Supplier Audits: What You Are Really Evaluating and How to Do It Well

A supplier audit is not a visit. It is a systematic evaluation of whether a supplier’s quality system is capable of consistently producing materials that meet your requirements. The distinction matters because audits conducted as formalities produce findings that look thorough and accomplish little.

Define the Scope Before You Go

An audit without a defined scope is a conversation. Before you schedule a supplier audit, determine what you are there to evaluate. Which quality system elements matter most for the materials you receive? What do you know from prior performance data, incoming test results, or previous audit findings that should guide your focus?

For a supplier of active pharmaceutical ingredients, you will examine manufacturing controls, deviation management, and change control. For a contract testing laboratory, the focus shifts to data integrity practices, instrument qualification, and analyst training records. Scope should follow risk.

What Strong Audits Actually Examine

The most informative audit findings come from examining systems rather than documents. Documents can be prepared for an audit. Systems cannot.

Effective supplier audits examine whether the procedures match actual practice; whether deviations are investigated at an appropriate depth; whether training records reflect real competency or just attendance; and whether the site’s management review process is genuinely evaluating quality trends or producing reports that no one acts on.

Ask to see a recent CAPA. Review the investigation narrative, not just the action items. A CAPA that closes promptly with actions like “retrain analyst” without examining why the error occurred tells you something meaningful about the site’s quality culture.

Documenting the Audit Report

An audit report that only lists observations is incomplete. It should also include a summary of the site’s strengths, the auditor’s overall assessment of system capability, the risk level assigned to any findings, and a timeline for corrective action responses.

Supplier corrective action commitments should be tracked to closure. An audit where the findings are documented and then filed without follow-up has not reduced your risk. It has produced a record that the risk was identified and ignored.

Frequency and Re-Qualification

Audit frequency should be risk-based. Critical suppliers of materials with direct product impact warrant more frequent evaluation. Suppliers with a history of deviations, regulatory actions, or significant changes to their process or ownership require expedited review regardless of schedule.

A supplier that has changed substantially since their last audit is, in a meaningful sense, a new supplier. Re-qualification is not a penalty. It is the program working as intended.

Building Supplier Audit Capability

Audit quality depends on auditor preparation. Teams that invest in training their auditors to examine systems—rather than check boxes—consistently find higher-value findings and build stronger supplier relationships. A supplier who knows what good looks like is a supplier who improves.