How to run a supplier audit, with a checklist

The vendor audit process belongs to the quality function, because quality owns the supplier approval decision and signs the quality agreement. Procurement, third-party risk, InfoSec and regulatory affairs each hold a piece, and the program stalls when those pieces have no names on them. A supplier quality engineer who also has to negotiate the audit date, chase the corrective action and update the scorecard is a program with one point of failure.

Give the lead auditor independence from the relationship. Under ISO 19011 the auditor should not audit a process they are responsible for, and the same logic says the engineer who qualified a supplier last year should not be the only person who audits it this year. Rotate leads on critical suppliers at least every other cycle.

Most audit schedules are built the way they were inherited: every approved supplier every three years, critical ones annually, and whoever has capacity in Q4 picks up the backlog. That schedule audits the calendar. The regulations want you to audit the risk. ISO 13485 Clause 7.4, which the QMSR now applies to US device manufacturers, ties the extent of supplier evaluation to the effect of the purchased product on the quality of the finished device and to the risk of that device. EU GMP Chapter 5 puts it as supervision "proportionate to the risks posed by the individual materials, taking account of their source, manufacturing process, supply chain complexity and the final use."

Tier on four inputs, scored at approval and updated by monitoring: the effect of the supplier's product or service on your finished product (a sterilization contractor and an API manufacturer sit at the top, an office supplies vendor at the bottom), the supplier's own process complexity and change history, supply chain complexity (brokers, distributors and sub-tiers between you and the maker), and performance history: nonconformances, late deliveries, complaints traced to the supplier, prior audit findings. The role of a supplier audit in risk management is to verify the tier you assigned, then feed the result back into it.

The ranges are a working starting point for a mature program, not a rule, and your procedure should say what moves a supplier between tiers. Certa's platform scores every third party across seven risk domains and schedules periodic assessment tuned to each vendor's risk tier. Quantcast used tiering of that kind to cut vendor onboarding to a 7-day cycle for high-risk vendors and 5 days for low-risk ones, which is the same principle applied to audits: the effort goes where the exposure is.

Scope is the sentence at the top of the audit plan that says which processes, sites, products and time period the audit covers, and criteria is the list of documents you are auditing against. Write both before you send the notification. An audit with no criteria produces opinions. An audit with the wrong criteria produces findings the supplier will reject on day one.

Criteria depend on what the supplier makes for you. For a medical device vendor audit of a contract manufacturer or critical component supplier, the criteria are ISO 13485:2016 and the FDA quality management system regulation, which amended 21 CFR Part 820 to incorporate ISO 13485:2016 by reference (§ 820.7 and § 820.10) and took effect on February 2, 2026. Scope the audit to the ISO 13485 clauses the supplier's work touches: 7.4 for their own purchasing, 7.5 for production and process validation, 8.2 for monitoring, 8.3 for nonconforming product, 8.5 for corrective and preventive action. If the supplier makes a finished device for you, the QMSR applies to them directly and the audit should test it.

A pharma supplier audit of an API or excipient manufacturer uses EU GMP Chapter 5 (sections 5.27 to 5.29 on supplier qualification), ICH Q7 for active substances, and 21 CFR Parts 210 and 211 for product bound for the US. One criterion worth auditing explicitly: 21 CFR 211.84(d)(2) lets you accept a supplier's certificate of analysis in place of full testing only if you run at least one specific identity test and establish "the reliability of the supplier's analyses through appropriate validation of the supplier's test results at appropriate intervals." If you rely on their COA, the audit should examine the lab that produced it. For a CMO or contract lab, add EU GMP Chapter 7: the contract giver assesses "the legality, suitability and the competence" of the contract acceptor before outsourcing (7.5) and reviews the acceptor's records and results on an ongoing basis (7.8).

Aerospace and defense suppliers are audited against AS9100 Rev D (2016), which carries the ISO 9001 text plus the aerospace additions on configuration management, product safety, counterfeit parts prevention and control of externally provided processes. IAQG's next revision, renumbered IA9100, was still in development when ISO 9001:2026 published, so confirm which edition your prime and certification body expect before you set criteria. For any supplier certified to ISO 9001, the current standard is ISO 9001:2026 (Edition 6, September 2026), which withdrew ISO 9001:2015. Ask the supplier where they are in the transition and audit to the edition on their certificate.

In life sciences the scope also has to cover the regulations beyond quality that the agencies attach to third parties: ABAC and FCPA exposure for distributors and sales intermediaries, GCP for CROs, HIPAA where a supplier handles protected health information. Certa's life sciences supplier compliance page lists the frameworks a program in this industry is expected to cover, and the audit plan should name the ones that apply to the supplier in front of you, so the auditor is not improvising compliance questions between quality sections.

Send the notification, the agenda and a document request 15 to 20 working days before the audit. The documents you read in advance decide what you sample on site. An auditor who arrives without having read the supplier's quality manual, procedure index and last two management reviews spends the first morning getting oriented and the afternoon rushing.

