Paperwork can show that a supplier should be able to deliver. Only first-hand evidence shows whether it does.
Buyers who rely on certificates and scorecards alone see the results but not the cause. Sending auditors to look at the process itself closes that gap, and ISO 19011 sets out how to do it properly.
How a visit is planned, run and followed up decides whether it changes anything. The place to start is what an audit is and what it is measured against.
What is a supplier audit?
A supplier audit is a structured check that a buyer or its representative carries out to see whether a supplier meets agreed requirements, based on objective evidence.
ISO 19011:2026, clause 3.1, defines an audit as a "systematic, independent and documented process for obtaining objective evidence and evaluating it objectively to determine the extent to which the audit criteria are fulfilled". The standard concentrates on internal audits (first party) and "audits conducted by organizations on their external providers and other external interested parties (second party)". A supplier audit is a second party audit. ISO 19011 is guidance rather than a requirement for certification, and the 2026 edition, published in May 2026, replaced ISO 19011:2018.
An auditor compares what a supplier does with audit criteria, which can include requirements in a management system standard, the buyer's own requirements and statutory and regulatory requirements. Typical evidence includes calibration records for inspection equipment, how the supplier stores and labels goods on the receiving dock and proof that the supplier completed a previous corrective action.
Why it matters: causes found at the source, evidence on file and fewer repeat failures
Because an audit rests on evidence gathered first-hand, it gives a buyer three advantages that certificates and scorecards cannot.
- First-hand evidence of how a supplier works, meaning the buyer sees the process behind the results and not only the results
- Root causes found for recurring non-conformances, meaning corrective action targets the source of the problem
- Verification at the supplier's premises, which ISO 9001:2026, clause 8.4.3, lists among the activities a buyer may communicate to external providers, meaning the buyer can show customers and auditors how the buyer checks outsourced work
Types of supplier audit: on-site, remote and document review
Buyers can gain those advantages in more than one way, because audits differ mainly in where and how the evidence is gathered. The right choice depends on the supplier's risk.
On-site audit
An on-site audit takes place at the supplier's premises, so the auditor can observe processes, equipment and storage directly and interview the people doing the work.
Remote audit
A remote audit gathers evidence through video calls and shared records. ISO 19011:2026 expands its guidance on remote auditing methods and virtual locations, although a remote audit cannot replace a physical look at equipment or workmanship.
Document review
A document review examines certificates, procedures and records without a visit. It works as a first step before a visit or as a lighter check for lower-risk suppliers, but it shows what is written down rather than what happens on the floor. Supplier audits and certifications covers how to keep certificates current between audits.
What happens in a supplier audit, from initiating to follow-up
Whichever type is chosen, the audit moves through the same four stages.
Initiating and preparing the audit
ISO 19011:2026 begins with initiating the audit. The buyer agrees the objectives, scope and criteria with the supplier, confirms access and schedule, and plans which processes and records to examine.
Gathering evidence
Once the audit is agreed and planned, the auditor reviews records, observes work and interviews staff, sampling rather than checking everything, and records what it finds as objective evidence.
Reporting findings
After the evidence is gathered, the audit report records the objectives, scope, criteria, findings and conclusions, including how far the supplier fulfilled the criteria.
Following up on corrective action
Findings usually call for action, and ISO 19011:2026 ends with conducting the audit follow-up. The supplier decides and carries out corrections or corrective actions within an agreed time frame, and the buyer then verifies that the supplier completed them and that they worked. Verified results feed the supplier's performance record and its next re-evaluation.
How supplier audits differ from monitoring, internal audits and certification audits
A supplier audit is one of four checking activities that are often confused, and they differ in purpose, owner and timing.
| Activity | Purpose | Owner | Timing |
| Supplier audit (second party) | Check whether a supplier meets the buyer's requirements | The buyer or an auditor acting for it | Planned by supplier risk or triggered by a problem |
| Supplier performance monitoring | Track delivery and quality results continuously | The buyer's purchasing or quality team | Ongoing, reviewed at intervals the buyer sets |
| Internal audit (first party) | Check the organization's own system against its criteria | The organization itself | On the organization's own audit schedule |
| Certification audit (third party) | Confirm conformity to a standard for certification | An independent certification body | On the certification body's cycle |
The same discipline applies inside the organization through quality management system audits.
Limitations of supplier audits
Even a well-run supplier audit has limits that the buyer should plan around.
- Sampling: an auditor sees only a portion of records, products and shifts
- Point in time: a result reflects the day of the audit, so monitoring between audits remains necessary
- Criteria: findings are only as clear as the requirements they are measured against
An audit finding only protects the buyer when the fix is verified
Because an audit is a sample taken at one point in time, its value depends on what happens next. For a team starting out, the practical move is to audit the highest-risk suppliers first, agree criteria before the visit and treat every finding as open until the buyer has checked the corrective action and confirmed that it has held.