How to Audit a Supplier Factory: From Documents to the Production Line

Executive summary

A factory audit should test whether a supplier can perform the work it claims to perform, at the stated site, with available equipment, qualified personnel, controlled processes, traceable records, and realistic capacity. Treat every capability claim as a hypothesis. Verify it through four evidence channels: controlled documents, interviews, historical records, and direct production-floor observation.

Do not accept certificates, equipment lists, capacity spreadsheets, or prepared presentations at face value. Follow active and completed production orders, reconcile records with physical activity, investigate exceptions, and identify dependencies such as subcontractors, temporary labor, shared equipment, excessive overtime, or one experienced operator. The final audit decision must specify exactly which facilities, processes, lines, shifts, products, and volumes were verified.

1. Set the Audit Scope Before Entering the Factory

Define the capability claims

List the requirements relevant to the intended production program:

• Product families and materials
• Manufacturing and supporting processes
• Required tolerances and controlled operations
• Expected order volumes and delivery patterns
• Tooling or mold maintenance
• Specialized machinery and software
• Licensed or certified activities
• Traceability and record-retention requirements
• Routine or peak-period subcontracting

Separate critical capabilities from optional activities and processes that may legitimately be outsourced. Convert each critical claim into both an evidence request and an on-site test.

For example, a claim of “in-house mold maintenance” should lead to requests for the tooling register, maintenance history, technician qualifications, repair records, and spare-parts controls. On site, verify the workshop, equipment, recent work, responsible technicians, and the route used when repairs exceed internal capability.

Map the legal and operational structure

Confirm which legal entity will receive orders and accept contractual responsibility. Compare that entity with the business license, factory signage, facility lease or title, certification scopes, payroll records, equipment ownership, and customer-facing documents.

Ask directly:

• Who owns or leases the premises and major assets?
• Are engineering, production, purchasing, maintenance, or warehousing shared with affiliates?
• Which processes leave the audited site?
• Are satellite factories, home-based workers, or related companies used?
• Does the entity named on certifications match the facility being audited?

Unexplained differences in company names, addresses, stamps, or certification holders are evidence gaps, not administrative details.

Plan a route around actual flow

Build the audit route around material and information flow: receiving, storage, production planning, production, rework, production release, and record retention. Include maintenance, tooling, training, document control, nonconformance handling, and outsourced-process management.

Do not allow the visit to become a management-led showroom tour. Ask to see inactive lines, maintenance areas, temporary storage, dispatch zones, restricted departments, and any location containing unidentified work in process.

Prepare a sampling plan

Select records from different dates, shifts, product families, machines, and operators. Include:

1. One completed order
2. One active order selected during the visit
3. One order affected by a breakdown, shortage, delay, deviation, or subcontractor problem

Request original, system-generated, or contemporaneous records rather than slides prepared for the audit. Record each sample’s title, owner, date, revision, system source, and relationship to the capability claim.

2. Verify Documents Against Independent Evidence

Confirm site identity and certificates

Review the business license, registered address, legal representative, permitted activities, and validity dates. Compare these details with utility records, employee records, tax or customs documents where relevant, and the certification scope.

For each certificate, check:

• Certificate holder and facility address
• Covered activities and product scope
• Applicable standard
• Issue and expiration dates
• Issuing body and registration number
• Recent surveillance or renewal evidence

Verify the certificate through the issuing body or official database when possible. Flag certificates belonging to another company or location, excluding the relevant process, displaying inconsistent formatting, or lacking independent verification.

Review controlled operating documents

Sample procedures, process flows, work instructions, control plans, maintenance plans, training materials, and routing documents. Check approvals, effective dates, revision status, and availability at the point of use.

Compare the controlled master with the copy at a workstation. Ask an operator to explain the operation using that instruction. Obsolete copies, unofficial notes, contradictory parameters, or operators unaware of the documented method indicate weak process control.

Reconstruct production from records

Sample schedules, job travelers, routing records, equipment logs, maintenance history, training records, and material-transfer records. Dates, quantities, machines, operators, and process steps should form a coherent timeline.

