ISO Supplier & Second-Party Audits
A risk-based framework for assessing suppliers, contractors, outsourced processes and critical technology providers against agreed requirements—and verifying that improvement actions work.
Move from supplier selection to defensible requalification through clear audit criteria, practical sampling, traceable findings and performance monitoring. Templates and examples are adaptable to actual procurement and assurance programmes.
Prioritize audits according to potential impact, documented concerns and changes—not a universal calendar.
Connect contractual requirements and management-system criteria to verifiable supplier evidence.
Record audit outcomes, corrective actions and approval decisions without claiming third-party certification.
01. Understanding Supplier & Second-Party Audits
A buyer or another party with a direct interest evaluates a supplier’s controls and capability against agreed criteria. This is a practical supply-chain assurance activity, not a certification service.
Purpose & Assurance
Evaluate whether externally provided products, services and processes can reliably meet contract, technical, customer, statutory and management-system requirements.
Contractual Relationship
Confirm audit rights, confidentiality, access, permitted methods, data sharing, sub-tier suppliers and cooperation duties before arranging an audit.
Risk-Based Control
Scale the form and extent of assessment to criticality, previous performance, change, complex interfaces and confidence in other evidence.
Audit Outputs
Deliver scope, criteria, sampled evidence, factual findings, audit conclusions and a management decision with recorded limitations.
Closed-Loop Improvement
Follow issues through containment, causes, corrective actions and independent or sufficiently objective verification of effectiveness.
Supplier Lifecycle
Link the audit outcome with approval conditions, ongoing scorecards, escalation, development and requalification decisions.
The principle that matters
A satisfactory second-party audit does not itself confer ISO certification, accreditation, or an ISO-issued certificate. A certification statement—if applicable—comes from an independent certification body under its defined certification programme. ISO 19011:2026 is guidance for auditing management systems, not a certification scheme.
02. First-Party vs Second-Party vs Third-Party Audits
Distinguish who commissions the audit, whose interests are represented and what the conclusion can legitimately support.
| AUDIT TYPE | WHO CONDUCTS / COMMISSIONS | TYPICAL INTENT | OUTCOME & LIMITS |
|---|---|---|---|
| First-party | An organization audits its own management system, using suitably objective personnel. | Internal conformity, control effectiveness and improvement. | Internal audit findings and management action; not a certification decision. |
| Second-party | A customer/buyer or an appointed auditor evaluates a provider or partner. | Supplier assurance, contractual control, qualification or risk response. | Supplier audit report, approval/conditions and follow-up. No independent ISO certificate is issued. |
| Third-party | An independent audit organization, such as a certification body, evaluates a client. | Independent assurance against the certification scheme and scope. | The certification body alone makes certification decisions where authorized; an audit report alone does not guarantee a certificate. |
Audits performed by external consultants on behalf of a buyer remain second-party in purpose; employer independence alone does not change the relationship.
Avoid a common supplier-control error
A supplier’s valid third-party certificate can be useful input, but it does not replace an assessment of products, outsourced activities, relevant locations, customer-specific requirements, process risk or actual delivery performance. Confirm certificate scope, validity and relevance before relying on it.
03. Supplier Audit Criteria & Scope
Build a traceable criteria register before designing questions. The supplier should know what will be audited, which evidence can be accessed and which restrictions or exceptions apply.
Commercial & Contractual
Supply agreement, SLAs, quality agreement, approved changes, audit/access clauses, subcontracting rules, data-processing terms and service credits where relevant.
Technical & Customer Requirements
Specifications, drawings, sampling and inspection plans, approved processes, traceability, delivery conditions and flowed-down customer requirements.
Legal & Regulatory
Applicable permits, licenses, safety, environmental, privacy, export, product and other sector requirements relevant to the purchased output.
Applicable Standards & Codes
Selected ISO management-system clauses or customer/industry codes, using the correct published edition and only when included in the audit criteria.
Scope Boundaries
Legal entity, supply site, product/service families, process and shift boundaries, remote operations, sub-tier interfaces and outsourced activities.
Information, Access & Confidentiality
Confidential information controls, secure evidence access, visitor induction, IT/security permissions, prohibited records and secure retention arrangements.
