How To Build A Supplier Audit Checklist

A supplier audit can produce pages of notes and still leave the purchasing team with no clear decision. The problem is usually not a lack of questions. It is the absence of defined evidence, weights, decision thresholds, and follow-up rules.

A practical supplier audit checklist turns the audit into a repeatable approval process. It tells the auditor what to verify, records objective evidence, weights the criteria by risk, converts the results into an approve, conditional-approve, or reject decision, and sets the next audit date from the score.

Start With the Supplier Decision

Before writing questions, define the decision the checklist must support. Most supplier audits serve one of three purposes: qualifying a new supplier, deciding whether to retain an existing supplier, or verifying that corrective actions resolved prior findings. The audit scope and evidence should change with that purpose.

Write the proposed decision at the top of the checklist. Use approve when the supplier meets the required controls, conditional approve when limited gaps can be corrected under a monitored plan, and reject when the score or a critical finding makes the risk unacceptable. This prevents the audit from ending with an ambiguous summary such as “generally acceptable.”

Define Scope and Criteria

Identify the products, services, locations, processes, systems, and time period included. List the applicable purchase specifications, contracts, internal procedures, customer requirements, and regulatory obligations. A supplier that provides office supplies does not need the same audit depth as a supplier that performs a critical outsourced process.

Connect the scope to the information already created during purchase requisition approval and to the requirements carried into the purchase order process. The audit should verify the controls that matter to the actual purchase, not a generic list copied from another supplier.

Choose Weighted Supplier Evaluation Criteria

A supplier quality audit checklist should cover the full route from requirements to delivery and corrective action. ISO and IAF procurement-audit guidance identifies an up-to-date approved-provider list, orders placed against defined criteria, effective performance monitoring, and verification that specified requirements were met as useful evidence. See the ISO/IAF guidance on external providers.

Those principles fit the broader controls described in ISO 9001 quality management requirements. They also support a disciplined approved-vendor process instead of treating supplier selection as a one-time price comparison.

The weights total 100. Adjust them before the audit when the supplier’s risk profile requires it, but do not change weights after seeing the results. A post-audit change makes the threshold unreliable and can create the appearance that the decision was reverse-engineered.

Build the Supplier Audit Checklist

Each checklist row needs more than a yes-or-no question. Include the criterion, weight, rating, expected evidence, actual evidence, finding, corrective action, owner, due date, critical-finding flag, and status. These fields create a traceable record from the requirement to the final decision.

Download the editable supplier audit scorecard. The workbook contains all 20 criteria above, 0-to-5 rating controls, weighted formulas, a critical-finding override, decision thresholds, corrective-action tracking, and a re-audit interval tied to the result.

Use a Consistent Rating Scale

1. 0: No evidence. The control is absent or the supplier cannot demonstrate it.
2. 1: Major gap. Some activity exists, but the risk is not controlled.
3. 2: Weak or inconsistent. The control exists but is incomplete, informal, or unreliable.
4. 3: Adequate. The supplier meets the basic requirement and provides suitable evidence.
5. 4: Effective. The control is consistently applied and monitored.
6. 5: Effective and demonstrated. Records show sustained performance, review, and improvement.

Calculate each weighted score as weight multiplied by rating divided by five. A criterion weighted at 6 points and rated 4 contributes 4.8 points. The final score is the sum of all weighted scores, with 100 as the maximum.

Run the Supplier Audit Process

1. Send a Focused Document Request

Request only the documents needed for the approved scope. Typical items include the organization chart, relevant procedures, specifications, recent inspection records, calibration status, nonconformance and corrective-action examples, delivery trends, business-continuity evidence, and the approved sub-supplier list. Tell the supplier which records may be sampled during the audit.

2. Follow One Real Order or Service

Select a recent transaction and trace it from the purchase requirement through production or service delivery, inspection, release, shipment, and any issue handling. A transaction trail reveals handoff failures that may remain hidden when the auditor reviews procedures one at a time.

