You do not need a factory audit for every supplier. You do need to know what evidence is missing before a first production order becomes difficult to reverse.
I separate three decisions:
- Do we need more than a desktop check?
- What exactly should the additional check test?
- What decision will the result support?
That keeps an audit in proportion to the order. It also stops a glossy “passed” report becoming a substitute for a sample, a written specification, a purchase order or a shipment inspection.
1. What a supplier audit can and cannot prove
An audit is a structured review against a defined scope and criteria at a point in time. The auditor may review a legal identity, site, process, records, capacity, quality controls, subcontracting and corrective actions. The result is useful only in relation to what was requested, observed and documented.
An audit can support conclusions such as:
- the named site was observed on a particular date;
- certain processes, people, equipment or records were present within the scope;
- stated procedures were available for review;
- specific findings were recorded; and
- corrective actions were proposed or verified.
It does not prove that:
- every unit in a future batch will match the sample;
- the supplier will keep the same staff, site or subcontractors;
- a product meets every legal requirement in every destination market;
- a certificate applies to your exact product or version; or
- a report completed by one party is independent of the supplier's commercial interests.
The ISO 19011:2026 guidance describes auditing management systems as a process involving objectives, criteria, evidence and evaluation. It is guidance, not a universal supplier-audit requirement, and using it does not itself certify a supplier.
2. Decide whether the order justifies an audit
Start with the downside of being wrong, not the supplier's sales pitch.
| Question | Lower concern may look like | Higher concern may look like | Validation response to consider |
|---|---|---|---|
| Order exposure | Small trial order you can absorb | Large deposit or order that could damage cash flow | Independent identity and capability review, then staged commitment |
| Product consequence | Simple, non-regulated item | Safety-sensitive, consumable, electrical, children's, cosmetic or medical product | Product-specific specialist review and evidence check |
| Product complexity | Standard catalogue item | Custom design, multiple components or critical tolerances | Specification review, sample control and process audit |
| Supplier history | Established relationship with consistent records | New supplier, unclear role or unexplained changes | Independent audit or live verification before commitment |
| Repeatability | Occasional replenishment | High-volume or recurring production | Process and quality-system review, plus batch inspection |
| Subcontracting | Supplier discloses a simple route | Key steps are outsourced or unclear | Add every relevant site and approval responsibility to scope |
| Failure impact | Easy replacement and low customer consequence | Recall, marketplace suspension, safety or brand damage | Specialist and independent validation before production |
These are decision inputs, not automatic rules. A £1,000 order of a regulated electrical product may deserve more scrutiny than a £10,000 order of simple, low-consequence packaging. Explain the reasoning in the order record.
3. Choose the right validation route
An audit is one option. Match the route to the question.
| Route | Best question | What it gives you | What it does not give you |
|---|---|---|---|
| Desktop document review | Do the identity, documents and stated process make sense? | Low-cost evidence and a list of gaps | Direct observation of the site or goods |
| Live remote walkthrough | Is the claimed site, product and process observable now? | Real-time questions and limited visual evidence | Independent assurance or a full record review |
| Supplier audit | Does the site and its process meet a defined audit scope? | Structured findings against agreed criteria | A guarantee of future batch quality |
| Product or sample testing | Does this identified item meet the test or specification? | Results for the item and method tested | Control of every future batch |
| Pre-shipment inspection | Does a sample of this shipment meet the agreed criteria? | A release decision for the inspected shipment | Findings about units outside the sample |
| Specialist compliance review | What product and market obligations need to be addressed? | A scoped interpretation and evidence plan | A general approval for every market or variant |
Do not order a supplier audit when the real unanswered question is whether your sample meets a safety requirement. Do not rely on a sample when the real question is whether the supplier can repeat the process across a large run.
4. Write the audit brief before appointing anyone
“Check the factory” is not an audit brief. Give the auditor a decision to support.
