Owned by procurement
Covers: on-time delivery, rejection rates, cost and responsiveness, from your own records.
Cadence: quarterly or yearly, by supplier tier.
Tells you: that something is going wrong.
Last reviewed: October 2026
No Credit Card Required
A supplier’s certificate tells you it had a working quality system on the day of its last external audit. A supplier audit tells you whether that system works on your parts now. This free supplier audit checklist is for supplier quality engineers, quality managers and buyers who audit a supplier’s quality system and processes, on site or remotely. One run covers one audit of one supplier site. It sets the audit type and scope from the supplier’s risk and recent performance, then covers notifying the supplier and agreeing the agenda, a document review before the audit, the opening meeting and system checks, process and product checks from goods-in to dispatch, graded findings and the closing meeting, and corrective action requests through to verified closure. It ends with an approval decision: approved, conditionally approved or not approved. The audit method adds a site visit or a remote set-up task, a for-cause audit adds a review of the problem behind it, and a major finding adds containment, escalation and a follow-up audit.
Three activities check a supplier, and they are easy to confuse. Supplier onboarding qualifies a new supplier before its first order. A supplier performance evaluation scores delivery, quality and cost from your own data, usually every quarter. A supplier audit goes to the source: it examines the supplier’s quality system and the processes that make your parts, and finds the causes behind the numbers.
It is also different from an internal audit. The QA compliance audit and the ISO 9001 internal audit check your own system. A supplier audit is a second-party audit: you audit another organisation against your requirements, so its findings become corrective action requests to the supplier, and its result decides whether you keep buying.
Covers: on-time delivery, rejection rates, cost and responsiveness, from your own records.
Cadence: quarterly or yearly, by supplier tier.
Tells you: that something is going wrong.
Covers: the supplier’s quality system, process control, inspection, calibration, nonconforming product, traceability, training and sub-tier suppliers.
Cadence: before approval, then by risk, and after a serious quality problem.
Tells you: why it is going wrong, and whether the supplier can fix it.
Covers: containment, root cause and corrective action for each nonconformity the audit raises.
Ends: when the action is shown to work. The CAPA Checklist runs the same loop inside your own organisation.
Eight phases take one supplier audit from scoping to an approval decision. The audit method decides whether Phase 2 shows the site visit or the remote set-up task, a for-cause audit adds a task to Phase 1, and a major finding adds tasks to Phases 6 and 7. The checklist halts at the approval decision in Phase 8.
The lead auditor named on the first task is assigned the audit tasks that follow. The answers there also decide which tasks appear: a for-cause audit adds a review of the problem behind it, and the audit method adds the site visit or the remote set-up task in Phase 2.
Only one of the site visit and remote set-up tasks appears, depending on the audit method chosen on the first task.
Done at your desk in the week before the audit. What you find here decides where the audit spends its time.
Ask to see the record, not a description of it. Note the document, record or observation behind every answer, and where you saw it.
Follow your own parts through the supplier’s process. On a remote audit, ask for a live camera walk-through rather than photographs taken earlier.
Answering Yes to a major nonconformity adds the containment and escalation tasks here and a follow-up audit in Phase 7.
The supplier quality manager named on the first task records the decision. The checklist halts there, so the approved supplier list is not changed before the decision is made.
Agree the grades at the opening meeting, so the supplier knows what a major finding means before you raise one. The definitions below are common practice, not the wording of a standard; if your quality agreement or your sector’s scheme defines the grades, use those. The grade decides how the finding is closed and how much it weighs in the approval decision.
| Grade | What it means | Example | How closure is verified | Usual effect on approval |
|---|---|---|---|---|
| Major nonconformity | A requirement is not met at all, or a failure could let nonconforming parts reach you | No calibration control for the gauges used at final inspection; a shipped batch cannot be traced to its material certificate | Containment at once, then a corrective action request with root cause, checked by a follow-up audit or evidence from the site | Conditionally approved at best until closed; not approved if the risk cannot be contained |
| Minor nonconformity | A single lapse in a system that otherwise works | One work instruction at a machine is a superseded revision; one operator’s training record is unsigned | A corrective action request closed on documents and records | Usually approved, or conditionally approved while several minors are open |
| Observation | Not a nonconformity, but a weakness that could become one | Inspection records are complete but kept on loose sheets that are easy to lose | No corrective action request; noted in the report and checked at the next audit | None on its own |
Some rules set the audit for you. In the United States, a food facility covered by the FDA’s preventive controls rule for human food (21 CFR part 117) must audit a supplier on site before first using its raw material and at least once a year after that, when the supplier controls a hazard with a reasonable probability of serious adverse health consequences or death. A written determination that other verification activities, or less frequent audits, give adequate assurance can replace this (21 CFR 117.430). A qualified auditor must perform the audit (117.435), and the record must include the supplier’s name, the audit procedures, the dates, the conclusions, the corrective actions taken for significant deficiencies and evidence that the auditor was qualified (117.475). Customers in regulated sectors often pass their own supplier audit requirements down through the purchase order or quality agreement, so check yours before planning the audit.
Choose on site or remote and the checklist adds the site visit or the video set-up task. A for-cause audit adds a review of the problem behind it, and a major finding adds containment, escalation and a follow-up audit, so nothing is skipped when an audit turns serious.
Every due date counts from the audit date on the first task. Findings and corrective action requests sit in tables on the tasks that raised them, the supplier’s files and replies attach to the same tasks, and the verification task stays open on the Reports Grid until someone checks the evidence.
The supplier quality manager records Approved, Conditionally approved or Not approved, with the conditions. The checklist halts at that approval, so nobody updates the approved supplier list first, and the activity trail shows who decided and when.
Supplier audits come round again. CheckFlow’s recurring checklist software can start each supplier’s next audit on its own schedule, yearly for one supplier and every six months for another, and CheckFlow for manufacturing shows how audits sit beside the daily quality checks on your own shop floor.
The Supplier Performance Evaluation Checklist produces the scorecard that tells you which supplier to audit next, and the Supplier Onboarding Checklist covers qualification before the first order. Nonconformities in your own processes go through the CAPA (Corrective & Preventive Action) Checklist, and the Calibration Management Checklist keeps your own gauges in the state you expect your suppliers’ to be in.

