Supplier Auditor
On-site supplier audits per ISO 9001 and IATF 16949, non-conformance logs, CAPA tracking, audit report with risk score. Scheduled against a rolling three-year cycle.
ISO 9001 · IATF 16949
Talk to us about Supplier Auditor
Three lines and you are in our inbox. We reply within one business day.
What does a supplier auditor do?
The supplier auditor verifies whether a supplier meets the contractually and normatively agreed criteria. The methodological foundation is ISO 19011:2018, the guideline for auditing management systems, which applies to first-party (internal), second-party (supplier) and third-party (certification) audits. Its six-phase model structures every audit: initiation, audit planning, preparation, on-site execution, audit reporting and audit closure with follow-up. Plan-Do-Check-Act (PDCA) frames the improvement cycle around it.
There is no statutory duty to appoint a supplier auditor. The role grows out of normative and contractual obligations. ISO 9001:2015 § 8.4 (control of externally provided processes, products and services) obliges every certified company to evaluate suppliers on a risk basis, without naming a post holder. Automotive suppliers additionally meet IATF 16949:2016, whose Annex B references the VDA 6.3 process audit as the recognised methodology for tier-1 and tier-2 audits. The VDA 6.3 question catalogue covers seven process steps (P1 potential analysis through P7 customer care) with 64 individual questions, each scored from 0 to 10 points. Who performs the audit therefore follows from the customer supplier manual, not from a statute.
Since 1 January 2024 a further audit layer applies. The Lieferkettensorgfaltspflichtengesetz (LkSG, the German supply chain due diligence act) requires companies inside the scope of § 1 LkSG, as a rule from 1,000 workers in Germany, to analyse human rights and environmental risks at their direct suppliers under § 5 Para. 1 LkSG and to agree contractual controls with risk-based execution under § 6 Para. 4 No. 4 LkSG. Recognised methodologies are SMETA (Sedex Members Ethical Trade Audit) and SA8000. The supplier auditor therefore bridges three domains: quality (ISO 9001, IATF 16949, VDA 6.3), information security (ISO 27001 supplier audits under Annex A.5.19) and sustainability (LkSG, CSDDD).
In daily practice the follow-up decides more than the audit day. A certification audit notices when findings are not classified as major nonconformity, minor nonconformity or observation, when corrective actions in the 8D framework are closed without effectiveness verification in the follow-up audit, or when the audit programme fails to reflect supplier classification by risk, volume and criticality. Proof of the auditor's own qualification is missed just as often: registration at IRCA, DGQ-PersZert or VDA QMC calls for continuing education plus logged audit days, and a lapse costs the status between two certification cycles. Holiday and sickness cover belongs in the audit programme as a named deputy, otherwise the annual plan slips without a documented reason.
Core duties
- Build the risk-based audit programme under ISO 19011:2018 Section 5 with audit objectives, scope and criteria.
- Classify suppliers by risk, volume and criticality under ISO 9001:2015 § 8.4.
- Prepare the audit checklist based on standard, customer-specific requirements and prior audit findings.
- Conduct VDA 6.3 process audits across the seven process steps P1 to P7 (64 questions, 0 to 10 points).
- Conduct system audits under VDA 6.1 or IATF 16949 with focus on management system and customer specifics.
- Classify audit findings as major nonconformity, minor nonconformity or observation under ISO 19011 Section 6.4.
- Track corrective actions in the 8D framework with effectiveness verification in the follow-up audit.
- Issue the audit report with findings, recommendations and supplier score.
- Run LkSG and SMETA audits on human rights and working conditions along the supply chain.
- Maintain own auditor qualification through annual training and audit-days proof (IRCA, DGQ-PersZert, VDA QMC).
Appointment and qualification
The duty to appoint a supplier auditor does not arise from federal statute but from normative and contractual requirements. ISO 9001:2015 § 8.4.1 requires every certified company to define criteria for the evaluation, selection, monitoring and re-evaluation of external providers. IATF 16949:2016 § 8.4.2.4.1 explicitly requires automotive tier suppliers to operate a supplier monitoring programme with second-party audits. The recognised methodologies are VDA 6.3 (process audit), VDA 6.1 (system audit) and predecessors.
Auditor qualification follows ISO 19011:2018 Section 7. General requirements: personal behaviour, technical competence for the audit subject, audit knowledge and audit days. Lead auditor training runs 40 hours with IRCA-accredited providers, with five logged audit days per year for maintenance. VDA 6.3 auditors complete a 3- to 5-day course at VDA QMC plus at least one practical audit per year. IRCA registration (Provisional Auditor, Auditor, Lead Auditor, Principal Auditor) requires between 5 and 35 proven audit days depending on level. External auditor day rates in Germany run from 950 to 1,800 EUR net for standard ISO 9001 audits and from 1,200 to 2,200 EUR net for VDA 6.3 specialists with automotive focus.
- ISO 9001:2015 certified company with supplier evaluation duty under § 8.4.
- Automotive tier supplier under IATF 16949 with mandatory supplier monitoring programme.
- Customer requirement in supplier manuals such as VW Formel Q, BMW STA or Daimler MBST.
- LkSG-obliged company under § 1 LkSG running supplier controls under § 6 Para. 4 No. 4 LkSG.
- Supplier change or new supplier with initial assessment before release.
- Major customer complaint or PPM threshold breach at supplier.
Typical sectors for supplier audits
- Automotive OEMs and tier-1 to tier-3 suppliers (IATF 16949, VDA 6.3).
- Medical devices manufacturers (ISO 13485, MDR (EU) 2017/745).
- Aerospace and defence (EN 9100, EN 9120).
- Mechanical and plant engineering with global sourcing.
- Pharmaceuticals and contract manufacturers (GMP, GxP audits).
- Food production (IFS Food, BRC, ISO 22000).
- Electronics and semiconductor manufacturing (IPC, IATF in automotive).
- Chemicals and process industry with REACH and CLP audits.
- Textile and apparel with SMETA, BSCI and SA8000 audits.
- Consumer goods retail and private label with LkSG supplier audits.
How CIVAC supports the supplier auditor
CIVAC holds the supplier auditor's audit programme as a role file. Audit objectives, audit criteria, the scope of each assessment and the risk class of each supplier sit in one place, versioned and dated. Every planned audit date is a scheduled task with a reminder, so a postponement becomes visible in the annual plan instead of surfacing during the certification audit. Role templates fix the audit checklist, the finding classes and the report structure, so two auditors work to the same system.
Auditor qualification runs as training with proof per person: refresher courses and logged audit days stay attached to the individual and can be evidenced towards IRCA, DGQ-PersZert or VDA QMC. Findings, corrective actions and the check on their effectiveness go into an append-only audit trail that makes later edits visible. Deputy cover and handover are on file, so an audit cycle survives a change of staff. The role costs 49 euros a month, optionally with an external appointment.
Frequently asked questions
Need this officer role for your organisation?
Appoint our experts as your external officer or license CIVAC for your in-house team. Get in touch and we walk you through the right setup.