Key Resources
Verified ISO references for planning the assurance choice.
A procurement manager proposes an annual factory audit for every important supplier. That sounds rigorous, yet a visit can consume skilled audit resources without resolving the uncertainty that matters. Conversely, accepting a polished questionnaire may be inadequate when manufacturing processes, safety controls or data practices need direct verification.
On-site verification is one evidence-gathering method within supplier assurance. The decision should start with the required confidence, the consequences of error and the access or testing needed. It should end with a defined evaluation question, not a travel booking.
1Identify what remains unknown after routine qualification
Start with the supplier’s approved scope, product or service criticality, past performance, change history and available certification or independent inspection evidence. A current management-system certificate can support confidence within its stated scope but does not independently verify a particular lot, special process or contractual characteristic. Ask which actual control or capability must be observed.
Supplier claims may be tested remotely using records, live video demonstration, sample inspection or third-party test reports. If these methods establish credible evidence at appropriate confidence, a site visit may add little. If a critical process relies on undocumented operator judgment or environmental controls, direct observation may be proportionate.
The most useful pre-visit document is an unanswered-question register. It may list uncertainty about machine maintenance, process parameter control, traceability or operator competence. Attach the most recent evidence and why it is insufficient. This prevents a site team from spending time touring a tidy factory while the unresolved concern remains hidden. Confirm whether supplier certification scope includes the exact process and location, and remember that certification does not replace contractual acceptance or product verification.
2Use risk, detectability and change as visit triggers
Escalation candidates include repeated failures without convincing root cause, new production locations, outsourced special processes, major ownership changes, complex environmental or health and safety exposure, and serious information-security deficiencies. Consider whether an incoming defect would be detected before customer harm and whether alternative supply is available.
Avoid treating one negative metric as an automatic audit trigger. A small temporary delivery delay may be better resolved through capacity data. A single safety-critical process escape with weak traceability might justify immediate process verification. Explicit decision thresholds improve consistency across categories and discourage opportunistic visits.
A visit may become more compelling when detection is weak. In a process that destroys evidence of an earlier stage, finished-product inspection might not reveal whether the correct treatment was applied. A remote service provider might have logs sufficient for assurance without a physical visit. The decision should reflect both how severe failure would be and whether relevant controls can be observed another way. Documented reasons for not visiting can be as important as reasons for visiting when resources are constrained.
Standards context. ISO 19011:2026 provides guidance on audit planning, evidence and auditor competence; it does not itself require every supplier to receive an annual on-site audit. Read the official ISO publication information.
3Choose the right kind of verification
An initial capability assessment, corrective-action follow-up, targeted process audit and broader management-system audit serve different purposes. A supplier with a questionable welding process may require an experienced specialist observing parameters and traceability, not a generic ISO document review. A logistics security concern may require site and route-security controls.
Define competence, independence and access before the visit. Verify the legal and contractual rights to inspect facilities, sample records, discuss staff competence or observe subprocessors. Site access may be restricted by privacy, safety, intellectual property or another customer’s confidentiality; agree evidence alternatives and permissions early.
Choose an assessor able to understand the process under review. General quality-system auditors may need specialists for heat treatment, environmental monitoring, food allergen segregation, occupational safety or information-security architecture. Develop a visit plan focused on the specific uncertainty and any restrictions on observing proprietary operations. Agree confidentiality and safety arrangements in advance. A narrowly scoped process verification and a full system audit are not interchangeable; each should have its own criteria and deliverable.
4Plan evidence sampling around the decision
State scope, criteria, methods, sample strategy and practical schedule. Select real jobs, shifts or transactions capable of demonstrating routine control, and sample exceptions as well as ordinary output. A staged production demonstration prepared solely for visitors may conceal the variation that causes defects in normal operation.
Where possible, follow one identifiable product or service transaction from input through critical controls, inspection and release. Record objective observations, traceable records and uncertainty, not only a pass/fail checklist. The principle aligns with ISO 19011 guidance on effective audit programmes, but a supplier visit does not have to be called an ISO audit to be useful.
