Factory Audit Checklist: Test the Evidence Trail

A factory audit should test whether a supplier can control the work it may receive—not whether its conference room contains the right certificates. For fabricated steel and project components, a generic yes/no checklist can record visible equipment while missing the links between contract requirements, material identity, process controls, inspection results and release authority. Define the purchasing decision first. Then choose representative samples and follow each claim through records, interviews and the physical product. The result should be a bounded approval decision with evidence, conditions and follow-up dates, not a score that disguises unresolved risk. This factory audit checklist organizes that work into an auditable evidence trail.

Define the Audit Decision Before Touring the Factory

Start by stating what the audit must decide. A first-time supplier capability audit, an order-readiness audit and a recovery audit after repeated nonconformities have different criteria and samples. Mixing them produces an impressive itinerary but a weak conclusion.

ISO 19011:2026 provides current guidance on audit principles, audit-program management, conducting audits and auditor competence. Its published structure includes both evidence-based and risk-based approaches. It does not turn a factory visit into product approval, and it does not supply an industry-specific purchasing checklist (ISO 19011:2026).

Use an audit charter before scheduling the visit.

The charter also sets boundaries. A management-system audit can test how controls operate. It does not replace project design review, product inspection, code acceptance, welding engineering, coating qualification, social-compliance review or a legal due-diligence process. Add competent specialists when those decisions are within scope.

Turn Supplier Claims into Testable Audit Trails

Do not organize the checklist only by departments such as sales, purchasing, production and quality. Begin with the claims that matter to the order, then identify where each claim should leave evidence.

The ISO 9001 Auditing Practices Group (APG) explains that audit evidence should be collected and evaluated against defined criteria. Its evidence-collection paper advises auditors to prepare for the evidence they need and to corroborate information rather than accept a single presented record. APG papers are educational guidance, not ISO requirements or an industry benchmark (APG Evidence Collection; APG disclaimer and library).

Build a Claim-to-Evidence Matrix for the visit.

This format changes the auditor’s behavior. A certificate becomes one node in a trail, not a conclusion. An interview answer becomes a lead to verify. A physical observation must be tied to a requirement, job and status before it supports approval.

Select Samples by Risk, Not Showroom Convenience

Sampling is necessary because an audit cannot inspect every order and record. The sample therefore needs a stated logic. Avoid universal sample counts: the appropriate depth depends on order scope, process risk, change history, prior performance, available evidence and the consequence of failure.

The APG checklist paper treats checklists and sampling plans as audit work documents, while warning that an overly narrow or generic checklist can restrict the audit and add little value. Use the checklist as a route map that can expand when evidence reveals a new risk—not as a script that prevents follow-up (APG Checklist).

Create a risk-based sample plan before the opening meeting.

Reserve time for auditor-selected samples. If records are electronic, ask the system owner to retrieve a sample through the normal workflow rather than opening a preassembled presentation. Record any access or confidentiality constraint and decide whether alternative evidence is adequate.

Walk One Order from Requirement to Release

Choose one order or representative job and follow it in both directions: from the customer requirement to the released component, then from the physical item back to its source records. This reveals handoff failures that departmental interviews often hide.

Begin with the accepted requirement set: contract, drawings, specifications, approved changes and delivery scope. Identify the current revision and the person or function authorized to resolve ambiguity. Then follow the job through the processes actually used. A fabricated-steel route may include material receipt, cutting, forming, fit-up, welding, dimensional inspection, surface treatment, final inspection, packing and dossier release. The actual route may be different; the audit should follow the supplier’s real process map and the sampled order.

At each handoff, ask five questions:

1. Identity: How does the next process know which job, item, material and revision it has received?
2. Acceptance: What evidence shows the incoming state was accepted before work continued?
3. Instruction: Which controlled requirement tells the operator or inspector what to do?
4. Exception: What happens when the input, result or physical condition does not match?
5. Release: Who has authority to let the item move, and where is that decision recorded?

Do not demand a document merely because it appears on a generic checklist. Ask whether the evidence supports the adopted requirement and control. Conversely, do not accept a polished procedure when the sampled job shows a different practice.

Traceability deserves a physical cross-check. Select an accessible item or bundle, record its identifier and work backward through production and material records. Then choose a source record and locate the related physical status forward. The Material Traceability in Steel Fabrication guide provides a separate buyer workflow for that narrower task; the factory audit uses it as one trail within a broader capability decision.

Challenge Outsourced Processes and Recent Changes

A facility tour shows only work performed at that site and time. Ask which operations, inspections, tests, treatments, engineering tasks or logistics steps are performed by external providers. Compare the answer with quotations, process maps, purchase records and the sampled job dossier.

