EN
2026Oct 22

Supplier Audit Checklist: How Japanese Customers Audit You

Working with JapanUpdated October 23, 202627 min read

Your plant supplies stamped and plated parts to a Japanese customer, either in Japan or at its factory in Thailand, India, or the US. An email arrives from their purchasing and quality assurance team: an audit plan with a date, a list of records they want to see, and a jiko shindan-hyo (自己診断票, supplier self-assessment questionnaire) to fill in before the visit. You have passed their incoming inspection for months, so what are they coming to look at?

The short answer: a supplier audit checks the system that makes your parts, not only the parts themselves. The auditors want to see that the processes, people, and rules that protect quality run the way you say they do. In a well-run audit, the visit is only one of six steps. Deciding what to look at beforehand, and following up on corrective actions afterward, matter as much as the visit itself.

This guide explains a supplier audit from the customer's side, as Japanese quality and purchasing teams are advised to run one, so you can see what is coming and prepare for it. It covers the eight areas they check, the six steps of the audit, what happens on audit day, how findings and corrective action requests are written, and how your replies will be judged. It ends with a supplier audit checklist and a list of questions to ask your customer before the visit.

Key Points
  • A supplier audit (second-party audit) checks your quality system on your shop floor. Passing incoming inspection does not show the customer how your results are produced.
  • There are eight areas to check. A buyer pays the most attention to change control, sub-suppliers, and lot traceability, because problems there reach the customer directly.
  • Auditors judge you against documents you have agreed to: drawings, specifications, the quality assurance agreement, and your own QC process chart and work standards.
  • On the day, expect them to walk the material flow and to connect what people say, what they see, and what the records show.
  • A finding closes only when the fix is in place and shown to work. "We retrained the operator" rarely closes anything.
Contents
  1. What a Supplier Audit Checks That Incoming Inspection Can't
  2. The 8 Areas on a Supplier Audit Checklist
  3. The 6 Steps of a Supplier Audit
  4. Before the Audit: What the Customer Prepares
  5. Audit Day: They Walk the Material Flow
  6. After the Audit: Findings and the Corrective Action Request
  7. Closing Findings: How Your Reply Will Be Judged
  8. Supplier Audit Preparation Checklist
  9. Questions to Ask Your Japanese Customer Before the Audit
  10. Limits of This Guide
  11. FAQ

What a Supplier Audit Checks That Incoming Inspection Can't

Inspector measuring a zinc-plated bracket with calipers at incoming inspection

In a supplier audit, the buyer visits your factory or office to confirm that the system that builds quality into the product works as defined. Auditors classify audits by who does them. An organization checking itself runs a first-party (internal) audit. A certification body runs a third-party audit. A customer auditing its supplier runs a second-party audit, called sapuraiya kansa (サプライヤー監査) or dai-nisha kansa (第二者監査) in Japanese.

ISO 19011:2018 (published in Japan as JIS Q 19011:2019) gives guidance on how to audit management systems, mainly internal audits and second-party audits. It is guidance, not a requirement, but its sequence of starting the audit, preparing, conducting it, reporting, completing, and following up fits a supplier audit well.

The requirement behind supplier audits sits in ISO 9001:2015 clause 8.4. It requires the buyer to set and apply criteria for evaluating, selecting, monitoring the performance of, and re-evaluating external providers (suppliers and subcontractors), and to keep records of these activities. It does not require on-site audits. The buyer decides how to control each supplier according to risk. ISO 9001:2026 was published on September 16, 2026; this guide uses the clause numbers of the widely used 2015 edition.

If you pass incoming inspection and your delivery and defect numbers look fine, why would a customer still audit you? Because inspection results and monthly performance data show only outcomes that have already happened. An audit looks at the processes, people, and rules that produce those outcomes, and it can find weak points before they show up as defects.

Figure 1: Incoming Inspection vs. Performance Monitoring vs. Supplier Audit

The three do not replace one another; each looks at something different.

