How to Conduct a Supplier Audit for QMS Compliance

Your product is only as good as the materials and services that go into it. You can run a tight internal process and still ship a defect that a supplier created, and that is the real challenge of relying on outside partners for quality, delivery, and compliance.

A supplier audit closes that gap. It lets you verify how suppliers work, spot risks early, and keep quality steady from one shipment to the next. This guide covers audit planning, risk assessment, checklists, evidence collection, nonconformities, corrective actions, and QMS software, and it shows how ISO 9001 and the FDA QMSR treat supplier oversight.

Quick answer: A supplier audit is a structured check of a supplier’s processes, records, and controls against defined criteria. To run one, define the scope and assess supplier risk, then prepare a tailored checklist, collect objective evidence, report findings, and verify corrective actions. Audit frequency depends on risk, not a fixed calendar.

What Is a Supplier Audit in Quality Management?

A supplier audit is a systematic evaluation of a supplier’s processes, records, and controls against defined audit criteria. Those criteria usually come from quality standards, contract terms, and your own procedures.

When a customer audits its own supplier, ISO 19011 calls it a second-party audit, as Certainty Software explains. Auditors gather objective evidence through documents, interviews, and observation, and they never rely on what the supplier says about itself.

The Purpose of a Supplier Audit

A good supplier audit does four jobs:

• It verifies compliance with applicable quality requirements.
• It evaluates supplier process controls and product conformity.
• It identifies risks before they turn into quality failures.
• It supports supplier approval and continuous improvement.

Outsourcing the work never outsources the responsibility. Greenlight Guru notes that the legal manufacturer stays accountable for a device even when a contractor builds it, and every regulated industry follows the same logic.

Supplier Audit vs. Supplier Assessment

Supplier assessment is the broader umbrella. It covers questionnaires, scorecards, certificate reviews, and performance reviews, which are quick and inexpensive but often rely on data the supplier supplies. An audit tests that data: auditors check records, question staff, and watch the work happen. A current ISO certificate helps, yet it does not replace an audit scoped to your own specifications.

	Supplier audit	Supplier assessment
Evidence	Records, interviews, observation	Questionnaires, scorecards, reviews
Who gathers it	The auditor	Often the supplier
Best use	Qualification, verification, for-cause checks	Screening and routine monitoring

Types of Supplier Audits in a QMS

Pick the audit type that matches the supplier’s risk, performance, and role in your business. One approach for every supplier wastes time on low-risk vendors and misses problems at critical ones.

Supplier Qualification Audits

A qualification audit happens before you approve a supplier and confirms that the supplier can meet your requirements consistently. SimplerQMS describes these initial audits as a review of the whole quality system, the supplier’s technical capability, and its compliance status. Approval without evidence is just a guess.

Routine and Risk-Based Supplier Audits

Routine audits monitor approved suppliers over time, and risk should set the schedule. Four factors carry the most weight:

• Criticality: Does the part or service affect safety, performance, or compliance?
• Defect history: Repeat issues justify a closer look.
• Process changes: New equipment, sites, or materials raise the odds of failure.
• Compliance exposure: Regulated products demand tighter oversight.

Greenlight Guru sorts suppliers into three risk tiers and schedules regular audits for the top two. Ramp and SimplerQMS both describe a common pattern: high-risk suppliers every one to two years and low-risk suppliers about every three. Treat that as a starting point, not a rule.

Hypothetical example: A device maker’s sterilization provider affects patient safety, while its label printer has a clean record. The sterilizer gets an on-site audit this quarter, and the printer gets a desktop review. A serious complaint would trigger a for-cause audit.

Remote vs. On-Site Supplier Audits

	Remote audit	On-site audit
Strengths	Lower cost, faster scheduling, strong document review	Direct view of processes, storage, and handling
Limits	Cannot observe the floor or interview operators in context	Higher travel cost and longer lead time
Best fit	Low-risk suppliers, follow-ups, pre-audit reviews	Critical suppliers, qualification, for-cause audits

Many teams combine both: they review records remotely first, then visit the site to watch the work and test what the paperwork claims.

