Supplier Auditing and Compliance Assurance

Introduction

Supplier auditing is a structured, evidence-based examination of a supplier’s management system, processes, products, and compliance obligations. In contemporary supply networks, organisations rarely control every activity that affects quality. Design may be outsourced, materials may pass through several tiers, and production, testing, logistics, cybersecurity, and regulatory activities may be distributed across countries. Supplier auditing therefore provides a mechanism for obtaining confidence that external providers can consistently meet specified requirements.

An audit is not simply an inspection of documents or a search for mistakes. It is a planned evaluation of conformity, capability, effectiveness, and risk control. Compliance assurance extends beyond identifying nonconformities: it includes translating requirements into auditable criteria, selecting appropriate audit methods, evaluating objective evidence, classifying findings consistently, ensuring effective corrective action, and verifying closure.

For postgraduate quality professionals, the central challenge is to design an audit programme that is proportionate to risk. A high-risk medical-device component, safety-critical aerospace part, or sole-source electronic controller requires a different audit strategy from a low-risk office consumable. Effective auditing also requires professional judgement. Auditors must remain independent, protect confidential information, resist conflicts of interest, distinguish fact from opinion, and communicate findings in a way that supports improvement without weakening accountability.

Learning Objectives

By the end of this chapter, the learner should be able to:

1. Distinguish system, process, product, remote, and compliance audits.
2. Develop a risk-based supplier audit programme and audit plan.
3. Construct audit trails from requirements through evidence and conclusions.
4. Evaluate objective evidence using triangulation and sampling principles.
5. Classify findings according to their significance and risk.
6. Apply ethical principles and governance controls to supplier auditing.
7. Conduct effective opening meetings, interviews, sampling, reporting, and closing meetings.
8. Assess root-cause responses and verify corrective-action closure.
9. Use audit results in supplier selection, development, escalation, and continuing assurance.

1. The Role of Auditing in Supplier Quality Management

Supplier quality management has three related purposes: prevention of defects, detection of unacceptable performance, and development of supplier capability. Auditing contributes primarily to prevention and capability development, although it may also reveal existing defects or control failures.

A supplier audit answers questions such as:

• Are requirements clearly understood and translated into operational controls?
• Are critical processes capable of producing conforming output?
• Are personnel competent and appropriately authorised?
• Are measurement, testing, traceability, and change controls reliable?
• Does the supplier’s documented system reflect actual practice?
• Are corrective actions effective rather than merely complete on paper?

Auditing should not be confused with supplier surveillance, inspection, certification, or an assessment of financial viability. These activities may complement an audit but have different purposes. Inspection evaluates particular items; auditing evaluates the processes and controls that produce or protect those items. Certification is normally performed by an independent certification body against a defined standard. A customer audit is commissioned by the purchasing organisation and may examine customer-specific requirements that certification does not cover.

A mature organisation treats audit results as one source of risk intelligence. Supplier performance data, complaints, process capability, delivery reliability, engineering changes, cybersecurity incidents, regulatory alerts, and business-continuity information should be considered together. An audit cannot compensate for an inadequate specification, an unrealistic contract, or poor internal supplier management.

2. Types and Scope of Supplier Audits

2.1 System audits

A system audit evaluates the supplier’s overarching management arrangements. Typical subjects include document control, competence, internal auditing, management review, corrective action, purchasing controls, risk management, and continual improvement. The question is whether the system is suitably designed and implemented to achieve intended outcomes.

System audits are useful during initial approval, periodic reassessment, major organisational change, or when repeated problems suggest systemic weakness. Their limitation is that broad coverage can reduce the depth available for critical technical processes.

2.2 Process audits

A process audit follows a defined process from inputs to outputs. For example, an audit of heat treatment may examine material identification, furnace loading, recipe control, calibration, process monitoring, cooling, inspection, records, and release. Process auditing is particularly valuable where quality depends on process discipline rather than final inspection.