3. Separate Interviews From Verification

An interview explains what the supplier believes should happen. Verification shows what happened. Record the specific document, record, system entry, observation, or sample that supports each rating. The evidence discipline used in an internal audit checklist applies equally to supplier audits.

4. Record Findings Before the Closing Meeting

State the criterion, observed condition, evidence, and risk. Confirm factual accuracy with the supplier without negotiating away supported findings. Identify any missing evidence and agree on the date by which it must be provided.

For medical-device suppliers, the FDA MDSAP purchasing-process audit approach ties the extent of purchasing controls to product risk and says supplier monitoring should consider actual performance against specified requirements. It lists re-audits, incoming acceptance results, complaints, nonconformities, certificate checks, and corrective-action responses as possible monitoring activities. Regulated organizations should adapt the checklist to the rules that apply to their products and jurisdiction.

Score the Supplier and Make the Decision

A critical finding overrides the numeric score. Examples include falsified records, an uncontrolled process that directly affects safety or conformity, a missing required license, deliberate concealment, or a security weakness that exposes protected data. Define critical findings before fieldwork and require an executive exception if the business proposes to use the supplier despite one.

The decision should enter the approved-vendor record and the wider vendor management process. Record the scope, score, findings, conditions, approving role, expiration or re-audit date, and any restrictions on what the supplier may provide.

Set a Score-Based Re-Audit Interval

A fixed annual schedule treats every supplier as equally risky and equally stable. Use the score as a starting interval, then shorten it when performance deteriorates, a major change occurs, complaints rise, a critical sub-supplier changes, or corrective actions remain open. A strong supplier can earn a longer interval, while a conditional supplier must demonstrate improvement sooner.

Technology suppliers need additional due diligence. NIST SP 1326 describes supplier due diligence as research that supports informed decisions about new acquisitions or existing systems. For ICT suppliers, it identifies provenance, resilience, foundational cyber practices, supply-chain tiers, and foreign ownership, control, or influence as assessment components.

Avoid Common Supplier Audit Mistakes

• Auditing every supplier with the same checklist. Adjust depth and weights to the product, service, outsourced process, and risk.
• Scoring documents instead of performance. Verify records, observations, transaction samples, and results.
• Changing weights after the audit. Lock the rubric before fieldwork.
• Ignoring critical overrides. A high average cannot cancel a safety, integrity, licensing, or security failure.
• Closing findings when a task is marked complete. Verify that the action corrected the cause and works in practice.
• Forgetting purchasing controls. Carry approved requirements into requisitions, purchase orders, receipt, acceptance, and supplier monitoring.

The checklist should make a supplier decision easier to explain and easier to repeat. When criteria, evidence, weights, thresholds, and follow-up rules are defined in advance, purchasing and quality teams can compare suppliers without replacing judgment with guesswork.

Frequently Asked Questions

What Should Be Included in a Supplier Audit Checklist?

Include the audit scope, applicable criteria, weighted questions, expected evidence, actual evidence, ratings, findings, corrective actions, owners, due dates, critical-finding flags, approval decision, and re-audit date. Tailor the criteria and weights to the supplier’s risk and the product or service being purchased.

How Do You Score a Supplier Audit?

Rate each criterion from 0 to 5, multiply the criterion weight by the rating, and divide by 5. Add the weighted results for a score out of 100, then apply the approved thresholds and any critical-finding override.

How Often Should a Supplier Be Re-Audited?

Set the interval from the supplier’s score and risk. In this template, scores of 90 or more receive a 24-month interval, scores from 85 to 89.9 receive 18 months, conditional approvals receive 6 months, and rejected suppliers must be re-audited before approval.

Can a Supplier Audit Be Performed Remotely?

A remote audit can work when records, interviews, system demonstrations, and live video provide sufficient evidence. Use an on-site audit when physical conditions, production controls, traceability, security, or process observation cannot be verified reliably from a distance.

What Is the Difference Between a Supplier Audit and a Supplier Assessment?

A supplier assessment is a broader evaluation that may combine questionnaires, financial review, references, certifications, performance data, and risk screening. A supplier audit is a structured examination of defined criteria and objective evidence, usually performed remotely or on site.