Supplier Audit: Definition, Requirements, Types, and Process

An audit is a systematic, independent, and objective evaluation of processes to verify compliance with specific predetermined criteria. A supplier audit is a structured evaluation process designed to verify whether a supplier meets regulatory, contractual, and quality requirements.

A supplier audit in the life science industry supports regulatory compliance, risk mitigation, and continuous improvement. Regulatory frameworks such as EU GMP, FDA 21 CFR Part 211 and 820, ISO 13485, ISO 9001, ICH Q7, and WHO GMP outline expectations for supplier oversight.

There are several types of supplier audits, both by scope and purpose. Based on the scope, audits include Quality Management System (QMS) audits, process audits, product audits, and compliance audits. Based on purpose, audits are categorized as initial, routine, for-cause, and follow-up.

The supplier audit process includes 11 main steps: defining audit objectives, planning the audit, preparing the agenda, conducting an opening meeting, reviewing supplier documentation, inspecting facilities and processes, identifying and classifying findings, conducting a closing meeting, issuing the audit report, requesting corrective actions and preventive actions (CAPA), and following up on those actions.

Quality management software significantly enhances supplier audit management by digitizing audit planning, execution, reporting, and follow-up. Features such as centralized document access, integration with CAPA for tracking findings through to resolution, support for remote audits, and actionable dashboards enhance audit efficiency and traceability.

SimplerQMS is a QMS software designed specifically for life sciences organizations. SimplerQMS supports comprehensive audit management, supplier oversight, and regulatory compliance with frameworks including ISO 13485, FDA 21 CFR Parts 820 and 211, EU MDR, IVDR, and EU GMP.

What Is a Supplier Audit?

A supplier audit is a structured process used to obtain evidence and objectively evaluate whether a supplier or vendor meets defined requirements. The primary goals of a supplier audit are to ensure regulatory and contractual compliance, mitigate operational and quality risks, and verify the supplier’s capability to consistently deliver products or services according to specifications.

Supplier audits are typically conducted by second-party auditors (such as the buyer’s audit team) or by independent third-party auditors, depending on regulatory requirements or organizational policies.

Supplier audits typically assess a supplier’s quality management system, critical processes for product or service quality, supply chain management, and data integrity practices. Supplier quality audits verify if suppliers’ internal procedures and controls align with applicable quality standards and regulatory frameworks.

Supplier audits may be performed on-site, remotely, or through a hybrid format, depending on audit scope, criticality of the supplier, and logistical feasibility.

Why Are Supplier Quality Audits Important in a QMS?

Supplier quality audits are critical within a quality management system because they assess the level of quality assurance of raw materials and services used, directly influencing the buyer’s product or service quality.

Supplier quality audits can reveal compliance gaps and provide real-world evidence of a supplier’s operational capabilities. Revealing the compliance gaps not only supports regulatory compliance but also minimizes risks related to defective raw materials or service failures.

Supplier audits impact product quality and customer satisfaction by giving organizations control and oversight of the raw materials and services that are used in their processes. Poor supplier quality can compromise final product outcomes and patient safety in life sciences.

Supplier audits support continuous improvement by identifying objective, actionable opportunities to enhance supplier performance. Periodic supplier audits allow tracking of previous findings closure, verification of improvements, and alignment of supplier processes with evolving quality and regulatory expectations.

What Are the Benefits of Performing Supplier Audits?

The main benefits of performing supplier audits are listed below.

• Regulatory Compliance: Supplier audits ensure suppliers comply with legal and industry requirements such as GMP and ISO 9001. For example, under EU GMP, supplier audits must be available to the Qualified Person (QP) performing the product release. Specifically, the audits of all sites involved in the manufacturing or testing of medicinal products, as well as the manufacturing of active substances, shall be available to QP.
• Risk Mitigation: Supplier audits help identify compliance gaps and potential risks before escalation. In life sciences, risk mitigation directly supports the mitigation of patient safety risks.
• Improved Quality Assurance: Audits verify that suppliers meet product and process quality requirements, reducing the likelihood of defects.
• Supply Chain Resilience: Audits ensure supply chain traceability and help detect weak points supporting continuity. Additionally, vendor audits facilitate the reliable qualification of alternative suppliers.
• Operational Efficiency: Audits uncover and resolve inefficiencies, reducing lead times and operational disruptions.
• Time to Market Acceleration: Audits performed on key suppliers streamline regulatory documentation and submission timelines.
• Stronger Supplier Relationships: Audits foster communication, build trust, and reinforce performance accountability.
• Data-Driven Decision Making: Supplier performance is evaluated using objective evidence, supporting informed procurement choices.