Use this structure:
| Brief field | What to specify |
|---|---|
| Audit objective | For example, decide whether the site is suitable for a first production order |
| Supplier and legal entity | Exact name, address and relationship to any trading company |
| Product and version | SKU, drawing, material, variant, packaging and approved sample ID |
| Sites in scope | Factory, warehouse, laboratory, subcontractor and management office where relevant |
| Processes | Receiving, production, assembly, packing, inspection, storage and dispatch |
| Records | Purchase inputs, batch records, inspection results, complaints, training and corrective actions |
| Criteria | Your specification, agreed quality plan, contractual requirements and scoped regulatory questions |
| Evidence method | Interview, observation, document review, photographs, sample records or test results |
| Independence | Who pays, who appoints, who receives the report and any conflicts to disclose |
| Output | Findings, evidence, severity, owner, due date, limitations and recommendation |
If a product is regulated, name the category, destination market and specialist question. Do not ask a general auditor to make a legal conclusion outside their competence.
5. Core supplier audit checklist
Use the following as a scope menu. Select what matters to the order instead of asking for a generic score.
Legal identity and site control
- Does the legal entity in the audit brief match the quotation and purchase order?
- Is the audited address the site that will make, store or release the goods?
- Are related companies, trading names and group entities explained?
- Are licences, registrations or permits relevant to the product identified?
- Does the supplier control the site, or is it using a third party?
Capacity and production control
- What equipment and production steps are available for this product?
- Which steps are subcontracted?
- How does the supplier schedule your order against existing capacity?
- What happens when demand exceeds the stated capacity?
- How are changes to materials, tooling, artwork or process approved?
Product specification and traceability
- Can the supplier identify the approved product version and sample?
- Are incoming materials and components identified by lot or batch where relevant?
- Can finished goods be traced back to inputs, production records and inspection results?
- Are changes recorded and communicated before production?
- Are labels, packaging, instructions and product identifiers controlled?
Quality controls
- Where are inspections performed?
- What is checked before, during and after production?
- Who can release or reject a batch?
- Are acceptance criteria written and linked to the product specification?
- Are non-conformities recorded with owner, cause, correction and follow-up?
Supplier and subcontractor control
- How are critical suppliers approved?
- Is the same product made at more than one site?
- Are subcontractors named and included in the audit scope?
- Who verifies that a subcontracted step meets the requirement?
- Can the supplier notify you before changing a site or material source?
People, safety and social-compliance scope
- Are roles and training relevant to the process recorded?
- Are safety controls visible for the work being observed?
- If labour or social-compliance evidence is material to your decision, what standard and evidence will be used?
- Does the auditor have the competence to assess the requested social or safety topic?
Do not turn this section into a claim that a general supplier audit proves ethical or legal compliance. Social-compliance and worker-safety assessments need an appropriate scope and qualified reviewer.
6. How to read the report
Read the report from the scope page, not the final score.
Check:
- Objective: What decision was the audit meant to support?
- Criteria: What requirements were used as the comparison point?
- Date: How old is the observation relative to your production order?
- Site: Was the relevant production or storage site included?
- Evidence: Are findings supported by records, observations, interviews or photographs?
- Limitations: What could not be observed or verified?
- Findings: Are issues described specifically, with severity and owner?
- Corrective actions: Is there a due date and a way to verify closure?
- Independence: Who commissioned and paid for the audit, and who controlled the scope?
A report that says “good factory” without criteria, evidence and limitations is not a decision record. A report with several findings can still be useful if it tells you what needs correcting before production.
7. Connect the audit to the sample and order
The audit is not the end of supplier approval. Link it to the documents that control the actual goods.
| Decision document | What the audit should inform |
|---|---|
| Product specification | Whether the supplier can control the required materials, dimensions, process and changes |
| Approved sample | Whether the observed process can produce the identified reference item |
| Quotation | Whether capacity, MOQ, lead time and subcontracting assumptions are credible |
| Purchase order | Which version, quantity, packaging, dates and inspection requirements are frozen |
| Inspection plan | Which characteristics need pre-production, in-process or pre-shipment checks |
| Corrective-action log | Which findings block production, require evidence or can be monitored |
For example, if the audit finds that the packaging step is subcontracted, add that step to the purchase-order and inspection plan. If the supplier cannot trace a critical component, do not let a clean office or well-presented factory score outweigh the gap.
