What Does a Supplier Audit Report Actually Contain?

Buyers ask for an audit report and then read only the grade. That is the single most common way a due-diligence step becomes theatre. A grade is a summary produced by a person working to a defined method over a defined scope on a defined day; the grade means nothing until the reader knows what that method, that scope and that day were. Two reports showing the same grade can describe completely different realities, and two reports showing different grades can describe the same one.

The useful way to read a report is structural. It has nine parts and each one either adds weight or removes it. A buyer who can name the nine and check them in ten minutes has more information than a buyer who commissioned the audit in the first place. This piece walks through all nine in the order they appear, and says what to do when one of them is missing.

One boundary matters before anything else. Social findings inside an audit report are a record of what an auditor observed against a code. They are not a legal determination, and they are not a basis for a buyer to make an allegation about a workplace. Where a finding touches working hours, safety, age of employment or any comparable topic, the position taken across this programme is fixed: the matter is assessed by a qualified third party against the law of the production country and against the buyer code of conduct, and the buyer reads the finding, records it, and tracks the corrective action.

What Does the Cover Page and Scope Statement Actually Tell You?

The cover page carries four facts that decide everything downstream: the legal name of the audited entity, the site address that was actually visited, the date range of the audit, and the name of the audit firm or programme. The first two are the ones buyers get wrong. A group can hold several legal entities and several addresses, and a report issued for one entity says nothing about another even if both share a brand. Compare the audited entity name against the entity on the quotation and the pro forma invoice; if they differ, ask why before anything else.

The scope statement narrows it further. It should say which buildings, which production lines and which processes were covered, and it should say explicitly what was excluded. A scope covering cut-and-sew but not welding, or covering the main site but not a subcontracted print shop, is a narrower document than its cover suggests. Where a programme depends on a process that sits outside the scope, the report is not evidence about that process at all.

Which Audit Type Produced the Report, and Does That Matter?

It matters more than the grade. An audit conducted on a pre-agreed date with a known agenda sees a prepared site. A semi-announced audit gives a window rather than a date. An unannounced audit sees the site as it runs. Each has a legitimate purpose and each produces a different class of evidence, so a report is only comparable with another report of the same type.

The type also tells the buyer how to use the result. A first-party self-assessment is a management document and is useful as a starting point, not as verification. A second-party audit conducted by the buying organisation is real evidence but is not independent. A third-party audit under a recognised programme is the class most buyers can rely on, and even then the accreditation of the body behind it matters. Ask which of the four classes the document belongs to before reading a single finding.

How Were the Findings Collected, and From Whom?

The methodology section is the part readers skip and the part that decides whether the findings mean anything. It should state the three collection routes and the sample behind each: document review, a physical tour, and interviews. For document review it should say which records and over what period — payroll records for a stated number of months, attendance records for a stated number of months, permits, training logs. For interviews it should say how many people were spoken to and how they were selected.

Sampling is where a report quietly narrows. A review covering the most recent month of records will look clean almost by construction, because problems in this category are historical. A review covering twelve months is a very different document. Similarly, interviews selected by management are not the same evidence as interviews selected by the auditor. If the method section does not state the sampling period and the selection method, treat the findings as indicative only and say so in the programme file.

How Are Findings Graded, and Who Decides the Grade?

Grading schemes differ between programmes and the same word means different things in different schemes. What a buyer needs is not the word but the definition behind it: what severity the scheme assigns, what the associated required action is, and what the expected closure route is. A finding graded as minor in one scheme can require the same remediation as one graded major in another, which is why the grade alone should never drive a commercial decision.

The grade is also a judgement made by an individual auditor on a day, reviewed by a second person at the audit firm. It is not a measurement. Where a finding matters commercially, read the finding text and the evidence rather than the grade. Where a grade looks generous relative to the finding text, that discrepancy is itself worth recording — it usually means the scheme has a narrow definition of the severity word rather than that the auditor was careless.

What Sits in the Evidence Annex, and How Much Should You Ask For?

The evidence annex is what turns a report from an opinion into a record. It typically contains photographs, copies of the records reviewed, the interview log with names removed, and any measurement or test data gathered on the day. Photographs carry the most weight in a quality context because they are hard to argue with: a photograph of a fire exit, a chemical store, a machine guard or a stack of cartons is evidence that survives the auditor leaving the building.