Example: supplier scope and criteria register
| SUPPLIER / SCOPE | AGREED AUDIT CRITERIA | BOUNDARY / EXCLUSIONS | PRIORITY EVIDENCE |
|---|---|---|---|
| RM-01 · Raw material mill | Material specification MS-410; purchase quality agreement; receiving and traceability controls. | Alloy machining feedstock at Plant 1; transportation subcontractor examined at interface only. | Heat/batch certificates, test logs, label-to-batch reconciliation, customer complaint records. |
| SV-02 · Maintenance contractor | Contract MNT-122; work permits, competence, isolation and response obligations. | On-site preventive maintenance and shutdown work; own corporate HR processes outside scope. | Training/authorization, permit-to-work samples, service reports, incidents and completion records. |
| IT-03 · Managed cloud provider | SLA SEC-20; agreed information-security controls, backup, access management, incident response and privacy terms. | Contracted tenant/service boundary; other customers and unrelated data excluded. | Shared responsibility matrix, access reviews, restore tests, incident logs, relevant assurance reports. |
Illustrative references and company identifiers are fictional. Define the exact contractual document versions and evidence-access rights for actual audits.
04. Supplier Risk Classification & Audit Prioritization
Classify risk before scheduling. Rate the consequence of supplier failure and the likelihood/strength of warning signals, then apply mandatory escalation triggers separately.
Impact / Criticality · 1–5
Consider product safety, regulatory exposure, customer continuity, cybersecurity, supply substitution and financial/operational consequences.
Likelihood / Exposure · 1–5
Consider defect and incident history, delivery stability, process maturity, change, geography, concentration and reliance on sub-tier providers.
Illustrative Risk Score
Risk score = Impact × Likelihood. Bands shown here are an internal decision aid, not an ISO-required formula or universal supplier audit threshold.
Supplier Risk Assessment Matrix — completed example
| SUPPLIER / SERVICE | IMPACT | LIKELIHOOD | SCORE / BAND | EVIDENCE & AUDIT RESPONSE |
|---|---|---|---|---|
| RM-01 · Critical alloy | 5 · Severe | 4 · Likely | 20 · High | Recent batch nonconformity + production dependence → prioritized on-site process audit and lot traceability samples. |
| IT-03 · Hosted ERP | 5 · Severe | 3 · Possible | 15 · High | Significant information and continuity exposure → remote/on-site audit as access permits; test access governance, restore evidence and incident response. |
| SV-02 · Maintenance | 4 · Major | 3 · Possible | 12 · Medium | Permit-to-work findings and contract controls → targeted site observation, competency and safety records. |
| OF-04 · Office supplies | 1 · Minor | 2 · Unlikely | 2 · Low | Stable performance and easily substitutable items → desk evaluation or performance monitoring as proportionate. |
Illustrative scoring: Low 1–5; Medium 6–14; High 15–25. The enterprise must approve and tailor criteria. Escalate immediately for critical legal, safety, data or customer events regardless of numerical band.
Illustrative decision rule
| RISK LEVEL | SUGGESTED CONTROL PATH | REASSESSMENT TRIGGERS |
|---|---|---|
| High | Supplier qualification or focused process audit, technical verification, management decision and tracked CAPA. | Critical complaint, process relocation, cybersecurity event, ownership or major control changes. |
| Medium | Targeted audit or remote review, relevant performance records and follow-up on weak processes. | Repeat nonconformity, contract scope change, worsening supplier scorecard. |
| Low | Document review, transactional verification, performance monitoring and justified sampling. | Material increase in criticality, failures or loss of alternate supply. |
These responses are risk-based examples. An organization should choose the audit method, cadence and depth from actual needs and contractual rights.
05. Supplier Audit Programme & Scheduling
Coordinate supplier audits as a portfolio, using approved priorities, realistic resources and defined audit purposes—not an automatic annual audit for every supplier.
Audit Universe & Population
Maintain supplier IDs, categories, provided outputs, critical sites, outsourcing tiers, current approval, contract owners and risk history.
Programme Triggers
Plan qualification, routine verification, change-driven review, customer concern, incident investigation and effectiveness follow-up.
Auditor & Specialist Selection
Select people with sufficient audit methods, supplier-process and technical competence; screen conflicts and preserve objective judgement.
