How to Audit a Supplier Factory: From Documents to the Production Line

Executive summary

A factory audit should test whether a supplier can repeatedly operate the production system required by the sourcing project. It is not enough to see machines, certificates, or a polished presentation. The auditor must connect legal identity, process ownership, controlled documents, trained personnel, equipment readiness, material movements, production records, demonstrated capacity, subcontracting, and exception handling.

The strongest field method is evidence triangulation. A capability claim should be supported by several independent sources: records, physical observations, system data, operator explanations, and historical output. Contradictions are not administrative details; they are leads that require investigation. An equipment list that names a machine absent from the floor, for example, may indicate an obsolete asset register, undisclosed outsourcing, or capability located at another group facility.

The audit should end with a documented capability decision and an evidence-based corrective-action plan. Price comparison, commercial negotiation, and final product quality inspection remain outside this audit’s boundaries.

1. Set the Audit Scope Around Capability, Not Claims

Define the capability that must be verified

Translate the sourcing requirement into auditable operating capabilities before visiting the site. Define the required manufacturing processes and materials, critical machines, tooling, fixtures, utilities, technical skills, certifications, licenses, process controls, monthly volume, peak demand, and expected lead time. Identify any process that may depend on an external processor.

Separate each capability into one of five statuses:

• Demonstrated and routinely operational in-house.
• Available in-house but rarely used.
• Installed but idle, uncommissioned, or unsupported.
• Outsourced to an identified external processor.
• Planned or under development but not yet available.

The audit question is not simply, “Can you make this?” A more useful question is: “Show how this process has operated repeatedly, under controlled conditions, at the required rate.”

Establish clear audit boundaries

The scope should include legal identity, process ownership, production continuity, staffing, maintenance, traceability, record integrity, demonstrated capacity, subcontracting, and exception handling. It should test whether the required production system can remain stable across orders, shifts, equipment interruptions, and changes in demand.

Exclude quotation comparison, price negotiation, and final product inspection. Following a work order or material batch is appropriate because it tests process control and continuity; evaluating finished-product conformity is a separate activity.

Prepare the evidence request

Request records before the visit so the audit does not depend on documents assembled for display on audit day. Ask for:

• The legal registration and audited-site details.
• Certification scopes and validity information.
• A production-flow diagram and equipment list.
• Maintenance plans and recent breakdown records.
• Training matrices and shift rosters.
• Recent production schedules and output reports.
• A complete subcontractor and external-processor list.
• Records from several dates, shifts, lines, and production orders.
• Examples of delays, deviations, shortages, rework, and machine stoppages.

Request access to receiving, warehouses, production lines, maintenance rooms, tooling storage, work-in-progress areas, rework or hold zones, dispatch staging, and relevant external processing locations.

Build a risk-based plan

Allocate the most audit time to processes that are difficult to replace, safety critical, capacity constrained, highly manual, or dependent on specialist operators. Examine transitions between departments carefully. Unrecorded queues, unclear ownership, mixed orders, and undocumented schedule changes often appear at handoffs rather than at the main machine.

Prepare order samples that can be traced from incoming material through dispatch documentation. Include a recent order, an older order, and an order affected by an interruption or delay.

Image gallery

A machine’s presence is only a starting point; ownership records, maintenance history, trained operators, utilities, tooling, and demonstrated output must support the capability claim.

Photo by Homa Appliances on Unsplash. Licensed under the Unsplash License.

2. Verify Documents Before Accepting the Factory Story

Confirm legal and operational identity

Match the legal company name, registered address, business scope, ownership details, and operating site across the business license, tax and banking documents, lease or ownership records, utility accounts, and certification scopes. Confirm that the entity occupying the factory is the entity named in commercial and compliance documents.

Investigate certificates issued to a related company, a different address, or a wider corporate group. Shared ownership does not prove that the audited site has the certified system, equipment, personnel, or process controls.

Useful questions include:

• Which legal entity owns or leases this building?
• Which entity employs the production workers?
• Which company owns the machines and tooling?
• Are invoices, production records, and dispatch documents issued by the same entity?
• Do certificates cover this address and the required manufacturing processes?

Test certification scope

Check certificate numbers, issuing bodies, validity dates, covered addresses, exclusions, and scope statements. Verify certificates independently with the issuer when possible. A valid certificate covering sales or assembly does not establish control over molding, machining, coating, heat treatment, or another required process.

Compare documented procedures with actual practice. Ask operators to explain the instruction they use, where it is located, and what happens when a process parameter falls outside the approved range.

Review documents as working controls

Examine process maps, work instructions, control plans, equipment registers, maintenance plans, training matrices, production schedules, and exception procedures. Check revision numbers, approval dates, document owners, and availability at the point of use.

Compare displayed instructions with controlled master copies. Obsolete, handwritten, or unofficial versions may indicate weak document control even when the master procedure looks complete.

Sample records independently

Select records yourself rather than accepting only the supplier’s preferred files. Review at least one current order, one older order, and one order involving a delay or exception. Look for consistent timestamps, signatures, machine references, quantities, shift details, material movements, approvals, and closure evidence.

Cross-check information against independent sources:

• Production records against machine-hour logs.
• Output against labor attendance.
• Material use against warehouse movements.
• Maintenance downtime against production schedules.
• Completed quantities against dispatch history.
• Operator authorization against shift assignments.

Recognize document red flags

Investigate records that appear newly created, contain identical handwriting, show implausibly perfect results, or share the same correction and approval times. Other red flags include blank fields, missing pages, unexplained overwriting, inconsistent dates, equipment that cannot be found, and reported output that exceeds plausible machine hours, labor hours, or material consumption.

3. Trace Process Continuity From Receiving to Dispatch

Walk the physical process in sequence

Start at incoming material receiving and follow the normal route through storage, material release, preparation, processing, transfer, waiting areas, rework, packing, and dispatch staging. Compare the physical route with the supplier’s process-flow diagram.

Record every point where material:

• Leaves the site.
• Changes departmental ownership.
• Waits without visible status identification.
• Is split, combined, relabeled, or returned.
• Bypasses a documented process step.
• Enters a hold, rework, or deviation area.

This walk evaluates continuity and control, not final-product conformity.

Trace one live production order

Select an order currently in production. Identify its material lot, work order, routing, assigned line or machine, tooling, operators, current status, completed quantity, waiting quantity, rework quantity, and next responsible department.

Confirm that the same identifiers appear on physical labels, travelers, system records, warehouse movements, and departmental logs. Ask:

• Who owns the order at this stage?
• How is the next department notified?
• How are shortages and partial transfers recorded?
• What prevents material from different orders from being mixed?
• How is the order status updated after a stoppage?

Prove that processes are in-house

For each claimed in-house process, locate the machine, tooling, operators, work instructions, maintenance history, utilities, consumables, and recent production records. If the process is not operating, request a live demonstration where practical or review evidence of recent routine use.

A disconnected machine, unused consumables, absent tooling, no trained operator, and no recent records do not support an operational capability claim. Determine whether the process is genuinely in-house, rarely used, uncommissioned, subcontracted, or available only at another group facility.

Examine handoffs and single points of failure

Check how departments confirm receipt, quantity, status, and priority. Look for unidentified work in progress, mixed orders, informal staging areas, and schedule changes communicated verbally.

Identify single points of failure such as:

• One bottleneck machine with no qualified backup.
• One mold or fixture without replacement planning.
• One technician able to set up or repair a critical process.
• One external processor approved for a required operation.
• One utility supply without a workable contingency.

Investigate subcontracting

Obtain the approved subcontractor list and compare it with external purchase orders, transfer records, transport documentation, turnaround times, and receiving confirmations. Confirm how identification and status remain controlled while goods are off site.

Undisclosed outsourcing is a major red flag, particularly when the supplier presents the process as in-house. Ask which operations left the facility during the previous three months and select transfer records independently.

Review exceptions and deviations

Request recent examples of breakdowns, shortages, delays, deviations, rework, and process interruptions. Trace each event through detection, containment, authorization, disposition, restart, and closure.

Check who can approve deviations, whether temporary controls have expiry dates, and whether affected orders are identifiable. Repeated exceptions closed through retraining or administrative sign-off may indicate that the underlying cause remains unresolved.

4. Validate Capacity With Records and Physical Constraints

Calculate demonstrated capacity

Build a capacity estimate from physical and historical evidence:

Effective capacity = usable assets × actual output rate × available operating time × historical uptime, adjusted for changeovers, maintenance, staffing, yield loss, and rework.

Distinguish theoretical capacity, scheduled capacity, and demonstrated historical output. Maximum machine specifications or sales-presentation figures should not be accepted as operating capacity.

Count only equipment that is installed, powered, commissioned, maintained, tooled, and supported by trained personnel. Include realistic setup, cleaning, changeover, planned maintenance, and external-processing time.

Reconcile output with independent evidence

Compare reported monthly output with work orders, machine hours, attendance, material consumption, utility use, and dispatch records. Investigate whether output depended on excessive overtime, postponed maintenance, shared equipment, temporary labor, or unreported subcontracting.

Ask how much current capacity is already committed and how competing customer orders are prioritized during peak demand. A supplier may demonstrate strong historical output while lacking available capacity for a new program.