The auditor evaluates both conformity and effectiveness. A procedure may exist and be followed, yet fail to control variation. Conversely, a process may achieve acceptable output while relying on undocumented workarounds that create unacceptable future risk.

2.3 Product audits

A product audit examines a product or service against specified characteristics. It may include dimensional verification, functional testing, visual examination, packaging, labelling, certificates, and traceability. Product audits are narrower than system audits and should not be used as proof that the supplier’s system is effective.

Product audit results are especially useful for confirming whether process controls produce the required outcome. However, product sampling must be designed carefully. A small sample can reveal a problem but cannot generally demonstrate that a large population is defect-free unless a statistically justified sampling plan and acceptance criteria are applied.

2.4 Compliance and regulatory audits

Compliance audits assess conformity with laws, regulations, contractual clauses, customer-specific requirements, permits, or sector rules. Examples include environmental obligations, labour and ethical sourcing requirements, export controls, product safety, data protection, and record-retention requirements.

The auditor must establish the applicable obligation and its authoritative source. A customer preference should not be presented as a statutory requirement, and a general standard should not be treated as automatically satisfying a specific regulation.

2.5 Remote and hybrid audits

Remote audits use videoconferencing, electronic records, live camera observation, secure portals, interviews, and digital evidence exchange. Hybrid audits combine remote review with targeted on-site verification.

Remote auditing is appropriate when travel is restricted, sites are geographically dispersed, or document and interview evidence are sufficient. It is less suitable when physical conditions, material handling, environmental controls, workmanship, or security arrangements are central to the audit objective. Remote methods also create risks involving connectivity, selective presentation, confidentiality, time-zone differences, and inability to authenticate physical evidence.

2.6 First-, second-, and third-party audits

A first-party audit is conducted by or for the organisation itself. A second-party audit is conducted by a customer or another party with a direct interest in the supplier. A third-party audit is conducted by an independent body, commonly for certification or regulatory purposes. The same audit principles apply, but authority, independence, reporting obligations, and confidentiality differ.

3. A Risk-Based Audit Programme

A risk-based programme allocates audit effort according to the potential consequences and likelihood of supplier failure, the effectiveness of existing controls, and the degree of uncertainty. Risk should be assessed at supplier, product, process, site, and supply-chain levels.

Relevant risk factors include:

• impact of failure on safety, regulatory conformity, customers, and reputation;
• complexity and novelty of the product or process;
• supplier performance history and complaint trends;
• degree of process outsourcing and sub-tier dependence;
• supplier maturity, turnover, and competence;
• results of previous audits and unresolved findings;
• volume, value, and criticality of supplied material;
• extent of change in design, equipment, ownership, location, or personnel;
• business continuity, geopolitical, environmental, and cybersecurity exposure;
• effectiveness of incoming inspection and other downstream controls.

Risk ranking should not become a mechanical score that conceals judgement. A low frequency of defects may reflect ineffective detection rather than low process risk. Similarly, a supplier with good historical performance may have introduced a new process that requires immediate reassessment.

A programme normally defines audit frequency, scope, method, auditor competence, reporting deadlines, escalation criteria, and follow-up rules. For example, critical suppliers may receive annual system and process audits, event-triggered audits after major change, and ongoing performance monitoring. Lower-risk suppliers may be managed through periodic self-assessments, document review, and performance surveillance.

The programme owner should maintain a clear distinction between audit frequency and audit intensity. A short annual audit may be less effective than a focused audit before a major product launch. Audit plans should therefore be adjustable when new evidence changes the risk picture.

4. Audit Criteria, Evidence, and the Audit Trail

4.1 Audit criteria

Audit criteria are the policies, procedures, specifications, drawings, standards, regulations, contractual requirements, and other defined expectations against which evidence is evaluated. Criteria must be sufficiently specific to support a defensible conclusion.

A weak criterion is “production must be controlled.” A stronger criterion identifies the required control, such as approval of work instructions, identification of current revision, defined process parameters, authorised parameter changes, and retention of records for a specified period.

