Supplier Audit Checklist: Plan and Write Up Visits With AI

Plan the visit from your own records: pull the last year's non-conformance reports (NCRs) for that supplier, turn each recurring defect into a question, and build a short on-site checklist around those questions plus a few basics. Write findings as requirement, evidence and gap. AI can draft the questions and tidy the notes; the auditor decides what is a finding.

A generic checklist downloaded from the internet asks forty questions and misses the one thing your supplier keeps getting wrong. The visit is short and expensive in travel and goodwill, so spend it on the failures you can already prove.

Follow me on Instagram@sagnikteaches

Start with what the supplier has already got wrong

Say a small maker of cycle accessories uses an outside powder coater for 38 lots a year. Over twelve months the maker raised six NCRs against that supplier. Pulled into a single table, they look like this (illustrative).

Connect on LinkedInSagnik Bhattacharya

Six rejected lots out of 38 is a 15.8 per cent lot rejection rate, and the rework total is $1,140. Three of the six are the same defect: thin coating. That is what the visit is for. A generic checklist would spend time on housekeeping and fire exits, while the real question is how the coater measures and controls film thickness. If you need a standing record of this kind, a supplier scorecard for delivery and quality keeps the same facts month by month.

Subscribe on YouTube@sagnikteaches

Have the assistant turn the NCR log into pre-visit questions

Strip your NCRs down to lot, defect, date and cost. Leave out part numbers, customer names and the supplier's name if you can. Paste them into a chat assistant (ChatGPT, Claude or Gemini) and ask for questions, not conclusions.

I am preparing to audit a powder-coating supplier. Below is a summary
of six non-conformance reports from the last 12 months. For each
recurring defect, write 3 pre-visit questions I can send the supplier
two weeks ahead, and 3 things to observe on site. Questions must ask
for records or demonstrations, not opinions. Do not assume a cause.
Do not suggest the supplier is at fault in any question.

[paste the table]

A reply (illustrative) for the thickness defect might include: "Which gauge is used to check film thickness, and when was it last calibrated? Please send the record." "How many readings are taken per rack, and where are they recorded?" "What action is taken when a reading falls below the minimum?" On site: "Watch an operator measure a part; note where on the part the reading is taken." What you fix: remove any question that assumes the answer ("Why is your gauge out of calibration?"), and delete generic questions the assistant adds, such as ones about environmental policy, unless you care about them. Keep the list to about twelve questions in total.

Send questions that need a document, not a promise

Questions of the form "Do you have a calibration procedure?" produce a yes. Questions of the form "Please send the calibration record for the thickness gauge used on our parts" produce a document or a silence, both of which tell you something. In the pre-visit email, request four to six documents, give a date (ten working days is reasonable) and say you will review them before arriving so the visit time is spent on observation.

A three-hour agenda that leaves room to look around

A small supplier loses a morning to your visit, so ask for what you need and no more. Write the agenda before you go, send it ahead, and keep time for walking.

The trace test is the cheapest powerful check you can run. Choose a lot number at random and ask to see everything that touches it: the incoming material record, the process settings, the inspection results and the delivery note. If it takes fifteen minutes and four people, you have learned something about the supplier's control that no questionnaire reveals.

The on-site checklist, grouped around what can go wrong

Keep the checklist to one page and group it by the flow of the product. For the coater, the groups and sample items might run as follows. Each item has a column for what you saw, with space to write who said it. Where your supplier makes something else, rewrite the items; the grouping stays.

• Incoming material and identification. Are your parts identified by lot on arrival? Is there a record of the condition checked on receipt? Where are rejected or unidentified parts kept?
• Process control. Are the process settings written down for your part? Can the operator show the record for the last run of your parts? What happens when a setting drifts?
• Measurement. Does each measuring device carry a calibration label with a due date? Does the operator know where on the part to measure? Are readings recorded, or only noted as "OK"?
• Non-conforming product. Is there a defined place and a tag for rejects? Who decides what happens to them? Can you see one example of a rejected item with its record?
• Packing and despatch. Are parts separated so they cannot rub? Is the packing method written down? Do delivery notes carry lot numbers?
• Corrective action. For each of your NCRs, can they show what they did and whether it worked?

If you work to a formal system, clause 8.4 of ISO 9001 covers the control of externally provided processes, products and services, which is the clause an auditor would point to for this activity. The 2026 edition, published in September 2026, replaced the 2015 edition and keeps that clause number; certificates to the 2015 edition stay valid through a three-year transition. That is a reference, not a requirement for a small business to certify; the checklist stands on its own. For a full picture of what a certificated system demands, drafting ISO 9001 documentation sets it out.

Take notes you can use later

Write what you saw, not what you think. "Gauge G-02 has no calibration label. Supervisor said it was checked when bought" is evidence. "Calibration is poor" is an opinion. Photograph labels, logs and storage areas where the supplier agrees, and note the time. Use a phone voice note for the walk-through if the supplier is comfortable, and keep your written notes as the record. Voice notes can be transcribed by an assistant afterwards, but check any name or number, because transcription turns "G-02" into "G zero two" and sometimes into something else.

