What a factory audit covers

A quality-system audit asks whether the factory runs a documented, repeatable process: incoming material control, process controls, calibration of measuring equipment, handling of non-conforming product, corrective action, traceability. It tells you whether good output would be reproducible, which is a different question from whether the last batch was good.

A social-compliance audit asks about people and premises: hours and rest days, wages and their calculation, age verification, freedom of association, health and safety, fire escapes, dormitories where they exist, and the presence of anything that looks like forced or bonded labour. It matters commercially as well as ethically, because in several markets a buyer now carries due-diligence obligations of their own for what happens up their supply chain.

A technical or capability audit is the one buyers commission least and benefit from most. Does this factory hold the specific processes your product needs, in-house, at the tolerances you require? Which steps are subcontracted? What is the actual capacity of the line your order would run on, as opposed to the site total? This is the audit that answers "can they make MY thing", and no third-party scheme covers it because it is specific to you.

None of the three is an inspection. An audit examines the organisation; an inspection examines the goods. A factory can hold a clean audit and still ship you a bad batch, and a factory with a poor audit can ship a perfect one — which is why the two exist as separate purchases rather than as alternatives.

This is the most useful paragraph on the page, because it is checkable in a minute and it changes what you ask for. The two most widely presented social-audit programmes are explicit on their own websites that they do not certify anything.

Sedex, which owns the SMETA methodology, states that "neither Sedex membership nor completing a SMETA audit are a certification, and there is no 'pass' or 'fail' as part of the SMETA methodology". SMETA is an audit methodology; the audits themselves are carried out by approved independent affiliate audit companies, and the output is a report of findings rather than a verdict. Sedex takes the misuse seriously enough to ask that companies offering "SMETA certification" or "Sedex certification" be reported to it.

amfori answers it even more plainly in its own frequently-asked questions: "No, amfori BSCI is not a certification." It is a monitoring system, and its assessment covers thirteen performance areas.

So what should you conclude when a supplier emails a one-page "BSCI certificate" with a logo on it? Not necessarily fraud — a great many people in this trade genuinely believe those documents are certificates, and audit firms have historically issued summary sheets that look like them. What you should conclude is that you have not yet seen anything. Ask for the full audit report, with its findings and its date, and the corrective action plan that followed it. A factory that has been audited has that report. A factory that only has the summary sheet has told you something.

And be precise about the difference between these and a genuine certification. ISO 9001 is a certification, issued by a certification body against an accredited scheme — and there the useful question is a different one: who accredited the body that issued it, and is the certificate current and in the name of the entity you are dealing with? Verifying a document's authenticity is its own subject and this page does not repeat it.

The factory tour is the least informative part of an audit, and an experienced auditor spends most of the day in an office instead. The records are where a system either exists or does not.

Time and wage records, cross-checked against each other and against what people say. The classic finding is not a missing record but two sets that do not reconcile — attendance that implies hours the payroll does not pay for, or a payroll too tidy for a factory with a seasonal order book.

Calibration and maintenance records for measuring and test equipment. A factory that measures with instruments nobody has calibrated is producing numbers rather than measurements, and every quality claim downstream inherits that.

Non-conformance and corrective-action records. A factory with no recorded defects is not a factory with no defects; it is a factory that does not record them, and that is a worse finding than an honest list. What you want to see is problems found, causes identified and actions closed out.

Traceability: can they tell you which batch of which material went into which production run? That question decides how expensive a recall or a customer complaint becomes, and the answer is either a system or a shrug.

Worker interviews, conducted privately and away from management, are the part that most often changes an auditor's conclusion — and the part most likely to be interfered with. It is worth asking, in the scope, how interviews will be selected and conducted.

This is the gap that costs buyers the most, and it is structural rather than dishonest. An audit examines a site. Your order is placed with a legal entity. The goods are exported by whoever holds the export rights. Those can be three different things, and nothing in a standard audit report is obliged to connect them.

So ask the connecting questions explicitly, in writing, before the order. Is the audited site the site where my product will be made? Is the entity on my purchase order the entity that was audited? Which steps of my product are subcontracted, to whom, and are those sites audited too? Subcontracting is normal and often necessary — plating, moulding, PCB assembly and printing are routinely outsourced by good factories. What causes losses is not subcontracting; it is UNDISCLOSED subcontracting, where a peak-season overflow goes to a site nobody has ever seen.

This page publishes no figure for how often that happens, because no honest figure can exist: the cases that matter are the undisclosed ones. What it offers instead is the check. Write a clause requiring disclosure of production sites and prior written consent for subcontracting, and make one unannounced or semi-announced visit during production the norm rather than the exception.

Which raises the announcement question. A fully announced audit tells you what a factory looks like when it has had three weeks to prepare — genuinely useful for assessing systems, much less useful for assessing reality. A semi-announced window, where the factory knows the fortnight but not the day, is the practical compromise most buyers should be asking for, and it costs no more.

Finally, notice who commissioned the audit you are reading. A report a factory ordered, from a firm the factory chose and paid, on a date the factory picked, is not worthless — but it is evidence about a day that was selected. If the audit is load-bearing for your decision, commission your own, choose the firm yourself, and have the report addressed to you.