Supply Chain Audit

A supply chain audit looks not at a single supplier but at several tiers of the chain. Sub-suppliers beyond the direct supplier and the source of raw material are also brought within scope.

The aim is to find where the risk is hidden. Problems usually arise not at the direct supplier but at its sub-supplier; an audit limited to the first tier cannot see that risk.

• Brands managing a multi-tier supply chain
• Companies within scope of human-rights due-diligence obligations
• Manufacturers dependent on a critical raw material
• Organisations subject to deforestation and conflict-minerals regulations
• Groups managing supply-chain continuity risk

The criteria are the buyer's supply-chain policy and code of conduct; sector schemes, chain-of-custody requirements and relevant legislation (due-diligence regulations) are added to these.

• Supply-chain mapping and tier visibility
• Sub-supplier selection and approval processes
• Deployment of the code of conduct through the chain
• Traceability of the raw-material source
• Chain-of-custody records and mass balance
• Critical and sole-source dependencies
• Social and environmental risks in the chain
• Undisclosed use of contract manufacturing
• Business continuity and alternative-sourcing plans
• Nonconformity management across the chain

• ISO 19011
• ISO 28000
• ISO 20400
• OECD Due Diligence Guidance

1. 1Defining the Scope and CriteriaWhat is to be audited and against which criteria is set out in writing: a customer code of conduct, a specification, a standard or a checklist.
2. 2Preliminary Information GatheringThe size and activity of the party to be audited, its audit history and any open nonconformities are reviewed.
3. 3Audit PlanThe audit date, team and timetable are prepared; the areas to be visited and the roles to be interviewed are planned.
4. 4Opening MeetingThe purpose, scope, method and reporting format of the audit are explained; the principles of confidentiality and impartiality are confirmed.
5. 5On-site AuditProduction or service areas are walked, records are examined and workers are interviewed. Findings are recorded on the spot.
6. 6Classification of FindingsDeterminations are graded according to the classification of the scheme in use (critical / major / minor / observation).
7. 7Closing MeetingThe findings are presented to management, their justification is explained and the expectation for corrective action is set out.
8. 8Report and Follow-upThe audit report is issued; a corrective action plan is obtained and its close-out is followed up. Where necessary a follow-up audit is carried out.

The most severe findings relate to loss of visibility: not knowing a tier of the chain, undisclosed use of a subcontractor, and a break in the traceability chain. These findings invalidate the buyer's entire supply assurance.

• Details of the audit body, the auditor and the auditee
• Date, duration and scope of the audit
• Criteria or checklist applied
• Areas and processes audited
• Findings and their classification
• Evidence and photographs supporting the findings
• Scoring or rating, where the scheme requires it
• Corrective action plan and close-out status

This audit documents the situation observed at the time of the audit and within the scope audited. Auditing is sampling-based: the records examined and the areas visited are selected to represent the whole, but this does not mean that every record was checked. The report is neither a guarantee nor a certificate, and it does not relieve the auditee of its responsibility.

Accreditation differs with the type of audit. Third-party audits underpinning management system certification are carried out under ISO/IEC 17021-1 and those underpinning product certification under ISO/IEC 17065; these scopes are subject to accreditation. First- and second-party audits, and audits governed by a scheme owner's own rules (such as SMETA or amfori BSCI), do not fall within accredited certification; they are conducted following the ISO 19011 guidance and produce a report. EUROLAB holds internationally recognised accreditation under ISO/IEC 17021-1 and ISO/IEC 17065, granted by accreditation bodies that are signatories to the IAF multilateral recognition arrangement; which audits can be offered within accredited scope is confirmed in writing at the quotation stage.

• Supplier Audit
• Factory Audit
• Process Audit
• Product Audit
• Quality Audit
• Compliance Audit
• Technical Audit