News
What a 2nd-Party Audit Reveals About Supplier Risks
An ISO 9001 certificate says that a supplier has a system – not whether it can deliver the required quality. A structured 2nd-party audit uncovers exactly this difference.
An ISO 9001 certificate says that a supplier has a system – not whether it can deliver the required quality. A structured 2nd-party audit uncovers exactly this difference.
An ISO 9001 certificate is often the decisive criterion in supplier selection – and in practice it is frequently confused with the question of whether a supplier can actually deliver the quality required in the individual case. A 2nd-party audit makes exactly this difference visible, often before it becomes an expensive problem.
At a glance
An ISO 9001 certificate confirms that a supplier has a documented quality management system that meets the requirements of the standard. It does not automatically confirm that this supplier can deliver the specific quality required in the individual case.
Industry sources also point to concrete limits of checking the certificate alone: fake certificates and manipulated evidence, expired or no longer valid certifications, insufficient audit depth in the certification audit in individual cases, a lack of monitoring after the certificate has been issued, and a limited scope. Every ISO 9001 certificate refers only to the scope defined in it – specific sites, processes or product groups. For the product actually to be procured, this scope may not apply at all in the individual case, without a mere certificate check revealing this at first glance.
The same pattern also shows up from another direction. A WEKA expert article describes how companies rely on a certificate while promised inspections and contractual agreements are not fully implemented in practice – the certificate creates responsibility without securing the supplier's actual performance capability.
A 2nd-party audit (second-party audit) is a review of the supplier by the customer itself or by an auditor commissioned by the customer. This distinguishes it from the certification audit (third-party audit), which is carried out by an independent certification body. The technical focus also differs. A third-party audit examines only the management system against the requirements of the standard. A 2nd-party audit supplements the questions about the management system with the customer's specific requirements for the product to be supplied.
At a glance
Third-party audit
Second-party audit
A 2nd-party audit serves the risk-based evaluation of suppliers. The tasks of the supplier auditor include planning and conducting the audit, reviewing the supplier-related QM documentation, gathering information for risk evaluation, monitoring supplier performance, and preparing a report with corrective actions and deadlines.
In clause 8.4 (control of externally provided processes, products and services), ISO 9001 requires companies to define criteria for the evaluation, selection, performance monitoring and re-evaluation of external providers and to design this control on a risk basis. For suppliers posing a high risk to the company, closer controls must be provided than for non-critical suppliers.
In consulting practice, a certain pattern keeps appearing when companies run into difficulties with a new or little-known supplier. The supplier was selected based on price and availability, an existing ISO 9001 certificate was checked during the on-site visit, and the order was placed on that basis. During such a visit, however, the commercial side – such as prices and delivery times – is often the focus, while a structured technical audit questionnaire is missing and technical aspects are assessed more on the basis of general experience. Accordingly, in these cases there is often no documentation at all of the visit's technical findings.
Only when the delivery arrives does it become clear that the supplier cannot meet the required quality level. Only at this point are further subject-matter experts often brought in to rescue the matter – after the damage has already been done.
Only when the delivery arrives does it become clear that the supplier cannot meet the required quality level.
A structured 2nd-party audit follows a different process. According to ISO 19011, the guideline for auditing management systems, this includes prepared working documents such as checklists, competent and appropriately qualified auditors, risk-based planning, a fact-based, documented audit report, a closing meeting to agree on the findings, and the tracking of corrective actions through to effectiveness verification.
Building blocks of a structured 2nd-party audit
Source: ISO 19011, guidelines for auditing management systems
If this structure is missing, industry sources name typical consequences: superficial or biased assessments, incompletely reviewed compliance topics, and a missing follow-up process that offers only limited certainty about the actual situation at the supplier.
A second-party auditor needs the corresponding competencies. These include document review, interviewing techniques, a systematic approach to process planning – such as the turtle method – and the ability to prepare a checklist in advance and to think in a risk-based way.
With QualiTEx Global, I support companies in setting up structured 2nd-party audits – from the checklist and the risk classification of the supplier base to ongoing on-site execution.
Let's discuss, without obligation, what this development means for your company.