parts of a process that nobody writes down.
A live video walk is better than a set of photographs, but it still depends on where the camera is pointed. Ask the supplier to walk a route you choose and to hold the camera on labels, records and material, not on the meeting room wall. Record what was not seen and treat it as a limit of the audit.
Do not use a remote audit to approve a new process with no production history, or to close a major finding without evidence from the floor. In those cases the travel cost is smaller than the risk.
| Area | On-site evidence | Remote evidence | What remote misses |
|---|---|---|---|
| Material identification | Tags, labels and physical segregation | Photographs and label records | Mixed or unlabelled material outside the frame |
| Process control | Setting sheets, first-off parts, operator practice | Scanned records and live video | Workarounds and informal adjustments |
| Calibration | Gauges in use and calibration stickers | Calibration list and certificates | A gauge that is listed but not used correctly |
| Traceability | Lot flow from receiving to packing | System screens and sample records | Whether the physical lot matches the system record |
| Housekeeping | Cleanliness, storage and tool condition | Wide shots of selected areas | The areas the camera never visits |
| Competence | Answers from operators and inspectors | Interviews with nominated staff | Whether the person doing the job knows the check |
| Corrective action | Evidence that the process changed | Document and photograph review | Whether the change holds on a normal shift |
Use the table to record what the method could not cover. An audit without a stated limit reads as more complete than it is.
Scoring, findings and the report
Score against the criteria you set, using the weights agreed in advance. The weights in the figure are illustrative. The principle is that every supplier is measured on the same model, so a score of 72 means the same thing at two different sites.
Classify each finding. A major finding is a system failure or a risk to the customer. A minor finding is an isolated lapse. An observation is an improvement that does not breach a requirement. Each finding needs evidence, a requirement reference, any containment, a root cause, a corrective action, an owner and a date.
A report with no findings is a red flag, not a perfect supplier. Every real audit finds something. The useful question is whether the findings are small and well managed, or large and unexpected.
Closing findings and deciding when to return
Accept a corrective action only when the evidence shows the cause was removed. A photograph of a new label is not evidence that the labelling process changed. Ask for the revised instruction, the training record and a check on the next lot.
Verify at the next visit or through a remote evidence review, and close the finding in the report with the evidence reference. Keep the report and the closure record in the supplier file so the next auditor starts from facts rather than memory.
Set a re-audit trigger: a new site, a new process, a major finding, a change of ownership, a quality escape or a defined interval. The trigger list turns the audit from a one-off event into part of the supplier relationship.
Frequently asked questions
How long does a supplier audit take?
It depends on the scope, the site size and the number of processes. A single-process site can be covered in a day, while a site with plating, heat treatment and assembly may need two or more. The document review should happen before the visit, not during it.
Can a remote audit replace an on-site audit?
For a management system review or a follow-up, often yes. For a new process, a new site or a major finding, the floor evidence matters. Record the parts of the process the remote method could not see and treat them as open questions.
What makes a finding major rather than minor?
A major finding is a system failure or a risk to the customer: a missing control on a special characteristic, an uncalibrated gauge in use, or a traceability break that affects a shipment. A minor finding is an isolated lapse that the system can correct. The classification should follow the criteria agreed before the audit.
Should the supplier see the score?
Yes. A score the supplier cannot see cannot be acted on. Share the findings, the evidence and the weighting, then agree the corrective actions and dates. The audit is more useful when both sides work from the same report.
Sources and further reading
- ISO 19011:2018, Guidelines for auditing management systems
- ISO 9001:2015, Quality management systems, Requirements
- IATF 16949:2016, Quality management system requirements for automotive production
Qumek Quality Desk
Quality team
The quality team responsible for first article inspection, PPAP packs, supplier audits and the records shipped with production parts.
Planning an audit of a new supplier?
Send the part scope and the process route. The quality desk will draft the criteria, the document request and the evidence list before the visit.
Plan an audit