Sampling should follow an authentic transaction. If the concern is traceability, select a delivered lot and follow the identifier through input records, operator instructions, test results and release authorization. Review at least one exception where available to see whether controls remain effective under stress. Interviews should corroborate records, not replace them. Record what could not be observed, such as a seasonal operation or an outsourced process, so the final conclusion does not imply confidence beyond the sampled evidence.
5Convert observations into supplier decisions
A visit report should distinguish confirmed conformity, nonconformity, improvement opportunity and unresolved evidence gap. Assign acceptance conditions and corrective-action owners. Where failures create immediate risk, decide whether incoming stock, work in progress or future shipments need containment before an action plan is approved.
Agree evidence needed to demonstrate effectiveness after corrective actions. A supplier may retrain operators, yet the real test may be stable process results across subsequent normal production runs. Record any approved temporary restrictions and their expiry, so continued purchasing is not mistaken for full acceptance.
An observation should be written as a factual condition linked to criteria and evidence. “Weak quality culture” is too broad to support action; “the sampled calibration record was expired at the time this measurement was released” is testable. The supplier deserves a chance to correct factual errors, but disagreements should not erase the evidence. For high-risk findings, immediately assess affected stock or service periods and set interim safeguards. Follow-up verification needs criteria that show the control performs after correction, not only a completed training record.
6Measure the value of field verification
After the visit, assess whether it changed qualification, risk treatment, inspection or continuity decisions. Track repeated findings, elapsed closure time and performance after actions. If visits consistently produce broad generic reports without affecting control choices, redesign the programme and invest in more targeted assurance.
Remote follow-up can be appropriate for documentary corrections, while direct follow-up may be necessary for an unsafe physical process. The next visit date should follow residual risk and material change—not simply the end of an annual calendar. The assurance approach should remain explainable to both the supplier and internal leadership.
When evidence from the visit changes the qualification decision, update purchasing controls, receiving inspection and supplier risk classification promptly. If nothing changed, document whether the original uncertainty was resolved and whether a cheaper assurance method could be used next time. Review the performance of assessed suppliers to evaluate whether visits detect actual precursors of failures. Supplier site verification is a means of achieving confidence; maintaining a high number of visits is not itself an operational objective.
Qualitative assurance matrix
This matrix organizes decisions, not measured research findings. Each criterion requires case-specific evidence.
| Decision context | Working control | Acceptance evidence |
|---|---|---|
| Identify what remains unknown after routine qualification | Define the exact assurance question before authorizing a visit | Approved criteria and exception record |
| Use risk, detectability and change as visit triggers | Check whether existing evidence or remote tests can answer it | A sampled normal operating transaction |
| Choose the right kind of verification | Select competent assessors and inspect real operating transactions | Accepted qualification or test result |
| Plan evidence sampling around the decision | Link findings to supplier approval, restrictions and follow-up | Documented owner and follow-up decision |
A practical go / no-go decision before travel
The approval request for an on-site visit should explain the unresolved question, the evidence available, the consequence of being wrong and why direct observation is expected to change the decision. It should name the competent assessor, site, processes, access rights and planned sample. A cost estimate can be included, but savings alone should not determine whether a critical process deserves direct verification. Remote evidence should be considered transparently rather than dismissed as inferior by default.
After the visit, compare the actual findings with that original rationale. If the relevant process was not operating during the visit, the team may need a remote video observation or a second scheduled sample. If the target uncertainty was resolved without a finding, preserve the evidence and explain what changed in the supplier decision. A visit that produces only generic housekeeping advice is not a substitute for checking the originally identified risk.
Operational decision checklist
- Define the exact assurance question before authorizing a visit
- Check whether existing evidence or remote tests can answer it
- Select competent assessors and inspect real operating transactions
- Link findings to supplier approval, restrictions and follow-up
Closing perspective
The decision to visit should be justified by the uncertainty it will resolve. A narrowly scoped, competent site verification tied to acceptance evidence is more credible than an impressive-looking universal visit schedule.
The best supplier visit concludes with a precise decision about confidence, restrictions or corrective action. If it did not answer the planned question, that uncertainty must be retained rather than hidden behind a completed audit checklist.