Second Party Audit

A second-party audit is an organisation auditing its supplier or business partner against its own requirements. Because a commercial relationship exists between buyer and supplier, the audit is not independent: the buyer's interest and criteria govern. That does not invalidate the audit — it merely defines the nature of its output.

The aim is for the buyer to assess supply risk against its own measures. An accredited certificate may not cover all of a buyer's particular requirements; a second-party audit fills that gap and lets the buyer decide on its own criteria.

• Buyer companies running a supplier-approval process
• Retail chains and brand owners
• Automotive and aerospace OEMs
• Companies using contract manufacturing
• Corporate buyers enforcing their own code of conduct

The audit criteria are set by the buyer: its own supplier manual, code of conduct, technical specification, customer-specific requirements (CSR), or a buyer-specific interpretation of a standard. The criteria must be communicated to the supplier in writing before the audit, so that the result is not disputable.

• Meeting the buyer's technical and quality requirements
• Production capacity and process capability
• Quality control and inspection practices
• Traceability and batch management
• Control of sub-suppliers
• Delivery performance and lead-time management
• Compliance with the code of conduct (social, environmental, ethical)
• The closure status of previous nonconformities
• Change management and notification obligations
• Capacity and continuity risk

• ISO 19011
• ISO 9001
• IATF 16949 (customer-specific requirements)
• VDA 6.3

1. 1Establishing the Audit ProgrammeThe areas to be audited, the frequency and the priorities are set on a risk basis. The programme is planned annually according to the size of the organisation and the criticality of its processes.
2. 2Audit Plan and TeamThe objective, scope and criteria of the audit are defined in writing; the audit team is appointed with regard to competence and impartiality.
3. 3Document ReviewPolicies, procedures, previous audit reports and corrective action records are reviewed before the audit.
4. 4Opening MeetingThe scope, method, schedule and reporting format are communicated to the auditee.
5. 5Gathering EvidenceObjective evidence is gathered through interviews, examination of records and observation on site. A finding is not an opinion without evidence but a verifiable determination.
6. 6Evaluation of FindingsThe evidence gathered is compared against the audit criteria; nonconformities and opportunities for improvement are classified.
7. 7Closing Meeting and ReportThe findings are presented to the auditee, objections are heard and the audit report is issued.
8. 8Follow-up of Corrective ActionFor each nonconformity a root cause analysis and a corrective action plan are requested; follow-up continues until effectiveness is verified.

Findings are rated according to the buyer's own classification and are usually tied to a score or supplier status (approved, conditional, suspended). Because this status directly determines whether you can win orders, second-party audits carry high commercial weight.

• Objective, scope and criteria of the audit
• Audit team and audit date
• Areas audited and roles interviewed
• Records examined
• Findings: nonconformities and opportunities for improvement
• The objective evidence supporting each finding
• Audit conclusion and overall assessment
• The corrective action expected and its deadline

A second-party audit does not produce an accredited certificate and does not substitute for a third-party audit. The result is meaningful only for the buyer that carried it out and against its own criteria; a general conformity claim cannot be built for another customer by saying 'company X audited us'. The audit also does not remove the supplier's contractual liability.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• First Party Audit
• Third Party Audit