Supplier Audit Checklist for Buyers: What Procurement Can Check Without a Quality Engineer
A procurement buyer without a quality engineer can verify more than most checklists assume. You can confirm that certificates are real and cover the right site and scope, that the supplier controls its measuring equipment, segregates rejected material, and can trace a lot from raw material to shipment on demand. You cannot judge whether their processes are statistically capable or whether special processes like welding, heat treatment or sterilisation are validated. For those, and for any regulated product, you need a specialist. The skill is knowing which side of that line each check sits on, and running the buyer-side checks well enough that you know when to call one.
Most supplier audit checklists are written for trained auditors and handed to buyers anyway. We have seen buyers walk a plant with a long ISO checklist, tick nearly every line because the supplier had a binder for each, and approve a supplier whose control existed mostly in the binder. The binder answers “does a procedure exist”. A buyer’s job on a visit is to find out whether anyone follows it.
In our experience the bigger problem is organisational. Quality, engineering and logistics each own a slice of what gets checked on a supplier visit. When those functions do not audit their own slice, the whole list lands on the buyer by default, and the buyer ends up signing off areas they were never equipped to judge. What follows is the buyer’s share done properly, and an honest account of where the other functions need to turn up.
What can a procurement buyer check in a supplier audit without a quality engineer?
A buyer can check anything where the evidence is visible, dated, or demonstrable on request, which covers most of what separates a controlled operation from an uncontrolled one. What a buyer cannot check is anything that needs technical interpretation of the process itself.
| Audit area | What a buyer can verify directly | How you verify it | What needs a quality engineer or specialist |
|---|---|---|---|
| Certification | Certificate is genuine, current, issued by an accredited body, and its scope covers your part and the site you are visiting | IAF CertSearch lookup before the visit, then compare the certificate on their wall to the lookup | Whether their QMS actually meets the standard in depth (that is the certification body’s job, and you are relying on it) |
| Measuring equipment | Gauges at point of use carry calibration labels that are in date and traceable to a register | Pick three gauges at random on the walk, note the IDs, ask to see them in the calibration register | Whether the measurement system is capable of the tolerance you need (gauge R&R, MSA) |
| Nonconforming material | Rejected material is physically segregated, labelled, and dated, and someone owns the decision on it | Ask to see the quarantine area. Read three tags | Whether their disposition decisions (use-as-is, rework) are technically sound |
| Traceability | They can trace a shipped lot back to raw material, operator, machine and date | The trace drill (see the questions section below). Give them a lot number from one of your receipts | Whether their lot definition is fine-grained enough for a recall in your industry |
| Document control | Work instructions at the station match the current revision and match what the operator is doing | Compare revision letter at the station to the master list. Watch one cycle | Whether the instructions are technically correct |
| Corrective action | Problems get root-caused and closed with evidence, not closed by retraining | Ask for their three most recent CAPAs and read them | Whether the root cause analysis is technically right |
| Process capability | Nothing reliable | Cpk/Ppk studies, control charts, process validation | |
| Special processes | That they know which of their processes are “special” and hold qualification records for them | Ask the question and see if they understand it | Whether the welding, heat treat, plating, bonding or sterilisation is actually validated |
The bottom two rows are where buyers get hurt. A supplier can be clean, organised and traceable and still make parts that drift out of tolerance, because capability is a statistical property you cannot see on a walk.
What should a buyer check before the supplier visit?
Check that the paperwork is real before you get on a plane. A half-day desk audit using free public databases catches problems that no site visit will, because on the day the supplier controls what you see.
| Check | Where | What it catches | Limits |
|---|---|---|---|
| Certificate validity and scope | IAF CertSearch | Expired, suspended or withdrawn certificates; certificates issued by unaccredited bodies; scope that covers a different site or a different product | Only covers accredited certificates from participating bodies, so absence is a question, not a verdict. Free tier allows 3 verifications a day and 30 a month |
| US workplace safety record | OSHA Establishment Search | Citations, penalties and inspection history for US sites | US only. Establishment names are not unique, so try spelling variations |
| Forced-labour exposure | DHS UFLPA Entity List | Named entities whose goods are presumed barred from US import | Covers named entities, not their sub-tiers. The list moves, most recently with 43 additions announced 31 July 2026 |
| Sanctions | OFAC Sanctions List Search | Sanctioned parties and their owners | Name matching only. Ownership structures need more than a search box |
Certification exists to save the buyer work. A valid certificate lets you assume the basics are in place without re-auditing them yourself, and for most parts that assumption holds. The scope check is what earns you the right to make it. A supplier with three plants often holds ISO 9001 for one of them, and the certificate on the lobby wall is real. It just is not for the building you are standing in, or it covers “assembly” when you are buying machined parts. That is not always deception. It is common enough that we treat a scope mismatch as the first question of the visit rather than a finding.
For a critical part, even a clean certificate with the right scope may not be enough. Someone else audited the whole site against a general standard. Nobody audited it against your part. When the part matters that much, we would re-audit the areas that bear on it rather than lean on the certificate.