How to Conduct a Supplier Audit Step by Step

The supplier audit process runs in six steps, and skipping one weakens your findings.

Step 1: Define the Audit Scope and Criteria

Start with what you are auditing and why, and write it down before you contact the supplier. Identify the supplier, products, services, and processes under review, establish the standards, contract terms, and internal procedures that apply, and define the audit objectives and the evidence needed to meet them. A written scope also prevents scope creep once your team is on site.

Step 2: Assess Supplier Risk

Risk decides how deep you go. Evaluate how critical the product or service is, review previous audit findings and supplier performance, and consider regulatory exposure, process complexity, and recent changes. Pull complaint logs, incoming inspection results, and open corrective actions before you finalize the plan, because those records show you where to dig.

Step 3: Prepare the Supplier Audit Checklist

Review the supplier’s quality procedures and certifications, then include process controls, inspection records, traceability, and corrective actions. Tailor the questions to your scope instead of relying on a generic template alone.

Send the supplier an evidence request list ahead of time, a tip Certainty Software stresses. That one step saves hours of record hunting on audit day. Build a short agenda too, with time slots for each area and the people you need to meet.

Step 4: Collect Objective Evidence

Objective evidence is what you can see, read, and verify. Four methods work together:

• Document review: Procedures, work records, training logs, and calibration certificates.
• Interviews: Ask operators and supervisors, not just the quality manager.
• Process observation: Watch real work, not a staged demonstration.
• Record sampling: Pick records yourself and trace them from start to finish.

Compare three things: what people say, what the procedure says, and what the records show. Gaps between them become your findings, so capture notes during the audit.

Step 5: Document Findings and Issue the Audit Report

Every finding needs three parts: the requirement, the evidence you saw, and the risk it creates. Most programs grade findings as critical, major, or minor, which tells the supplier which issues to fix first.

Hold a closing meeting before you leave to share strengths and nonconformities and let the supplier clarify. Then issue a written report that lists the scope, dates, participants, findings, responsible owners, and agreed follow-up dates.

Hypothetical example: An auditor samples five lots at a machining supplier. Four carry signed inspection records, and one has none. The finding cites the procedure clause, the lot number, and the missing record, and the auditor rates it major because the gap touches a critical dimension.

Step 6: Follow Up and Verify Corrective Actions

The audit does not end with the report. Ask the supplier for a root cause analysis and a corrective action plan with owners and dates, then check that the work happened. Verification can include updated procedures, training records, or photos of the changed process.

Certainty Software warns that programs accepting plans as proof see the same findings return in the next cycle, and a promise is not evidence. If the corrective action holds up, re-evaluate the supplier and update its risk rating. If it fails, escalate.

Supplier Audit Checklist for QMS Compliance

A supplier audit checklist keeps audits consistent across auditors and suppliers and stops you from forgetting a topic mid-interview. Still, adjust the scope to each supplier’s risks, because the checklist guides your audit while judgment drives it.

Essential Areas to Include in a Supplier Audit Checklist

Most checklists cover the same core areas:

• Quality management documentation and document control
• Personnel training and competency
• Manufacturing or service process controls
• Inspection, testing, and calibration
• Product identification and traceability
• Nonconforming product management
• Corrective and preventive action processes
• Change management and supplier performance monitoring

Tie every item to a requirement source, such as a standard clause, a contract term, or an internal procedure, so any finding traces straight back to its basis. Add industry criteria where they apply. According to SimplerQMS, medical device suppliers fall under the purchasing controls in ISO 13485 clause 7.4.

How to Use Audit Questions and Evidence Effectively

A question only helps if you can check the answer, so pair each question with the evidence you expect to see.

