Supplier audit checklist

Templates are guides only. Check your contract's audit clause with your legal team before you plan an audit. This is not legal advice.

A supplier audit checks that a supplier is doing what the contract and its own answers said it would. It can be a remote review of documents, a call with the supplier's team, or a visit to their site. This checklist covers planning, the areas to test and what to do with the findings.

1. Plan the audit

• Check your right to audit. Read the audit clause: what you can inspect, how much notice you must give, how often, who pays and whether you can send a third party. Without a clause, an audit depends on the supplier's goodwill.
• Set the scope. Pick the risks that matter for this supplier: for example data protection for a payroll bureau, or health and safety for a facilities contractor. Our supplier risk tier calculator helps decide how deep to go.
• Choose the method. Remote document review, interviews, or an on-site visit. Use on-site visits where you need to see the work, the premises or the controls in action.
• Pick the team. Include someone who knows the service and, for security or data protection, someone who knows those controls. Check that no one on the team has a conflict of interest.
• Give notice and ask for documents in advance, as the contract requires. Send the supplier a list of what you'll look at and when.

2. Contract and commercial

• Services are delivered as the contract and statements of work describe.
• Service levels and KPIs are measured the way the contract says, and the reported figures match the underlying records.
• Invoices match the agreed rates, volumes and any price review terms. Test a sample of invoices against timesheets, delivery notes or usage data.
• Service credits due for missed service levels were applied.
• Subcontractors are approved where the contract requires it, and the contract's key terms are passed down to them.
• Key personnel named in the contract are still in place.

3. Information security

• Certificates (Cyber Essentials, ISO 27001) are current and their scope covers the service you buy. Ask for the ISO 27001 statement of applicability, or the SOC 2 report and any exceptions it lists.
• Access to your data and systems is limited to the people who need it, reviewed regularly and removed promptly when people leave.
• Multi-factor authentication is used for remote and administrator access.
• Security updates are applied within the timescales they promised.
• Backups are taken, protected and tested by restoring them.
• Security incidents are logged, and the ones affecting you were reported to you as the contract requires.

4. Data protection

• Personal data is processed only on your documented instructions, as UK GDPR Article 28 requires. Article 28 also requires processors to make available the information needed to show compliance and to allow for audits, including inspections, by you or an auditor you appoint.
• Sub-processors match the list you agreed, and you were told about changes.
• Staff with access are bound by confidentiality and trained.
• Data held outside the UK has a valid transfer mechanism.
• Data is kept no longer than agreed, and deletion at the end of the contract is possible and documented.

5. Business continuity

• A business continuity and disaster recovery plan exists for your service and was tested in the last year. Ask for the test results.
• Recovery targets in the plan match what the contract promises.
• Single points of failure (one site, one person, one key supplier) are known and managed.

6. People, ethics and safety

• The modern slavery statement, if required, is current. Ask how the supplier checks its own supply chain.
• Workers on your contract are paid at least the legal minimum, and right to work checks are recorded.
• Health and safety: risk assessments, method statements, training records and incident logs for work on your premises.
• Required qualifications and registrations (for example Gas Safe, SIA or DBS checks) are in date for the people doing the work.
• Insurance certificates are current and meet the contract's cover amounts.

7. Findings and follow-up

• Rate each finding, for example High (fix now, risk to service or law), Medium (fix within an agreed time) or Low (improvement).
• Share a draft report with the supplier and let them correct facts before you finalise it.
• Agree a corrective action plan: what will be done, by whom and by when.
• Follow up each action until it is closed, and keep the evidence.
• Feed the result into the supplier's risk rating, tier and next review date.
• Tell the contract owner and, for serious findings, whoever approved the supplier.

How often to audit

Few organisations can audit every supplier. Audit your T1 and high-risk T2 suppliers on a regular cycle, and any supplier after a serious incident or a significant change. For lower tiers, a desk review of certificates and questionnaire answers is usually proportionate. See our guide to third-party risk management.

Templates are guides only. Check your contract's audit clause with your legal team before you plan an audit. This is not legal advice.