Before the audit, the team should identify conflicts among requirements. The contract, drawing, purchase order, customer specification, and supplier procedure may not be aligned. The auditor should not silently choose one interpretation; ambiguities should be escalated to the responsible authority.

4.2 Objective evidence

Objective evidence consists of verifiable information relevant to the audit criteria. It may include records, observations, measurements, system logs, samples, photographs subject to permission, interview statements, and demonstrations of actual work.

Evidence should be:

• relevant to the criterion;
• sufficient in quantity and depth;
• reliable and attributable;
• current enough for the conclusion;
• traceable to a product, process, person, date, or transaction where appropriate.

An interview statement is evidence of what a person says, but not necessarily proof that the process is implemented. It should normally be corroborated through observation or records. A single conforming record does not prove consistent control, and a single defective record does not automatically establish a systemic failure. The auditor must consider context, sampling, recurrence, and risk.

4.3 Audit trails

An audit trail links five elements:

1. requirement;
2. question or test;
3. evidence examined;
4. evaluation against the requirement;
5. conclusion or finding.

For example, a traceability trail may begin with a drawing requirement for heat number identification, proceed to the supplier’s identification procedure, follow a selected batch through receiving and production, examine material and inspection records, and verify the final label. The trail should be reproducible by another competent auditor.

A useful working-paper entry states what was examined rather than merely recording “OK.” It may identify the purchase order, batch, revision, record date, sampled transaction, and interviewee role. Personal data should be limited to what is necessary.

4.4 Sampling and professional judgement

Audits rely on sampling because complete examination is usually impractical. Samples should be selected to cover relevant variation: different shifts, operators, equipment, products, dates, lots, and subcontractors. Random selection can reduce conscious bias; judgemental selection can target high-risk or unusual cases. A combination is often appropriate.

Audit sampling is not automatically equivalent to statistical acceptance sampling. Unless a statistically designed method is used, the auditor should avoid claiming that the sample estimates the exact defect rate of the population. The appropriate conclusion is usually about the evidence observed and the adequacy of controls, subject to sampling limitations.

5. Planning and Conducting an Audit

5.1 Initiation and preparation

Audit initiation establishes purpose, authority, scope, criteria, timing, team, confidentiality arrangements, and reporting expectations. The lead auditor reviews previous reports, supplier performance data, complaints, changes, open corrective actions, process maps, specifications, and relevant regulatory obligations.

The audit plan should identify processes and locations, responsible contacts, interview groups, sampling intentions, required access, and time allocation. It should remain flexible enough to follow significant evidence. An auditor who rigidly follows a timetable may miss an important trail discovered during an interview.

Auditor competence must match the audit. Technical specialists may be required for welding, software, sterilisation, laboratory methods, cybersecurity, or regulated products. Specialists should understand audit conduct and should not make unsupported technical judgements outside their expertise.

5.2 Opening meeting

The opening meeting confirms objectives, scope, criteria, methods, communication channels, safety and security requirements, and arrangements for daily debriefing. The auditor should explain that findings will be based on evidence and that the audit is not a test of individual personalities. The supplier should identify escorts, process owners, restrictions, and emergency arrangements.

5.3 Gathering evidence

Auditors use four complementary techniques:

• interviewing personnel who perform or supervise the work;
• observing work under normal conditions;
• examining records and electronic data;
• tracing selected items, transactions, or batches through the process.

Questions should progress from open to specific. “How is a change approved?” may be followed by “Show me the approval for the last change affecting this product.” The auditor should avoid leading questions that invite a desired answer.

The auditor must distinguish procedure from practice. If the procedure says that two people verify a critical setting, the auditor should determine whether the requirement is understood, whether the setting is actually verified, and whether records demonstrate completion.

5.4 Daily review and evidence evaluation

The audit team should periodically compare notes, test whether conclusions are supported, identify gaps, and avoid duplicate interviews. Potential findings should be discussed with process owners during the audit to confirm factual accuracy, without negotiating away valid conclusions.

