01The concept in depthEl concepto a fondo
Supplier audit programs: the systematic assurance that suppliers meet your standards›
A supplier audit program is the structured program of periodic supplier facility inspections and document reviews that verifies supplier compliance with quality, environmental, social, and contractual requirements. Audits provide independent evidence that supplier self-assessments are accurate and that the supplier's operational reality matches their stated capabilities. Audit programs are the primary governance mechanism for supply chain risk management after supplier qualification.
Audit program structure: frequency, scope, and risk-based tiering›
Risk-based audit frequency: Tier 1 critical suppliers (single-source, high-spend, high-risk): annual full audit. Tier 1 standard suppliers: biennial audit. Tier 2 critical suppliers: 3-year audit cycle. Tier 2 standard: questionnaire-based assessment only. Audit types: (1) Quality audit: compliance with quality management system (ISO 9001, IATF 16949 for automotive), specification adherence, process capability, and measurement system validation. (2) Social audit (SA8000, SMETA 4-pillar): labor rights, health and safety, environmental compliance, and management systems. Required by European retailers (Carrefour, Walmart EU, Lidl) for all Tier 1 suppliers. (3) Financial/solvency audit: for critical single-source suppliers, an annual review of financial health indicators (credit rating, DSO trends, debt ratios) to assess insolvency risk. (4) Environmental audit: environmental management system compliance, permit validity, waste management, and emissions reporting accuracy.
Corrective Action Reports (CARs): the follow-through mechanism that converts audit findings into compliance›
An audit without corrective action follow-through is an audit that doesn’t improve compliance — it only documents it. CAR process: (1) Critical finding: requires a CAR with root cause analysis within 30 days and verification re-audit within 60 days. A critical finding that is not corrected within the CAR timeline triggers a supplier qualification suspension. (2) Major finding: CAR with corrective action plan within 90 days and documentary evidence of closure. (3) Minor finding: observation documented for tracking; corrective action recommended within 180 days. (4) CAR closure: the audit team (or a qualified third-party auditor) verifies corrective action effectiveness before closing the CAR.
Intermediate vs. Advanced›
Intermediate: participates in supplier quality audits; tracks CAR status for assigned suppliers; escalates overdue CARs.
Advanced: designs and manages the supplier audit program; leads complex supplier audits; manages the CAR process; integrates audit results into the supplier risk scorecard.
Advanced: designs and manages the supplier audit program; leads complex supplier audits; manages the CAR process; integrates audit results into the supplier risk scorecard.
Supplier audit programs: the systematic assurance that suppliers meet your standards›
A supplier audit program is the structured program of periodic supplier facility inspections and document reviews that verifies supplier compliance with quality, environmental, social, and contractual requirements. Audits provide independent evidence that supplier self-assessments are accurate and that the supplier's operational reality matches their stated capabilities. Audit programs are the primary governance mechanism for supply chain risk management after supplier qualification.
Audit program structure: frequency, scope, and risk-based tiering›
Risk-based audit frequency: Tier 1 critical suppliers (single-source, high-spend, high-risk): annual full audit. Tier 1 standard suppliers: biennial audit. Tier 2 critical suppliers: 3-year audit cycle. Tier 2 standard: questionnaire-based assessment only. Audit types: (1) Quality audit: compliance with quality management system (ISO 9001, IATF 16949 for automotive), specification adherence, process capability, and measurement system validation. (2) Social audit (SA8000, SMETA 4-pillar): labor rights, health and safety, environmental compliance, and management systems. Required by European retailers (Carrefour, Walmart EU, Lidl) for all Tier 1 suppliers. (3) Financial/solvency audit: for critical single-source suppliers, an annual review of financial health indicators (credit rating, DSO trends, debt ratios) to assess insolvency risk. (4) Environmental audit: environmental management system compliance, permit validity, waste management, and emissions reporting accuracy.
Corrective Action Reports (CARs): the follow-through mechanism that converts audit findings into compliance›
An audit without corrective action follow-through is an audit that doesn’t improve compliance — it only documents it. CAR process: (1) Critical finding: requires a CAR with root cause analysis within 30 days and verification re-audit within 60 days. A critical finding that is not corrected within the CAR timeline triggers a supplier qualification suspension. (2) Major finding: CAR with corrective action plan within 90 days and documentary evidence of closure. (3) Minor finding: observation documented for tracking; corrective action recommended within 180 days. (4) CAR closure: the audit team (or a qualified third-party auditor) verifies corrective action effectiveness before closing the CAR.
