Supplier audits

You know what your supplier ticked in the self-assessment. You do not know whether it is true.

A supplier audit is the occasion when someone travels there and looks. Not in order to certify – others are responsible for that – but to give you a defensible statement on how that business actually works. We have been carrying out audits of this kind on behalf of third parties since 2020, mostly in the supply chain of the energy sector.

Why this is back on the agenda

The most common trigger today is not the law but the contract.

The German Supply Chain Due Diligence Act (Lieferkettensorgfaltspflichtengesetz, LkSG) still applies to companies with 1,000 or more employees, although BAFA – the federal office responsible for enforcement – suspended the reporting obligation in November 2025. The European Corporate Sustainability Due Diligence Directive (CSDDD) has been narrowed to very large companies by the EU Omnibus package, and its first application pushed back to July 2029. What is meant here is the CSDDD, that is due diligence in the supply chain, and not the CSRD, which governs sustainability reporting. Anyone who concludes from this that there is nothing left to do is confusing reporting with risk: the due diligence duties themselves remain, and large buyers pass their requirements down the chain by contract to companies that never fall within the scope themselves. (As at August 2026.)

On top of that come the triggers that have nothing to do with legislation at all:

• Voluntary commitments. You have published a code of conduct or committed to sustainability targets. Both are worthless as long as they exist on paper only for the supply chain.
• Initial qualification. A new supplier is to go into series production – and you want to know beforehand what you are getting into.
• Surveillance and requalification in an ongoing relationship.
• A specific incident. A cluster of complaints, a near miss, a report in the press.

Who this is for

• You buy from businesses you have never seen from the inside
• Your customer requires evidence about your supply chain, and all you have are self-assessments
• You have your own supplier evaluation, but nobody who actually visits the sites
• You need someone from outside, because your purchasing department cannot manage and assess the same supplier at once
• You are a supplier yourself and are being audited – there is a separate section on that below

Your checklist or ours

Either works, and the decision is taken in the first conversation.

A workable checklist draws a clean line between what can be evidenced at a desk and what only the walkthrough shows. That distinction is not a formality. It decides later whether an audit can take place remotely.

What we audit

The scope follows what you specify. A full supplier audit usually covers six audit areas:

Sustainability: part of every audit, a separate one on request

Sustainability is not an add-on module with us. Working conditions, human rights, environment and business ethics are audit areas in every supplier audit, see above.

If you would like more depth, we also run this as a standalone sustainability or ESG audit. The weighting then shifts: less process control, and considerably more time for employee interviews, working time records, payroll documents, accommodation and the question of how far the requirements are passed on to the next tier of the supply chain.

What employee interviews achieve – and how they have to be run

The part that separates a sustainability audit from a document review is the conversations with employees. They only work under strict conditions, and we keep to them:

• At least five employees, selected at random, mixed by area, length of service, position and gender
• Voluntary and confidential, in a room that offers privacy, with no other company staff present
• No interviews with management – the management side is heard elsewhere in any case
• No names in the report. Documentation is anonymised: area, approximate length of service, fixed-term or permanent
• Ten to fifteen minutes per interview, so that operations can carry on

On site or remote

Both are possible, but they are not the same audit.

Remotely you can audit whatever is documented: the management system, evidence, key figures, contracts, certificates, conversations with the people responsible. That is fast, inexpensive and free of travel time, and for a requalification with a known supplier often entirely sufficient.

On site you add the part that cannot be audited remotely through documented information. The walkthrough tests practice against theory. An example from our work, without company names: on paper, the storage of hazardous substances was under control. Outside stood a hydraulic oil drum in the rain that had not been emptied, the oil containers had been taken off their spill containment pallets because of building work, and one of the pallets had tools lying on it. No safety data sheet in the world shows you that.

There is also this: confidential employee interviews are in practice impossible to run remotely. You need a room that nobody walks into, and a person opposite you who is sure that nobody is listening in.

Our experience from our own audit practice, beyond supplier audits as well: a document review alone, without observation on site, leaves a hole. So where travel time is an issue, the more honest answer is usually a split audit – the documents remotely in advance, the site itself on site – and not an audit that pretends the walkthrough is dispensable.

What you get

• An audit report with findings and objective evidence: what was seen, where, and what the assessment follows from
• A classification by severity. Our default logic, if you do not set your own: breaches of legal requirements are major nonconformities, departures from the supplier's self-assessment are minor nonconformities
• Improvement suggestions for each audit area – the part the supplier actually does something with
• A defensible statement on suitability, not a gut feeling
• On request, the follow-up: what became of the findings, and was the action effective?

If you use a portal, we enter the results there and attach the evidence directly to the relevant question. That way the report is finished on the last day of the audit and not two weeks later.