CAPA (Corrective & Preventive Action) Checklist

QA Compliance Audit Process Checklist

Supplier Performance Evaluation Checklist

Supplier Onboarding Checklist

Product Inspection Workflow Checklist
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
Planning, the audit itself and the follow-up. Planning sets the audit type and scope from the supplier’s risk and recent performance, notifies the supplier, agrees the agenda and reviews certificates, the quality manual, the process flow and earlier findings. The audit covers the opening meeting, the quality management system, process control, incoming, in-process and final inspection, calibration, nonconforming product, traceability, training and control of sub-tier suppliers, then the closing meeting. The follow-up grades the findings, issues the report and corrective action requests, verifies closure and records the supplier’s approval status.
A supplier evaluation scores performance from your own data: on-time delivery, rejections, cost and responsiveness. A supplier audit examines how the supplier works, at its site or by video, against your requirements and its own procedures. The evaluation tells you that something is wrong, and the audit finds out why. Many teams use the evaluation to decide which suppliers to audit next. The Supplier Performance Evaluation Checklist covers the scorecard.
Most teams set the frequency by risk: critical or high-risk suppliers every year or more often, lower-risk suppliers less often or by questionnaire, and an extra audit after a serious quality problem. Record the reasoning with the risk rating. Some rules set a minimum. Under the FDA’s preventive controls rule for human food (21 CFR 117.430), a facility that relies on a supplier to control a hazard that could cause serious adverse health consequences or death must audit that supplier on site before first use and at least annually, unless a written determination shows other verification is adequate.
Yes, for much of the work. Document review, interviews, record sampling and a live camera walk-through of the work areas all work by video if the connection is tested first. Remote audits are weaker at seeing what the camera is not pointed at: housekeeping, storage, segregation of rejected parts and how the floor runs when nobody is presenting. Many teams audit lower-risk suppliers remotely and go on site for initial approval, special processes and after a major finding.
A major nonconformity is a requirement that is not met at all, or a failure that could let nonconforming parts reach you, such as uncalibrated gauges at final inspection or batches that cannot be traced. A minor nonconformity is a single lapse in a system that otherwise works, such as one out-of-date work instruction. An observation is a weakness that is not yet a nonconformity. Agree the definitions at the opening meeting, or use the ones in your quality agreement, and apply them the same way to every supplier.
A SCAR is the formal request you send the supplier for each nonconformity. It states the requirement, the evidence and the dates by which you expect containment, a root cause and a corrective action plan. Review the response before you accept it: a root cause of operator error, or an action that only says retrain, rarely stops the problem coming back. Close the SCAR only when the action is in place and the evidence shows it worked. The CAPA Checklist covers the same loop for your own nonconformities.
The supplier may keep supplying, but only under conditions you set and record: for example, open corrective actions closed by a date, extra inspection at your goods-in, a limit to existing part numbers or a follow-up audit. Put the conditions and the review date on the approved supplier list, so buyers see them before placing an order. If the conditions are not met by the review date, decide again, and move the supplier to not approved if the risk remains.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting