Technical reference
An audit gives evidence of whether a supplier's controls work as described, on the day and at that site. Its value depends on what you look at and what you do with the answer. schemes ask for risk-based audits by knowledgeable people. They leave the frequency and method to you.
Three kinds of audit answer different questions. A first-party audit is your own check of yourself. A is a customer checking a supplier against its own requirements. A audit is an independent certification body checking against a published scheme.
An assumes both sides want to find problems. A can't assume that, because the supplier wants to pass. That doesn't make anyone dishonest, but it is why evidence seen at the point of work counts for more than a prepared file.
Percentage scores have a known weakness. Averaging lets strength in housekeeping offset weakness at a critical control, and removing questions as not applicable changes the total. A score is useful for spotting trends, and should never replace reading the findings.
Parameters
| Frequency | Set by risk and by your scheme or customer. There is no universal figure |
|---|---|
| Types | Document review, , site audit, certification |
| Auditor | Knows the product and process, and is independent of the buying decision |
| "Not applicable" answers | Each is justified and accepted, because it raises a percentage score |
| Critical findings | Read on their own, and able to override the overall score |
| Outcome | A buying decision that reaches purchasing |
Records that prove it
- Audit calendar with each supplier's risk rating and basis
- Questions asked, evidence seen, who audited and when
- Scoring method and reviewer's sign-off
- Corrective actions: finding, root cause, evidence, closure
- Outcome, and the date purchasing was told
- Periodic report across suppliers
CCP or prerequisite?
That depends on the for your process. The number, if it has one, belongs to your plan.