Supplier Audit Checklist Template

Most supplier problems that reach your goods-in were visible at the supplier months earlier: a gauge past its calibration date, an operator never trained on your part, a sub-tier source nobody approved. An audit that only reads the certificate and the quality manual will not find them.

Last reviewed: October 2026

A supplier’s certificate tells you it had a working quality system on the day of its last external audit. A supplier audit tells you whether that system works on your parts now. This free supplier audit checklist is for supplier quality engineers, quality managers and buyers who audit a supplier’s quality system and processes, on site or remotely. One run covers one audit of one supplier site. It sets the audit type and scope from the supplier’s risk and recent performance, then covers notifying the supplier and agreeing the agenda, a document review before the audit, the opening meeting and system checks, process and product checks from goods-in to dispatch, graded findings and the closing meeting, and corrective action requests through to verified closure. It ends with an approval decision: approved, conditionally approved or not approved. The audit method adds a site visit or a remote set-up task, a for-cause audit adds a review of the problem behind it, and a major finding adds containment, escalation and a follow-up audit.

A Supplier Audit Tests the System Behind the Scorecard

Three activities check a supplier, and they are easy to confuse. Supplier onboarding qualifies a new supplier before its first order. A supplier performance evaluation scores delivery, quality and cost from your own data, usually every quarter. A supplier audit goes to the source: it examines the supplier’s quality system and the processes that make your parts, and finds the causes behind the numbers.

It is also different from an internal audit. The QA compliance audit and the ISO 9001 internal audit check your own system. A supplier audit is a second-party audit: you audit another organisation against your requirements, so its findings become corrective action requests to the supplier, and its result decides whether you keep buying.

Supplier performance evaluation

Owned by procurement

Covers: on-time delivery, rejection rates, cost and responsiveness, from your own records.

Cadence: quarterly or yearly, by supplier tier.

Tells you: that something is going wrong.

Supplier audit

Run by a lead auditor (this checklist)

Covers: the supplier’s quality system, process control, inspection, calibration, nonconforming product, traceability, training and sub-tier suppliers.

Cadence: before approval, then by risk, and after a serious quality problem.

Tells you: why it is going wrong, and whether the supplier can fix it.

Corrective action

Owned by the supplier, verified by you

Covers: containment, root cause and corrective action for each nonconformity the audit raises.

Ends: when the action is shown to work. The CAPA Checklist runs the same loop inside your own organisation.

What the Supplier Audit Checklist Covers

Eight phases take one supplier audit from scoping to an approval decision. The audit method decides whether Phase 2 shows the site visit or the remote set-up task, a for-cause audit adds a task to Phase 1, and a major finding adds tasks to Phases 6 and 7. The checklist halts at the approval decision in Phase 8.

  1. Phase 1

    Phase 1: Audit Type, Scope & Team

    6 tasks

    The lead auditor named on the first task is assigned the audit tasks that follow. The answers there also decide which tasks appear: a for-cause audit adds a review of the problem behind it, and the audit method adds the site visit or the remote set-up task in Phase 2.

    • Record the supplier, the audit date and the audit method — what they supply, the site to be audited, whether the audit is on site or remote, and who leads it and who decides the outcome
    • Rate the supplier’s risk — how critical the parts are to your product, any safety or regulatory impact, the spend, and whether you have another source
    • Review the supplier’s recent performance — rejections, deliveries, complaints and open corrective action requests since the last audit
    • Review the problem that triggered the audit — the complaint, rejection, field failure or late corrective action behind a for-cause audit, and what the audit must establish
    • Set the audit scope and criteria — the processes, part numbers, shifts and buildings in scope, and the requirements you will audit against
    • Choose the audit team — a lead auditor who is independent of the purchasing decision, plus a technical expert for special processes such as heat treatment, plating or welding
  2. Phase 2

    Phase 2: Notify the Supplier & Plan the Audit

    6 tasks

    Only one of the site visit and remote set-up tasks appears, depending on the audit method chosen on the first task.

