ISO 9001 Supplier Audit Checklist

Use this ISO 9001 Supplier Audit Checklist to assess a supplier's QMS against ISO 9001:2015 requirements, covering context, leadership, competence, process controls, traceability, etc.

Download as free PDF

Library
ISO Standards
ISO 9001 Supplier Audit Checklist

Clause 4 — Context, Scope, And QMS Foundation

6. Any ISO 9001 clauses excluded from the supplier's QMS scope are identified with documented justification, and exclusions are limited to Clause 8 where the relevant requirements do not apply due to the nature of the supplier's products or services (Clause 4.3).

Photo Comment

Clause 5 — Leadership, Quality Policy, And Management Commitment

Clause 6 — Planning, Risk Management, And Quality Objectives

Clause 7 — Competence, Training, And Documented Information

Clause 8.1–8.2 — Operational Planning And Customer Requirements

2. The supplier has a documented process for determining and reviewing customer requirements before accepting an order, including product specifications, delivery requirements, statutory and regulatory requirements, and any additional requirements determined by the supplier (Clause 8.2.2).

Photo Comment

Clause 8.4 — The Supplier's Own Supply Chain Controls

Clause 8.5 — Production And Service Delivery Controls

Clause 8.5.2 — Identification, Traceability, And Nonconforming Output

1. Products and materials are identified throughout all production and storage stages using a defined method — such as labels, tags, barcodes, batch numbers, or serial numbers — enabling conforming and nonconforming stock to be distinguished at all times (Clause 8.5.2).

Photo Comment

4. Nonconforming outputs — including in-process nonconformances, finished goods failures, and incoming material rejections — are identified and segregated from conforming product using a defined method to prevent unintended use or dispatch (Clause 8.7.1).

Photo Comment

Clause 8.6–8.7 — Inspection, Release, And Nonconformance Management

Clauses 9–10 — Performance Monitoring, Internal Audit, And Corrective Action

8. Management reviews are conducted at planned intervals by the supplier's top management, covering QMS performance data, audit results, customer complaints, objectives performance, and resource adequacy, with documented outputs and actions (Clause 9.3).

Photo Comment

Checklist by GoAudits.com – Please note that this checklist is intended as an example. We do not guarantee compliance with the laws applicable to your territory or industry. You should seek professional advice to determine how this checklist should be adapted to your workplace or jurisdiction.

Is this sample what you are looking for?
Sign up to use & customize this template, or create your own custom checklist.

NEW! Try generating a custom checklist with our free AI tool:

Easy inspection app for your digital checklists

Conduct inspections anytime, anywhere - even offline
Capture photos as proof of compliance or areas needing attention
Instantly generate and share detailed reports after the inspections
Assign & track follow-up tasks, view historical trends on a centralized dashboard

ISO 9001 Supplier Audit Checklist

Use this ISO 9001 Supplier Audit Checklist to assess a supplier's QMS against ISO 9001:2015 requirements, covering context, leadership, competence, process controls, traceability, etc.

1. The supplier has identified and documented the internal and external issues relevant to their purpose and strategic direction that could affect their ability to consistently provide conforming products or services (Clause 4.1).

2. The supplier reviews internal and external issues at defined intervals and updates their QMS when significant changes in context occur (Clause 4.1).

3. The supplier has identified the interested parties relevant to their QMS — including customers, regulators, sub-suppliers, and employees — and has documented their relevant requirements and expectations (Clause 4.2).

4. The requirements of interested parties relevant to product or service conformity are reflected in the supplier's QMS processes and controls (Clause 4.2).

5. The scope of the supplier's QMS is documented, defining which products, services, sites, and processes are included, and is consistent with what the supplier has represented in their quality capability or certification claims (Clause 4.3).

6. Any ISO 9001 clauses excluded from the supplier's QMS scope are identified with documented justification, and exclusions are limited to Clause 8 where the relevant requirements do not apply due to the nature of the supplier's products or services (Clause 4.3).

7. The supplier's QMS scope covers the products and services being supplied to the auditing organisation — there are no gaps between what is within scope and what is being provided (Clause 4.3).

8. The processes needed for the QMS are identified, their sequence and interaction documented, and the criteria, methods, responsibilities, and resources for each process are defined (Clause 4.4).

9. Evidence is available that the supplier's QMS processes are being operated and controlled in accordance with their documented approach, not just defined on paper (Clause 4.4).

10. The supplier retains documented information sufficient to demonstrate that QMS processes are being carried out as planned (Clause 4.4.2).

1. The supplier has a documented quality policy approved by top management that is appropriate to the supplier's purpose and context (Clause 5.2).

2. The quality policy includes commitments to satisfying applicable requirements and to continual improvement of the QMS (Clause 5.2.1).

3. The quality policy is communicated to and understood by relevant personnel at the supplier's organisation, and evidence of this communication is available (Clause 5.2.2).

