A supplier qualification audit is the documented, evidence-based assessment that feeds a larger, risk-tiered supplier qualification program. It is one input, not the whole program. Choose desktop review, remote audit, or on-site visit by risk tier, applying the risk-based thinking in ISO 9001 guidance, and check ISO 19011 before you schedule anything.
TL;DR:
- Run qualification as a four stage lifecycle: classify risk, evaluate with records or audits, approve through signed quality agreements, then monitor and requalify.
- Reserve on site audits for high criticality suppliers; use remote audits for medium risk only after documenting feasibility, security, bandwidth, auditor competence, and observable processes.
- Each written report should classify findings by severity, cite objective evidence, assign corrective action owners and due dates, and record the approval decision.
- Document each supplier’s risk tier, approval basis, requalification schedule, and performance history, and trigger an unscheduled review after ownership changes, site moves, or repeated nonconformances.
Table of Contents
- How does a supplier qualification program differ from a single audit?
- Which audit type and method fit each supplier?
- How do you run an initial qualification audit, step by step?
- What belongs in a supplier qualification file?
- How often should you re-audit, and where do programs go wrong?
- How do you keep audits objective and efficient?
- Why I run qualification as a program, not an event
- How can we support your supplier qualification checks?
- FAQ
- Sources
How does a supplier qualification program differ from a single audit?
A qualification program is a lifecycle. Current practice runs it in four stages: classification (risk tier and its rationale), evaluation (desktop review, questionnaire, or audit), approval (signed quality agreements), and monitoring with requalification. The audit sits inside the evaluation stage, next to cheaper methods. Treating it as the whole program is how teams end up with a stack of reports and no defensible approval decision.
ISO 9001 audit guidance also says an approved supplier list alone is not enough. You must show that risk-based thinking determined the controls over each external provider, so program design and documented evaluation go together.
Move a supplier into a higher tier when any of these apply:
- The item is critical to product function or safety.
- The supplier is sole-source or hard to replace.
- A failure carries regulatory or safety consequences.
- Prior audits or performance trends show instability.
Which audit type and method fit each supplier?
Match the audit type to the moment in the relationship:
- Initial (qualification) audit: before approval, to confirm the supplier can meet your specification.
- Periodic (surveillance) audit: after approval, on a cadence set by risk tier.
- For-cause audit: triggered by a complaint, a nonconformance, or a material change at the supplier.
Method follows risk. ISO 19011:2018 guidance allows remote audits but expects a documented feasibility check first, covering technology, bandwidth, auditor competence, and data-protection arrangements. IAF-aligned guidance adds confidentiality, security, and whether you can observe processes by video, and it asks you to record which processes cannot be audited remotely.
A workable decision rule:
- High criticality: on-site visit.
- Medium criticality: remote audit or sample-lot verification, with a documented feasibility check.
- Low criticality: desktop review of certificates and records.
How do you run an initial qualification audit, step by step?
The sequence below follows standard supplier audit practice:
- Define scope and criteria.
- Select the audit team and confirm independence rules.
- Request documentation in advance.
- Hold an opening meeting.
- Review documents against the criteria.
- Walk through the process where the work happens.
- Sample evidence and interview staff.
- Hold a closing meeting.
- Issue a written report with severity-classified findings and corrective action requests.
- Verify follow-up on every action.
Request and verify these records before and during the visit, in line with the vendor qualification checklist:
- Active quality certificates and their expiry dates
- Standard operating procedures and training records
- Prior audit reports and corrective action history
- Insurance and financial-stability evidence
- Sample-lot or first-article results
Pro Tip: Ask for the sample-lot results before the visit, then pick your walk-through path from whatever looks thin. Auditing where the data is weakest finds more than following the supplier’s tour.
A defensible report states the scope, the criteria, and the objective evidence behind each finding. It classifies findings as critical, major, or minor, assigns an owner and due date to each corrective action, and records the approval disposition. If a finding cannot be traced to evidence, it will not survive a challenge from the supplier or your own regulator.
What belongs in a supplier qualification file?
The file is what an auditor expects to see when they ask why you approved a supplier. Per the vendor qualification guidance, keep:
- Vendor identity and the scope of supply
- The risk-tier rationale, written down
- Active certifications with expiry dates
- Regulatory registrations where relevant
- Insurance and financial-stability evidence where applicable
- The assessment method and its outcome
- Approval signature and date
- The requalification schedule
- A running record of complaints and corrective actions
The file does double duty. At selection, it shows the decision rested on evidence. Afterward, it is the baseline for surveillance: when a certificate lapses or a complaint arrives, you compare against what you approved rather than reconstructing history. If you build these files in a quality platform, supplier quality management system guidance shows how inspection data and records can be structured in one place.
How often should you re-audit, and where do programs go wrong?
Tier the cadence. As example rules: high-risk suppliers get regular on-site visits or surveillance; medium-risk suppliers get periodic remote audits or sample-lot verification; low-risk suppliers get documentation reviews at longer intervals, with an off-cycle check whenever something material changes.
Programs commonly tier suppliers by risk based on item criticality, audit history, and replacement difficulty, so that re-audit intervals stay proportional to exposure.
Common failures include:
- Treating qualification as a one-time event
- Leaving the tier rationale undocumented
- Relying on stale audit data instead of current quality, delivery, and financial trends
- Skipping documented requalification triggers
Fix them by trending live performance data and writing the triggers (ownership change, site move, repeated nonconformance) into the program itself.
How do you keep audits objective and efficient?
Use a cross-functional team. Industry experts recommend pairing procurement, logistics, and quality so no single auditor’s preference decides the outcome or favors one supplier.
Guard against audit fatigue by reserving on-site effort for critical suppliers and using documentation-only reviews for the rest. Coverage stays where the risk is, and your suppliers stop treating audits as noise.
For remote audits, prepare before the day: test the connection, confirm data-protection agreements, and write down exactly what must be seen on-site versus on screen.
Pro Tip: Run a short test call with the supplier’s IT contact a few days ahead. A failed video link on audit day wastes the auditor’s time and often forces a rescheduled on-site visit.
Why I run qualification as a program, not an event
In my experience, the teams that write down their tier rationale and requalification triggers spend far less time on onboarding surprises and rework later. The discipline matters more than the length of any single audit. You are welcome to ask us about specification packages and qualification documentation.
— Hu
How can we support your supplier qualification checks?
If your project involves PV or storage procurement, we can discuss your supplier qualification requirements. Jiangsu Guoqiang manufactures high-strength steel products, and our range includes the PV mounting system line, OEM and ODM mounting solutions, and the ODM/OEM energy storage container for storage projects. We also supply steel guardrails and data center cooling piping.
You can request information about the item you are assessing for your supplier-qualification file. Contact us through our product pages to start.
FAQ
How do you do a vendor audit?
Define the scope, request documents, then hold an opening meeting, review records, walk the process, sample evidence, and close with a written report. Follow up until every corrective action is verified, as set out in the supplier audit steps.
What should an audit checklist include?
It should cover certifications, procedures, training records, prior audit findings, insurance, financial evidence, and sample-lot results. Add the process steps you will observe on the floor.
Can you audit a supplier remotely?
Yes, for suitable risk levels, after a documented feasibility check of technology, bandwidth, competence, and data protection. High-risk cases usually need an on-site audit.
How often should suppliers be re-audited?
Set the interval by risk tier: more often for critical suppliers, rarely for low-risk ones. Add an off-cycle review whenever a material change occurs.