ISO Audit Group / After

Auditing suppliers and contractors

The scope extends past your own gate.

Management systems extend to externally provided processes, and organisations routinely treat supplier oversight as a purchasing matter. Where a supplier performs part of a controlled process, its performance is within the system.

Supplier audits work best when they are proportionate to the risk rather than uniform. Auditing every supplier annually to the same depth spends the same effort on a stationery vendor as on the contractor performing a critical operation.

Certificates held by a supplier establish that somebody assessed them against a standard, in a scope that may not include what they do for you. Reading the scope on the certificate is a thirty-second check that regularly finds a mismatch.

The most useful supplier audit follows the work rather than the paperwork: what actually happens on your job, with your specification, by the people actually assigned to it.

Where a supplier is unwilling to be audited, that position is information, and it is usually cheaper to act on at the point of engagement than after something has gone wrong.

The other supplier check worth making is whether the certificate is current and issued by an accredited body. Certificates are occasionally expired, occasionally from bodies with no accreditation, and both are visible in under a minute from the relevant register.