Supplier audit is a structured evaluation of a supplier’s quality management system, processes, and controls, carried out by a customer or their representative to confirm the supplier can consistently meet requirements before and during a contract, reducing the risk of defects moving down the aerospace or manufacturing supply chain. It verifies capability with evidence rather than promises.
In the systems we build for aerospace and manufacturing clients, a weak supplier audit is where quality escapes are born. A part fails final inspection, the investigation traces it to a sub-tier process that was never checked, and the finding lands on the buyer during their own certification audit. This guide covers what a supplier audit is, why it matters for AS9100 and ISO 9001 supply chains, the three main audit types, the process from planning to follow-up, and a practical supplier audit checklist you can put to work.
Key takeaways
- A supplier audit confirms, with objective evidence, that a supplier can meet quality and delivery requirements before problems reach your line.
- The three main types are first-party (internal), second-party (customer auditing supplier), and third-party (independent certification body).
- AS9100 clause 8.4 and ISO 9001 clause 8.4 both require control of externally provided processes, products, and services, which is where supplier audits live.
- A defensible audit runs a repeatable process: plan, prepare the checklist, conduct on-site, document findings, and verify corrective action.
What is a supplier audit and why it matters
A supplier audit is a formal assessment of an external provider against a defined set of requirements: the applicable standard, the contract, drawings, and the customer’s own quality expectations. It looks at whether the supplier has a working quality management system, controls its processes, manages nonconformities, and can prove all of it with records. The goal is not to catch a supplier out. It is to confirm capability before you depend on it.
This matters because your certification does not stop at your own four walls. Under AS9100 and ISO 9001, you are responsible for the quality of everything you buy and pass along. If a supplier ships defective material and you install it, the nonconformity is yours. That is why supplier control is one of the most heavily scrutinized areas in an aerospace audit, and why a documented supplier audit program is not optional for a mature system. Our internal audit work often starts by testing whether a client’s supplier controls would actually hold up.
What are the three main types of supplier audits
Auditors and buyers use three categories, defined by who performs the audit and against what. Confusing them is a common source of gaps, because each answers a different question.
| Type | Who performs it | Purpose | Example |
|---|---|---|---|
| First-party | The organization audits itself | Verify your own QMS works before a customer or registrar checks it | An internal audit of your receiving inspection process |
| Second-party | A customer audits its supplier | Confirm a supplier can meet contract and quality requirements | Your team auditing a machine shop before approving it as a source |
| Third-party | An independent certification body | Grant or maintain certification to a standard | A registrar auditing a supplier to AS9100 |
The supplier audit most buyers mean is the second-party audit: you assessing a supplier you rely on. Third-party certification helps, but it does not replace your own evaluation, because a registrar audits against the standard in general, not against your specific parts and contract terms.
The supplier audit process from planning to follow-up
A supplier audit that produces real assurance follows a repeatable sequence. Skipping the front end is where most programs go wrong, because an unplanned audit becomes a plant tour.
- Plan and scope. Define why you are auditing this supplier, which processes and part numbers are in scope, the standard and contract clauses you will assess against, and the risk level. A new sub-tier source needs deeper coverage than a long-approved distributor.
- Prepare the checklist. Build a supplier audit checklist tied to the standard and your requirements so the audit is consistent and repeatable, not dependent on one auditor’s memory.
- Notify and schedule. Agree a date, share the scope and agenda, and request documents in advance so the on-site time is spent verifying, not waiting.
- Conduct the on-site audit. Interview process owners, trace real jobs from order to shipment, examine records, and gather objective evidence. Follow the product, not just the paperwork.
- Document findings. Classify each finding as a major nonconformity, minor nonconformity, or opportunity for improvement, each supported by the specific evidence and the clause it fails.
- Request corrective action. Ask the supplier for containment, root cause, and a permanent fix on each nonconformity, with due dates that match the risk.
- Verify and follow up. Confirm the corrective actions were implemented and effective before you close the audit and set the next review interval based on performance.
Step seven is where discipline pays off. An audit is not finished when you leave the site. It is finished when the findings are closed with evidence and the supplier’s risk rating is updated in your approved supplier list. AS9100 and ISO 9001 are published and governed through bodies such as SAE, whose aerospace standards define the supplier control expectations auditors apply.
The OQS supplier audit checklist
Before you sign off on any supplier, run their operation against this practical checklist we use with aerospace and manufacturing clients. It targets the areas that actually generate escapes:
- Can the supplier show a controlled QMS, with current procedures, a document control system, and evidence it is used on the floor rather than filed away?
- Does the supplier flow down your requirements to its own sub-tiers, including special processes, key characteristics, and any customer-directed sources?
- Is there real control of nonconforming material, a working corrective action process, and records that show problems get to root cause instead of just rework?
- Are calibration, first article inspection, and special processes managed with current records and qualified personnel, not verbal assurances?
- Does on-time and quality performance data exist, and does the supplier act on its own trends before you have to?
What are the 5 key supplier evaluation criteria
Beyond a single audit, buyers score suppliers against recurring criteria so approval is objective and comparable across sources. Five carry the most weight:
- Quality. Defect rates, first article results, and the strength of the supplier’s own quality system.
- Delivery. On-time performance and the ability to hold schedule under load.
- Cost and value. Total cost including scrap, rework, and administrative burden, not just unit price.
- Capability and capacity. Whether equipment, processes, and headcount actually match your volume and tolerances.
- Responsiveness. How quickly the supplier contains issues, communicates, and closes corrective actions.
A supplier audit gives you the evidence behind these scores. Pairing the two turns supplier management from a paperwork exercise into a real defect-prevention tool, which is exactly what an AS9100 auditor wants to see. If you are building this into a certification-ready system, our AS9100 resources cover how supplier control fits the wider standard.
Supplier audit FAQ
What is a supplier audit checklist? It is a structured list of requirements an auditor verifies at a supplier, drawn from the applicable standard, the contract, and your quality expectations. A good checklist covers the QMS, process controls, nonconformance handling, calibration, special processes, and sub-tier flow-down, so audits stay consistent from one auditor and one supplier to the next.
What are the three main types of supplier audits? First-party, where an organization audits itself; second-party, where a customer audits its supplier; and third-party, where an independent certification body audits against a standard. The audit buyers usually mean by supplier audit is the second-party audit of a source they depend on.
How often should you audit a supplier? Frequency should match risk. A critical sub-tier source with special processes may warrant an annual on-site audit, while a low-risk, long-approved distributor may need only periodic performance review. Poor performance or a serious escape resets the clock and triggers a fresh audit.
Does supplier certification replace a supplier audit? No. Third-party certification to AS9100 or ISO 9001 is strong evidence a supplier has a working system, but it audits against the standard in general, not your specific parts and contract. You remain responsible for confirming the supplier meets your requirements. If you need help building a defensible program, get in touch.
Need a defensible supplier audit program for your AS9100 or ISO 9001 system?
Optimal Quality Solutions helps aerospace, defense and manufacturing teams build audit-ready quality systems, with a 98% first-time certification success rate and 15+ years of hands-on experience.