Where it usually goes wrong at suppliers

The classics are almost always in place. First aid, fire extinguishers, escape routes, ladder inspections – most businesses have that in order. It goes wrong at the edges: wherever something has been rebuilt, newly purchased or outsourced.

• Safety data sheets. By far the most common finding. For a newly purchased product there is no safety data sheet (SDS) yet. One that exists is years old, although the manufacturer updated it long ago. The container is missing the hazard pictogram, even though the data sheet states eye irritation. In the store itself there is none at all.
• Inspection intervals after alterations. Racking is moved and painted over – afterwards the load capacity signs are missing and the repeat inspection has not been caught up. One door is broken and its inspection overdue, while every other door is on schedule.
• Supplier control that stops at the complaint. The defective part sits in quarantine, the fault code has been assigned – and then nothing more happens, “because it is a bought-in part”. That is precisely where the effectiveness review should begin.
• Compliance without evidence. The code of conduct has been signed, but nobody can say where that is documented. A reportable accident occurred, and the report to the statutory accident insurance institution (Berufsgenossenschaft) cannot be evidenced. The waste contractor does a proper job, but the certificate as a certified waste management company (Entsorgungsfachbetrieb) is not available.

That we know these patterns is the real difference from a checklist that somebody works through once.

How we work

1. 1

   Setting the criteria and the scope

   What is being audited against, in what depth, at which sites? Your question set or ours, on site or remote, one day or two. Without clear criteria an audit is a matter of taste.

2. 2

   Documents in advance

   We request the evidence before the visit and review it. That shortens the visit noticeably and makes sure the time on site is used for what can only be done on site.

3. 3

   Audit plan to the supplier

   Who is needed when and for which area – quality, HSE, environment, human resources, commercial management. The supplier can prepare and does not have to guess. A two-day audit typically allows around eight hours per day.

4. 4

   Audit

   Conversations, inspection of evidence, site walkthrough, employee interviews. We document every finding with objective evidence as we make it.

5. 5

   Closing meeting and report

   No result that the supplier first learns of in the report. All findings are discussed on site, the report follows promptly and goes solely to the agreed recipients.

How we handle confidentiality

A supplier audit generates knowledge about someone else's business that can harm that business. We therefore raise the reporting route explicitly in the opening meeting: who receives the report, who does not, and what happens to the records. Beyond that, absolute confidentiality applies towards any third party and towards our other clients.

That applies to this website too: we name no clients and no audited companies.

Are you the one being audited?

Then you are in the right place as well. We know the question set from the side of the person asking.

In a preparation session we look at your self-assessment, compare it with reality and walk the site once through the auditor's eyes. The most common mistake is not a poor business but a self-assessment filled in more optimistically than the business warrants, and that gap is exactly what becomes a minor nonconformity in the report. More on this under Internal audits and gap analyses.

Who handles this at our end

Rüdiger Rammé carries out the supplier audits – IRCA certified and registered QMS / OHSMS Lead Auditor #01192806, working continuously on supplier audits on behalf of third parties since 2020.

Marion Rammé steps in as cover.

Both audit in German and in English.

The team in detail

How this looked in practice

Starting point: An international qualification programme audits the suppliers of large energy utilities on their behalf. The businesses supply the energy sector – wind turbine components and service, photovoltaics, inverters, battery cells, offshore geotechnics, sheet metal working, process engineering. In size they range from family firms to corporate group sites.

Approach: Since 2020, a continuous run of two-day audits to the client's protocol, very largely on site, at locations in Germany and at European suppliers, in German and English. Six audit areas from business ethics through to the formal basics, each with a site walkthrough and confidential employee interviews. Entries and evidence recorded directly in the client's portal.

Result: For each site the client receives a comparable, evidence-based assessment instead of a self-assessment. The collaboration has been running continuously since 2020, and assignments keep coming in.

Clients and audited companies are not named.

Related topics

• Internal audits and gap analyses – 1st party audits in your own business, and the preparation for when you are audited yourself
• ISO 9001 – the most common basis for requirements placed on suppliers
• ISO 45001 – health and safety, almost always the largest audit area in a supplier audit
• ISO 14001 – environment, waste, hazardous substances
• Risk management – when the audit results are to become a supplier risk assessment

Frequently asked questions

Let us talk about it

The first conversation is free and without obligation. It usually takes half an hour. Afterwards you know which audit scope fits your risk and what it costs.

• Rüdiger Rammé, Lüneburg – phone: +49 4131 2198634
• Marion Rammé, Hamburg
• Email: all@bout-quality.de

Prefer to write? The contact form reaches us just as well.