Audit · pdf-lib

Supplier audit checklist generator

Walk the floor with a checklist, not a memory.

Qualify a supplier on a handshake and a quick look round, and the gap you did not check (no segregated storage, no calibration records, a licence that does not cover the product) surfaces as a failed shipment months later when it is expensive to unwind. The audit record is also what protects you if a downstream customer asks how the supplier was vetted.

Build a supplier-audit checklist by category, walk the floor ticking Yes / No / N-A per item with comments, and generate a branded PDF for the qualification record.

Last updated 2026-05-09. Math runs in your browser, no data leaves your computer.

Audit header

General guidance only. Verify against the cited primary sources before you commit to a shipment, declaration, or contract.

Supplier audit in chemical-trade context

A supplier audit is the formal pre-qualification step that bridges the gap between marketing materials and operational reality. The supplier markets a 5,000 MT per month plant with ISO 9001 + ISO 14001 + GMP; the audit verifies that the plant exists, that it has the equipment and people to deliver, that the certificates are valid, that the workforce is paid above minimum, that the books look healthy, and that the operating licences are in the entity name on the contract.

For Chinese chemical suppliers, the audit picks up four risks that desk research cannot. First, identity risk: is the entity on the contract the same entity that owns the factory? Sub-letting and shadow-factory patterns are common; the audit walks the gates with the licence in hand. Second, capacity risk: does the stated capacity match the equipment count, the shift schedule, and the production records? A 5,000 MT plant cannot be a single 24,000 L reactor on day shift only. Third, compliance risk: are the operating permits current; is the safe-production permit covering the product on the contract; is the export licence held in the entity name. Fourth, financial risk: does the registered capital match the stated production scale; is the bank account in the entity name; are there active lawsuits.

The audit checklist here covers the universal backbone (QMS, capacity, compliance, environment, social, commercial) plus a category overlay. The category overlay matters: a food-grade supplier with no HACCP plan and no FSSC 22000 certification cannot ship to most western retailers, regardless of how good the chemistry is. A pharma API supplier without GMP certification cannot ship to regulated markets at all. The overlay is the fast filter for whether the supplier can support the contract scope.

The output is a branded PDF that goes into the supplier qualification record. Buyer-side QC and procurement teams expect this document on file; auditors from BSCI, SMETA, ISO 9001 surveillance, FDA inspection, and customer audits all ask for it. A clean, dated, signed audit checklist is the proof of due diligence; a dropped or missing audit is grounds for buyer-side QC to reject the supplier on the spot.

The desk-research steps that pair with the floor audit are linked below.

A worked example

The booking. A supplier markets a 5,000 MT per month plant with ISO 9001, ISO 14001, and GMP, the price is sharp, and you place a first order on the strength of the brochure and a video call.

The failure. The plant on the contract is a shadow factory: the entity sub-lets capacity it does not own, the safe-production permit does not cover your product, and the bank account is in a different name. The first shipment slips, the second fails QC, and when you try to claim you find the contract entity has no assets. None of it showed on the brochure.

The fix. Walk the floor with the checklist before the first order. It catches all four blind spots: identity (is this entity the one that owns the gates), capacity (does the equipment count match 5,000 MT), compliance (is the permit current and in the right name), and finances (does registered capital match the scale). A dated, signed audit on file is the due-diligence proof, and the shadow factory fails it on page one.

Confirming the entity is legitimately registered before you visit? The USCC validator checks the company code at /tools/china-trade/uscc-validator.

Cross-checking shareholders, capital, and lawsuits? The Tianyancha and Qichacha quicklinks open the registry at /tools/china-trade/tianyancha-qichacha-quicklink.

Frequently asked

When should I run a supplier audit?

Before the first commercial order, again at year 2 (or sooner if quality drifts), and on any major change of scope (new product line, new factory address). For high-value or regulated products (pharma, food, electronics), expect to run a full audit before every multi-million-dollar contract; for commodity chemical, a desk audit plus a one-day site visit is usually enough.

Can I do this audit myself?

Yes for an initial-impression audit. Hire a third-party auditor (SGS, TUV, BV, Intertek, Cotecna) for the high-stakes audits, especially when buyer-side compliance (SMETA, BSCI, FDA) is a contractual requirement. The third-party auditor brings the buyer-side credibility plus the multi-language capability.

What does a fail look like?

Fundamental failures: business licence not in the entity name on the contract; sub-letting space rather than owning the production; falsified ISO certificates (verify on the issuing body site); litigation pattern showing payment defaults or quality disputes; bank account in a personal name. Any one of these is grounds to walk away.

Related tools