Intermediate vs. Advanced›
Intermediate: participates in supplier quality audits; tracks CAR status for assigned suppliers; escalates overdue CARs.
Advanced: designs and manages the supplier audit program; leads complex supplier audits; manages the CAR process; integrates audit results into the supplier risk scorecard.
Advanced: designs and manages the supplier audit program; leads complex supplier audits; manages the CAR process; integrates audit results into the supplier risk scorecard.
02In practiceEn la práctica
Design the audit program to be risk-based — allocate the most audit resources to the suppliers whose failure would have the highest operational and compliance impact›
An audit program that audits every supplier equally generates both insufficient coverage (not enough audits for critical suppliers) and wasteful coverage (too many audits for low-risk suppliers). Risk-based tiering — with annual audits for Tier-1 critical suppliers and questionnaire-only assessment for Tier-2 standard suppliers — maximizes audit impact within a fixed budget.
Use remote audits for document review and management system assessment — reserve on-site audits for process observation, worker interviews, and facility condition assessment›
Remote audits (video conference + shared screen document review) are 60–70% as effective as on-site audits for document-focused assessments — at 25–30% of the cost. On-site audits add value primarily for: facility condition observation, unannounced worker interviews (critical for social audits), production process observation, and physical inventory verification.
Conduct social audits (SMETA or SA8000) for any supplier exporting to European retailers — and use SMETA reports shared across the industry to avoid redundant auditing›
European retailers (Carrefour, Lidl, Aldi, Walmart Europe) increasingly require SMETA (Sedex Members Ethical Trade Audit) certification for all Tier-1 suppliers. SMETA reports are shareable through the Sedex platform — a single SMETA audit can satisfy the requirements of multiple European retail customers, eliminating redundant audit costs.
Integrate audit results into the supplier scorecard and supplier segmentation — audit findings should affect sourcing decisions, not just generate corrective actions›
A supplier with 3 critical audit findings in 2 years should have their sourcing volume reviewed regardless of their OTIF performance. Audit results integrated into the supplier scorecard create the commercial consequence that makes suppliers invest in compliance improvement.
Design the audit program to be risk-based — allocate the most audit resources to the suppliers whose failure would have the highest operational and compliance impact›
An audit program that audits every supplier equally generates both insufficient coverage (not enough audits for critical suppliers) and wasteful coverage (too many audits for low-risk suppliers). Risk-based tiering — with annual audits for Tier-1 critical suppliers and questionnaire-only assessment for Tier-2 standard suppliers — maximizes audit impact within a fixed budget.
Use remote audits for document review and management system assessment — reserve on-site audits for process observation, worker interviews, and facility condition assessment›
Remote audits (video conference + shared screen document review) are 60–70% as effective as on-site audits for document-focused assessments — at 25–30% of the cost. On-site audits add value primarily for: facility condition observation, unannounced worker interviews (critical for social audits), production process observation, and physical inventory verification.
Conduct social audits (SMETA or SA8000) for any supplier exporting to European retailers — and use SMETA reports shared across the industry to avoid redundant auditing›
European retailers (Carrefour, Lidl, Aldi, Walmart Europe) increasingly require SMETA (Sedex Members Ethical Trade Audit) certification for all Tier-1 suppliers. SMETA reports are shareable through the Sedex platform — a single SMETA audit can satisfy the requirements of multiple European retail customers, eliminating redundant audit costs.
Integrate audit results into the supplier scorecard and supplier segmentation — audit findings should affect sourcing decisions, not just generate corrective actions›
A supplier with 3 critical audit findings in 2 years should have their sourcing volume reviewed regardless of their OTIF performance. Audit results integrated into the supplier scorecard create the commercial consequence that makes suppliers invest in compliance improvement.
03Illustrative caseCaso ilustrativo
Illustrative case built from typical industry values — not data from a specific company.Caso ilustrativo construido con valores típicos de la industria — no son datos de una empresa específica.
Illustrative case: Supplier audit program — consumer goods company, 180 Tier-1 suppliers across Mexico, Asia, and Europe
The company designs and implements a risk-based supplier audit program replacing an ad-hoc, audit-on-complaint approach.