    • Notify the supplier of the audit in writing — the dates, scope, criteria, method and team, with enough notice for the right people to be there
    • Agree the agenda with the supplier — the opening meeting, the areas in the order you will visit them, the people you need to interview and the time of the closing meeting
    • Request the documents you will review before the audit — certificates, the quality manual or system overview, the process flow and control plan for your parts, and the status of earlier findings
    • Arrange the site visit — travel, the site’s safety induction and PPE, photography and confidentiality rules, and who will escort the team
    • Set up the remote audit — test the video platform, screen sharing and file transfer with the supplier, and agree how they will show the work areas live by camera
    • Prepare the audit questions and the sampling plan — the questions for each area, the part numbers, batches and records you will sample, and the time allowed per area
  3. Phase 3

    Phase 3: Document Review Before the Audit

    5 tasks

    Done at your desk in the week before the audit. What you find here decides where the audit spends its time.

    • Check the supplier’s certificates — the issuing body, the scope, the sites covered and the expiry date, and that they cover the site and processes you buy from
    • Review the quality manual or system overview — how the supplier controls documents, records, changes, inspection and its own suppliers
    • Review the process flow and control plan for your parts — the process steps, the inspection points, the characteristics checked and what happens when a check fails
    • Review the findings of the previous audit — check each corrective action was closed, and plan to confirm on the day that the fix is still in place
    • List the areas to probe during the audit — gaps from the document review, recent quality problems, special processes and changes since the last audit
  4. Phase 4 — Audit day

    Phase 4: Opening Meeting & Quality System Checks

    5 tasks

    Ask to see the record, not a description of it. Note the document, record or observation behind every answer, and where you saw it.

    • Hold the opening meeting — introduce the team, confirm the scope, agenda and finding grades, agree the confidentiality rules and name the supplier’s guides
    • Check the quality management system — document control, records, internal audits, management review and how the supplier’s own corrective actions are run
    • Check contract review and change control — how your drawings, revisions and special requirements reach the shop floor, and that the supplier tells you before it changes a process, material or site
    • Check training and competence — sample the operators and inspectors who work on your parts: training records, the skills matrix and qualifications for special processes
    • Check how the supplier controls its own suppliers — approval, monitoring and incoming checks for sub-tier suppliers of raw material and outsourced processes
  5. Phase 5 — Audit day

    Phase 5: Process & Product Checks

    8 tasks

    Follow your own parts through the supplier’s process. On a remote audit, ask for a live camera walk-through rather than photographs taken earlier.

    • Walk the process for your parts from goods-in to dispatch — observe the work and talk to the people doing it, on site or by live camera, against the process flow you reviewed
    • Check incoming inspection — how material is received, identified, checked against its certificates and held until it is released
    • Check process control — set-up approval, first-off checks, current work instructions at the machine, in-process checks and the reaction when a result is out of limits
    • Check in-process and final inspection — the inspection plan against the control plan, sample sizes, signed and dated records and who authorises release for dispatch
    • Check calibration of measuring equipment — sample the gauges used on your parts for a current calibration status and certificate, and ask what happens when one is found out of tolerance
    • Check control of nonconforming product — identification, segregation, the disposition record, rework approval and when the supplier must tell you before shipping
    • Check traceability with one shipped batch — trace it back to the material certificate, the machines, the operators and the inspection records
    • Check packaging, labelling and storage — part identification, protection in transit, shelf life where it applies and stock rotation
  6. Phase 6 — Audit day

    Phase 6: Findings & Closing Meeting

    5 tasks

    Answering Yes to a major nonconformity adds the containment and escalation tasks here and a follow-up audit in Phase 7.