Incoming inspection
Performance monitoring
Supplier audit
Looks at
The delivered lot itself
Trends in defect rate, on-time delivery, and similar
The system: processes, people, rules, and records
Tells you
Whether to accept that lot
Trends and ranking by supplier
Why results happen, and what problems are likely next
Where and how often
At the customer's receiving area, for every delivery
At the customer's desk, monthly or quarterly
On the supplier's floor, when needed
Weak point
Sampling misses low defect rates
Acts only after things get worse
Takes effort; not every supplier can be visited

ISO 9001:2015 clause 8.4 requires criteria and records for evaluation, selection, monitoring, and re-evaluation. The company decides which methods to use.

The 8 Areas on a Supplier Audit Checklist

Figure 2: The 8 Areas a Supplier Audit Covers

The customer starts from the full picture, then picks the areas to examine closely for this audit.

1. Quality System and Documents
SystemResponsibilities and authority, control of the latest drawings and specifications, training and operator qualification
2. Receiving and Storage
Shop floorIncoming checks on materials, identification, first-in first-out, storage conditions
3. Process Control
Shop floorQC process chart and work standards, setting and recording conditions, equipment and jig checks
4. Inspection and Measuring Equipment
Shop floorInspection criteria and records, boundary samples, calibration status of measuring equipment
5. Nonconforming Product and Corrective Action
SystemSegregation and disposition of nonconforming product; whether past corrective actions are holding
6. Change Control
Buyer priorityA process for notifying changes in material, equipment, method, or people in advance
7. Sub-Suppliers and Outsourcing
Buyer priorityKnowing which processes are outsourced, evaluating subcontractors, checking returned parts
8. Traceability and Shipping
Buyer priorityTracing a lot back to material, pre-shipment checks, packaging and labeling

Sample questions and records for each area are in Figure 7.

What a customer checks falls into eight areas. Five of them (quality system and documents, receiving and storage, process control, inspection and measuring equipment, and nonconforming product and corrective action) cover the same ground as an internal audit.

The other three, change control, sub-suppliers and outsourcing, and traceability and shipping, carry more weight for a buyer. They do not stay inside your factory; they affect the customer's receiving and the customer's own deliveries. Suppose you switch a material or a machine with good intentions, and the change causes a defect in the customer's process. Inspecting your delivered parts will not always catch that.

Depth Depends on the Type of Audit

An auditor who tries to cover all eight areas equally in one day ends up only confirming that documents exist. Instead, the customer chooses which areas to examine closely based on why the audit is happening:

  • New supplier approval (before the first order): a broad look at your organization and process capability.
  • Periodic audit (for an existing supplier): whether past findings stayed fixed, and what has changed since.
  • After a quality problem (defects that escaped, repeated late deliveries): concentrated on the process where the problem started and on the corrective action.
  • Change notification (you reported a process or material change): narrow and deep, on the changed point and what it affects.

Figure 3: Which Areas Get the Closest Look, by Audit Type (Example)

◎ = time spent tracing physical evidence and records; ○ = checked once through.

Area
New supplier
Periodic
After a quality problem
Change notification
Quality system and documents
New supplier◎
Periodic○
After a quality problem–
Change notification–
Receiving and storage
New supplier○
Periodic○
After a quality problem◎ if related to the cause
Change notification◎ if material changed
Process control
New supplier◎
Periodic○
After a quality problem◎
Change notification◎
Inspection and measuring equipment
New supplier◎
Periodic○
After a quality problem◎
Change notification○
Nonconforming product and corrective action
New supplier○
Periodic◎
After a quality problem◎
Change notification–
Change control
New supplier○
Periodic◎
After a quality problem○
Change notification◎
Sub-suppliers and outsourcing
New supplier○
Periodic◎
After a quality problem◎ if related to the cause
Change notification◎ if subcontractor changed
Traceability and shipping
New supplier○
Periodic○
After a quality problem◎
Change notification○

This split is only an example. The customer sets it again for each audit, based on how critical the part is and on past performance.