8. Audit-scope selector examples
Small trial of a standard, low-consequence product
You are buying a small quantity of standard homeware. The supplier is identifiable, the sample matches the simple specification and the payment exposure is manageable.
I might use a desktop review, live walkthrough and a pre-shipment inspection rather than a full audit. I would record why the lower-cost route is proportionate and what would trigger a deeper review.
Large first order of a custom product
You have a custom item, new tooling and a deposit that would be painful to lose. Several production steps are outsourced.
I would define a site and process audit, require the approved sample and specification in the brief, and make subcontractor control a specific finding. I would still inspect the first shipment. The audit answers capability and process questions. The inspection answers a narrower shipment question.
Regulated or safety-sensitive product
You are buying an electrical or children's product for a named destination market. Product evidence and traceability matter as much as capacity.
I would add a product-compliance specialist to the review, name the applicable authority questions, and avoid treating a general audit certificate as a legal clearance. The audit brief should identify the product version, test evidence, labels, instructions and responsible parties that need separate review.
9. Stop rules and corrective actions
Hold the order when:
- the audited entity or site is not the entity or site in the quote;
- the product or version cannot be identified in the scope;
- a critical process is subcontracted but the subcontractor is not disclosed;
- records are missing for a requirement that matters to the order;
- findings are severe and have no owner or due date;
- the supplier refuses access to a relevant site or evidence; or
- the audit report is being used to answer a legal or product question outside its scope.
Use a corrective-action log:
| Finding | Evidence | Risk to order | Owner | Due date | Verification method | Decision |
|---|---|---|---|---|---|---|
| Uncontrolled packaging change | Artwork and interview note | Wrong label or pack configuration | Supplier quality lead | Before sample approval | Review controlled artwork and repeat sample check | Hold |
| Missing batch traceability | Record review | Difficult recall or investigation | Production manager | Before production release | Review a completed traceability record | Hold or specialist review |
| Minor housekeeping issue | Dated observation | Low direct product impact | Site manager | Next visit | Photo or follow-up observation | Monitor |
The decision column is yours. An audit report does not decide whether you should place the order.
10. What to do next
Write the scope, choose the validation route and connect the result to the product and order documents. Then use the quote-ready product specification and supplier verification checklist to keep the evidence together.
The supplier-vetting guide remains the wider pre-payment process. If the product is regulated or the report makes a market-specific claim, get the appropriate specialist review before treating the order as ready.
This is general supplier-risk guidance, not legal, product-safety, social-compliance or certification advice. Audit scope, product rules and evidence requirements depend on the supplier, product and destination market.
11. Frequently asked questions
Does every new supplier need a factory audit?
No. Decide based on order exposure, product consequence, complexity, supplier history, subcontracting and the cost of failure. A sample, document review or shipment inspection may be proportionate for a small, simple order.
Is an audit the same as a pre-shipment inspection?
No. An audit reviews a supplier, site or process against a defined scope. A pre-shipment inspection examines a sample of a particular shipment against agreed criteria. They answer different questions.
Does a passed audit guarantee product quality?
No. It is point-in-time evidence within the report's scope. Connect it to a specification, sample approval, purchase order and inspection plan.
Should the supplier pay for the audit?
The commercial arrangement varies. Record who appoints and pays, disclose any conflict and make sure the scope and evidence remain suitable for your decision. Payment alone does not determine whether a report is useful.
Can ISO 19011 certify my supplier?
No. ISO 19011 provides auditing guidance. It does not itself certify a supplier or make a product legally compliant.