What are the key steps for conducting a supplier risk audit based on ISO 19011?

In order to ensure that supplier risks are effectively identified, assessed, and managed in accordance with international standards, the essential steps for conducting a supplier risk audit based on ISO 19011 are defining audit criteria aligned with risk management objectives, systematically evaluating supplier processes and controls, and documenting findings to facilitate corrective actions and continuous improvement.

One thing that I have found helpful when conducting supplier risk audits is to clearly define the audit criteria upfront. The audit criteria form the basis against which the supplier's management system and performance will be evaluated. Deriving the audit criteria from recognized risk management standards, industry best practices, and your organization's requirements helps ensure the audit stays focused on assessing the most relevant risks. It also provides transparency for the auditees on what specifically will be assessed. Defining the audit criteria early on and communicating them to the supplier being audited sets clear expectations and enhances the efficiency and effectiveness of the audit process for both parties.

One thing that I have found helpful is to include both subject experts and trained auditors on the team. The subject experts bring in-depth knowledge of the processes and risks being audited. The trained auditors know how to apply formal audit procedures and techniques. By combining these skill sets, you end up with an audit team that can effectively evaluate the technical aspects while upholding audit protocols. This helps lend more credibility and weight to the audit findings. Additionally, having both internal team members and external third-party auditors can reduce potential conflicts of interest and bias.

ISO 19011 promotes a risk-based approach. Begin by assessing risks associated with supplier performance. Consider factors such as quality, delivery timelines, compliance, and financial stability. Identify areas where risks are higher, especially those linked to weaker supplier scores. Develop an audit plan that aligns with the identified risks. Focus on areas where supplier performance gaps or weaknesses exist.

One thing that I have found helpful is to formally document the agreed-upon audit actions in a supplier corrective action plan. This captures the specific findings, root causes, planned actions, owners, and due dates. Establishing regular check-in meetings to review progress against the corrective action plan provides joint accountability to ensure items are addressed in a reasonable timeframe. Linking supplier audit performance to potential impacts on future business also incentivizes the supplier to follow through. Overall, taking a collaborative yet firm approach to formally tracking and reviewing corrective actions leads to sustainable risk reduction with suppliers rather than allowing issues to drag out because of a lack of alignment.

Working together with suppliers to resolve audit issues has several benefits. Joint efforts improve processes and products, while addressing issues promptly reduces risks. This collaboration builds trust, strengthens buyer-supplier relationships, and ultimately leads to cost-effective solutions through shared insights driving continuous improvement.

One story that illustrates this shift was when I was auditing a key supplier that had received some major non-conformances in the previous year's audit. I could sense hesitation and anxiety when I arrived for the follow-up. Rather than diving right into questioning, I took time to meet with leadership over coffee, ask about challenges they had faced, and better understand their perspective. The audit itself still covered what was needed, but it felt more like a robust conversation between partners. In the end, they appreciated that I took the time to see things from their side. And I gathered intel I wouldn't have gotten through a more adversarial approach. Now collaboration and mutual understanding are core to how I lead supplier audits.