Audit Method & Access
Choose on-site observation, live remote interview, desktop evidence review or a justified hybrid; record limitations.
Time & Practicality
Allow for supplier availability, permits, confidentiality, translation, processes across shifts and testing or sampling time.
Decision Gate & Follow-Up
Approve scope and plan, monitor delivery, report findings and link significant concerns to supplier status, CAPA and purchasing controls.
Illustrative supplier audit schedule
| SUPPLIER | TRIGGER & OBJECTIVE | METHOD / SCOPE | AUDIT LEAD / TARGET | CURRENT PLAN STATUS |
|---|---|---|---|---|
| RM-01 · Critical alloy | New supplier qualification + unresolved material escape. | On-site production, lab and traceability review. | Quality & materials specialist · 2027-02 | Planned · supplier access pending |
| IT-03 · Hosted ERP | Contract renewal and change in privileged-access architecture. | Remote review of tenant security and restore controls. | IT audit lead + cloud specialist · 2027-03 | Scheduled · NDA approved |
| SV-02 · Maintenance | Permit-control complaint and contractor performance trend. | On-site sample of permits, competence and completed jobs. | HSE auditor · 2027-04 | Proposed · risk review |
| OF-04 · Office supplies | Low criticality and no change/poor results. | Document review + performance scorecard. | Procurement owner · risk-review cycle | Monitoring · no site audit justified |
Dates, audit personnel, statuses and IDs are illustrative planning data, not actual supplier audit appointments.
06. Supplier Audit Preparation & Evidence Planning
Use a structured supplier-specific desk review to identify the right questions and samples. Do not depend exclusively on a generic ISO clause checklist.
Contract & Change Review
Collect purchase/quality agreements, SLA, statements of work, approved drawings, revision notices and customer-specific flow-down.
Performance History
Study delivery accuracy, defect/rejection rates, customer complaints, security incidents, response time and service levels.
Risk & Sample Design
Choose critical product batches, orders, incidents, shifts, contractors or IT service events based on risk and recent changes.
Audit Rights & Safeguards
Confirm confidentiality terms, evidence export limits, visitor HSE requirements, remote security and permission to contact sub-tiers.
Team Competence
Verify relevant audit-method capability and specialist understanding; separate technical advisers from audit decision authority.
Supplier Coordination
Agree objectives, agenda, site/process owners, opening/closing discussions, evidence requests and escalation routes.
Supplier audit preparation checklist
Before fieldwork, approve the audit mandate and evidence access; map the criteria-to-process matrix; examine previous defects and corrective actions; select risk-relevant transactions; verify auditor independence; agree how sensitive supplier and customer data will be handled; and define audit report approval and follow-up responsibilities.
07. Supplier Audit Execution: Interviews, Observation & Sampling
Follow the actual product or service trail, compare observed practice with the agreed criteria and explain sampling limitations in the audit report.
Verify the supplier’s real control points
Second-party fieldwork should address how purchased outputs are designed, produced, released, delivered and corrected at their operating location—not merely whether a procedure exists.
Interview process owners and operators about specifications, changes, responsibilities and exceptions.
Trace selected batches, maintenance work orders or service tickets through source evidence and decision records.
Record sample IDs, location, time period, applicable criterion, evidence access limitations and any conflicting observations.