Evidence should be evaluated against the precise requirement. A supplier’s explanation may clarify why an event occurred, but it does not erase a nonconformity. Conversely, an auditor should not issue a finding merely because a preferred practice is absent when the requirement does not demand it.

5.5 Closing meeting and report

The closing meeting presents conclusions, positive observations where useful, and findings supported by evidence. The auditor should explain the basis, risk, required response, due dates, and dispute or appeal process. Findings should be communicated in language that is factual, concise, and free from blame.

A strong audit report contains scope, criteria, dates, locations, team members, limitations, executive conclusion, findings, evidence, classification, required response, and follow-up arrangements. It should not include confidential information beyond the authorised purpose.

6. Finding Classification and Escalation

Classification systems vary among organisations, but consistency is essential. A practical structure is shown below.

The classification must consider consequence, extent, recurrence, detectability, and the importance of the affected requirement. A single missing signature on a low-risk record may be minor; the same omission on a release record for a safety-critical product may be major or critical. Classification should not be determined solely by the number of examples.

A finding statement generally has three parts: the requirement, the objective evidence, and the resulting gap. For example: “The approved procedure requires verification of the final torque setting before release. For batch X, the release record contained no verification entry, and the operator confirmed that the check was not performed. The required verification was therefore not demonstrated.” This statement is stronger than “torque control is poor.”

7. Corrective Action and Closure Verification

An audit is incomplete when the report is issued. Closure requires evidence that the supplier has controlled the immediate problem, determined why it occurred, implemented action, and verified that recurrence risk has been reduced.

A sound response distinguishes:

• correction: action to address the detected nonconformity, such as re-inspection or replacement;
• containment: action to protect the customer while the cause is investigated;
• root-cause analysis: systematic determination of underlying causes;
• corrective action: action to eliminate the cause and prevent recurrence;
• effectiveness verification: evidence that the action works over an appropriate period or sample.

A superficial response such as “retrained operator” may be inadequate if the underlying cause was an ambiguous work instruction, poorly designed interface, excessive workload, missing error-proofing, or ineffective supervision. Root-cause methods may include causal analysis, fault-tree reasoning, process mapping, barrier analysis, or structured questioning. The method should fit the complexity of the problem; mechanically asking “why?” five times is not a guarantee of valid analysis.

Closure review should ask:

1. Was affected product identified and controlled?
2. Does the analysis use evidence rather than speculation?
3. Does the action address the verified cause?
4. Were related processes, shifts, products, and sub-tier suppliers considered?
5. Were documents, training, software, equipment, and controls updated where necessary?
6. Is there evidence of implementation?
7. Is the selected effectiveness period and measure appropriate?

Document review can confirm implementation, but high-risk findings normally require verification through records, interviews, observation, repeat sampling, or a follow-up audit. Closure should mean effective control, not merely receipt of a completed form.

8. Auditor Ethics, Independence, and Governance

Auditor credibility depends on impartiality and professional conduct. Core ethical principles include integrity, fair presentation, due professional care, confidentiality, independence, and evidence-based judgement.

Potential conflicts include auditing one’s own design work, accepting gifts or hospitality, having financial interests in the supplier, allowing commercial pressure to influence findings, or using confidential information for personal advantage. Conflicts should be declared and managed before the audit. Independence is relative to the assignment: an internal auditor may belong to the same organisation but should not audit work for which they are directly responsible.

Auditors must protect intellectual property, personal information, security-sensitive data, and commercially confidential records. Remote audits require secure platforms, controlled recording, access permissions, and agreement on storage and deletion. Screenshots, photographs, and copies should be collected only when necessary and authorised.

Governance also requires a clear separation between audit evidence and supplier development advice. An auditor may explain the requirement and identify the gap, but should be cautious about designing the supplier’s exact solution. If the auditor prescribes the solution and later evaluates it, independence may be compromised.

