- What a supplier audit is
- Visual map of the supplier audit
- Audit types and when to choose each
- A four-phase routine
- Checklist: six areas and key questions
- How to score
- Worked example: a machined-parts supplier
- Classifying findings and setting deadlines
- From class to sourcing decision
- Common mistakes
- Frequently asked questions
What a supplier audit is
A supplier audit is a planned, on-site check that the supplier has the system and process to deliver what you buy, at the right quality and on time. A good checklist-based routine has four phases: preparation, execution, report and follow-up of actions. Scoring turns findings into a number and a class that guides the sourcing decision.
It differs from supplier evaluation (IQF), which is indirect and measures delivery and quality history. The audit goes and sees how the work is done. In ISO 9001, control of externally provided processes, products and services (8.4) requires criteria for evaluating and selecting suppliers; auditing is one way to meet it. For audits of your own company, the routine is in ISO 9001 internal audit.
Visual map of the supplier audit
The map shows the four phases, the six checklist areas and this article's scoring example.
Audit types and when to choose each
| Type | Focus | When to use |
|---|---|---|
| System audit | Quality management system (ISO 9001, IATF 16949) | Qualifying a new supplier or periodic verification |
| Process audit | One specific process end to end (e.g. machining, welding, painting) | Critical process, change or recurring problem; see VDA 6.3 |
| Product audit | Conformity of the finished product to specification | Lot verification and product release |
| Document (remote) audit | Questionnaire and evidence sent in | Low-risk screening or before a visit |
Prioritize by risk: part criticality, purchased volume, complaint history and single-source dependence. ABC classification of suppliers and the IQF help build the annual plan.
A four-phase routine
1. Preparation
- Define scope, objective and criteria (standard, contract requirements, specifications).
- Build the team: lead auditor, technical support and, if needed, a Purchasing representative.
- Send the supplier the agenda and a pre-audit questionnaire, with agreed notice.
- Study the history: complaints, delivery rates, open corrective actions and earlier audits.
2. Execution
- Opening meeting: present scope, method and agenda.
- Document review: procedures, records, the control plan and certificates.
- Shop floor walk: follow the flow from receiving to shipping and observe, do not just ask.
- Sample trace: pick a lot delivered to you and follow the records from material to shipment (traceability).
- Interviews with operators and team leaders, not only management.
- Closing meeting: present the findings and confirm the facts before leaving.
3. Report
- Classify each finding: major nonconformity, minor nonconformity or observation.
- Calculate the score and the supplier class.
- Issue the report within a defined time, for example 5 working days.
4. Follow-up
- The supplier replies with an action plan: cause, correction, corrective action, owner and due date.
- Verify effectiveness with evidence, not just a promise.
- Re-audit the critical point when the class requires it.
Checklist: six areas and key questions
| Area | Key questions | Weight |
|---|---|---|
| Quality management | Are there a policy, objectives, management review and a valid certificate? Controlled documents? | 20 |
| Purchasing and sub-suppliers | How does the supplier evaluate its own suppliers? Are specifications passed down? | 10 |
| Production and process control | Work instructions at the station, 5S, material identification, control plan in use, handling of nonconforming product? | 25 |
| Measurement and calibration | Gauges calibrated and identified? Is there measurement system analysis on critical features? | 15 |
| Storage and traceability | Lot identification, FIFO/FEFO, segregation of nonconforming product, controlled shipping? | 15 |
| Corrective action and improvement | Complaints handled with root cause analysis, deadlines met, KPIs tracked? | 15 |
| Total | 100 |
How to score
The model below is an example to adapt; it does not replace scoring defined by a standard or by your customer. Each area gets a grade from 0 to 10 according to compliance with its items, and the weight reflects importance to your product.
Final score = Σ (weight × grade ÷ 10)
Suggested classes: A (approved) at 85% or more; B (conditionally approved) from 70% up to below 85%; C (not approved) below 70%. Extra rule: if any area falls below 50%, the supplier cannot rise above B. VDA 6.3 also classifies by percentage of compliance, but with its own calculation and downgrading rules.