Turn raw notes into findings: requirement, evidence, gap

A finding is useful only if the supplier can act on it. Each finding needs three parts: the requirement (what should have been the case: a drawing, a purchase order term, your quality agreement, a standard), the evidence (what you saw or were shown, with who and where), and the gap between them. Grade it with a short scale you define in advance.

Those response times are an example; set your own and put them in your supplier agreement so nobody is surprised. Here is one finding written out fully (illustrative).

Finding 1 (Major)
Requirement: Drawing note requires film thickness 60 to 80 microns on
all surfaces; purchase order requires measurement of each rack.
Evidence: Thickness gauge G-02, used on our lots, carries no
calibration label. The supervisor stated it "was checked when bought".
Record of readings for lot 35 shows "OK" without values for 4 of 6 racks.
Gap: Film thickness measurement cannot be shown to be accurate or
recorded as required.
Request: Containment for stock held now; calibration certificate for
G-02; corrected recording method; response within 10 working days.

Findings written this way give the supplier something to do, and they flow straight into a formal request when the gap is serious. Drafting a supplier corrective action request picks up from here, and writing a non-conformance report covers the internal record that sits beside it.

Let the assistant tidy the notes and keep it honest

After the visit, paste your notes with any identifying details removed and ask for a draft in the requirement-evidence-gap form. State clearly what the assistant may not do.

Below are my raw notes from a supplier visit. Rewrite each issue as a
finding with Requirement, Evidence, Gap and Request. Rules:
- Use only facts in my notes. If a requirement is not stated, write
  "REQUIREMENT NEEDED" instead of guessing.
- Do not grade the findings; I will do that.
- Do not add anything I did not observe.
- Keep each finding under 90 words.
- List separately any note you could not turn into a finding.

[paste notes]

The output (illustrative) will usually be neat. It will also contain small embellishments you must catch: "the supplier does not calibrate its gauges" when your note says only one gauge lacked a label; "no records are kept" when you saw records for two lots out of three. Overclaiming is the typical failure, and it hurts you because a supplier who can disprove one sentence will dismiss the whole report. Read each finding against your notes and cut anything not supported. The grade, the tone of the cover note and the decision to escalate stay with you.

The pre-visit email, filled in

The email that carries the questions sets the tone for the whole visit. Keep it short, specific and free of accusation. Here is a version for the coater (illustrative; names in brackets are for you to fill).

Subject: Visit on [date] - documents we would like to see first

Hi [first name],

Thank you for agreeing to a visit on [date], 09:30 to 12:30. We would
like to follow one of our lots through your process and review a few
records. To save time on the day, could you send these by [date, 10
working days ahead]:

1. Calibration certificate or record for the film thickness gauge
   used on our parts
2. Your written instruction for measuring thickness, including how many
   readings per rack
3. The inspection record for lot [number]
4. Your procedure for parts that fail a check
5. The cure oven temperature record for the last three runs of our parts

We are not expecting anything new to be written for this. If a
document does not exist, please say so, as that is useful for us to
know. We would also like to take a few photographs of labels and logs;
please tell us if there are areas where that is not allowed.

Thanks,
[your name]

Notice the line "if a document does not exist, please say so". It makes an honest answer easier than a rushed invention, and a document created the night before the visit is a finding in itself, because it shows the control was not in use.

One checklist group filled in on the day

A blank checklist helps less than one that shows the standard of evidence you want. This is the measurement group after the walk (illustrative).

Three results are marked gap, one an observation. The column of who said it matters: "supervisor said" and "record seen" carry different weight, and when a supplier disputes a finding later, you can say whether it came from a document, a demonstration or someone's recollection. If you take notes by voice, have the assistant sort them into this four-column form and then check each row against your own recollection.

The closing meeting: read the findings back

The last fifteen minutes decide whether the report is received well. Read each finding aloud in plain language, starting with something done well that you actually saw (a tidy rack system, rejects clearly tagged and kept apart). Do not grade in the room if you are unsure; say you will confirm in writing. Ask the supplier whether any fact is wrong. Correct what is wrong on the spot, because a corrected finding is far better than a disputed one.

Promise a date for the written report (three working days is generous) and keep it. A report that arrives three weeks later has lost the supplier's attention and your own memory of what the operator said. Writing the findings the same evening, with the assistant's help on structure, is what makes the three-day promise easy.

When the supplier will not let you in, or is far away

Some suppliers refuse a visit or are on another continent. Do not drop the idea; shrink it. Ask for a video walk-through of the process with a handheld camera, following one of your lots, plus the same document pack. Ask for a photograph of the calibration labels and a screen share of the batch records. A supplier who refuses all of those for a part that matters to you is telling you something, and your scorecard should record it. For overseas orders that start with a sample, requesting and scoring samples gives you evidence before you decide whether a visit is worth the fare.