What Are the Regulatory Requirements and Industry Standards for Supplier Audits?

Supplier audits are mandated or expected under various regulatory frameworks and industry standards to ensure control over externally provided products and services.

The key requirements in life sciences are the following.

• EU GMP: EU GMP is a set of guidelines concerning medicinal and veterinary products manufactured and/ or marketed in Europe. Supplier audit expectations for GMP-certified companies are outlined in Chapter 5 (Production) and Annex 16 (Batch Release). Chapter 7 (Outsourced Activities) covers the requirements for overall supplier management, including that the contract should permit the auditing of outsourced activities. In addition, Part II (API manufacturing) and Good Distribution Practice (GDP) can be used as regulatory bases during the audit of API suppliers or distributors, accordingly.
• FDA 21 CFR Part 211: FDA 21 CFR Part 211 is the U.S. GMP regulation for finished pharmaceuticals. While no section explicitly mandates supplier audits, section 211.84(b) requires that raw material sampling plans consider supplier quality history, implying the need for supplier assessment through audits.
• ICH Q7: ICH Q7 is an international guideline that defines GMP requirements for Active Pharmaceutical Ingredients (API) manufacturers and, similar to EU GMP Part II, can be used as a basis for auditing API manufacturers. ICH Q7 also mandates robust controls over suppliers of starting and intermediate materials.
• PIC/S GMP: Harmonized GMP guidelines for inspectorates and pharmaceutical manufacturers. Part I of PIC/S GMP concerns medicinal products, and Part II refers to API manufacturing. Chapter 5 and Annex 16 of Part I mandate audits for API suppliers and contractors performing outsourced GMP activities. Chapter 4 requires written procedures for supplier audits. Chapter 7 specifies that written contracts between the supplier and buyer must permit auditing activities at the supplier’s premises. Similarly, Part II, Chapter 16 imposes the same requirements for written contracts between API manufacturers and GMP-related suppliers.
• WHO GMP: The World Health Organization GMP guide defines international quality standards for pharmaceutical production. Supplier audit requirements are included in TRS 986 – Annex 2 for the main GMP principles for pharmaceuticals, as well as in TRS 957 – Annex 2 for GMP in API manufacturing.
• ISO 13485: ISO 13485:2016 is an international QMS standard for medical devices. Clause 7.4.1 of ISO 13485:2016 requires evaluation and monitoring of suppliers to ensure purchased products meet specified requirements. Clause 7.4.3 refers to the verification of supplier activities based on the risk of the supplied material.
• FDA 21 CFR Part 820: FDA 21 CFR 820 is the U.S. Quality System Regulation for medical devices. FDA 21 CFR 820, Section 820.50 sets the requirements for control over suppliers and the supplier qualification process. The type and extent of controls are influenced by supplier evaluation results.
• EU MDR: EU MDR is the European regulation for medical devices. In Article 10 of the EU MDR, the general obligations of medical device manufacturers are stated, including a requirement for resource and supplier management. Additionally, in point 4.5.2(b) of Annex VII for the requirements of notified bodies, it is stated that suppliers of critical materials may be subject to audits by notified bodies.
• EU IVDR: EU IVDR is the regulation for in vitro diagnostic devices in the EU. Mirroring the requirements set by EU MDR, in Article 10 of EU IVDR, supplier control is required as part of the IVD manufacturer’s obligations. Annex VII, point 4.5.2, states that a notified body may audit critical material suppliers.
• ICH E6: ICH E6 is an international guideline for clinical trials and sets the principles of Good Clinical Practice (GCP). As per ICH E6, the investigator/ institution should permit audits on their activities by the clinical trial sponsor. Sponsor is not obligated to perform an audit. However, the ICH E6 in paragraph 3.11.2 provides audit guidance to sponsors and key points to take into consideration.
• ISO 9001: ISO 9001:2015 is an international standard for quality management applicable across industries. Clause 8.4 of ISO 9001:2015 requires organizations to ensure that external providers meet specified requirements and includes monitoring and re-evaluation, supporting the case for supplier audits.