Supplier Audit Checklist — sample questions and evidence tests
| CHECKPOINT / CRITERION | SAMPLE AUDIT QUESTION | EXPECTED OBJECTIVE EVIDENCE | RESULT FIELD |
|---|---|---|---|
| 01 · Scope & requirements | How are contract and customer specifications translated to the supplier’s controlled processes? | Current purchase agreement, version-controlled specifications, responsibilities and change records. | C / PC / NC / N/A |
| 02 · External-provider controls | Which sub-tier activities affect supplied output, and how are these controlled? | Approved sub-tier register, oversight method, inspection outcomes, escalation records. | C / PC / NC / N/A |
| 03 · Competence | How is relevant operator, technician or IT administrator competence demonstrated? | Role criteria, authorization matrix, task observation, competence assessment. | C / PC / NC / N/A |
| 04 · Traceability / service records | Can a selected batch, work order or ticket be traced end-to-end? | Batch tags, lot genealogy, service tickets, equipment logs and release approvals. | C / PC / NC / N/A |
| 05 · Change control | How are changes to material, location, process, tooling or system access assessed and notified? | Change request, impact/risk assessment, customer approval where required. | C / PC / NC / N/A |
| 06 · Inspection / verification | Which acceptance checks detect nonconforming supplied outputs? | Test results, inspection records, release authority, equipment verification. | C / PC / NC / N/A |
| 07 · Nonconformity control | What happens after a failed inspection, incident or service breach? | Segregation/containment, issue logs, customer notification and disposition. | C / PC / NC / N/A |
| 08 · Corrective action | How are recurring issues investigated and effectiveness tested? | Cause analysis, action ownership, revised controls, post-change verification. | C / PC / NC / N/A |
| 09 · Business continuity | How is critical supply or service restored after disruption? | Contingency plans, exercises, backups, restoration or alternate-source tests. | C / PC / NC / N/A |
| 10 · Security / confidentiality | How are buyer data, access privileges and supplier personnel permissions protected? | Access reviews, NDA, security logs, offboarding, encryption or incident evidence as applicable. | C / PC / NC / N/A |
Illustrative result legend: C = Conforming; PC = Partly Conforming; NC = Nonconforming; N/A = Not Applicable, with reason. Include actual record identifiers and audit findings in completed working papers.
08. Supplier Findings, Audit Report & Corrective Action Follow-Up
Every reported nonconformity should identify the failed criterion, observed facts, evidence source and affected output. Separate immediate containment from systemic corrective action and effectiveness.
Supplier Audit Report — completed illustrative summary
| REPORT FIELD | ILLUSTRATIVE COMPLETED ENTRY |
|---|---|
| Report ID / status | SA-RM01-2027-01 · Supplier audit report · Example / training record |
| Supplier & site | RM-01 Alloy Feedstock Manufacturer · Production and laboratory site 1 |
| Audit purpose / method | Qualification and response to recent out-of-spec batch; on-site interviews, observations and sampling. |
| Scope & criteria | Contract QA-18 Rev 3; customer material specification MS-410 Rev 4; supplier batch-testing and traceability controls. |
| Audit team / independence | Lead auditor: QMS purchasing auditor; technical expert: metallurgy engineer. No direct responsibility for the supplier’s process. |
| Samples & traceability | Three sample heat/batch IDs H-104, H-107, H-113; receiving records, laboratory results and release approvals. All IDs fictional. |
| Positive evidence | Receiving and raw material test acceptance criteria were documented and consistently communicated in sampled records. |
| NC-01 · Material traceability | Criterion: QA-18 §4.2. Observation: batch H-107 label did not reconcile with release log RL-218; disposition was not documented. |
| Risk / immediate action | Potential mix-up before release; supplier to quarantine affected lot and trace related stock pending containment verification. |
| Audit conclusion / limitations | Conditional supplier status recommended pending containment, action plan and effectiveness verification; only sampled products/site covered. |
| Report approval | Lead auditor signature/date and purchaser approval to be completed for actual report. |
All names, references, sample IDs and conclusions are examples and must be replaced by verified evidence before use.
Corrective Action Follow-Up Register — illustrative
| FINDING / RISK | SUPPLIER ACTION / OWNER | DUE / STATUS | EFFECTIVENESS EVIDENCE & DECISION |
|---|---|---|---|
| SA-01 · RM-01 label mismatch | Contain implicated lots; analyze label-to-release interface; revise scanning check. Owner: Supplier Quality Lead. | 2027-03-20 · Open | Pending post-action sample of 10 new lots, receiving-to-release trace and review of recurrence. |
| SA-02 · SV-02 missing permit sign-off | Stop affected task; retrain permit issuers; system gate on job close. Owner: Contractor Manager. | 2027-04-10 · In progress | Retest across sample of completed jobs and different shifts; assessor to confirm compliance. |
| SA-03 · IT-03 stale privileged access | Disable access; investigate provisioning and offboarding; automate review. Owner: IT Service Lead. | 2027-04-25 · Verification pending | Examine sampled access-removal events and independent review results; no closure on policy change alone. |
Dates, facts and planned verification results are illustrative, not actual audit outcomes.
