Every business depends on others. A bakery depends on its flour supplier, an agency on its hosting provider, a shop on a courier. When one of them fails, your customer does not blame the supplier: they blame you. So it is sensible to know how your key suppliers work before something goes wrong.
A supplier audit is simply a structured look at how a supplier does what they promise. For a small company it can be light, quick and friendly. The aim is trust with evidence, not suspicion.
Start with a list and a ranking
Write down everyone you buy from. For each, note what you buy, how much you spend and what happens to your customers if they fail. Then rank them by risk:
- High: you cannot easily replace them, or their failure stops your work or harms a customer. Examples: your main manufacturer, your software host, the person who handles customer payments or data.
- Medium: their failure hurts, but you can work around it in a few days.
- Low: you can switch with little effort.
Spend your effort on the high group first. For the low group, a quick look at reviews and an invoice check is plenty.
Decide what matters for each
The questions depend on what they supply. Some themes appear often:
- Delivery. Do they deliver the right thing, on time? Do they tell you early when they cannot?
- Quality. How do they check their work? What happens when something is wrong?
- Capacity and continuity. What if their key person is ill, or their site is out of use? Do they have a backup?
- Legal and safety. Are they allowed to do what they do? Do they hold the licences, insurance or certificates the work needs?
- Information and data. Do they handle your or your customers' data? How is it protected, where is it kept and who can see it?
- People and ethics. Do they treat their workers fairly and follow the law? This matters more in some trades.
Pick the three or four that matter most for each high risk supplier.
Choose the method
You have three levels of effort.
A questionnaire. Send a short list of questions and ask for evidence with the answers: a certificate, a policy, a sample record. Ten questions are enough. It is quick for both sides and gives you something to file.
A call or video visit. Ask them to show how they do the work. "Can you show me how an order moves from receipt to dispatch?" Watching reveals more than reading.
A site visit. For suppliers whose failure would be serious. Tell them in advance what you want to see and who you want to meet. Bring a short checklist and take notes.
In each case, keep the tone collaborative. Most suppliers welcome a customer who cares about quality.
Ask questions that need evidence
"Do you have a quality process?" gets a yes. "Please send your procedure for handling a faulty batch, and one example from the last year" gets the truth. For each answer, ask what proves it.
You can use a recognised certificate such as ISO 9001 or ISO 27001 as one piece of evidence. Check that it is current, covers the work you buy, and was issued by a real body. A certificate does not replace your own look at the things you rely on.
Record and judge
For each question, record the result: meets what you need, partly meets it, does not meet it, or does not apply. Write what you saw or received. Then give the supplier an overall view: approved, approved with conditions, or not approved.
Be fair and consistent. Judge each supplier against the same standard for their risk level.