The company designs and implements a risk-based supplier audit program replacing an ad-hoc, audit-on-complaint approach.
| Audit program dimension | Pre-program (ad-hoc) | Post-program (risk-based) |
|---|---|---|
| Annual audit coverage (% of Tier-1 suppliers audited per year) | 8% of Tier-1 suppliers audited per year · Audits triggered by quality incidents, not proactive schedule · Average audit backlog: 14 months from incident to audit completion | 35 Tier-1 critical suppliers: 100% audited annually · 80 Tier-1 standard suppliers: biennial schedule · 65 Tier-2 critical suppliers: triennial schedule · Total: 48% of supplier base audited per year on rotating schedule |
| CAR closure rate (% of critical and major audit findings closed within the required timeframe) | CAR tracking in Excel spreadsheet · No systematic escalation · CAR closure rate: 34% within required timeframe · 28% of critical findings still open after 6 months | CAR management system (Intelex) with automated escalation · Critical finding CAR closure rate: 96% within 30-day requirement · Major finding CAR closure rate: 89% within 90-day requirement · 0 critical findings open >45 days |
| Remote audit adoption (% of audits conducted remotely vs. on-site) | 0% remote audits · All audits required on-site travel · Average audit cost: $42K MXN/audit (travel + auditor fees) | 40% of biennial standard supplier audits conducted remotely using video audit protocol · Remote audit cost: $12K MXN/audit · Annual savings from remote audit adoption: $2.4M MXN |
Result: Risk-based audit program: annual coverage increased from 8% to 48% of supplier base, critical finding CAR closure rate improved from 34% to 96%, $2.4M MXN/year in audit cost savings from remote audit adoption. Most significant outcome: 4 Tier-1 critical suppliers identified with previously unknown quality or social compliance issues that would not have been discovered under the ad-hoc incident-triggered approach.
Illustrative case built from typical industry values — not data from a specific company.Caso ilustrativo construido con valores típicos de la industria — no son datos de una empresa específica.
Case: Supplier audit program — consumer goods company, 180 Tier-1 suppliers across Mexico, Asia, and Europe
The company designs and implements a risk-based supplier audit program replacing an ad-hoc, audit-on-complaint approach.
The company designs and implements a risk-based supplier audit program replacing an ad-hoc, audit-on-complaint approach.
| Audit program dimension | Pre-program (ad-hoc) | Post-program (risk-based) |
|---|---|---|
| Annual audit coverage (% of Tier-1 suppliers audited per year) | 8% of Tier-1 suppliers audited per year · Audits triggered by quality incidents, not proactive schedule · Average audit backlog: 14 months from incident to audit completion | 35 Tier-1 critical suppliers: 100% audited annually · 80 Tier-1 standard suppliers: biennial schedule · 65 Tier-2 critical suppliers: triennial schedule · Total: 48% of supplier base audited per year on rotating schedule |
| CAR closure rate (% of critical and major audit findings closed within the required timeframe) | CAR tracking in Excel spreadsheet · No systematic escalation · CAR closure rate: 34% within required timeframe · 28% of critical findings still open after 6 months | CAR management system (Intelex) with automated escalation · Critical finding CAR closure rate: 96% within 30-day requirement · Major finding CAR closure rate: 89% within 90-day requirement · 0 critical findings open >45 days |
| Remote audit adoption (% of audits conducted remotely vs. on-site) | 0% remote audits · All audits required on-site travel · Average audit cost: $42K MXN/audit (travel + auditor fees) | 40% of biennial standard supplier audits conducted remotely using video audit protocol · Remote audit cost: $12K MXN/audit · Annual savings from remote audit adoption: $2.4M MXN |
Result: Risk-based audit program: annual coverage increased from 8% to 48% of supplier base, critical finding CAR closure rate improved from 34% to 96%, $2.4M MXN/year in audit cost savings from remote audit adoption. Most significant outcome: 4 Tier-1 critical suppliers identified with previously unknown quality or social compliance issues that would not have been discovered under the ad-hoc incident-triggered approach.
04How it is measuredCómo se mide
Supplier Audit Coverage Rate % (% of Tier-1 critical suppliers audited within the required cycle)›
Supplier Audit Coverage Rate % (% of Tier-1 critical suppliers audited within the required cycle)
(Tier-1 critical suppliers audited within the required annual cycle / Total Tier-1 critical suppliers) × 100
Benchmark: 100% Tier-1 critical supplier audit coverage within the annual cycle · <80% indicates the audit program is understaffed or underprioritized
⚠️ A Tier-1 critical supplier audit coverage rate of 8% means 92% of critical supplier risks are unknown and unmanaged. The ad-hoc audit-on-complaint approach is reactive by design — the audit only occurs after a quality incident has already impacted production or customers.