The APG paper on external providers recommends looking beyond an approved-provider list to the wider procurement, outsourcing and supply-chain process, including how requirements are defined, how provider performance is monitored and how specified requirements are verified. Again, this is non-normative auditing guidance; the buyer’s contract and adopted criteria control the actual decision (APG External Providers).

For one outsourced process, trace:

• why the provider and exact scope were selected;
• which technical, inspection, documentation and notification requirements were transmitted;
• how customer or project-specific requirements were preserved;
• which evidence returned with the work;
• what incoming verification occurred before the item re-entered production; and
• how provider performance, exceptions and changes affect continued approval.

Then test recent changes. A capable system should distinguish controlled change from routine variation. Select a changed drawing, material source, key person, machine, inspection method, procedure or external provider. Look for impact review, approval, updated instructions, affected-item identification and any required revalidation. If the audit cannot establish when the change took effect or which orders it affected, narrow the approval decision until the boundary is proven.

Record Findings at Evidence Level

Separate what the auditor observed from what the team concludes. “Traceability is weak” is an opinion. A useful audit note identifies the sampled item or record, the observed condition, the applicable criterion and the missing or conflicting evidence.

The APG guidance on documenting nonconformity separates three elements: audit evidence, the requirement that was not fulfilled and a concise statement of nonconformity. It also distinguishes documenting the finding from later correction and corrective-action work. Apply that logic only where the audit criteria support it; do not relabel a concern as a formal nonconformity without a defined requirement (APG Nonconformity—Documenting).

Use one Finding Record for each issue or unresolved trail.

Avoid inventing “major” and “minor” definitions during the closing meeting. If the buying organization uses finding classes, define them in the audit plan and tie each class to a consequence. An isolated record gap, a loss of material identity and an uncontrolled release may require very different purchasing actions even if a scoring formula gives them similar points.

Convert the Audit into a Bounded Approval Decision

Do not average critical failures into a passing score. Close the audit by linking each finding to the intended purchasing decision and to the scope that was actually tested.

Use explicit decision states:

• Approved for defined scope: the sampled evidence supports the named site, component family and process route, subject to normal order controls.
• Conditionally approved: limited work may proceed only after named pre-order or pre-production conditions are closed.
• Limited scope: approval excludes an unverified product, process, site, shift, capacity assumption or external provider.
• Follow-up required: additional records, a remote review or an on-site revisit is needed before the decision can expand.
• Not approved: evidence does not support the intended order or a stop condition remains open.

Approval should name its expiry or review trigger. Relevant triggers can include a new facility, ownership or legal-entity change, critical-process relocation, material-source change, repeated quality escape, unapproved outsourcing, loss of key qualification, major equipment change or a materially different order. The trigger is a buyer control, not a claim that the supplier is permanently capable.

Keep supplier qualification separate from order release. A factory may demonstrate a suitable control system but still need project-specific drawing approval, material acceptance, procedure qualification, inspection planning, product testing and shipment-document review. The Structural Steel Fabricators guide covers desk-based contract-scope prequalification; this audit workflow begins after that review and tests how the evidence operates at the facility.

Issue a Factory Audit Evidence Record

Package the result so another buyer or reviewer can understand both the conclusion and its limits without attending the visit.

The record should not claim more than the sample supports. State unavailable evidence, remote-access limits, processes not operating during the visit and areas outside auditor competence. Those are decision boundaries, not editorial footnotes.

Related Resources

• Quality — review East Baoyu’s quality information and inquiry route.
• Structural Steel Fabricators: Match Evidence to Contract Scope — complete the desk-based entity, facility and contract-scope prequalification before the audit.
• Material Traceability in Steel Fabrication — test the material-identity trail in greater depth.
• Inspection and Test Plan — define notice, witness, waiver and release controls for a specific order.
• Steel Fabrication Quality Control — connect detected exceptions to containment, disposition and corrective action.

References

• ISO — ISO 19011:2026, Guidelines for auditing management systems
• ISO 9001 Auditing Practices Group — library and disclaimer
• ISO 9001 APG — Checklist
• ISO 9001 APG — Evidence Collection
• ISO 9001 APG — External Providers
• ISO 9001 APG — Nonconformity: Documenting

Next Step: Prepare One Evidence Trail

Before arranging a factory audit, choose one proposed component family and one representative order route. Send the supplier the audit objective, site and process scope, criteria, sample-access request and permitted decision states. Build the Claim-to-Evidence Matrix and identify the records or physical samples the auditor must select independently.

Submit that bounded scope through Quality when you need East Baoyu to clarify available process, quality-document and quotation inputs for a proposed supply package. The buyer and its appointed auditors, engineers, inspectors and authorities retain responsibility for audit criteria, competence, confidentiality, legal or social-compliance review, product acceptance and final supplier approval.