4. Top management at the supplier's organisation demonstrates commitment to the QMS through active involvement in quality governance, resource provision, and visible endorsement of quality objectives (Clause 5.1.1).

5. The supplier demonstrates customer focus — processes are in place to determine and consistently meet customer requirements, and risks to product or service conformity and on-time delivery are managed (Clause 5.1.2).

6. QMS roles, responsibilities, and authorities are documented and assigned at the supplier's organisation, including a named role responsible for QMS conformity and performance reporting to top management (Clause 5.3).

7. Evidence that QMS responsibilities have been communicated to relevant supplier personnel is available (Clause 5.3).

1. The supplier has a documented process for identifying risks and opportunities relevant to their QMS and to their ability to consistently provide conforming products or services (Clause 6.1).

2. Risks and opportunities are assessed and treated, with documented actions and assigned owners, and evidence that actions have been implemented and reviewed for effectiveness (Clause 6.1.2).

3. Quality objectives are established at relevant functions and levels within the supplier's organisation, are measurable, and are monitored at defined intervals (Clause 6.2.1).

4. Quality objectives are consistent with the quality policy and relevant to product or service conformity and customer satisfaction (Clause 6.2.1).

5. Plans to achieve quality objectives include assigned responsibilities, required resources, timelines, and methods for evaluating results (Clause 6.2.2).

6. A change management process is in place at the supplier's organisation for planned changes to processes, products, or services that could affect conformity or customer requirements (Clause 6.3).

7. Evidence is available that significant changes have been assessed before implementation and that relevant documentation, competence, and process controls have been updated accordingly (Clause 6.3).

1. Competence requirements are defined for all roles at the supplier's organisation that affect product or service quality (Clause 7.2a).

2. Evidence of competence is available for personnel in quality-relevant roles, including training records, qualifications, licences, and on-the-job assessments (Clause 7.2d).

3. Where competence gaps have been identified, actions have been taken to address them and their effectiveness has been verified and documented (Clause 7.2c).

4. Personnel at the supplier's organisation are aware of the quality policy, quality objectives relevant to their role, their contribution to QMS effectiveness, and the consequences of non-conformity (Clause 7.3).

5. A document control procedure is in place at the supplier's organisation covering creation, approval, version control, and access management for QMS documented information (Clause 7.5.2).

6. QMS documents are at the correct revision level, accessible to relevant personnel, and protected against unintended alteration (Clause 7.5.3).

7. Records required as evidence of QMS operation — including inspection records, training records, nonconformance records, and corrective action records — are retained for defined periods and available for review (Clause 7.5.3).

8. The supplier's infrastructure — including buildings, equipment, utilities, and IT systems — is adequate to support consistent product or service conformity (Clause 7.1.3).

9. The working environment is controlled to prevent product damage or deterioration, including relevant temperature, humidity, cleanliness, and contamination controls (Clause 7.1.4).

10. Monitoring and measurement equipment used by the supplier is calibrated or verified at defined intervals, with calibration records retained (Clause 7.1.5).

1. Operational procedures are documented for all key production and service delivery processes, and evidence that processes are carried out in controlled conditions in accordance with those procedures is available (Clause 8.1).

2. The supplier has a documented process for determining and reviewing customer requirements before accepting an order, including product specifications, delivery requirements, statutory and regulatory requirements, and any additional requirements determined by the supplier (Clause 8.2.2).

3. Records of customer requirement reviews are retained, including how any differences between contract or order requirements and previously expressed requirements are resolved (Clause 8.2.3).

4. Customer communications are managed through defined channels, covering information about products and services, enquiry and order handling, customer feedback, and complaints (Clause 8.2.1).

5. Where customer-specific requirements or special customer quality requirements apply — such as PPAP, FAI, or customer-specific QMS requirements — these are identified, documented, and implemented (Clause 8.2.2).

6. Outsourced processes at the supplier's organisation are identified and controls are in place to ensure outsourced activities meet QMS and customer requirements (Clause 8.4.1).

1. The supplier has a documented process for evaluating, selecting, and monitoring their own sub-suppliers and external providers of goods and services that affect product or service quality (Clause 8.4.1).

2. An approved supplier list or equivalent record is maintained by the supplier, reflecting current approval status of each sub-supplier (Clause 8.4.1).

3. Sub-supplier performance is monitored at defined intervals using documented criteria, and results are used to inform purchasing decisions (Clause 8.4.1).

4. Purchase orders or equivalent documents issued by the supplier to their sub-suppliers specify the products, quantities, specifications, and quality requirements (Clause 8.4.3).

5. Incoming goods from sub-suppliers are inspected or verified upon receipt against defined acceptance criteria before being accepted into stock or production (Clause 8.4.3).

6. Records of incoming goods inspection are maintained, including date of receipt, quantity, inspection findings, and disposition (Clause 8.4.3).