Keeping the audit fair to a small supplier

A small supplier has a handful of staff, and the person who answers your questions is often also the person running the oven. Be realistic about what you ask for. A written procedure for every activity is a large-company expectation; a one-page instruction at the point of use, with a record kept, is often enough for a ten-person shop and is easier to follow. Ask what they would need from you to do the job properly: a clearer drawing note, a tolerance that can actually be measured, a sample panel for colour approval. Several of the coater's problems traced back to a drawing that said "powder coat black" without a film thickness or a colour reference, so the supplier had been guessing. Part of the corrective action belonged to the customer. Writing that into the report builds trust, and it keeps your findings credible when the supplier checks them against their own view of events.

An audit that checked everything and fixed nothing

Picture a manufacturer that sends its quality person to a long-standing supplier with a 60-line checklist found online. The visit takes a full day. The report runs to nine pages, lists 23 observations about signage, document control and training records, and says little about the three recurring defects that have cost the manufacturer money for a year. The supplier replies politely to everything and corrects the signs. The defects continue, because the report never asked what happens to a reading below the minimum.

The lesson is not that a long checklist is bad; it is that a checklist with no link to your own failures spreads effort evenly across things that do not matter evenly. A second visit built from the NCR log would take three hours, produce a handful of findings tied to those defects, and give the supplier something specific to change. The sentence to keep is "audit for what has gone wrong, then for what could".

Deciding who gets a visit this year

Use a small risk table and revisit it annually. Score each supplier from 1 to 3 on four things: how critical the part is to your product, how many NCRs in the last twelve months, how much a failure would cost you, and how much you know about their process. A total of 10 or more means a visit; 7 to 9, a remote review of documents; 6 or less, a questionnaire.

The coater above would score 3 for criticality (appearance and protection), 3 for NCRs, 2 for cost and 2 for visibility: 10, so a visit. A supplier of packaging cartons with one late delivery and no quality failures might score 1, 1, 1 and 1: a questionnaire at most. A supplier you have never used has no NCR log yet, so score it from samples and first lots instead, and between visits sampling incoming goods shows how to check what actually arrives.

How to tell the audit changed anything

Judge the audit by what happens after it, not by whether it was written. Three months later, ask three questions: have the defects in the NCR log you targeted fallen, were the supplier's responses delivered on time, and did the actions they promised appear on the next trace test? Put a date in your diary for a short follow-up call or a remote check of the corrected records. Where the same defect appears again in the next three lots, escalate by sending a formal request and, if it still continues, rethink whether this is the right supplier for the part.

Keep each audit in one folder: the questions sent, the responses, the notes, the findings and the corrective action tracking. A year of those folders makes the next risk table far more accurate, and they are the documents you will want if a customer ever audits you about how you control your suppliers.

Questions before you visit a supplier

How often should I audit a supplier?

Let risk decide, not the calendar. A supplier with repeated defects, a critical part or a recent change of process or ownership deserves a visit this year. A reliable supplier of a low-risk part may need a questionnaire every two or three years. Write your rule down so the choice is consistent and defensible.

Can I audit a supplier remotely?

Partly. A video walk-through and a document review cover records, calibration labels and housekeeping reasonably well. They are poor at showing smells, noise, what is stacked behind a door and what operators really do when nobody is watching. Use remote audits for low-risk suppliers and as a pre-visit step, not as a replacement for a visit after a serious failure.

Should AI write the audit report for me?

It should tidy and structure your notes, not decide what they mean. You supply the evidence, what you saw, who said what and which requirement it relates to. The assistant drafts the wording, and you then remove anything it added, because an audit report with a claim you did not observe is worse than a short one.

Is it safe to put supplier information into an AI tool?

Treat it as confidential business information. Remove supplier names, prices and drawing numbers where you can, use a business plan that does not train on your content by default, and check any non-disclosure agreement with the supplier. Never paste photographs showing other customers' parts or names.

Further reads

• 8D Report With AI: Answer a Customer Complaint Step by Step — The same root-cause thinking for your own customer complaints.
• First Article Inspection Report: AI Formats the FAI, You Measure — Check a new part before a supplier ships a full batch.
• Scrap Rate Tracking: Group Reject Reasons From Shop Notes With AI — Group reject reasons to see what to ask suppliers about.
• AI Supplier Negotiation Emails for Importers: Price, MOQ, Terms — Put audit expectations into price and terms talks.
• Check a Bill of Materials With AI: Template, Gaps and Revisions — Check the parts list before blaming a supplier for a mismatch.
• AI for Technical Sales: Answer Spec Questions From Your Datasheets — Build an internal spec-answer routine with versioned datasheets, cited replies, abstentions and a 30-question accuracy test.
• Supplier Onboarding Automation: AI Forms, Checks and Reminders — How a wholesaler can collect supplier documents with one form, have AI check them, chase gaps on a schedule and stop bank-detail change fraud.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: ISO 9001 clause 8.4 (control of externally provided processes, products and services), as a general reference; publication of ISO 9001:2026 on 16 September 2026 and the three-year transition, as reported by the certification bodies DEKRA and PJR, checked November 2026; the NCR figures and findings in the examples are illustrative.