Ask for the full annex rather than a summary, and ask for it with the report rather than after. There is a legitimate limit: interview logs are normally anonymised and personal data is redacted, and a buyer should expect and accept that. What a buyer should not accept is an annex consisting only of photographs chosen after the event. A dated annex produced as part of the audit is different from a set of pictures sent later, and only the first is evidence.

What Does the Corrective Action Section Have to Contain?

The corrective action section is the part of the report that predicts future behaviour, and it is the part most often written badly. A useful entry has five fields: the finding, the root cause rather than the symptom, the action that addresses the root cause, the person accountable, and the date. Most entries contain the finding and the symptom; entries containing a root cause are the minority, and those are the ones worth relying on.

The difference is easy to see in practice. Where a finding records a missing record, an action that says the record will be created addresses the symptom; an action that says the person responsible for creating it has been identified, trained and added to a monthly check addresses the cause. A buyer reading this section should reject any entry whose action is a restatement of the finding, because that entry will reappear in the next cycle unchanged.

How Long Is a Report Valid, and What Resets the Clock?

Audit cycles are set by the programme rather than by the buyer, and the interval varies by scheme and by the previous result. What a buyer needs is the issue date and the cycle length, from which the expiry follows. Equally important is the list of events that reset the clock regardless of the date: a change of site, a change of legal entity, a significant change in the scale of operations, or a finding that required verification and has not been verified.

Record the expiry in the programme file next to the commercial calendar, not in a compliance folder nobody opens. The practical failure is not holding an expired report; it is holding a current report and assuming it covers a product or a process that was added to the programme after the audit date. Scope drift between audits is the common gap, and the only defence is a dated note of what the programme looked like on the day of the audit.

What Should a Buyer Do With a Report That Shows No Findings?

Treat it as a question rather than an answer. A report with no findings is either a genuinely well-run site, a narrow scope, a generous grading scheme, or a short sampling period, and the report itself usually says which. Check the scope statement first, then the sampling period in the method section, then the definitions in the grading scheme. If all three are broad and the report is still clean, that is real information.

The second check is comparative. A site with no findings in a first audit and a long list in a second is a common pattern, because the second audit usually has a wider scope and a longer sampling period. Where a clean report is the first one, treat it as a baseline rather than a verdict, and set the next audit with a deliberately wider scope so that the comparison is meaningful.

1. Entity

Audited legal name matches the name on the quotation and invoice

2. Site

The address visited is the address that will produce the order

3. Dates

Visit dates present, not only an issue date

4. Scope

Inclusions and exclusions both stated; subcontracted processes named

5. Class

First, second or third party, and the programme behind it

6. Method

Sampling period for records and selection method for interviews

7. Findings

Each with a clause reference and a severity definition

8. Evidence

An indexed annex produced on the day, with personal data redacted

9. Closure

Corrective entries with root cause, owner and date, plus the expiry

How Do You Compare Two Reports From Different Programmes?

Direct comparison of grades across schemes is not valid, because the schemes define severity differently and audit different clause sets. The workable comparison is at finding level: map each finding to the topic it concerns, then compare the topic coverage and the closure status rather than the letter grade. Two reports with the same grade but different topic coverage are not equivalent documents, and the coverage is the more useful signal.

Where a programme genuinely needs comparability, the answer is to commission against one scheme and hold all sites to it. Mixing schemes across a supply base produces a file that looks tidy and cannot be reasoned about. If that is not possible, keep a one-page mapping note in the file recording which clause sets each scheme covers, and compare only within a scheme.

The commercial frame is unchanged by any of this. A programme runs on MOQ 500 pcs per style and colourway, sampling in 6-10 working days from a signed-off tech pack, bulk production in 35-50 days from written sample approval, inspection at AQL 2.5 under ISO 2859-1 General Inspection Level II, T/T 30/70, quoted FOB Xiamen. An audit report does not shorten any of those windows; what it does is tell a buyer whether the schedule quoted is likely to survive contact with the calendar.

Frequently Asked Questions

People Also Ask