Audits should be accessible and culturally respectful. Language differences, disability, hierarchy, and local communication norms can affect evidence collection. Respect does not mean lowering standards; it means using competent interpreters, clear questions, and fair opportunities to respond.

9. Remote Auditing, Digital Evidence, and Artificial Intelligence

Remote auditing can improve access and reduce travel, but it requires deliberate controls. The audit plan should define the platform, identity verification, permitted recording, document transfer, camera use, contingency arrangements, and method for confirming that demonstrations represent normal operations rather than staged conditions.

Digital manufacturing execution systems, laboratory information systems, enterprise-resource-planning records, access logs, and supplier portals can provide rich audit evidence. Auditors should examine data lineage, user permissions, revision history, time stamps, exception handling, and retention. A dashboard is not automatically reliable evidence; the underlying data and logic must be understood.

Artificial intelligence can assist with identifying complaint trends, clustering audit findings, prioritising suppliers, checking document consistency, and detecting unusual transactions. It should support—not replace—competent auditor judgement. Risks include biased historical data, false correlations, opaque recommendations, hallucinated interpretations, privacy breaches, and automation bias. AI-generated risk rankings should be explainable, validated, reviewed by humans, and prevented from making unauthorised compliance decisions.

10. Applied Case: Illustrative Scenario in an Automotive Electronics Supply Chain

Background

An automotive manufacturer purchases a safety-related electronic control module from a long-term supplier. The supplier has historically achieved acceptable delivery and defect performance. A new software revision and a second production shift are introduced to meet increased demand. The customer’s risk review raises the supplier’s audit priority.

Problem

A focused audit finds that the supplier’s change procedure requires software validation and customer approval before release. In three sampled change records, two contain engineering approval but no evidence of customer approval. Production personnel state that the software was released after an urgent telephone discussion. The electronic system allows production to proceed even when the approval field is blank.

Analysis

The issue is not merely missing paperwork. The audit trail shows a gap between the contractual change requirement, the supplier’s documented procedure, system controls, and actual release practice. The product is safety-related, the change affects software behaviour, and the electronic system permits bypass of a required barrier. These factors support a major, potentially critical, finding depending on the safety and regulatory consequences confirmed by technical review.

The audit team also examines whether affected units can be identified. Serial-number records are available for one production line but incomplete for the second shift. This increases containment difficulty and demonstrates that traceability is part of the same risk picture.

Approach and solution

The customer requires immediate containment: identify all units produced under the unapproved software condition, suspend further release of affected configurations, and complete a technical safety assessment. The supplier performs a structured root-cause analysis and determines that commercial urgency, an ambiguous escalation path, and system permissions combined to permit release.

Corrective actions include revision of the change procedure, explicit customer-approval gates in the electronic workflow, role-based permissions, validation of software and traceability records, training for engineering and production personnel, and a review of other software-controlled products. The customer conducts a follow-up audit rather than closing the issue solely through document review.

Outcome

The follow-up confirms that the approval gate prevents release without the required authorisation, records are complete across both shifts, and a sample of subsequent changes demonstrates correct operation. The finding is closed after evidence shows sustained implementation. The supplier’s audit frequency remains elevated for one year because the control change is recent and the product consequence is high.

Learning points

1. Long-term satisfactory performance does not eliminate event-driven audit risk.
2. A missing record may indicate a missing control, not an administrative error.
3. Digital workflow design is part of process control.
4. Traceability determines the effectiveness of containment.
5. Closure requires evidence that controls operate under normal pressure, not only during an audit.

11. Challenges and Limitations

Auditing has unavoidable limitations. Evidence is sampled, processes may change after the audit, and personnel may behave differently when observed. Auditors can overlook sub-tier risks, misunderstand local practices, or overemphasise documentation. Supplier audits may also create defensive behaviour when purchasing power is unequal.

To reduce these limitations, organisations should use multiple evidence sources, rotate auditors when appropriate, include technical expertise, analyse trends across audits, perform unannounced or event-triggered verification where justified, and maintain open channels for reporting concerns. Audit results should be integrated with performance and risk data rather than treated as a certificate of permanent conformity.