    • Record every finding with its objective evidence — the requirement, what was seen and where, so the supplier can check each one against its own records
    • Grade each finding as a major nonconformity, minor nonconformity or observation — using the definitions agreed at the opening meeting or set in your quality agreement
    • Agree containment for each major finding — parts at the supplier, in transit and in your stores checked, sorted or held until the risk is understood
    • Hold the closing meeting — present each finding, agree the facts, set the supplier’s response dates and record who attended
    • Escalate the major finding inside your organisation — tell your quality manager and the buyer, and decide whether to stop shipments, add inspection at goods-in or look for another source
  7. Phase 7

    Phase 7: Report & Supplier Corrective Actions

    5 tasks
    • Write and issue the audit report — the scope, team, dates, method, each finding with its evidence and grade, good practice seen and the overall conclusion
    • Raise a supplier corrective action request for each nonconformity — the requirement, the evidence and the dates for containment, root cause and the corrective action plan
    • Schedule a follow-up audit for the major finding — on site or remote, to see the corrective action in place before the supplier’s status is restored
    • Review the supplier’s root cause and action plan — send it back if the cause is operator error or the action is retraining with nothing else
    • Verify each corrective action and close the requests — evidence of the change, then later batches or a follow-up check that show the problem has not come back
  8. Phase 8

    Phase 8: Approval Status Decision

    5 tasks

    The supplier quality manager named on the first task records the decision. The checklist halts there, so the approved supplier list is not changed before the decision is made.

    • Summarise the audit result for the decision — the findings by grade, what is closed and still open, the risk rating and how the supplier responded
    • Decide the supplier’s approval status — approved, conditionally approved or not approved, with any conditions and the date they will be reviewed
    • Update the approved supplier list and the purchasing system — the status, the parts or processes it covers, any conditions and any block on new orders
    • Tell the supplier the outcome in writing — the status, any conditions and when the next audit or review is due
    • Set the date of the next audit — from the risk rating and this result, and add the findings to the supplier’s performance record

Grading Supplier Audit Findings

Agree the grades at the opening meeting, so the supplier knows what a major finding means before you raise one. The definitions below are common practice, not the wording of a standard; if your quality agreement or your sector’s scheme defines the grades, use those. The grade decides how the finding is closed and how much it weighs in the approval decision.

Grade What it means Example How closure is verified Usual effect on approval
Major nonconformityA requirement is not met at all, or a failure could let nonconforming parts reach youNo calibration control for the gauges used at final inspection; a shipped batch cannot be traced to its material certificateContainment at once, then a corrective action request with root cause, checked by a follow-up audit or evidence from the siteConditionally approved at best until closed; not approved if the risk cannot be contained
Minor nonconformityA single lapse in a system that otherwise worksOne work instruction at a machine is a superseded revision; one operator’s training record is unsignedA corrective action request closed on documents and recordsUsually approved, or conditionally approved while several minors are open
ObservationNot a nonconformity, but a weakness that could become oneInspection records are complete but kept on loose sheets that are easy to loseNo corrective action request; noted in the report and checked at the next auditNone on its own

Some rules set the audit for you. In the United States, a food facility covered by the FDA’s preventive controls rule for human food (21 CFR part 117) must audit a supplier on site before first using its raw material and at least once a year after that, when the supplier controls a hazard with a reasonable probability of serious adverse health consequences or death. A written determination that other verification activities, or less frequent audits, give adequate assurance can replace this (21 CFR 117.430). A qualified auditor must perform the audit (117.435), and the record must include the supplier’s name, the audit procedures, the dates, the conclusions, the corrective actions taken for significant deficiencies and evidence that the auditor was qualified (117.475). Customers in regulated sectors often pass their own supplier audit requirements down through the purchase order or quality agreement, so check yours before planning the audit.

Why Run Supplier Audits in CheckFlow?

1

The right tasks for each audit

Choose on site or remote and the checklist adds the site visit or the video set-up task. A for-cause audit adds a review of the problem behind it, and a major finding adds containment, escalation and a follow-up audit, so nothing is skipped when an audit turns serious.

2

Findings become dated actions

Every due date counts from the audit date on the first task. Findings and corrective action requests sit in tables on the tasks that raised them, the supplier’s files and replies attach to the same tasks, and the verification task stays open on the Reports Grid until someone checks the evidence.

3

The approval decision is a recorded gate

The supplier quality manager records Approved, Conditionally approved or Not approved, with the conditions. The checklist halts at that approval, so nobody updates the approved supplier list first, and the activity trail shows who decided and when.