Warning signs include:

• Identical handwriting across departments
• Repeated or impossible timestamps
• Overwritten entries without authorization
• Unexplained quantity differences
• Long gaps followed by complete records
• Implausibly perfect results
• Records completed after the activity
• System entries that conflict with physical tags or machine status

Audit evidence checklist

Audit question	Evidence to request	Floor verification	Strong evidence	Red flags
Is this the contracted manufacturing entity?	License, lease or title, organization chart	Match names and addresses to signage and operations	One consistent legal and operating identity	Different entities or unexplained shared premises
Are claimed processes in-house?	Process flow, routing records, equipment list	Observe equipment running and interview operators	Active assets, qualified staff, recent matching records	Display machines, no operator, routine off-site work
Is equipment usable?	Asset register, maintenance history, status records	Match asset IDs, utilities, condition, and labels	Regular use and completed maintenance	Disconnected machines, duplicate IDs, overdue work
Are procedures controlled?	Instructions, revision history, approvals	Compare master copies with workstation copies	Current instructions available where work occurs	Obsolete copies or unofficial notes
Can an order be reconstructed?	Travelers, schedules, material issues, transfer records	Follow the order across departments	Quantities, dates, locations, and people align	Missing stages or retrospective records
Are operators qualified?	Skills matrix, training and authorization files	Interview operators and observe assignments	Authorization matches actual responsibility	Generic attendance sheets or untrained substitutes
Is capacity supportable?	Shift plans, cycle times, utilization, history	Time operations and identify bottlenecks	Output reflects constraints and downtime	Claims based only on theoretical speed
Are outsourced steps controlled?	Supplier list, purchase and transfer records	Inspect dispatch, receipt, and identification	Declared, traceable, approved outsourcing	Hidden transfers or undeclared factories
Are exceptions closed?	Deviation, downtime, shortage, and action records	Trace one event from detection to closure	Ownership, cause, action, and effectiveness evidence	Verbal handling or recurring unresolved events

3. Follow the Process Through the Factory

Begin with receiving and material identity

Verify how incoming materials are identified, recorded, segregated, and released. Compare purchase descriptions, supplier labels, internal codes, storage labels, and material issue records.

Check how the factory controls unidentified, pending, rejected, returned, expired, and customer-owned materials. Where applicable, verify shelf-life, environmental, and special-handling controls. The objective is continuity and traceability through production, not final product inspection.

Walk one live order

Select an active order yourself rather than accepting a prepared example. At every handoff, verify:

• Order or batch identity
• Quantity transferred
• Date and time
• Sending and receiving departments
• Machine or line used
• Applicable instruction
• Current production status
• Any deviation, hold, rework, or shortage

Compare the documented routing with the physical route. Investigate unlabeled queues, mixed batches, informal transfers, and material moved outside the defined process.

Useful questions include:

• What operation was completed before this stage?
• How do you know this material is approved to proceed?
• What happens if the quantity received does not match the traveler?
• Who authorizes a route change?
• Where is the exception recorded?
• How can the next department identify unfinished or restricted work?

Verify equipment, tooling, and operator readiness

Match equipment nameplates and asset IDs to the asset register. Confirm that machines claimed for the relevant product family are connected, operational, appropriately maintained, and used in recent production.

Verify the availability and control of fixtures, molds, dies, programs, gauges, and setup tools. Ask who owns critical tooling, who may change or repair it, and how changes are documented.

Interview operators about setup, common failures, escalation, shutdown, and restart rules. Compare their answers with procedures and supervisor expectations. Check whether temporary or substitute workers perform controlled operations without appropriate authorization.

Test maintenance and downtime controls

Sample equipment in four conditions: running, idle, under repair, and recently serviced. Compare preventive-maintenance schedules with completed records and physical condition.

For a bottleneck asset, ask:

• What was its most recent breakdown?
• How long was it unavailable?
• How was affected production rescheduled?
• Who authorized production restart?
• Is backup equipment genuinely equivalent?
• Are spare parts and qualified technicians available?
• Has the same failure occurred before?

Repeated breakdowns without root-cause action, overdue maintenance, or production restart based only on verbal approval undermines continuity and capacity claims.

Examine outsourced and off-site work

Reconcile process flows with purchase records, transfer notes, vehicle logs, subcontractor invoices, and receipt records. Determine which processes are always outsourced, used only during peaks, or transferred during disruptions.

Material identity and production records should remain continuous when work leaves the factory. Hidden subcontracting, unlabeled transfers, home-based work, and undeclared satellite facilities are major integrity concerns.