One timing note. ISO published ISO 9001:2026 on 16 September 2026, and certificates to the 2015 edition stay valid through a transition that ends on 30 September 2029. That deadline comes from Global Accreditation Cooperation (Global ACI), the body that replaced IAF and ILAC on 1 January 2026. The CertSearch database still carries the IAF name. For a buyer this means a 2015 certificate is not a red flag for a while yet, and a supplier who claims to be “already certified to 2026” in late 2026 deserves a polite follow-up question.
What should a buyer look for on the plant walk?
Look for evidence that controls are used, not evidence that they exist. Every plant you visit will have a calibration procedure and a quarantine area. What you are reading on the walk is whether the labels are in date, whether the quarantine cage is full of old stuff nobody has decided about, and whether the operator’s work instruction is the one in the system.
Walk the plant in the direction the material flows, from receiving to shipping, and ask to see the parts of the building they did not put on the tour. The tour route is the part they cleaned.
| Where you are standing | What good looks like | What bad looks like | What it tells you | Severity |
|---|---|---|---|---|
| Receiving | Incoming material is held in a marked area until it is checked, with the check recorded | Material goes straight from the truck to the line, or sits unlabelled | Whether they control their suppliers. If not, your risk includes their sub-tier | Fix |
| Raw material storage | Every bin, coil or bag carries a lot label; oldest stock is in front | Loose stock with no labels, lots mixed in one bin | Traceability breaks here first, long before it breaks on paper | Fix, or disqualify if it is your critical material |
| Gauges at the workstation | Calibration label in date, ID matches the register | No label, expired label, or a personal tool (an operator’s own calipers) in use | Whether measurements that “pass” your parts mean anything | Fix if isolated, disqualify if systemic |
| Work instruction at the station | Current revision, visible, and what the operator does matches it | Photocopied, hand-annotated, out of date, or absent because “she knows the job” | Whether a drawing change you send will actually reach the floor | Fix |
| Quarantine / reject cage | Small, labelled, dated, recent | Overflowing, undated, or nothing in it at all | A full cage means decisions are not getting made. An empty one in a busy plant usually means rejects are not being segregated | Fix, or disqualify if no segregation exists |
| Rework area | Small and logged | Large, busy, and not in the process flow you were shown | Hidden yield loss. Their quoted price may be assuming output they do not get | Note, ask about first-pass yield |
| Maintenance board or log | Planned maintenance on schedule, breakdowns logged with causes | No log, or a board frozen months ago | How often your parts will be late for reasons nobody tracks | Note |
| Corners off the tour route | Roughly the same standard as the tour route | Visibly worse | How much of what you saw was prepared for you | Note, but weight everything else accordingly |
| Shipping / packing | Packing matches a spec, labels are printed from the system | Hand-written labels, ad-hoc packaging | Whether the part arrives the way it left the machine | Fix |
If you are also trying to read whether the supplier is financially sound, the same walk carries a second layer of signals (deferred maintenance, empty racks, a car park that used to be full). We cover that lens separately in our piece on supplier financial distress red flags, because mixing the two on one walk tends to blur both.
What questions should a buyer ask during a supplier audit?
Ask questions that make the supplier show you something rather than tell you something. “Do you have a traceability system?” gets a yes from everyone. “Trace this lot for me” gets the truth in about twenty minutes.
The trace drill. Before the visit, pick a lot number from a delivery you actually received from them. On the day, hand it over and ask them to show you the raw material lot, the machine, the date, the operator and the inspection record behind it. Time it. A controlled operation does this from the system in minutes. A struggling one sends someone to a filing cabinet, comes back with part of the answer, and promises the rest by email.
The trial run. The drill tests the records. For a new supplier we go a step further before approval and run a trial shipment with our own people standing beside the supplier’s team for the live run, from pulling material to packing the box. It is user acceptance testing for a supplier. It closes most of the gaps a desk review and a plant walk leave open, and it works in both directions, because the supplier sees exactly what we expect instead of reading it in a spec.
The rest of the “show me” list, with what good and bad answers sound like:
| Ask them to show you | A good answer | A worrying answer |
|---|---|---|
| The last customer complaint and what changed because of it | A specific complaint, a specific process change, a date | “We don’t really get complaints” |
| How a drawing revision reaches the floor | A walk-through from receiving the revision to replacing the old instruction at the station | “Engineering handles that” |
| What happens when a gauge fails calibration | They check what it measured since its last good calibration and decide about that product | “We send it for repair” (and nothing about the parts it passed) |
| How they approve their suppliers | A list, a criterion, and at least one supplier they dropped | “We’ve used them for years” |
| Their last late shipment to anyone, and why | A real cause, owned internally | Only external causes: freight, raw material, the customer |
| Who covers when the key person on your parts is off | A named second person who can explain the job | Silence, or the same name again |
| Current capacity utilisation on the lines your parts run on | A number and a view on what happens when you add volume | “We can handle it” |
The late-shipment question is worth dwelling on. If a supplier reports its own on-time performance to you, remember that the number is only as honest as its definition, and suppliers are as good at gaming delivery metrics as any internal team. Ask how they calculate it before you trust it. Our DIFOT calculation walkthrough gives you the definition to hold them to.