Keep the pre-audit questionnaire short. Its job is to confirm scope and surface changes since the last audit, not to pre-run the audit by email. Ten to twenty questions is enough: current certifications and their scope statements, changes to sites, processes, equipment or key personnel, open regulatory actions or customer audits in the last 12 months, sub-tier suppliers used for your product, and any outsourced processes.

The document request is where a supplier audit template earns its keep. Standardize the list by supplier type so every auditor asks for the same core set, then let the lead auditor add product-specific items. A working core set:

• Quality manual, procedure index and organization chart with quality's reporting line
• Current certificates with scope statements, plus the last external audit report and any open findings
• Last two management review records and the internal audit schedule with results
• Nonconformance, CAPA and complaint logs for the last 12 to 24 months, with trend data
• Change control log, and the change records that touched your product
• Process validation summaries and the calibration status list for equipment used on your product
• Training matrix for the roles on your product line
• Approved supplier list for the sub-tier suppliers and outsourced processes behind your product
• Record of your product's last five lots or deliveries: batch records, test results, release

Ask for records, not statements about records. A supplier that answers the CAPA request with a sentence about having a CAPA procedure has told you what to sample first.

The vendor audit on the day has one method: trace. Pick a lot, batch or delivery of your product and follow it backward through the supplier's system. Purchase order to incoming inspection of their materials, to the batch record, to the equipment and its calibration, to the operator and their training record, to in-process and final test, to release and shipment. Then pick a nonconformance and follow it forward to the CAPA, the effectiveness check and the closed record. Every finding you write should point at an objective record, a dated observation or a measured result, not at an interview answer.

1. Opening meeting, 20 minutes: confirm scope, criteria, agenda, confidentiality, how findings will be classified and when the supplier will see the draft.
2. Facility tour with the process owners, in process order. Note housekeeping, segregation of nonconforming material, label control and equipment status tags as you go.
3. Trace sampling: two to three lots of your product end to end, plus one nonconformance and one change record end to end.
4. Clause or section coverage: work through the remaining criteria with the documents requested in advance, sampling records against each.
5. Daily wrap-up on multi-day audits, so nothing in the final meeting is a surprise.
6. Closing meeting: read each finding with its evidence and classification, agree the corrective action timeline, state what happens to approval status.

Remote audits became normal in 2020 and are a legitimate method when the evidence is documentary and the risk supports it. They are the wrong method when the finding you need lives on the shop floor: cleanroom behavior, segregation, equipment condition, whether the procedure on the wall matches the procedure in the binder. FDA's QMSR preamble allows that where audits are not practical, supplier capability can be assessed through historical data, monitoring and trending, inspection and testing, among other means, which is a floor for the lowest tiers, not a substitute at the top. The Interagency Guidance tells banks to document the limitation when a third party will not allow on-site visits and to mitigate the risk another way. Apply the same discipline: when you go remote, write down why.

EU GMP sets the standard for what a supplier audit report should do: it "should fully reflect what was done and seen on the audit with any deficiencies clearly identified," and "any required corrective and preventive actions should be implemented." Those two sentences describe most of the audit reports that fail. It says the audit happened and lists findings. It does not say what was sampled, which records were seen, or what happened next.

Issue the draft within 10 working days and the final within 20. Give the report a fixed structure so an inspector, a second auditor or a procurement lead can read any of them the same way:

1. Scope, criteria, sites, dates, auditors and supplier attendees.
2. Method: which lots, records and processes were traced, how many records were sampled per area, and what was not covered and why.
3. Findings, each with a classification, the requirement it fails, the objective evidence (record number, date, observation) and the auditor's assessment of effect on your product.
4. Overall conclusion and recommended approval status: approved, approved with conditions, suspended, or disqualified.
5. Corrective action requirements: what the supplier must submit, by when, and what evidence will close each finding.

Corrective action is where the audit either changes something or does not. Require a root cause, a correction and a corrective action for every major, with an owner and a due date, and verify closure with evidence rather than a statement that the action is complete. For a major that affects product already delivered, the report triggers your own nonconformance and, where it applies, a review of released product. Under ISO 13485 Clause 7.4 the supplier's performance in closing findings becomes part of the record you re-evaluate them on, and under the QMSR that record is now within an FDA investigator's reach: FDA's April 1, 2026 town hall on the new inspection program said supplier audit processes are expected to be reviewed in baseline surveillance and premarket approval inspections.

Feed the result into the scorecard. An audit outcome that lives in a PDF and a scorecard that lives in a spreadsheet will disagree within a quarter. Certa's vendor scorecards guide covers the quality, delivery, compliance and risk categories a scorecard should carry, and the audit result belongs in the quality and compliance rows with a date. Certa's lifecycle runs a Remediation stage that resolves findings with assigned tasks and tracked evidence, and its Contracts Agent extracts the obligations, SLAs and key dates from the quality agreement so the audit clause and the corrective action commitments sit on the supplier record rather than in a filed contract. Every disposition on the platform is captured with documented rationale, citations and timestamps, immutable and exportable on demand, which is the shape an audit trail needs to be in when the inspector asks for it.