CAR On-Time Closure Rate % (% of critical and major audit findings closed within the required timeframe)›
CAR On-Time Closure Rate % (% of critical and major audit findings closed within the required timeframe)
(Critical and major audit finding CARs closed within the required timeframe (30 days for critical, 90 days for major) / Total critical and major CARs issued) × 100
Benchmark: >90% CAR on-time closure rate in mature audit programs · <70% indicates the audit program generates findings but does not systematically follow through on corrective actions
🔑 A CAR on-time closure rate of 34% means 66% of critical and major audit findings are not corrected within the required timeframe. This is a compliance program that identifies risks and then allows them to persist — generating audit liability without the compliance benefit.
Supplier Audit Coverage Rate % (% of Tier-1 critical suppliers audited within the required cycle)›
Supplier Audit Coverage Rate % (% of Tier-1 critical suppliers audited within the required cycle)
(Tier-1 critical suppliers audited within the required annual cycle / Total Tier-1 critical suppliers) × 100
Benchmark: 100% Tier-1 critical supplier audit coverage within the annual cycle · <80% indicates the audit program is understaffed or underprioritized
⚠️ A Tier-1 critical supplier audit coverage rate of 8% means 92% of critical supplier risks are unknown and unmanaged. The ad-hoc audit-on-complaint approach is reactive by design — the audit only occurs after a quality incident has already impacted production or customers.
CAR On-Time Closure Rate % (% of critical and major audit findings closed within the required timeframe)›
CAR On-Time Closure Rate % (% of critical and major audit findings closed within the required timeframe)
(Critical and major audit finding CARs closed within the required timeframe (30 days for critical, 90 days for major) / Total critical and major CARs issued) × 100
Benchmark: >90% CAR on-time closure rate in mature audit programs · <70% indicates the audit program generates findings but does not systematically follow through on corrective actions
🔑 A CAR on-time closure rate of 34% means 66% of critical and major audit findings are not corrected within the required timeframe. This is a compliance program that identifies risks and then allows them to persist — generating audit liability without the compliance benefit.
05What you would useQué se usa
📌 Supplier Audit & Compliance Platforms
Intelex / ETQ Reliance / Veeva Vault Quality›
Module: Supplier Audit & CAR Management
Intelex, ETQ Reliance, and Veeva Vault Quality are the reference quality management systems for supplier audit scheduling, audit finding documentation, CAR management, and corrective action verification tracking.
Intelex, ETQ Reliance, and Veeva Vault Quality are the reference quality management systems for supplier audit scheduling, audit finding documentation, CAR management, and corrective action verification tracking.
Sedex SMETA / BSI Supply Chain Solutions / Bureau Veritas Supplier Audit›
Module: Third-Party Social Audit Programs
Sedex SMETA, BSI Supply Chain Solutions, and Bureau Veritas are the reference third-party social audit platforms for suppliers to global retailers and consumer goods companies — providing shareable audit reports that satisfy multiple customer audit requirements simultaneously.
Sedex SMETA, BSI Supply Chain Solutions, and Bureau Veritas are the reference third-party social audit platforms for suppliers to global retailers and consumer goods companies — providing shareable audit reports that satisfy multiple customer audit requirements simultaneously.
📌 Supplier Audit & Compliance Platforms
Intelex / ETQ Reliance / Veeva Vault Quality›
Module: Supplier Audit & CAR Management
Intelex, ETQ Reliance, and Veeva Vault Quality are the reference quality management systems for supplier audit scheduling, audit finding documentation, CAR management, and corrective action verification tracking.
Intelex, ETQ Reliance, and Veeva Vault Quality are the reference quality management systems for supplier audit scheduling, audit finding documentation, CAR management, and corrective action verification tracking.
Sedex SMETA / BSI Supply Chain Solutions / Bureau Veritas Supplier Audit›
Module: Third-Party Social Audit Programs
Sedex SMETA, BSI Supply Chain Solutions, and Bureau Veritas are the reference third-party social audit platforms for suppliers to global retailers and consumer goods companies — providing shareable audit reports that satisfy multiple customer audit requirements simultaneously.
Sedex SMETA, BSI Supply Chain Solutions, and Bureau Veritas are the reference third-party social audit platforms for suppliers to global retailers and consumer goods companies — providing shareable audit reports that satisfy multiple customer audit requirements simultaneously.
← PreviousAnteriorTrade sanctions & export controls: OFAC, BIS & Denied Party ScreeningSanciones comerciales y controles de exportación: OFAC, BIS y Denied Party ScreeningNextSiguiente →Responsible sourcing: conflict minerals, human rights due diligence & OECD guidelinesSourcing responsable: minerales de conflicto, due diligence de derechos humanos y Modern Slavery Act
All D19 componentsTodos los componentes de D19D19 artifactsArtifacts de D19SCRA