Closure rule
Record who accepts the supplier’s response and who verifies effectiveness. Supplier statements, submitted policies or training attendance alone are not sufficient proof of effective corrective action. If exposure remains, define restricted approval, additional inspection, alternative source, suspension or escalation according to the contract and organizational policy.
09. Supplier Performance Evaluation & Requalification
Use the audit result alongside live performance and business risk. A supplier is not automatically approved forever because one audit had a favourable conclusion.
| CONTROL DIMENSION | EXAMPLE INDICATOR / SOURCE | DECISION USE |
|---|---|---|
| Quality / product conformity | Defective lots / inspected lots; customer escape count; batch-release and rework evidence. | Target additional product verification, supplier development or restricted use. |
| Delivery & service reliability | On-time delivery against agreed windows, critical SLA breaches and service recovery time. | Adjust schedule, buffers, contingency or contractual controls. |
| Regulatory / safety / environmental | Applicable license validity, incidents, required monitoring and compliance notifications. | Immediate escalation where legal, safety or material environmental risk exists. |
| Information security & continuity | Security incidents, backup restore evidence, privileged access reviews and security assurance limits. | Escalate exposure and confirm service continuity or exit plans. |
| Corrective-action capability | Overdue critical findings, evidence quality, repeat problems and verified effectiveness. | Change approval conditions and determine re-audit priority. |
| Financial / concentration / change | Supply concentration, ownership, site/process changes, capacity and financial continuity signals. | Evaluate resilience, substitution options and the extent of requalification. |
Define KPI denominators, reporting period, data owner and data quality in the supplier scorecard; avoid mixing example values with actual results.
Approved
Supplier meets applicable conditions for defined products/services and locations; continue monitoring.
Conditionally Approved
Use only within specified restrictions, elevated inspection or an approved improvement plan.
Restricted or Suspended
Stop or limit relevant new orders or services where significant uncontrolled risk remains.
Requalified / Rejected
Reassess when required by risk, critical changes or performance—not simply by passing a calendar date.
Requalification evidence gate
Confirm current scope, accepted corrective actions, performance history, customer and regulatory constraints, technical capability and any material changes. Record the authorized buyer/quality decision, approved limitations, next review trigger and the objective basis for the conclusion.
10. Worked Examples: Raw Materials, Service Contractors & IT Providers
Each scenario identifies its own criteria and evidence. The same generic supplier checklist cannot establish adequate assurance across every sector or outsourcing model.
Scenario A · Critical Raw Material Supplier
Criteria: alloy specification, purchasing quality agreement, heat/batch identity, inspection and release requirements.
Evidence: laboratory COAs, three sampled heat records, raw material labels, receiving results, gauge verification and complaint disposition.
Sample audit trail: purchase order → heat certificate → label → incoming test → release.
Decision: conditional qualification until traceability gap is verified closed.
Scenario B · On-Site Service Contractor
Criteria: maintenance scope, safety permit rules, competence/authorization, site isolation requirements and agreed service levels.
Evidence: sampled permits, equipment isolation logs, competence assessments, 5 completed work orders and incident/action records.
Sample audit trail: job request → risk assessment → permit → execution → handback.
Decision: restrict critical work if permit controls remain ineffective.
Scenario C · Managed IT / Cloud Supplier
Criteria: signed SLA, security and privacy clauses, access governance, incident reporting, restoration targets and shared responsibility.
Evidence: access review and offboarding tickets, backup restore tests, incident exercises, service reports and relevant assurance results.
Sample audit trail: identity request → privileged approval → activity log → periodic review → removal.
Decision: adjust approval and remediation to security/continuity exposure.
Cross-supplier learning: compare the assurance logic
| ASSURANCE QUESTION | MATERIAL SUPPLIER | SERVICE CONTRACTOR | IT PROVIDER |
|---|---|---|---|
| What could fail? | Incorrect material grade or untraceable lot. | Unsafe work, missed controls or poor equipment handback. | Unauthorized access, data loss or prolonged outage. |
| Where to observe? | Production/lab, labelling and dispatch. | Worksite, permits and completed service jobs. | Identity administration, monitoring, change and incident workflow. |
| Who validates closure? | Purchasing quality owner + technical specialist. | HSE/maintenance contract owner. | Information security and service owner. |
| What changes approval? | Consecutive conforming lots, successful cause-control verification. | Demonstrated permit execution and safe repeat jobs. | Verified access removals, control testing and restoration evidence. |
These examples are fictional and illustrative; sector-specific legal obligations and actual contractual criteria take precedence.