What Are the Types of Supplier Audits?

Supplier audits vary based on their scope and purpose, supporting different stages of the supplier evaluation.

The main types of supplier audits based on their scope are listed below.

• QMS Audit: Evaluates the overall quality management system of the supplier. Quality audits cover processes such as document control, training management, CAPA, change control, and management review to verify alignment with applicable QMS requirements.
• Process Audit: Reviews specific manufacturing, testing, distribution, or service processes for their adherence to the supplier’s internal procedures and contractual agreements. The focus is on processes that are critical to the quality of purchased material or service.
• Product Audit: Assesses the conformity of specific products against specifications. Manufacturing process data, testing results, storage, and distribution conditions are commonly reviewed.
• Compliance Audit: Verifies adherence to applicable regulatory requirements. Examples include checking GMP compliance for API manufacturing or GDP compliance for distribution activities.

The key types of supplier audits based on their purpose are described below.

• Initial Audit: Performed during supplier initial qualification to assess suitability before approval. Initial audits cover the full assessment of the quality management system, technical capabilities, and compliance status.
• Routine Audit: Scheduled at regular intervals to monitor ongoing supplier performance. Auditors may inspect areas such as QMS implementation, process changes, and consistent adherence to requirements.
• For-Cause Audit: Triggered by major quality incidents such as nonconformities, complaints, or regulatory actions. For-cause audits focus on quality investigation, root cause analysis, risk management, and CAPA management.
• Follow-Up Audit: Conducted after a for-cause audit to verify the implementation of corrective actions. Follow-up audits typically focus on previously identified quality defects to confirm closure and CAPA effectiveness.

When to Perform Supplier Audits?

Supplier audits should be scheduled according to the supplier qualification procedure, which usually defines timeframes based on supplier criticality and risk level.

Audits are typically initiated during initial qualification, at periodic intervals, after major quality incidents, or when significant changes occur in the supplier’s operations.

Audit frequency depends on the risk classification of the supplier. For instance, high-risk suppliers may be audited every 1 to 2 years, while low-risk suppliers may be audited every 3 years.

Key factors influencing supplier audit timing include supplier risk profile, regulatory and industry requirements, historical compliance performance, material or service criticality, and the outcome of previous audits.

What Is the Role of Supplier Audits in Supplier Qualification?

Supplier audits play a central role in supplier qualification by providing objective evidence of the supplier’s capabilities, compliance status, and operational controls. Supplier qualification is the formal process of evaluating and approving a supplier to ensure it can consistently meet defined quality, regulatory, and operational requirements.

Audits verify that the supplier’s quality management system, processes, and operational practices meet required criteria before approval. Supplier audits are crucial because they reduce the risk of nonconforming inputs, confirm alignment with regulatory expectations, and enable informed decision-making before supplier approval.

What Is the Supplier Audit Process?

The steps of the supplier audit process are the following.

1. Defining Supplier Audit Objectives: Establishing the scope, purpose, and objectives of the audit based on assessed risk and applicable regulatory requirements.
2. Planning the Supplier Audit: Selecting the audit team, determining the audit method (on-site, remote, or hybrid), and collecting relevant background information.
3. Preparing the Audit Agenda: Developing a detailed schedule of key areas to be assessed, including allocated time slots for each section.
4. Conducting the Supplier Audit Opening Meeting: Aligning expectations with the supplier, introducing the audit team, and confirming the agreed agenda.
5. Reviewing Supplier Documentation and Records: Examining Standard Operating Procedures (SOPs), quality manuals, and QMS documentation for compliance.
6. Inspecting Supplier Processes and Facilities: Observing operations, inspecting equipment, and assessing process controls and cleanliness.
7. Identifying and Classifying Supplier Audit Findings: Recording observations, categorizing findings by severity, and linking them to regulatory or contractual obligations.
8. Conducting the Audit Closing Meeting: Presenting audit findings, discussing major issues, and agreeing on the timeline for the CAPA response.
9. Preparing and Issuing the Supplier Audit Report: Documenting the audit outcome, findings, and recommendations in a formal audit report.
10. Requesting the Supplier Corrective Actions (CAPA) Plan: Requesting a CAPA plan from the supplier that addresses the audit findings and includes defined timelines and assigned responsibilities.
11. Following Up on Supplier Audit Actions: Reviewing CAPA implementation and verifying its effectiveness before concluding the supplier’s audit status.

1. Defining Supplier Audit Objectives

The first step in the supplier audit process is defining supplier audit objectives and setting clear goals that guide the audit’s focus. Typical supplier audit objectives are assessing regulatory compliance, verifying the effectiveness of the supplier’s QMS, evaluating processes and controls, and ensuring product or service quality meets specifications.

The scope and objectives are determined based on whether the audit is intended for initial qualification, performance monitoring, or issue investigation. Supplier risk assessments, previous audit reports, regulatory requirements, and quality agreements are referenced to define the audit’s objectives.

Defining precise objectives ensures the audit remains focused, resources are used efficiently, and audit findings are directly relevant to organizational risk and compliance goals.

2. Planning the Supplier Audit

The supplier audit is planned by selecting qualified auditors, determining the audit method (on-site, remote, or hybrid), and gathering preliminary information about the supplier.

Key aspects of the audit plan include supplier classification matrices and audit checklists aligned with applicable requirements. Communication with the supplier is initiated to confirm availability, share logistics, and agree on confidentiality terms if needed.

Thorough planning ensures audit objectives are achievable, and resources are allocated effectively.

3. Preparing the Audit Agenda

The audit agenda preparation includes setting the structure and timelines for the audit day. The audit agenda outlines which areas will be assessed, the time allocated to each, and the personnel required from the supplier’s side.

Auditors define the timelines for reviewing documents, inspecting processes, and interviewing key staff. A standardized audit procedure and supplier audit checklists streamline audit agenda creation.

A clear agenda ensures focus, minimizes disruptions, and keeps the audit on schedule. For example, a process audit of a sterile fill line may include dedicated time to observe line clearance, batch record review, and personnel gowning practices.

A well-structured agenda helps evidence collection and reduces the risk of missing compliance-critical items.

4. Conducting the Supplier Audit Opening Meeting

The supplier audit opening meeting supports the establishment of mutual understanding of the audit scope, expectations, and relevant procedures.

During the opening meeting, the lead auditor introduces the audit team, reviews the audit agenda, confirms logistics, and clarifies roles and responsibilities. The supplier is invited to present a brief overview of their operations to provide context for the audit. Key participants from the quality, production, and warehouse departments are expected to attend the audit opening meeting.

The audit opening meeting ensures alignment, reduces misunderstandings, and sets a professional tone.

5. Reviewing Supplier Documentation and Records

Supplier documentation and records are reviewed by the auditors to assess the compliance and effectiveness of the supplier’s QMS.

Initially, suppliers typically present the quality policy, the site master file, and the quality manual to the auditors to provide an overview of the supplier’s QMS. Auditors examine controlled documents, including standard operating procedures, batch records, training logs, calibration certificates, nonconformance and complaint reports. Auditors request evidence of document control, version history, change approvals, and record retention procedures.

The review of supplier records verifies that processes are documented, consistently applied, and all actions are traceable. Audit findings like missing equipment calibration logs or outdated SOPs may indicate compliance gaps or operational risks.

6. Inspecting Supplier Processes and Facilities

Supplier processes and facilities are inspected to verify that actual operations align with documented procedures and requirements. Auditors walk through production areas, warehouses, and laboratories to observe workflows, environmental controls, personnel practices, and material handling. Auditors also conduct interviews with key personnel to confirm understanding of SOPs and verify competence.

The inspection of supplier processes can identify discrepancies between procedures and actual execution, which may signal risks to product or service quality. For instance, unlabeled materials or improper gowning in clean areas are considered major GMP violations. Facility inspection provides real-time evidence of the supplier’s compliance and operational integrity.

7. Identifying and Classifying Supplier Audit Findings

The identification and classification of supplier audit findings involve the evaluation of evidence against predefined audit criteria and the categorization of observations based on severity. Findings are documented with objective evidence, such as document references, photographs, or process observations.

Supplier audit findings are classified based on the importance of regulatory or contractual violations. Auditors use grading systems, commonly “critical,” “major,” “minor”, and “recommendation”, to prioritize findings according to potential impact on product or service quality or regulatory compliance.

Clear classification helps the supplier focus on high-risk issues first. Structured classification supports transparent reporting and effective corrective action planning.

8. Conducting the Audit Closing Meeting

The audit closing meeting is conducted to present the audit findings, clarify outstanding questions, and align the next steps. The lead auditor summarizes the observations, including both strengths and nonconformities.

The draft findings list and classification summary are used to communicate supplier audit outcomes. The supplier is invited to comment, provide clarifications, and acknowledge the findings. Timelines for submitting a corrective action plan are confirmed during the meeting.

Audit closing meeting ensures transparency, fosters mutual understanding, and sets expectations for post-audit actions.

9. Preparing and Issuing Supplier Audit Report

The supplier audit report is prepared and issued by the auditors to formally document the audit scope, findings, evidence, and conclusion. The supplier audit report includes audit objectives, date, location, audited processes, a list of participants, and categorized findings with supporting evidence.

A written audit procedure incorporating standard report templates and classification criteria can be used to ensure consistency and clarity in the compilation of supplier audit reports.

A complete supplier audit report provides traceability and accountability for post-audit follow-up.

10. Requesting the Supplier Corrective Actions (CAPA) Plan

The auditors request a CAPA plan from the supplier to ensure each audit finding is addressed with a timely, effective, and traceable resolution. The supplier is expected to submit a documented response outlining corrective measures, responsible personnel, and implementation timelines.

A clear CAPA plan drives accountability and ensures risks are mitigated. For example, a finding on incomplete training records must prompt a CAPA plan detailing how documentation practices will be improved, as well as a CAPA effectiveness review.

A robust corrective and preventive action plan ensures the supplier audit leads to measurable improvements.

11. Following Up on Supplier Audit Actions

The last step of the supplier audit process is the follow-up on the supplier’s CAPA to verify that all actions have been implemented and their effectiveness has been or will be confirmed. Supplier audits follow-up may include requesting evidence such as updated procedures, training records, calibration logs, or photos of facility changes.

Auditors may use a CAPA tracking log to evaluate resolution status. Timelines and closure criteria are compared against the original audit report and CAPA plan.

Audit follow-up confirms that risks have been mitigated and supports the successful closure of the audit process.

What Are the Best Practices for Effective Supplier Audits?

Some of the best practices for customers to conduct effective supplier audits are given below.

• Define a Clear Audit Scope: Establish focus areas to align audit efforts with key objectives.
• Identify High-Risk Suppliers: Prioritize audits based on supplier criticality, quality impact, and compliance history.
• Select Qualified Auditors: Assign trained auditors with relevant regulatory knowledge and technical expertise.
• Use a Standardized Audit Checklist: Apply consistent criteria for evaluating compliance and quality across suppliers.
• Conduct Pre-Audit Planning: Analyze supplier performance data such as deviations, complaints, and CAPA trends.
• Review Documentation in Advance: Assess key documents like the Site Master File (SMF) and Quality Manual before the audit.
• Follow-up on Previous Findings: Verify the closure and effectiveness of previous audit CAPAs.
• Focus on Critical Processes: Allocate more time to high-impact operations that affect product or service quality and safety.
• Document Objective Evidence: Record facts and observations that support audit findings without assumptions.
• Perform Daily Debriefs: Summarize daily results during multi-day audits to align with the supplier and refine focus.
• Engage in Open Communication: Maintain transparency and professionalism to foster collaboration and trust.
• Track and Verify Corrective Actions: Monitor CAPA progress to ensure sustainable resolution of issues.
• Review and Improve Audit Processes: Assess audit execution and outcomes to refine future audit strategy and tools.

How to Streamline the Supplier Audit Process?

The main steps that customers should follow to streamline their supplier audit process are described below.

1. Follow Risk-Based Prioritization: Evaluating vendors based on criticality, compliance history, and ongoing performance enables targeted audits and resource allocation optimization.
2. Standardize Supplier Audit Procedure: Implementing a standardized audit procedure ensures consistency across all audits, regardless of the auditor.
3. Use Audit Templates and Checklists: Standardized templates and checklists that are part of the internal audit procedure improve workflow and overall process efficiency.
4. Prepare an Audit Agenda Based on Supplier’s Weak Points: Tailoring audit agendas to supplier weak points based on ongoing performance data maximizes audit value.
5. Leverage Audit Management Software: Using audit management software to schedule, document, and manage audits is a key driver in supplier audit process optimization.
6. Conduct Remote or Hybrid Audits: Where appropriate, remote audits reduce travel time and cost while maintaining oversight of supplier operations.
7. Digitize Documentation and Reporting: Electronic records improve traceability, simplify access, and enhance long-term audit data storage and retrieval.
8. Automate CAPA Tracking and Notifications: Automated notifications support timely CAPA closure, while automated tracking provides an improved overview of pending actions.
9. Integrate Supplier Data with eQMS: Centralized access to audit findings, supplier-related complaint logs, and deviation records supports supplier performance monitoring and supplier audit management.
10. Participate in Joint Audits: Collaborative audits reduce duplication, expand audit coverage, and reduce costs across multi-stakeholder networks.

How Does QMS Software Support Supplier Audit Management?

QMS software is a digital platform that centralizes quality processes to help ensure compliance, traceability, and efficiency. QMS software streamlines and enhances supplier audit management by digitizing the audit lifecycle from planning to closure.

QMS software supports supplier audit activities through the features outlined below.

• Audit Planning and Scheduling: Supports the supplier audit process by streamlining the scheduling and planning of recurring events.
• Template-Based Audit Execution: Empowers auditors with predefined digital checklists and standardized workflows that ensure consistent audit process execution.
• Centralized Document Access: QMS software provides centralized access to historical audit reports, previous CAPAs, and supplier compliance documentation.
• Electronic Signatures and Approvals: An eQMS enables secure electronic sign-off of documentation such as audit reports, meeting the requirements of 21 CFR Part 11 and EU-GMP Annex 11, enhancing traceability during the supplier audit process.
• CAPA Integration: Supplier audit process is strengthened through QMS software capability to link audit findings with their corresponding CAPAs. Automated notifications support effective CAPA follow-up.
• Dashboards and Reporting: QMS software enhances visibility into supplier audit status, supplier performance, and overdue actions through exportable reports.
• Remote Audit Capabilities: Supplier audit process extends beyond on-site audits with QMS software’s capabilities for remote or hybrid audit execution.

QMS software improves audit efficiency by reducing manual work and increasing visibility with centralized records.

SimplerQMS is a QMS software built for life science companies. SimplerQMS supports all major quality processes, including audit management, supplier management, document control, and CAPA management, among others.

SimplerQMS enables organizations to manage internal, external, and supplier audits in one system, with built-in workflows that help ensure proper planning, execution, and follow-up. SimperQMS supports compliance with key life science requirements such as ISO 13485, FDA 21 CFR Part 820, FDA 21 CFR Part 211, EU GMP, EU MDR, EU IVDR, ICH Q10, and others.