A further limitation is audit fatigue. Excessive customer audits can consume supplier resources without improving control. Customers should coordinate requirements, accept credible shared evidence where appropriate, and focus audits on material risk. Conversely, excessive reliance on self-assessment can create confirmation bias. The appropriate balance depends on risk, trust, performance, and the supplier’s demonstrated control maturity.

12. Best-Practice Framework

A professionally managed supplier audit system should:

• define audit criteria before evidence collection;
• prioritise suppliers and processes using current risk information;
• match auditor competence to technical and regulatory complexity;
• prepare an adaptable plan and a traceable working-paper structure;
• triangulate interviews, observation, records, and product or process samples;
• distinguish requirements from preferences;
• write findings as factual requirement–evidence–gap statements;
• classify findings consistently and escalate according to consequence;
• require containment, root-cause analysis, corrective action, and effectiveness evidence;
• verify closure at a depth proportionate to risk;
• control confidentiality, conflicts of interest, and remote-access security;
• use digital analytics and AI cautiously, with human accountability;
• feed results into supplier selection, development, contracting, and continuity planning.

Chapter Summary

Supplier auditing is an evidence-based method for assuring that external providers can meet quality, regulatory, contractual, and customer requirements. System audits examine management arrangements; process audits follow operations; product audits examine outputs; compliance audits assess obligations; and remote or hybrid audits use digital methods subject to additional authenticity and confidentiality risks.

An effective audit programme is risk-based, dynamic, and supported by supplier performance information. Planning begins with clear criteria, scope, competence, and sampling intentions. During the audit, auditors build traceable links among requirements, questions, evidence, evaluations, and conclusions. Findings must be factual, proportionate, and consistently classified.

Compliance assurance continues after the closing meeting. Corrective action must address containment, root causes, implementation, and effectiveness. Closure is verified through evidence appropriate to the risk, not merely through receipt of a supplier response. Ethical conduct, independence, confidentiality, cultural respect, and governance are essential to credibility. Technology and AI can strengthen audit planning and analysis, but professional judgement and accountability remain indispensable.

Key Terms

Audit criteria: Requirements used as the reference against which evidence is evaluated.

Audit evidence: Verifiable information relevant to audit criteria.

Audit trail: Traceable link from requirement through evidence to conclusion.

Compliance audit: Audit evaluating conformity with legal, regulatory, contractual, or customer obligations.

Containment: Immediate action taken to protect the customer while a problem is investigated.

Corrective action: Action taken to eliminate the cause of a nonconformity and prevent recurrence.

Correction: Action taken to address a detected nonconformity.

Critical nonconformity: Failure with potentially severe consequences for safety, compliance, or essential control integrity.

Effectiveness verification: Examination of evidence showing that corrective action works.

Finding: An audit conclusion about conformity or nonconformity based on evidence.

Independence: Freedom from responsibility or influence that could bias audit judgement.

Major nonconformity: Significant system or process failure requiring formal corrective action.

Minor nonconformity: Limited deviation that does not indicate a major control breakdown.

Objective evidence: Information that can be verified and supports an audit conclusion.

Process audit: Evaluation of controls and performance within a defined process.

Product audit: Examination of product characteristics against specified requirements.

Remote audit: Audit conducted partly or wholly through communication and digital technologies.

Root cause: Underlying reason whose removal reduces the likelihood of recurrence.

System audit: Evaluation of an organisation’s management-system arrangements and effectiveness.

Triangulation: Corroboration of evidence using different sources or methods.

Review Questions

Short Answer Questions

1. Distinguish a process audit from a product audit.
2. What are the five elements of an audit trail?
3. Why should an interview statement usually be corroborated?
4. Differentiate correction, containment, and corrective action.
5. State four ethical principles relevant to supplier auditors.