How can a buyer tell whether a supplier’s corrective action process actually works?
Ask for their three most recent corrective actions and read them. You do not need quality training to spot the patterns that give a paper-only CAPA system away, and they are the most reliable single indicator of whether problems you raise later will be fixed or just answered.
Four things to look for:
The root cause says “operator error” and the action says “retrained operator”. Once is fine. If it is most of them, the system is protecting the process from scrutiny by blaming the person running it.
The same problem appears twice. If two of the three are about the same defect, the first one did not work, and someone closed it anyway.
The closure date is the same week as the opening date. Real root cause work on anything non-trivial takes longer than that. Fast closure usually means the fix was a containment action wearing a CAPA’s clothes.
There is no effectiveness check. A good record says what was changed and then, weeks later, whether the problem came back. A record that ends at “action implemented” does not know whether it worked.
Spotting these patterns is the buyer’s job. Judging whether a root cause is technically correct is not, and if the records worry you, that is the moment to bring quality in.
Which supplier audit findings should disqualify a supplier, and which are fixable?
Disqualify on anything that shows dishonesty or an absence of basic control; give a time-boxed fix for anything that shows a control exists but is not being run well. Most findings are fixable. Buyers who treat every finding as fatal end up with no supplier, and buyers who treat none as fatal end up with the wrong one.
| Tier | Example findings | What you do | Why this tier |
|---|---|---|---|
| Disqualify | Falsified or back-dated records. Certificate invalid, withdrawn, or not covering the site. A hit on the UFLPA Entity List or a sanctions list. No segregation of rejected material at all. Refusing the trace drill | Stop. Do not approve. If already a supplier, escalate the same day | These are integrity or legal failures. A corrective action plan cannot fix a supplier who will not tell you the truth |
| Conditional approval | Expired calibration on a few gauges. Out-of-date work instructions at some stations. Trace drill succeeds but slowly. CAPAs closed without effectiveness checks | Approve with a written corrective action plan, named owner and a deadline, typically 30 to 90 days and shorter for critical parts. Verify closure with evidence, ideally on a return visit or trial run | The control exists and is being run badly. That is fixable, and whether they fix it is itself your best data point |
| Note and monitor | Housekeeping off the tour route. No maintenance log. Large rework area. Thin cover on a key person | Record it, raise it in the next business review, watch delivery and quality data for the consequence | Weak signals about future performance rather than current control failures |
| Refer to a specialist | Anything about process capability, special processes, or regulated-product requirements you cannot judge | Get a quality engineer or third-party auditor in before approval, not after | You are outside what a buyer can verify (next section) |
When does a buyer need a quality engineer or a third-party auditor?
You need a specialist when the product is regulated, when the part depends on a special process, or when your tolerance is tight enough that capability matters more than control. In those cases a buyer-led audit is a useful first screen and nothing more.
Our working rule is that each function audits its own area. If quality owns the part’s quality plan, quality walks the plant for it. If engineering owns the drawing, engineering signs off that the process can hold it. The buyer runs the commercial, desk and control-discipline checks in this piece and makes sure the others actually turn up. Most of the audit failures we have seen trace back to that rule being skipped, not to a buyer missing something on a checklist.
Regulated products. For medical devices sold into the US, FDA’s Quality Management System Regulation took effect on 2 February 2026. It amends 21 CFR Part 820 to incorporate ISO 13485:2016 by reference, per the February 2024 final rule, and FDA replaced its old QSIT inspection technique with a new compliance programme the same day. Purchasing controls were already required under the previous regulation. What changed is the framework and the inspection approach, which puts more weight on documented, risk-based supplier decisions. If you buy for a device maker, your supplier approval is part of their regulated quality system, and it needs a quality function behind it. The same logic applies to aerospace (AS9100), automotive (IATF 16949) and food. We are not going to pretend a buyer’s walk-through satisfies any of them.
Special processes. Welding, heat treatment, plating, bonding, sterilisation and similar processes cannot be fully verified by inspecting the finished part, so their quality depends on the process being validated and held. A buyer can confirm the supplier knows which of its processes are special and holds qualification records. A buyer cannot judge whether those records are adequate.
Tight tolerances and high volumes. If the part sits near the edge of what the process can hold, the question becomes statistical. Ask for capability data by all means, and then give it to someone who can read it.
A test before you book the flight
Take your supplier approval checklist and mark every line either “a buyer can see this” or “needs a specialist”. If most lines are in the second column and you do not have a specialist, you have not got an audit programme, you have a form. If most are in the first, you can run it yourself next month, and the trace drill alone will tell you more than the rest of the list.