Supplier Audit Control Checklist & Template Use
Use the four sample records as a connected set, with one supplier identifier linking risk classification, audit scope, report findings, corrective actions and requalification decisions.
Supplier Risk Assessment Matrix: record criticality, likelihood, previous issues, escalation triggers, assessed evidence, approval and review logic.
Supplier Audit Checklist: connect each question to an applicable requirement, selected sample ID, observation, result and documented exception.
Supplier Audit Report: identify supplier/site, scope, team, methods, reviewed criteria, evidence trail, findings, limitations and dated conclusion.
Corrective Action Follow-Up Register: record finding ID, containment, root cause, change owner, due date, response, verification method and closure authorization.
Supplier authorization: record who may approve, restrict, suspend or requalify each supplier and which sourcing controls apply.
Document control: protect supplier commercial/security records; retain revision, access permissions and retention criteria as applicable.
Professional use note
All sample records on this page are deliberately illustrative. Actual supplier approval, findings and compliance claims require verifiable evidence, competent personnel, applicable contractual authority and an authorized management decision. Nothing here asserts that a second-party audit creates or substitutes for accredited certification.
Related ISO Toolkits Guidance & Professional References
Use these pages to connect procurement assurance with audit planning, auditor competence, risk decisions and controlled documentation.
ISO Audit Preparation
Audit methods, evidence quality, reporting and practical readiness checks. Read Audit Preparation →
Risk & Opportunity Management
Translate supplier-related operational uncertainty into proportionate controls and follow-up. Explore Risk Management →
Internal Auditor Competence
Select, evaluate and authorize audit personnel with relevant technical skill and impartiality. Read Auditor Competence →
Audit Programme Planner
Build risk-based audit schedules, responsibilities, findings and progress tracking. Open Programme Planner →
ISO Documentation Templates
Structure supplier registers, contract controls, checklists and action evidence. Explore Templates →
Authoritative references
ISO 19011:2026 — Guidelines for auditing management systems ↗ provides guidance on auditing, audit programme management and auditor competence. Consult the licensed, current edition of the applicable management-system standard and relevant contracts, regulations and industry requirements. For ISO 9001 supplier controls, consider the requirements for externally provided processes, products and services under clause 8.4 where applicable.
Build an Evidence-Based Supplier Assurance Programme
Use editable ISO management-system resources to document supplier scope, risk assessments, approved purchasing criteria, audit reports and corrective-action verification. Adapt the templates to your industry, contracts and actual sourcing controls.
Keep a documented trail from supplier risk to audit sampling and final qualification decisions.
Require operational evidence before closing supplier corrective actions.
Speed Up ISO Implementation
with Ready Made Documentation
Access editable ISO templates, procedures, forms, registers, and audit checklists to reduce manual work and prepare faster with confidence.
The templates gave us a well-organized management system that is professional, accessible, and easy for process owners to use.
Our teams and auditors responded positively. The toolkit helped us present our processes in a structured and professional way.
The toolkit provides a flexible best-practice framework that keeps our documentation aligned as requirements evolve.
We saved significant time preparing our policies, procedures, forms, and internal audit materials for the implementation project.
The documentation was clear, professional, and easy to adapt. It gave our team a much stronger starting point.
A practical toolkit for consultants who need a repeatable and organized approach to ISO implementation documentation.
The toolkit helped us organize our health and safety documents into a more practical and ready for implementation structure.
The templates were easy to customize and gave us a clear foundation for building a client-ready ISO management system.
The audit checklists were practical and helped our team review gaps before the external audit preparation stage.
We appreciated the clear structure. It made implementation planning easier and helped our department owners understand their role.
The documentation package saved our team time and reduced the need to create ISO forms and registers from the beginning.
The toolkit gave us a professional starting point and helped us improve consistency across procedures, records, and checklists.
Trusted by over 10,000+ Client Organizations
We have provided ISO Implementation Toolkits to over 10,000 businesses and organizations of all sizes, from startups and small businesses to the Fortune 100, in over 130 countries.
