Business Advice
Supplier Audits: How to Check Your Chain Before Your Customer Checks You
Every manufacturer knows the moment: a customer complaint, traced back to a batch of material delivered four months earlier. The supplier holds a valid ISO 9001 certificate. Incoming inspection was signed off. And the defect still got through.
Your supplier’s certificate proves that somebody audited them against the general requirements of a standard. It does not prove they can make your part, to your tolerance, on your lead time. Closing that gap is exactly what a supplier audit — a second-party audit — is for.
Key Takeaways
- A second-party audit is an audit an organisation carries out at its own supplier — as distinct from an internal audit (first party) and a certification audit (third party).
- ISO 9001 does not explicitly require supplier audits. Clause 8.4 requires criteria for evaluation, selection, performance monitoring and re-evaluation — and for a critical supplier an audit is often the only way to meet them.
- A supplier’s certificate is not evidence of capability. It shows a management system exists, not that it produces your part in tolerance.
- ISO 19011:2026 is the current edition of the guidelines for auditing management systems, published on 27 May 2026. It moves remote and hybrid audits from exception to norm and strengthens the risk-based approach.
- Do not audit every supplier. Categorise by risk and audit only the critical ones — a programme that covers everything is a programme that never gets executed.
- An audit without follow-up is a cost. The value appears only when findings are closed with verified effectiveness, not with an email saying “noted”.
What a second-party audit is
A second-party audit is an audit performed by an organisation at an external provider or other interested party with which it has a contractual relationship. The distinction between the three audit types is fundamental, because it determines who pays, who sets the scope and what can be demanded.
| Audit type | Who performs it | Scope | Output |
|---|---|---|---|
| First party (internal) | The organisation itself | Its own management system | Report to management |
| Second party (supplier) | The customer, at the supplier | Whatever the customer defines by contract | Approval decision or corrective actions |
| Third party (certification) | An accredited body | The requirements of the standard | Certificate |
The key advantage of the second party is freedom of scope. A certification auditor checks conformity with a standard. You check what actually hurts: the specific process, the specific machine, the specific control that let the defect through last time. Nothing stops you going into detail a certification audit would never reach.
What ISO 9001 clause 8.4 actually requires
ISO 9001 contains no requirement saying “audit your suppliers”. This is the most common misunderstanding and worth stating plainly. Clause 8.4 requires the organisation to:
- determine criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers;
- apply those criteria and retain documented information of the results;
- determine the type and extent of control based on the impact the supply has on the organisation’s ability to deliver conforming product.
In other words, the standard obliges you to have a method but lets you choose which. For a supplier of office consumables, the method is a quotation and a complaint history. For the supplier of the single critical part in your product, the method that stands up to an auditor is usually an audit.
A useful test. Ask yourself: “If this supplier stopped tomorrow, or started failing systematically, how much time and money would I lose?” An answer measured in days or in tens of thousands usually means a written questionnaire is not a sufficient extent of control.
What changed with ISO 19011:2026
ISO 19011 is the guidance standard for auditing management systems — and it explicitly covers second-party audits, not just internal ones. The new edition was published on 27 May 2026 and replaces the 2018 version. The revision is evolutionary: the principles stay, the execution changes.
Four changes matter in practice for supplier audits:
- Remote and hybrid audits are the norm, not the exception. The choice between on-site, remote and mixed is now justified by risk, scope and evidence quality — not by habit or by travel budget.
- The risk-based approach is more central. The audit programme is planned against risk: what gets audited, how often and in what depth.
- Digital evidence and data analysis carry more weight — remote access to systems, shared records, analysis of production data instead of interviews and binders alone.
- Auditor competence now includes digital skills — working with audit platforms, evaluating electronic evidence and interviewing over video, which is a different skill from interviewing on the shop floor.
The standard remains guidance, not a requirement — you cannot be certified against ISO 19011. But it is the reference framework every auditor expects you to follow, and the basis on which auditor training is built.
Which suppliers are worth auditing
The most common reason supplier audit programmes die quietly is ambition. A list of 60 suppliers is drawn up, 60 audits are planned, 7 are performed, and the programme is abandoned. The approach that works starts with categorisation.
| Category | Indicators | Control method | Frequency |
|---|---|---|---|
| Critical | Single source; directly affects safety or a key characteristic | On-site audit plus performance indicators | Every 1–2 years |
| Significant | An alternative exists, but switching takes months | Remote audit or extended questionnaire | Every 2–3 years |
| Standard | Interchangeable, low impact if it fails | Delivery and complaint metrics | Annual data review |
| New supplier | No performance history | Evaluation before the first order | Before approval |
For most manufacturers this means between three and eight audits a year — a volume that actually gets done and that stands up to an external auditor, because there is visible logic behind the selection.
A supplier audit programme in seven steps
- Categorise suppliers by risk. Use two criteria — impact if they fail and availability of an alternative. Document the result, because that is precisely the evidence clause 8.4 asks for.
- Secure the contractual basis. The right to audit belongs in the supply contract or in your general purchasing terms. Without it, a supplier can lawfully refuse you access.
- Define the scope of the specific audit. Not “the ISO 9001 system”, but the processes that affect your product: production, inspection, traceability, control of nonconformity, operator competence.