Worked example: a machined-parts supplier
Fictitious example. The team audited a machined-parts supplier and gave the grades below.
| Area | Weight | Grade (0–10) | Compliance | Points (weight × grade ÷ 10) |
|---|---|---|---|---|
| Quality management | 20 | 8 | 80% | 16.0 |
| Purchasing and sub-suppliers | 10 | 7 | 70% | 7.0 |
| Production and process control | 25 | 7 | 70% | 17.5 |
| Measurement and calibration | 15 | 9 | 90% | 13.5 |
| Storage and traceability | 15 | 6 | 60% | 9.0 |
| Corrective action and improvement | 15 | 7 | 70% | 10.5 |
| Total | 100 | 73.5 |
Final score: 16.0 + 7.0 + 17.5 + 13.5 + 9.0 + 10.5 = 73.5%. No area fell below 50%, so the class is B (conditionally approved). The weak point is storage and traceability (60%): the action plan prioritized lot identification and segregation of nonconforming product, due in 60 days with a re-audit of that point. Measurement, at 90%, is the strength. Because production carries the highest weight (25), every point lost there costs more in the final score.
Classifying findings and setting deadlines
| Classification | Criterion | Expected response (example) |
|---|---|---|
| Major nonconformity | Unmet requirement that can lead to out-of-spec product or a systemic failure | Immediate containment and plan within 10 days |
| Minor nonconformity | Isolated lapse with no immediate product risk | Action plan within 30 days |
| Observation | Improvement opportunity or potential risk | No mandatory deadline; follow up at the next visit |
The deadlines above are examples; adjust them to your product risk and contract. What cannot be missing is the action owner, the date and the closure evidence.
From class to sourcing decision
- Class A: keeps its qualification and is re-audited on the normal cycle, for example every 24 months.
- Class B: kept with an action plan and monitoring; re-audited within 12 months, or the critical point sooner.
- Class C: new business restricted until actions are proven, with a full re-audit. For single-source suppliers, consider developing an alternative in parallel.
Results feed the IQF, purchasing decisions and, in automotive, the APQP and PPAP cycle and IATF 16949 requirements. When a supplier ships defective material, the MRB and nonconforming material control decides the lot's fate, and the audit checks whether the cause was removed.
Common mistakes
- Auditing documents only: the procedure exists, but the workstation does it differently.
- Generic checklist: not adapted to the process and risk of the purchased product.
- Finding without evidence: the supplier disputes it and the discussion stalls. Note the fact, the place and the record.
- Scoring without criteria: two auditors give different grades to the same situation. Calibrate the team with examples.
- Report without follow-up: actions have no deadline and no effectiveness check.
- A punitive audit: the supplier hides problems. The goal is to reduce risk and develop the partner.
- Ignoring results in sourcing: class C does not change volume allocation.
Frequently asked questions
What is the difference between a supplier audit and supplier evaluation?
Evaluation (IQF) measures historical performance from delivery and quality data. The audit checks on site how the supplier works. One complements the other.
How often should a supplier be audited?
It depends on risk. A common reference is every 12 to 36 months, with extra visits after serious complaints or process changes. Define it in your procedure.
How long does a supplier audit take?
Usually one to three days, depending on scope and size. A focused process audit can fit in one day.
Should the supplier be notified in advance?
Yes, with an agreed agenda and scope. Unannounced audits make sense only if provided for in the contract or in case of well-founded suspicion.
Who should perform the audit?
Auditors trained in audit method who know the process. Avoid having the buyer as the only auditor, to preserve independence.
Can I use VDA 6.3 scoring on any supplier?
You can use it as a reference, but VDA 6.3 has its own scoring rules. For formal use, follow the manual or adapt the model and document the criteria.
Sources
- ISO 19011:2018. Guidelines for auditing management systems.
- ISO 9001:2015. Quality management systems: requirements (clause 8.4, control of externally provided processes, products and services).
- VDA QMC. VDA 6.3: Process Audit. Berlin: Verband der Automobilindustrie.
- IATF 16949:2016. Quality management system requirements for automotive production organizations.
Keep studying: trusted sources and links
- ISO: ISO 9001 and related standards, Quality management
- ASQ: Quality Resources
- Wikipedia: Quality audit
Save this address: Manufatura Enxuta is your school for lean manufacturing. Come back whenever you need to study, with a complete article, a visual map and trusted sources. Follow one of the learning paths or check the A–Z glossary.
Want the tools ready to use?
Download the free "Problem Solving Kit" e-book, with PDCA, A3, 5 Whys and Ishikawa.
Download the e-book
About the author
Lean Manufacturing & Behavioral Management Specialist
Over 20 years in the automotive and metalworking industries (GM and Dana), Lean Manufacturing practitioner since 2006. SENAI instructor and mentor in Brazil’s Brasil Mais Produtivo program, delivering consulting, training and audits for 50+ companies, combining quality, productivity and people development.