4. Challenge Capacity and Exception Handling

Calculate demonstrated capacity

Do not calculate capacity from the fastest machine or theoretical cycle time. Use the actual constraint:

Demonstrated capacity = available bottleneck time ÷ observed cycle time, adjusted for changeovers, maintenance, downtime, staffing, and normal losses.

Separate four figures:

• Theoretical machine capacity
• Scheduled capacity
• Demonstrated sustained output
• Capacity remaining after existing commitments

Compare the result with recent production history. If management claims output above demonstrated history, ask what changed and require evidence of additional machines, shifts, personnel, or process improvements.

Verify staffing assumptions

Review rosters, attendance, shift records, payroll summaries, skills matrices, overtime, and temporary-labor use. Count personnel by department and shift during the visit.

Higher volume requires more than direct operators. Determine whether production planning, supervision, maintenance, tooling, warehousing, and engineering can support the proposed workload. Capacity dependent on excessive overtime, seasonal labor, shared staff, or one expert operator is fragile.

Trace a disrupted order

Use a disrupted order to test how the factory responds to equipment failure, material shortage, labor absence, schedule change, process deviation, or subcontractor delay.

Trace the event through:

1. Detection
2. Immediate containment
3. Authorization and escalation
4. Internal and customer communication
5. Disposition or rescheduling
6. Root-cause analysis
7. Corrective action
8. Effectiveness verification
9. Formal closure

A verbal workaround is not an effective exception system. Look for repeated incidents, missing ownership, undocumented route changes, and corrective actions that consist only of “retraining” without addressing the underlying system.

Classify red flags by impact

• Critical: False identity, forged evidence, concealed subcontracting, missing mandatory authorization, or no traceable production records.
• Major: Unsupported capacity, unavailable critical equipment, uncontrolled process changes, serious record gaps, or recurring unresolved breakdowns.
• Moderate: Weak handoffs, inconsistent document control, incomplete training evidence, or delayed record completion.
• Observation: An improvement opportunity that does not currently invalidate the capability claim.

Tie every classification to objective evidence, the affected process, and the resulting capability, continuity, capacity, or traceability risk.

5. Turn Findings Into Verifiable Follow-Up

Write findings that another auditor can check

Each finding should state:

• The requirement or supplier claim tested
• The objective evidence reviewed
• The exact gap
• The affected process or capability
• The resulting business risk
• Relevant document titles, dates, versions, asset IDs, locations, and sampled orders

Separate confirmed facts from assumptions. Avoid vague statements such as “maintenance needs improvement.” A verifiable finding identifies the machine, overdue task, breakdown history, missing evidence, and operational consequence.

Require evidence-based corrective action

Request immediate containment, root-cause analysis, corrective action, responsible owner, deadline, revised controlled documents, implementation evidence, and an effectiveness-check method.

Do not close findings based only on promises of more training, closer supervision, or future attention. The change should appear in subsequent operating records and floor practices.

Verify closure according to risk

Low-risk document issues may be closed with validated remote evidence. Moderate findings may require live video, system demonstrations, and targeted sampling. Critical capability, integrity, capacity, or subcontracting findings usually require a focused return visit.

Resample production activity created after implementation. Reopen a finding when evidence is staged, contradictory, incomplete, or too recent to demonstrate effectiveness.

Use clear decisions:

• Verified: Documentary and physical evidence consistently support the capability.
• Conditionally verified: Capability exists, but defined gaps must close before reliance or higher volume.
• Not verified: Evidence is insufficient, contradictory, or dependent on undeclared parties.
• Rejected: Integrity, legality, continuity, or control risks make reliance unacceptable.

Limit the decision to the products, processes, lines, shifts, volumes, and facilities actually sampled.

Image gallery

A factory audit must connect visible machinery with asset records, maintenance history, qualified operators, actual production routes, and demonstrated capacity.

Photo by Homa Appliances on Unsplash. Unsplash License.

Final next move

Create a one-page capability verification matrix linking every critical supplier claim to its document evidence, floor evidence, sampled records, capacity evidence, open exceptions, finding severity, corrective-action deadline, and closure status.

Resolve critical findings before treating the factory as a verified production source. Schedule follow-up according to risk and evidence maturity—not the supplier’s preferred timeline.