- Choose the format. First audit of a new critical supplier — on site. Repeat audit with no changes — remote. The mixed format usually delivers the most for the least time.
- Build a risk-based checklist. Start from the complaints you have actually had and the points where the supplier’s process can hurt you — not from a downloaded generic list.
- Run the audit and gather objective evidence. Trace one real batch from order to dispatch. A single traced case tells you more than twenty questions asked.
- Close findings on substance. Ask for root cause analysis, not just correction. Verify effectiveness at the next delivery and record the result.
On the right to audit. If your contract has no audit clause, ask for one at the next renewal. The wording is not complex: the customer’s right to audit during working hours, with a defined notice period, subject to confidentiality. A supplier who refuses such a clause without an argument has already told you something useful.
What to check on site
- Traceability. Pick a serial or batch number from your last delivery and trace it back to incoming material. If it cannot be traced in 30 minutes, it cannot be traced during a recall either.
- Change control. How the supplier notifies you when a sub-tier, material or machine changes. An unchanged specification with a changed process is the classic cause of sudden defects.
- Inspection and measurement equipment. Whether the instruments accepting your part are calibrated, and who decides at a borderline reading.
- Operator competence. Who is authorised to run the critical operation and how that qualification is evidenced.
- Nonconforming product. Where scrap physically sits and whether it can re-enter the flow by accident.
- The supplier’s own chain. Especially where you carry responsibility for the origin of materials — for example under the Conflict Minerals Regulation.
Remote or on site
| Situation | Recommended format | Why |
|---|---|---|
| New critical supplier | On site | Equipment, housekeeping and people can only be judged in person |
| Repeat audit, no changes | Remote | Documents and records review equally well at a distance |
| Verification after a finding | Mixed | Evidence is reviewed remotely, effectiveness confirmed on site |
| Supplier in another country | Mixed | Travel is reserved for what cannot be done remotely |
Five mistakes that waste the audit
Mistake 1: auditing from a generic checklist. A 120-point questionnaire downloaded from the internet checks everything a little and nothing properly. Twenty questions derived from your own complaints are worth more.
Mistake 2: no follow-up. If a finding is closed with a promise rather than demonstrated effectiveness, you will find the same finding next year. That is the most expensive way to run an audit programme.
Mistake 3: auditing only after a problem. Then the audit is an investigation, not prevention — and the supplier receives it as an accusation, which ends the conversation.
Mistake 4: auditors without independence from purchasing. The person negotiating price should not be the only one assessing quality. The conflict is obvious and an external auditor spots it immediately.
Mistake 5: ignoring the result when awarding work. If a supplier with a red audit report keeps receiving orders without corrective measures, the whole programme loses meaning — including in front of the certification auditor.
Supplier audits performed by an external team
We carry out second-party audits on your behalf — in Bulgaria and abroad, on site or remotely. You receive a report with clear findings and an action plan, not a form with ticks.
Conclusion
Supplier auditing is one of the few quality activities with a directly measurable effect: fewer stopped lines, fewer complaints, fewer emergency deliveries at double price. Not because it finds everything, but because it changes supplier behaviour — knowing that someone will check works better than any contract clause.
Start with categorisation. It takes half a day and will immediately show you that the critical suppliers number five, not fifty. The rest is discipline. And if auditing itself is still new to your team, build the auditors before you plan the first visit.
Frequently Asked Questions
What is a second-party audit?
A second-party audit is an audit an organisation performs at an external provider or partner with which it has a contractual relationship. Unlike an internal audit (first party) and a certification audit (third party), its scope is set by the customer and may cover only the processes that affect the customer’s product.
Does ISO 9001 require supplier audits?
No, ISO 9001 does not explicitly require supplier audits. Clause 8.4 requires criteria for the evaluation, selection, performance monitoring and re-evaluation of external providers, as well as determination of the type and extent of control based on risk. For critical suppliers, an audit is often the only method that genuinely satisfies this requirement.
Is a supplier’s ISO certificate enough?
Not on its own. A certificate proves the supplier has a management system assessed against the general requirements of a standard, but not that your specific part is produced in tolerance and on time. A certificate reduces risk and justifies less frequent auditing, but it does not replace performance evaluation.
How often should suppliers be audited?
Frequency follows risk, not the calendar. Critical suppliers are typically audited every one to two years, significant suppliers every two to three years, and standard suppliers are managed through delivery and complaint metrics without an audit. A new critical supplier is evaluated before the first order.
Can a supplier audit be carried out remotely?
Yes. ISO 19011:2026 treats remote and hybrid audits as part of the standard approach rather than as an exception. The remote format suits repeat audits and the review of documents and records; for a new critical supplier and for verification of production conditions, an on-site audit remains more reliable.
What makes ISO 19011:2026 different from the 2018 edition?
ISO 19011:2026, published on 27 May 2026, is an evolutionary revision. The main differences are the recognition of remote and hybrid audits as a normal method, a more central role for the risk-based approach in planning the audit programme, greater weight on digital evidence and data analysis, and the expectation that auditors hold digital competences.
Must a supplier grant us access for an audit?
Only if it has been agreed. The right to audit does not come from the standard but from the contract, which is why the audit clause belongs in the supply agreement or in the general purchasing terms. It normally defines the notice period, working hours and confidentiality obligations.