Long Answer Questions

1. Explain how a risk-based supplier audit programme should be designed and governed.
2. Discuss the planning, evidence-collection, reporting, and follow-up stages of a supplier audit.
3. Explain how findings should be classified and why consequence matters more than the number of examples alone.
4. Evaluate the benefits and limitations of remote and hybrid supplier audits.
5. Discuss how audit results should influence supplier approval, development, escalation, and continuing assurance.

Analytical / Application Questions

1. A supplier has excellent delivery performance but has introduced a new automated process and changed its sub-tier source. Design an audit response and justify its scope, timing, and evidence requirements.
2. During an audit, a supplier presents complete procedures but observation shows that operators use an undocumented workaround. Analyse the likely finding, additional evidence required, and appropriate corrective-action expectations.
3. A supplier submits a corrective-action report stating “employees were retrained,” but provides no effectiveness data. Evaluate whether closure is justified and specify the evidence needed before closure.

Multiple Choice Questions with Answers

Question 1

Which audit primarily follows inputs, activities, controls, and outputs within a defined operation?

A. Process audit

B. Product audit

C. Financial audit

D. Certification audit

Correct Answer: A. Process audit

Question 2

What is the strongest example of objective audit evidence?

A. The auditor believes the operator is experienced

B. A dated, traceable inspection record linked to the sampled batch

C. A supplier manager’s general assurance

D. An auditor’s preference for a different procedure

Correct Answer: B. A dated, traceable inspection record linked to the sampled batch

Question 3

Which sequence correctly represents an audit trail?

A. Opinion, recommendation, requirement, conclusion

B. Requirement, question or test, evidence, evaluation, conclusion

C. Finding, contract, interview, invoice, approval

D. Training, complaint, forecast, inspection, shipment

Correct Answer: B. Requirement, question or test, evidence, evaluation, conclusion

Question 4

What is the primary purpose of containment after a nonconformity is identified?

A. To eliminate the root cause permanently

B. To protect the customer while the problem is investigated

C. To classify the auditor’s performance

D. To replace the supplier’s management system

Correct Answer: B. To protect the customer while the problem is investigated

Question 5

Which situation most strongly supports a major nonconformity?

A. A typographical error in a non-critical internal memo

B. An isolated late meeting invitation

C. Absence of a required control for a safety-related product

D. A supplier uses a different colour for office folders

Correct Answer: C. Absence of a required control for a safety-related product

Question 6

Why is a product audit insufficient by itself to demonstrate system effectiveness?

A. Product audits never examine requirements

B. A conforming sample may not demonstrate consistent process control

C. Product audits cannot use measurements

D. System audits do not examine products

Correct Answer: B. A conforming sample may not demonstrate consistent process control

Question 7

Which action best demonstrates corrective-action effectiveness?

A. Sending a reminder email

B. Updating a presentation

C. Showing sustained conforming results after the implemented control change

D. Receiving a signed promise from the supplier

Correct Answer: C. Showing sustained conforming results after the implemented control change

Question 8

Which practice best protects auditor independence?

A. Allowing the auditor to approve the supplier’s corrective-action solution and then audit it

B. Accepting expensive hospitality from the supplier

C. Declaring conflicts of interest before the audit

D. Removing evidence that may affect the commercial relationship

Correct Answer: C. Declaring conflicts of interest before the audit

Question 9

What is a significant limitation of remote auditing?

A. It cannot involve interviews

B. It may limit verification of physical conditions and normal work practices

C. It always costs more than an on-site audit

D. It cannot examine electronic records

Correct Answer: B. It may limit verification of physical conditions and normal work practices

Question 10

A supplier’s procedure requires customer approval before software release, but sampled records show release without approval. What should the auditor do first?

A. Ignore the issue because the supplier has good past performance

B. Record factual evidence and evaluate the gap against the requirement

C. Immediately redesign the supplier’s software system

D. Close the audit without discussing the issue

Correct Answer: B. Record factual evidence and evaluate the gap against the requirement