Area	Sample question	Evidence to verify
Nonconforming material	How do you control nonconforming materials?	Written procedure, quarantine area, disposition records
Calibration	How do you keep measuring equipment accurate?	Calibration schedule, certificates, out-of-tolerance actions
Traceability	Can you trace this lot from raw material to shipment?	Lot records, material certificates, shipping records
Training	How do you confirm operators are competent?	Training matrix, signed records, competency checks
Change control	How do you notify customers about process changes?	Change records, approvals, notification logs
CAPA	Show me your last closed corrective action.	Root cause analysis, action proof, effectiveness check

Suppose a supplier says it quarantines nonconforming material. Walk to the quarantine area and compare the physical stock with the log. When the two disagree, you have found something worth writing down.

Supplier Audit Requirements Under ISO 9001 and FDA QMSR

Supplier audit requirements depend on the standard you follow, your regulatory framework, your contracts, and your risk. No single rule fits every company, so your quality management system should state which rules apply and how you meet them.

Supplier Audits and ISO 9001

Clause 8.4 covers externally provided processes, products, and services. It expects you to evaluate, select, monitor, and re-evaluate external providers and to tell them your requirements, including any planned verification at their premises, as Auditor Training Online outlines.

ISO 9001 does not require an on-site audit of every supplier. It requires controls that match the risk, and an audit is one tool, often the strongest one for critical suppliers.

ISO scheduled ISO 9001:2026 for publication on September 16, 2026, and Advisera reports that the new edition is now available. It also reports that clause 8.4.3 now covers how providers interact with your customers and other interested parties. Check the current text before you update your procedures.

Supplier Audit Records Under FDA QMSR

The FDA’s Quality Management System Regulation took effect on February 2, 2026. It incorporates ISO 13485:2016 into 21 CFR Part 820, according to NSF, and applicable medical device manufacturers feel the biggest change here.

The old rule exempted supplier audit reports from routine FDA review. The FDA’s QMSR FAQ now says investigators may review management review, quality audit, and supplier audit reports during inspections on or after February 2, 2026. They may also review QMS records created before that date. Write every report as if an investigator will read it: stick to facts, cite the evidence, and track each finding to closure.

Industry-Specific Supplier Audit Considerations

Do not treat regulatory frameworks as interchangeable, because each one sets its own expectations.

• Medical devices: ISO 13485 clause 7.4 calls for evaluating and monitoring suppliers, with verification tied to the risk of the material supplied.
• Pharmaceuticals: EU GMP Chapter 7 says contracts should permit audits of outsourced activities. SimplerQMS also notes that 21 CFR 211.84(b) requires raw material sampling plans to account for supplier quality history, although Part 211 does not explicitly require supplier audits.
• Other regulated sectors: Standards such as IATF 16949 and AS9100 add their own supplier requirements.

Verify each requirement against the current official text before you build it into your program.

How to Manage Supplier Audit Findings and CAPA

An audit report that sits in a drawer protects nobody. Every finding should lead to documented corrective action, and every action should end in verified proof.

Classify and Investigate Supplier Audit Findings

Start by recording the objective evidence: the record, the observation, the lot number. Next, judge severity and risk with three questions: Could this affect product safety or compliance? Does the issue look isolated or systemic? Has it happened before?

Critical findings carry immediate risk, major findings point to systemic gaps, and minor findings describe isolated slips. Then press the supplier to find the root cause with tools like 5 Whys or a fishbone diagram, because symptoms alone will not stop a repeat.

Create a Supplier Corrective Action Plan

A workable plan names every detail:

• Action owners: A named person at the supplier for each action.
• Due dates: Timelines tied to severity.
• Required evidence: Exactly what proves the action is done.
• Escalation steps: Who steps in when dates slip.
• Completion criteria: Closure terms agreed in writing.

Spell out the closure evidence. As Certainty Software points out, a request like “provide the revised work instruction and training records” works far better than “fix the issue.” A CAPA management system can hold owners, dates, and evidence in one linked record. eLeaP’s CAPA module, for example, lets teams link a CAPA to an audit finding, assign each action an owner and planned completion date, and flag overdue actions.

