PRACTICAL GUIDANCE
What this review is for
A second-party audit focused on the supplier activities that matter to your contract. Establish what the supplier does, how it demonstrates control and which risks need a decision before or during the relationship.
Who this is for. For buyers assessing a critical supplier, reviewing recurring delivery problems, checking outsourced processes, or following up contractual assurance requirements.
SERVICE SPECIFICATION
Scope and evidence
What the review covers
- Define the purchasing, contractual or management-system criteria that the supplier has agreed can be assessed.
- Confirm access rights, confidentiality, permitted locations, subcontractors and evidence-sharing arrangements.
- Trace selected services or products through the supplier’s delivery and control processes.
- Check exceptions such as incidents, changes, rejected work and the handling of subcontracted activities.
- Distinguish verified findings, supplier explanations and matters that could not be tested.
Evidence to prepare
- The relevant contract, specification, service requirements and agreed audit rights.
- Supplier scope, locations, subcontractor arrangements and relevant certificates.
- Representative delivery records, quality checks, service measures and incident histories.
- Change-control, continuity and escalation arrangements relevant to the contract.
- Previous assurance responses and actions that the buyer wants to follow up.
What the review is intended to produce
- A supplier-specific audit plan and agreed evidence request.
- A findings report mapped to the agreed criteria, with access and sampling limits.
- An action register suitable for discussion with the supplier.
- A buyer decision note separating evidence from assumptions and residual risks.
- Suggested follow-up questions and a proportionate basis for future assurance activity.
How the work is structured
Define the buyer’s concern
Start with the service dependency and decision to be made. Avoid requesting every possible policy without knowing why it matters.
Agree access and criteria
Confirm the supplier’s cooperation, permitted evidence and confidentiality arrangements before the audit. A customer relationship alone does not authorise unrestricted access.
Test delivery and exceptions
Follow selected work and ask how deviations were identified, escalated and resolved. Use corroborating evidence where possible.
Support a risk decision
The buyer decides whether to accept, mitigate, monitor or decline the remaining risk. Findings should make that decision easier to explain.
Service boundaries
- Certification audits are carried out by independent certification bodies, ideally accredited by UKAS. ISOaudit does not issue certificates and is independent of ISO, UKAS and certification bodies.
- A supplier audit is limited to agreed access and criteria. It does not certify the supplier, guarantee future performance or authorise technical testing of its systems.
- This page describes a proposed service method. An audit brief records your needs; it does not place an order or confirm scope, availability or delivery terms.
The specification does not constitute an offer or an agreed engagement. Trading identity, price, availability, scope, liability and service terms must be confirmed before a paid engagement can be accepted.
Common questions
Is a supplier certificate enough?
A relevant, valid certificate can contribute to assurance. Check the organisation, activities and sites it covers, then consider whether your contract-specific risks require further evidence.
Can the supplier redact confidential records?
Appropriate redaction or controlled viewing may be possible. Agree the approach in advance and record when restrictions prevent a conclusion.
Can this be a remote audit?
That depends on the evidence required and the activities being assessed. Interviews and records may be suitable remotely; some physical conditions or operations may need observation by an appropriate person on site.
FICTIONAL WORKED EXAMPLE
Fictional example: checking whether a certificate covers the purchase
A fictional buyer receives a group-branded certificate while contracting with a particular subsidiary. This educational scenario does not allege a false certificate or describe a real supplier.
| Criteria to establish | Agree the contract requirement, assurance objective, permitted access and audit criteria. Establish the entity, activity and locations to which the buyer intends to rely on certification. |
|---|---|
| Evidence and sample | Compare the selected certificate and schedule with the contracting entity and service. Check current status through the issuer or relevant authoritative register and record the evidence and date. |
| What the evidence shows | The fictional certificate covers a manufacturing activity, while the proposed purchase concerns a separate hosting service. Relevance to that purchase has not been established. |
| Next step | Ask for clarification through independently verified channels, obtain appropriate service-specific evidence and record unresolved differences for the buyer's risk decision. |
A scope mismatch or missing register result does not by itself prove fraud. Supplier audit rights do not authorise unrestricted access or technical testing.
YOUR NEXT STEP
Make the scope concrete.
Describe your organisation, objective and constraints. Download the brief and review it before commissioning work.
Prepare an audit brief ↗SOURCES & REVIEW
Check the underlying information.
These are independent summaries and implementation suggestions, not the copyrighted standard text. Use an authorised copy of the applicable standard for its full requirements.
Reviewed 1 November 2026 · Next editorial review 1 December 2026 · Editorial policy
The displayed review date records an editorial source check. Named specialist review is still to be assigned for this private edition. The 2 November 2026 content update added an original fictional worked example and related guidance; source corrections are recorded in the project change log.