How to review supplier compliance evidence: a checklist

A supplier file can be complete and still fail a review. The certificates are there, the policies are attached, the questionnaire is signed, and yet when a customer or a certification body asks how the supplier was approved, nobody can point to the page that supports each decision.

This guide is about that gap: how to check that the evidence on file actually supports each requirement, and how to record the outcome so that it can be defended later.

What a supplier compliance review is

A supplier compliance review takes a list of requirements, such as certifications, policies, corrective actions and agreements, and checks each one against the documents the supplier has provided. The output is a decision for each requirement, backed by a reference to the evidence, and an overall approval decision made by a named person.

It is not the same as collecting documents, and it is not a supplier audit. Collection gets material into a file. An audit tests whether the supplier works the way its documents say, usually on site. The review sits between the two: it decides what the file proves.

Quality standards expect this to be deliberate. ISO 9001 has long required organisations to set criteria for evaluating, selecting, monitoring and re-evaluating their external providers, and to keep records of those evaluations. The standard leaves the criteria to you, but it expects the evaluation itself to be done and recorded.

Start from the requirements, not the documents

Write each requirement as a question a reviewer can answer from evidence. “Does the supplier hold the certifications we require?” can be answered. “Is the supplier compliant?” cannot.

For each requirement, decide in advance what evidence would support it, and what a near miss looks like.

The first four rows are the starting requirements of our supplier compliance review template. The fifth is a common addition. Your list will differ by category and risk: a supplier of safety-critical parts needs more than a supplier of stationery.

Check every document on five points

Most review errors come from accepting a document that is genuine but does not fit. Before a document counts as evidence, check it on five points.

1. Entity. Does it name the supplier’s legal entity, ideally with a company number, or a parent, a subsidiary or a trading name? Group certificates and group policies often do not cover every company in the group.
2. Scope. Does it cover the products, services and sites you actually buy from? A certificate for the distribution of electronic components does not cover their design or manufacture.
3. Dates. Is it in force on the date of the review? Look for the issue date, the expiry or next review date and, for certificates, the date of the last audit if it is shown.
4. Version. Is it the current version? Policies are revised, certificates are reissued and agreements are amended. An older version on file is not wrong, but it should not be the one a decision relies on.
5. Authority. Who issued or approved it, and can that be checked independently? A certificate can be checked with the body that issued it or against a public register; a policy should show who approved it.

Certificates deserve the most care, because a convincing PDF proves little on its own. We cover the checks step by step in how to verify a supplier’s ISO certificate.

Keep “supports”, “related” and “nothing found” apart

Three different outcomes are often collapsed into one, and that is where audit trails go wrong.

• Supports the requirement. The document, read at a specific page or section, answers the question. Record where.
• Related, but does not support it. An environmental policy is related to an ISO 14001 requirement; it is not evidence of certification. Related material is useful context. It is not proof.
• Nothing found. If no evidence was located, say so in the record. A blank field reads as “not checked”. “No evidence located” reads as a finding, and it gives you something specific to send to the supplier.

A fourth outcome is common enough to name: partial support. A certificate that covers two of three sites, or a corrective action with an action recorded but no verification, supports part of the requirement. Record which part.

Record the decision, not just the documents

The record is what you will be asked for. For each requirement, keep:

• the requirement wording as it stood when the review was done;
• the decision: approved, rejected or needs follow-up;
• the reference to the evidence: the file, and the page or section, or the sheet and rows of a spreadsheet;
• who decided, and when;
• any follow-up, with an owner and a due date.

Record the overall approval decision separately, with the name of the person who made it. When the supplier is re-reviewed, start a new record rather than overwriting the old one: an auditor may want to see what was known when the earlier decision was made.

How often to re-review

There is no single legal interval for re-reviewing a supplier. Most teams set one by risk, often annually for important suppliers, and add triggers that force an earlier look:

• a certificate expiring, or being suspended or withdrawn;
• a change of ownership, legal entity or manufacturing site;
• a significant nonconformance, recall or customer complaint;
• a change to your own requirements.

Red flags in a supplier file

• A certificate with no certificate number, no certification body or no expiry date.
• Documents that name a different company from the one you contract with.
• Policies with no date, no revision and no approver.
• Questionnaire answers that say yes with nothing attached. Answers are claims, and checking them against evidence is a review step of its own.
• One document offered as evidence for several unrelated requirements.
• Everything dated in the week before the review.

Where software helps, and where it does not

Software can take the slow part off the reviewer: reading every document in a supplier file against every requirement and showing where support was found. DataStruct does this. It runs your requirements against the documents, links each finding to the file and the page, section or spreadsheet rows it came from, keeps related material separate from support, and states plainly when it located nothing.

It does not approve suppliers. It does not check certificates against external registers, and where an old and a new version of a record are both on file, it can return both: the reviewer decides which one counts. Every finding gets a decision from a named person, and that decision is recorded. How it works walks through a review from upload to decision.