Supplier Quality Audit Checklist

Identify which standard governs the audit — ISO 9001, AS9100, IATF 16949, ISO 13485, or a customer-specific spec — and the parts or commodities in scope. A mismatched scope is the most common reason audit findings get disputed after the fact.

Export the last 12 months of OTD%, PPM defective, open NCRs, and CAR closure rate. Flag any commodity where PPM trend is rising — those drive the on-site sampling plan.

Request quality manual, current ISO certificate, calibration register, internal audit schedule, last management review minutes, top-5 PFMEAs for in-scope parts, and CAR log. Ask for these in advance so the on-site time goes to verification, not document hunting.

Look up the supplier's ISO/AS/IATF certificate on the registrar's public database (IAQG OASIS for AS9100, IATF database for 16949). Suppliers occasionally claim certifications that are suspended or expired — the registrar database is the source of truth.

Confirm the manual addresses all clauses of the applicable standard and that the quality policy is posted and known on the floor. Stop a random operator and ask what the policy means in their words — if no one can answer, policy deployment is on paper only.

Pull three active travelers from the floor and verify the drawing rev matches the current PLM rev. Obsolete prints in the operator's binder is a top finding — usually because ECN release does not push to the floor.

Confirm the supplier has audited every clause and every shift in the last 12 months. Look for findings — an audit program that produces zero findings is not auditing, it is checking boxes.

Pick three closed CARs and verify the effectiveness check — defect-free run for X cycles, audit re-verification, or SPC evidence. CARs closed on the strength of "retrained the operator" with no follow-up are a red flag and almost always recur.

Walk a part through its routing with the control plan in hand. Every CTQ and special characteristic on the plan should have a matching gauge, frequency, and reaction plan at the workstation. Drift between control plan and actual practice is where escapes are born.

Pick five gauges from the floor and trace each to its calibration certificate and last gauge R&R. Past-due calibration stickers, missing R&R on critical-dimension gauges, or R&R results above 30% are immediate findings.

Look for charts that are current, signed, and showing real reaction to out-of-control points. Charts updated weekly from a clipboard with no annotations on rule violations are decoration, not control.

Watch a changeover if possible, or pull the last five FAIs (AS9102 form for aerospace). Confirm the first piece is fully measured and signed off before run release. Skipped FAIs after changeover are a leading cause of full-lot scrap.

Trace one recent ECN from release to operator acknowledgment. Verify the PFMEA and control plan were updated, training was delivered, and obsolete prints were removed from the floor. Half-finished ECN cascades are a routine source of escapes.

Verify the receiving inspector has current ANSI Z1.4 sampling plans, mill certs are on file for raw stock, and PMI is performed where alloy verification matters. "Trusted supplier" skips are common and dangerous — sample the records, not the policy.

Pick a recent shipment and walk the traceability chain backwards: packing list, final inspection record, traveler, in-process inspection, kit pull with lot/heat numbers, mill cert. Any break in the chain is a finding — traceability gaps make a recall impossible to bound.

Walk the red-tag area. Look for parts older than 30 days without disposition, mixed-status pallets, or absent identification. NCRs that sit open past SLA with no escalation indicate a closed-loop system that is not actually closing.

Confirm final inspection is performed per the documented sampling plan with sign-off before release to shipping. For PPAP-required parts, verify the PPAP package matches the customer-required level (typically Level 3).

Pull last quarter's OTD% and reconcile against the supplier's own dashboard. Discrepancies usually mean OTD is being measured against requested ship date instead of customer need date — clarify the definition.

For special processes (heat treat, plating, NDT), confirm the sub-supplier holds Nadcap accreditation when the customer flow-down requires it. Unflowed special-process requirements are a chronic AS9100 finding.

Verify packaging matches the customer packaging spec — barcode placement, lot label format, ESD bag requirements where applicable. Incorrect labels cause receiving rejection and back-charges that damage the relationship faster than quality issues.

Ask for the BCP and confirm it has been exercised in the last 12 months. Single-source raw material with no qualified second source is a meaningful supply risk to capture in the audit report regardless of QMS maturity.

Walk through findings live with the supplier's quality manager and plant manager. Confirm each finding is understood and acknowledged before leaving site — disputes after the report goes out are far harder to resolve.

For each major finding, open a supplier CAR with a 30-day response window for containment and root cause, and an effectiveness verification milestone before closure. Track each CAR back to the audit finding ID so the audit report can be closed in full.

For rejected suppliers, schedule a re-audit only after CAR closure evidence is reviewed. For conditional approvals, schedule the surveillance visit at 6 months instead of the standard 12.

Push the audit outcome into the approved vendor list with the new approval expiration date. Notify purchasing and engineering of any restrictions (e.g., approved for commodity X but not for special-process work).