Verify Corrective Action Effectiveness

Closing the action is not the same as closing the problem. Use a follow-up review, a record sample, or a re-audit to confirm the fix worked and the issue stays gone. For critical or recurring findings, Certainty Software suggests checks at 30, 60, or 90 days.

Hypothetical example: A molded-housing supplier answers a finding for missing first-article records with retraining, and nobody verifies the result. Six months later, the same records are missing again, because the real root cause was an unclear work instruction. A record sample three months in would have caught the gap.

How QMS Software Improves Supplier Audit Management

A QMS ties supplier audits to the rest of your quality work. Software helps most in three places.

Centralize Supplier Audit Records and Evidence

Controlled document storage and searchable audit histories speed record retrieval and improve traceability. Auditors find the last report, the open actions, and the supporting evidence in one place instead of across email threads and shared drives.

Automate Audit Scheduling and Corrective Action Tracking

QMS platforms commonly support audit calendars, ownership assignments, and flags for overdue actions. Features vary by vendor, so confirm exactly what each platform supports before you buy.

Monitor Supplier Audit Performance With QMS Data

Useful metrics include audit completion rate, overdue corrective actions, repeat nonconformity rate, average corrective action closure time, and supplier defect trends. These numbers show whether your audit program works or only produces paperwork.

Frequently Asked Questions About Supplier Audits

How Often Should Suppliers Be Audited?

No single interval fits every supplier, because risk sets the schedule. A critical supplier with a defect history may need an annual audit, while a low-risk commodity vendor might need one only when something changes. Performance data, process changes, and regulatory obligations all shift the frequency, so write down your rationale to show inspectors why you chose it.

What Should a Supplier Audit Checklist Include?

Cover document control, personnel training and competency, process controls, inspection and calibration, traceability, nonconforming product handling, and corrective action. Then tailor the questions to the supplier’s scope, since a generic template misses the risks tied to a specific product or service.

Does ISO 9001 Require Supplier Audits?

Not by name. ISO 9001 requires you to control externally provided processes, products, and services, and you decide how to evaluate, select, and monitor providers. An audit is one option, and questionnaires, scorecards, and incoming inspection data can also satisfy the requirement when they match the risk.

What Is the Difference Between a Supplier Audit and a Supplier Assessment?

An audit checks a supplier against defined criteria and relies on objective evidence. An assessment casts a wider net and can include questionnaires, scorecards, performance reviews, and site visits. Many quality teams use assessments to screen suppliers and then reserve audits for high-risk ones.

How Should Supplier Audit Findings Be Closed?

Start with an evidence-based finding, investigate the root cause, and agree on a corrective action plan with owners and due dates. Close the finding only after you verify the fix worked, by sampling records or scheduling a follow-up audit. Closing a finding on a promise instead of proof invites repeat nonconformities.

Can QMS Software Help Manage Supplier Audits?

Yes. Digital workflows keep audit plans, evidence, findings, and corrective actions in one searchable place, and QMS software can show repeat nonconformances and closure times across suppliers. Confirm the specific features with each vendor, and in eLeaP’s CAPA module you can link a CAPA directly to an audit finding.

Conclusion: Build a More Effective Supplier Audit Program

A strong supplier audit program rests on four habits: plan by risk, collect objective evidence, report findings clearly, and verify that corrective actions actually work.

Audits deliver the most value when their results keep flowing. Feed findings into ongoing supplier monitoring, and use trends to guide supplier development and shape the next audit plan. That loop turns a one-time check into continuous improvement across your quality management system.

Start with a candid review of your current process. Where does your risk assessment rely on guesswork, and where do corrective actions stall after the report goes out? Then ask whether your existing workflows give you enough traceability from audit to closure. If they do not, a connected quality management system is the logical next step.