Second-Party Audits for Buying Organisations
Second-party audits of suppliers, contractors and service providers against the buyer's own criteria, planned and conducted following ISO 19011.
A second-party audit is carried out on behalf of a buying organisation on a supplier, contractor or service provider, against criteria set by the buyer, and itmad provides second-party audits with local auditors and a travelling team. itmad plans and conducts them following the principles of ISO 19011. itmad operates across the Middle East, Asia and Europe.
Where second-party audits sit
A second-party audit is made on behalf of an organisation, of a party with which it has a contractual relationship: a supplier, contractor, subcontractor or service provider. The criteria are set by the commissioning organisation, not by a certification standard, and that is what separates it from certification auditing. In first-party auditing an organisation audits itself, in second-party auditing a customer audits a party in its supply chain, and in third-party auditing an independent body audits against defined criteria.
What the audit is measured against
Criteria are typically drawn from contract terms and service level commitments, technical specifications and drawings, approved quality plans or inspection and test plans, customer-specific requirements passed down from the buyer's own clients, and supplier codes of conduct, including ethical and labour requirements. The audit answers a procurement question, whether a party can really do what it has committed to, and not a certification question.
How an audit is carried out
itmad plans the audit against criteria agreed with the commissioning organisation and then verifies implementation at the audited party's premises. Auditors examine the documented arrangements, sample objective evidence from records, watch processes in operation, and interview personnel at the levels where requirements are actually met. Where the audited party relies on sub-tier vendors, the controls over those vendors are examined in the same audit.
The standard behind the method
Audits follow the principles of ISO 19011, the international guideline for auditing management systems, which governs auditor competence, the evidence-based approach and impartiality. The audit criteria themselves remain those of the commissioning organisation.
When buyers commission one
Buyers use second-party audits before awarding a contract to a new supplier or contractor, at agreed intervals through a long-term supply agreement, after a quality escape, a recurring defect or a delivery failure, as part of a vendor approval programme in a regulated supply chain, and whenever a customer wants evidence that the buyer's supply chain is under control.
Related audit services
Supplier audits cover vendor qualification at manufacturing sites. Third-party compliance audits cover independent assessment against regulatory frameworks, contracts and standards, for organisations that need a report accepted by a regulator, insurer or client.
Frequently asked questions
What is a second-party audit?
A second-party audit is carried out on behalf of a buying organisation on a party with which it has a contractual relationship, such as a supplier, contractor, subcontractor or service provider. The criteria are set by the commissioning organisation and not by a certification standard.
How does a second-party audit differ from a certification audit?
A certification audit assesses conformity with a published management system standard, while a second-party audit assesses conformity with criteria set by the buyer. It answers a procurement question about whether a party can do what it has committed to, and it does not lead to a certificate.
What criteria does a second-party audit use?
Typically contract terms and service levels, technical specifications and drawings, approved quality plans or ITPs, customer-specific requirements passed down from the buyer's clients, and supplier codes of conduct including ethical and labour requirements. The commissioning organisation sets them, not a certification standard.
Which standard governs how the audit is conducted?
itmad follows the principles of ISO 19011, the international guideline for auditing management systems, which covers auditor competence, the evidence-based approach and impartiality. The criteria remain those of the commissioning organisation.
When is a second-party audit used?
Before awarding a contract to a new supplier, at agreed intervals through a long-term agreement, after a quality escape, defect recurrence or delivery failure, in a vendor approval programme, and when a customer needs evidence that the supply chain is controlled. Each situation raises the same procurement question: whether the party can do what it has committed to.
What happens with the supplier's own sub-tier vendors?
Where the audited party relies on sub-tier vendors, the controls over those vendors are examined as part of the same audit. That is often where a buyer's requirements get lost.