Second-Party Audits

What a second-party audit covers

A second-party audit is carried out on behalf of a buying organisation on its own supply chain. The criteria are set by you rather than by a certification standard, which is what distinguishes it from certification auditing.

Audit criteria are typically drawn from:

• Contract terms and service level commitments
• Technical specifications and drawings
• Approved quality or inspection and test plans
• Customer-specific requirements imposed by your own clients
• Supplier codes of conduct, including ethical and labour requirements

This is the audit that answers a procurement question — can this supplier actually do what it has committed to — rather than a certification question.

How the audit is conducted

itmad plans the audit against criteria agreed with you, then verifies implementation at the supplier premises. Auditors examine documented arrangements, sample objective evidence from records, observe processes in operation, and interview personnel at the levels where requirements are actually met. Where the supplier depends on sub-tier vendors, those controls are examined as part of the same audit.

Standards applied

Audits are planned and conducted following the principles of ISO 19011, the international guideline for auditing management systems, which governs auditor competence, the evidence-based approach and impartiality. The audit criteria themselves remain yours.

What you receive

• A report stating findings against each audit criterion
• Objective evidence recorded for every finding
• Non-conformities classified by severity for prioritised action
• Findings in your own vendor scorecard format, on request
• Follow-up verification of corrective action, where included in scope

When it is used

• Before awarding a contract to a new supplier
• At agreed intervals through a long-term supply agreement
• Following a quality escape, defect recurrence or delivery failure
• As part of a vendor approval programme in a regulated supply chain
• When a customer requires evidence that your own supply chain is controlled