7. Nonconforming incoming goods are identified, segregated, and managed through the nonconformance control process before use or disposition (Clause 8.7).

1. Production and service delivery is carried out under controlled conditions, including the use of documented procedures or work instructions, appropriate equipment, and defined monitoring activities (Clause 8.5.1).

2. Where output cannot be verified by subsequent monitoring or measurement — process validation — the supplier has validated affected processes to demonstrate their ability to achieve planned results (Clause 8.5.1f).

3. Process validation records are available and show that processes consistently produce conforming output before release (Clause 8.5.1f).

4. Property belonging to customers — including supplied materials, tooling, intellectual property, or packaging — is identified, protected, and reported to the customer if lost, damaged, or found to be unsuitable (Clause 8.5.3).

5. Preservation controls are in place to protect products during internal processing, storage, and dispatch, including handling, labelling, packaging, and environmental controls appropriate to the product (Clause 8.5.4).

6. Post-delivery activities — including warranty obligations, service agreements, or product feedback handling — are defined and managed where applicable (Clause 8.5.5).

7. Change control procedures are applied to all changes to production processes, materials, equipment, or key personnel that could affect product conformity, with customer notification where required (Clause 8.5.6).

8. Records of production or service delivery — including batch records, travellers, route cards, or equivalent — are maintained to demonstrate that products have been produced in accordance with requirements (Clause 8.5.1).

1. Products and materials are identified throughout all production and storage stages using a defined method — such as labels, tags, barcodes, batch numbers, or serial numbers — enabling conforming and nonconforming stock to be distinguished at all times (Clause 8.5.2).

2. Where traceability is a customer, regulatory, or QMS requirement, unique identification is maintained and documented information is retained to enable the complete traceability of each product or batch through the supply chain (Clause 8.5.2).

3. Traceability records are retained for a defined period consistent with customer, regulatory, and QMS requirements and are retrievable in a timely manner (Clause 8.5.2).

4. Nonconforming outputs — including in-process nonconformances, finished goods failures, and incoming material rejections — are identified and segregated from conforming product using a defined method to prevent unintended use or dispatch (Clause 8.7.1).

5. Nonconforming outputs are assessed and dispositioned through a documented process covering options including rework, regrade, return to supplier, use under concession, or disposal (Clause 8.7.1).

6. Disposition decisions are made by personnel with appropriate authority, documented, and include the nature of the nonconformity, the disposition selected, and the identity of the authorising person (Clause 8.7.2).

7. Where nonconforming product has been dispatched to the customer, a process is in place for customer notification, recall or replacement where required, and root cause investigation (Clause 8.7.1).

1. In-process inspection and final product inspection are carried out at defined stages using documented criteria and methods, with inspection records retained (Clause 8.6).

2. Products are not released to the customer until all planned inspection and verification activities have been satisfactorily completed, or unless specifically approved by the customer under a concession arrangement (Clause 8.6).

3. Release records identify the person authorising release and confirm that acceptance criteria have been met (Clause 8.6).

4. Statistical process control or other process monitoring techniques are used where appropriate to monitor process stability and detect trends before nonconformances occur (Clause 9.1.1).

5. First article inspection, first-off inspection, or equivalent is conducted when new products, tooling, or processes are introduced, with records retained (Clause 8.6).

6. Measuring and test equipment used for product inspection is calibrated or verified, with calibration status indicated on the equipment or in associated records (Clause 7.1.5).

1. Key quality performance indicators are tracked by the supplier at defined intervals, including product conformity rates, customer complaint volumes, delivery performance, nonconformance rates, and scrap or rework rates (Clause 9.1.1).

2. Customer satisfaction is monitored through defined methods — such as customer complaints, returns, delivery performance data, or customer feedback — and results are analysed and acted upon (Clause 9.1.2).

3. The supplier conducts internal audits of their QMS at planned intervals, covering all relevant processes and clauses, with auditors independent of the areas being audited (Clause 9.2).

4. Internal audit records — including audit plans, reports, findings, and corrective actions — are retained and available for review (Clause 9.2.2).

5. Nonconformities identified through internal audits, customer complaints, process monitoring, or inspection are subject to root cause analysis, with corrective actions implemented and verified for effectiveness (Clause 10.2).

6. A corrective action register or equivalent is maintained, documenting each nonconformity, root cause, action taken, responsible person, target date, and closure evidence (Clause 10.2.2).

7. Corrective actions address the root cause of nonconformities — not just the immediate symptom — and there is evidence that actions have prevented recurrence (Clause 10.2.1).

8. Management reviews are conducted at planned intervals by the supplier's top management, covering QMS performance data, audit results, customer complaints, objectives performance, and resource adequacy, with documented outputs and actions (Clause 9.3).

9. Evidence of continual improvement of the supplier's QMS is available, demonstrating that quality performance, process controls, and customer outcomes improve over time (Clause 10.3).