Verify equipment resilience

Inspect machine condition and status labels, then sample preventive-maintenance and breakdown records. Confirm the availability of critical spare parts, backup tooling, qualified maintenance personnel, and contingency arrangements for bottleneck assets.

A contingency procedure is not sufficient if the backup machine is disconnected, incompatible, untooled, or lacks an authorized operator.

Test planning discipline

Compare planned and actual start dates, completion dates, downtime, and external-processing time. Check whether overdue work is visible, assigned, and escalated. Planning data should reflect real changeovers, maintenance windows, staffing levels, and constrained resources.

Ask the planner to demonstrate what happens when a bottleneck machine fails or two priority orders require the same line.

Evidence checklist

Audit area	Evidence to request	Shop-floor verification	Common red flags
Legal identity	Business license, registration, lease or ownership record	Confirm address, signage, occupied buildings, and operating entity	Different company name or location
Process ownership	Process map, equipment and asset records	Locate machines, tooling, operators, utilities, and active work	Claimed process absent or off site
Document control	Procedures, instructions, revision register	Compare controlled masters with point-of-use copies	Obsolete or unofficial instructions
Production continuity	Work orders, routings, transfer logs	Trace an order between departments	Unidentified queues or missing handoffs
Material traceability	Receiving, batch, and warehouse records	Match physical labels with system or paper records	Mixed, relabeled, or unidentified material
Capacity	Output, machine-hour, schedule, and staffing records	Count usable assets and observe actual rates	Output exceeds plausible hours
Maintenance	Maintenance plans and breakdown history	Inspect condition, status, and spare-parts readiness	Overdue work or recurring stoppages
Workforce capability	Training matrix, authorizations, rosters	Interview operators and compare task assignments	Untrained labor or one-person dependency
Subcontracting	Approved list, purchase orders, transfer records	Identify where goods leave and return	Undisclosed external processing
Exceptions	Deviation, shortage, downtime, and rework records	Inspect hold and rework controls	Verbal approval or repeated recurrence
Data integrity	System extracts, machine logs, timestamps	Cross-check independent sources	Duplicate entries or impossible timing
Continuity planning	Backup and contingency records	Confirm backups are usable	Paper-only contingency

Classify findings by business risk

• Critical: Falsification, invalid legal status, undisclosed outsourcing, nonexistent core capability, or an uncontrolled process break.
• Major: Capacity cannot be demonstrated, traceability repeatedly fails, critical maintenance is overdue, or exception control is ineffective.
• Minor: An isolated record or procedural gap that does not currently undermine the production system.
• Observation: An emerging weakness requiring monitoring but not yet a confirmed nonconformity.

For every finding, record the requirement, objective evidence, operational risk, responsible owner, due date, and exact closure evidence required.

5. Close the Audit With Evidence-Based Follow-Up

Hold a factual closing meeting

Present findings using observed facts rather than impressions. Explain the affected process and operational risk, and allow the supplier to clarify evidence or provide missing records. Do not downgrade a finding solely because management gives a verbal assurance.

Distinguish a confirmed process failure from an unresolved evidence gap. Both may block approval, but they require different corrective actions.

Require root-cause corrective action

Each response should include:

• Immediate containment.
• Root-cause analysis.
• Corrective action.
• Responsible owner.
• Completion deadline.
• Implementation evidence.
• Effectiveness-check method.

Reject generic commitments to retrain staff, complete forms, or “pay more attention” unless they correct the system weakness that allowed the problem to occur.

Verify closure

Cross-check revised procedures against new operating records. Confirm that actions work across multiple orders, shifts, or production dates. Documentary issues may be closed remotely when physical verification is unnecessary.

Schedule a targeted revisit when findings concern equipment, process ownership, capacity, subcontracting, utilities, tooling, or shop-floor continuity. Submitted photographs and files alone may not prove that these controls operate consistently.

Make an explicit capability decision

Assign one outcome:

• Approved: The required capability is supported by consistent evidence.
• Conditionally approved: Capability is credible, but defined actions must close before production release or volume expansion.
• Not approved: Core capability is absent, evidence is unreliable, or operational risk remains uncontrolled.

Document all assumptions, exclusions, unavailable records, and unresolved contradictions. Establish re-audit triggers for relocation, capacity expansion, major process changes, new subcontracting, ownership changes, or repeated delivery disruption.

Final next move

Convert the audit report into a dated corrective-action tracker within one business day. Assign an owner and precise closure evidence to every open finding, and block sourcing progression for any critical issue until the capability is physically or independently verified. Before leaving the closing meeting, schedule the first follow-up review and identify which findings require a targeted site revisit.