Factory audit: checking a supplier before the first order

Three kinds of audit

ISO's quality vocabulary splits audits by who runs them: an audit can be an internal audit (first party) or an external audit (second party or third party)^[1].

For a brand placing a first order, the second-party audit is the one that answers your question. You can run it yourself or hire an inspection firm to do it for you.

What an audit looks at

• Quality management. The ISO standard on auditing itself is ISO 19011, which gives guidelines for auditing management systems^[2], including quality systems built to ISO 9001. A quality audit typically follows how the factory controls incoming materials, production, testing, records and complaints.
• Social compliance. Social audits check how workers are treated. The SA8000 standard, for example, is based on the Universal Declaration of Human Rights, ILO conventions, and national laws^[3].
• Forced labor, for goods entering the US. CBP's operational guidance tells importers that supply chain audits should be unannounced and conducted by independent or third-party auditors^[4] able to review the International Labour Organization's 11 indicators of forced labor^[4]. CBP generally does not treat financial audits, environmental audits, or audits that do not look at the ILO forced labor indicators^[4] as enough to mitigate forced labor risk.

A certificate is not an audit

A management system certificate on the factory wall tells you a certification body assessed a system at some point. It says nothing about your product or your order. ISO itself does not perform certification or issue certificates^[5]; independent certification bodies do that. To check that a certificate is real and current, ISO's advice is to contact the certification body, the accreditation body, or Global ACI^[5], or to search the accreditation database it points to.

When US rules expect an audit

For some food imports, US rules make an onsite audit the default. Under FDA's Foreign Supplier Verification Program, when the foreign supplier controls a hazard in the food that has a reasonable probability of causing serious adverse health consequences or death, the importer must conduct, or obtain records of, an onsite audit of that supplier before initially importing the food and at least annually thereafter, unless a written determination supports other verification^[6].

Example: what an audit costs per unit

Line	Amount
Audit, one auditor-day on site, report included	$1,200
Auditor travel	$250
Total audit cost	$1,450
First order	4,000 units
Audit cost per unit on the first order	$0.36
The same audit spread over a year of orders, 16,000 units	$0.09

Illustrative figures, not a quote. Real prices depend on the spec, quantity and factory.

Set against a failed production run, that is a small line in the landed cost. The report also gives you a baseline to hold the factory to, and a list of fixes to agree before you pay a deposit.

What to agree before you book one

• The scope: quality system, social compliance, or both, and whether the visit is announced or unannounced.
• What you receive: the full report with photos, and a corrective action plan with dates.
• Who pays for a follow-up visit if the factory fails.
• That the audit covers the site where your goods will actually be made, not a showroom factory or a sister plant.

An audit checks the supplier; a quality inspection checks each order before it ships.