Supplier audits come round again. CheckFlow’s recurring checklist software can start each supplier’s next audit on its own schedule, yearly for one supplier and every six months for another, and CheckFlow for manufacturing shows how audits sit beside the daily quality checks on your own shop floor.

The Supplier Performance Evaluation Checklist produces the scorecard that tells you which supplier to audit next, and the Supplier Onboarding Checklist covers qualification before the first order. Nonconformities in your own processes go through the CAPA (Corrective & Preventive Action) Checklist, and the Calibration Management Checklist keeps your own gauges in the state you expect your suppliers’ to be in.

AI generator

Didn’t find what you need? Describe it.

Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.

Frequently Asked Questions

What should a supplier audit checklist include?

Planning, the audit itself and the follow-up. Planning sets the audit type and scope from the supplier’s risk and recent performance, notifies the supplier, agrees the agenda and reviews certificates, the quality manual, the process flow and earlier findings. The audit covers the opening meeting, the quality management system, process control, incoming, in-process and final inspection, calibration, nonconforming product, traceability, training and control of sub-tier suppliers, then the closing meeting. The follow-up grades the findings, issues the report and corrective action requests, verifies closure and records the supplier’s approval status.

What is the difference between a supplier audit and a supplier evaluation?

A supplier evaluation scores performance from your own data: on-time delivery, rejections, cost and responsiveness. A supplier audit examines how the supplier works, at its site or by video, against your requirements and its own procedures. The evaluation tells you that something is wrong, and the audit finds out why. Many teams use the evaluation to decide which suppliers to audit next. The Supplier Performance Evaluation Checklist covers the scorecard.

How often should you audit a supplier?

Most teams set the frequency by risk: critical or high-risk suppliers every year or more often, lower-risk suppliers less often or by questionnaire, and an extra audit after a serious quality problem. Record the reasoning with the risk rating. Some rules set a minimum. Under the FDA’s preventive controls rule for human food (21 CFR 117.430), a facility that relies on a supplier to control a hazard that could cause serious adverse health consequences or death must audit that supplier on site before first use and at least annually, unless a written determination shows other verification is adequate.

Can a supplier audit be done remotely?

Yes, for much of the work. Document review, interviews, record sampling and a live camera walk-through of the work areas all work by video if the connection is tested first. Remote audits are weaker at seeing what the camera is not pointed at: housekeeping, storage, segregation of rejected parts and how the floor runs when nobody is presenting. Many teams audit lower-risk suppliers remotely and go on site for initial approval, special processes and after a major finding.

What is the difference between a major and a minor nonconformity in a supplier audit?

A major nonconformity is a requirement that is not met at all, or a failure that could let nonconforming parts reach you, such as uncalibrated gauges at final inspection or batches that cannot be traced. A minor nonconformity is a single lapse in a system that otherwise works, such as one out-of-date work instruction. An observation is a weakness that is not yet a nonconformity. Agree the definitions at the opening meeting, or use the ones in your quality agreement, and apply them the same way to every supplier.

What is a supplier corrective action request (SCAR)?

A SCAR is the formal request you send the supplier for each nonconformity. It states the requirement, the evidence and the dates by which you expect containment, a root cause and a corrective action plan. Review the response before you accept it: a root cause of operator error, or an action that only says retrain, rarely stops the problem coming back. Close the SCAR only when the action is in place and the evidence shows it worked. The CAPA Checklist covers the same loop for your own nonconformities.

What does conditionally approved mean for a supplier?

The supplier may keep supplying, but only under conditions you set and record: for example, open corrective actions closed by a date, extra inspection at your goods-in, a limit to existing part numbers or a follow-up audit. Put the conditions and the review date on the approved supplier list, so buyers see them before placing an order. If the conditions are not met by the review date, decide again, and move the supplier to not approved if the risk remains.

Is CheckFlow free for this template?

14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.

Audit Every Supplier the Same Way, From Scope to Approval

Free trial — no credit card required.

14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting