Supplier Verification and Second-Party Audits: A Risk-Based Approach
How to verify that suppliers can meet your requirements before a problem reaches the production line or the customer
Much of the risk an organisation faces does not start inside it but at its suppliers: a contaminated raw material, non-conforming packaging, a transport service that does not hold temperature, or a contractor working without controls. That is why management system standards and food safety schemes require organisations to set criteria for evaluating, selecting and monitoring suppliers, with the type and extent of control proportionate to the risk.
One of the most important tools is the second-party audit: the organisation itself, or an independent body acting on its behalf, audits or inspects the supplier on site.
This article explains how to build a risk-based supplier verification programme, when a questionnaire or certificate is enough, and when an on-site audit or inspection is needed.
1. Types of audit
| Type | Who audits? | Purpose |
|---|---|---|
| First party | The organisation itself (internal audit) | Checking its own system |
| Second party | The organisation or its representative, at a supplier or contractor | Checking the supplier can meet its requirements |
| Third party | An independent certification body | Granting or renewing certification |
A second-party audit can cover what a third-party certificate does not, such as customer-specific specifications, legal requirements in the country of sale and private-label requirements.
2. Classifying suppliers by risk
List every supplier and service provider and classify them by the effect of the material or service on the product and the customer:
| Level | Examples | Suggested approval route |
|---|---|---|
| High | Main raw materials, sensitive ingredients, food-contact packaging, outsourced processes | A recognised certificate covering the material, or a site audit by a qualified auditor |
| Medium | Chemicals, transport, pest control, calibration, laboratories | Suitable certificate or accreditation plus periodic performance evaluation |
| Low | Outer packaging, general services | Supplier questionnaire with annual evaluation |
A questionnaire alone is not appropriate for high-risk suppliers.
3. What a supplier audit covers
Scope depends on the supplier, but usually includes:
- The management system, its certificates and their scope.
- Control of the supplier’s own incoming materials.
- Process control and critical control points.
- Hygiene, infrastructure and maintenance.
- Traceability, withdrawal and recall.
- Control of allergens, chemicals and foreign bodies.
- Food defence and food fraud vulnerability assessment (food sector).
- Handling of complaints and nonconformities.
- Compliance with legal and customer-specific requirements.
The auditor must be competent in the sector: auditing a packaging supplier is different from auditing a farm or an ingredient plant.
4. On-site inspection complements auditing
An audit evaluates the system; an inspection checks the product, shipment or site at a given moment. Many importers and retailers use pre-shipment or during-production inspection to verify:
- Conformity to the specification and the approved sample.
- Quantities, packing and labelling.
- Storage and loading conditions.
- Sampling for analysis in an accredited laboratory.
Combining periodic supplier audits with inspections of critical shipments gives a fuller picture than either alone.
5. Periodic performance evaluation
Verification does not end at approval. Suppliers are evaluated periodically against measurable criteria, for example:
| Criterion | Suggested weight |
|---|---|
| Conformity to specification and incoming inspection results | 60% |
| Quantities and delivery dates | 20% |
| Price, payment terms and cooperation | 20% |
Clear decision rules follow: excellent, good, acceptable with an improvement plan, or suspended pending re-approval. Rejected deliveries are recorded as nonconformities, and the supplier is asked for a corrective action supported by root cause analysis.
6. Common mistakes
- An approved supplier list that is never updated: suppliers no longer used, or whose manufacturing sites changed, without review.
- Relying on a certificate without reading its scope: a valid certificate that does not cover the product supplied.
- Emergency approval that becomes permanent: an alternative supplier approved in a crisis and never fully evaluated.
- Requirements not communicated: purchase orders without the specification, certificate of analysis or transport conditions.
- Supplier performance not reported to management review.
Conclusion
An effective supplier verification programme starts with risk classification, uses the right tool for each level (questionnaire, certificate, second-party audit or on-site inspection) and then follows performance with clear numbers. It is an investment that reduces rejections, recalls and complaints before they cost far more.
Look at your high-risk suppliers: when was the last one audited on site?