The 6 Steps of a Supplier Audit

Figure 4: The 6 Steps of a Supplier Audit

The visit is one step of six; the other five decide what the results are worth.

Preparation
01Set scope and purposeWhich supplier, which part numbers and processes, and why
02Research and planningCollect performance data and the self-assessment questionnaire, choose the method and date, notify the supplier
03Build the checklistGather the documents that set the requirements and narrow down the focus items
Audit day
04Check on siteOpening meeting, shop floor, documents, closing meeting
After the audit
05Report and corrective action requestGrade findings, set reply deadlines and contacts, issue in writing
06Verify and feed backConfirm the fix is implemented and effective, close, update the supplier rating and next plan

Rearranged for supplier audits from ISO 19011:2018 (JIS Q 19011:2019) clause 6: initiating, preparing, conducting, reporting, completing, and following up an audit.

A supplier audit has three preparation steps, one on-site step, and two follow-up steps. Audits turn into a formality when the customer treats Step 4 as an event and leaves Steps 5 and 6 to individual staff with no follow-through. From the supplier's side, this means the audit is not over when the auditors leave.

The audit team is often two people, one from purchasing and one from quality assurance. For complex processes, a production engineer or design engineer may join. Purchasing looks at commercial terms and communication rules, quality assurance looks at inspection and corrective action, and the engineer judges whether your process conditions make sense. In the customer's purchasing workflow, the audit belongs to supplier selection and evaluation.

Who comes affects what they find. IATF 16949, the automotive quality management standard, requires the customer to demonstrate the competence of its second-party auditors in clause 7.2.4. That includes understanding the manufacturing process being audited, including the process FMEA and the control plan (Japanese suppliers often call the control plan a QC kotei-hyo, QC工程表, or QC process chart). In any industry, having at least one auditor who knows the process keeps the audit from stopping at a paperwork check. Related: DRBFM vs FMEA.

Related: AIAG-VDA FMEA for Japanese Customers: DFMEA vs PFMEA

Before the Audit: What the Customer Prepares

Desk with a drawing, clipboard, calipers, and bracket samples laid out for audit preparation

Before the visit, the customer decides three things: which supplier to visit, what to judge you against, and how to check. The rest of this guide uses one fictional example. The part is a bracket made by sheet-metal stamping and zinc plating. You (the direct, or tier-1, supplier) do the stamping in-house and send the plating to an outside plating shop.

Why You Were Selected

No customer can visit every supplier every year, so the choice is based on risk. IATF 16949 clause 8.4.2.4.1 asks automotive companies to base the need, type, frequency, and scope of second-party audits on a risk analysis that includes product safety and regulatory requirements, supplier performance, and the supplier's quality certification level. The IATF's published FAQ adds that, depending on that analysis, a second-party audit may not be needed at all, and lists further criteria such as product complexity, new product launches, significant staff turnover, and quality and delivery problems. The same criteria work as a yardstick for setting priorities in other industries. Expect a closer look if any of these apply to you:

  • You make parts whose failure has serious consequences (safety- or regulation-related parts).
  • You have had repeated incoming rejects or late deliveries, or your corrective action replies have been late.
  • A new product launch or a major change in plant, equipment, or key staff is coming up.
  • You lack certification such as ISO 9001, or the customer has no alternative source.

The Documents They Judge You Against

An auditor who arrives without a clear standard cannot say whether what they see is acceptable. A finding counts as a nonconformity only when the facts do not meet a requirement you have agreed to.

Those requirements live in drawings and specifications, the hinshitsu hosho kyotei-sho (品質保証協定書, quality assurance agreement) or the quality clauses of the basic transaction agreement, the nonyu shiyosho (納入仕様書, delivery specification), the inspection agreement, and the rules for notifying changes. Your own QC process chart and work standards count too, because you wrote them. In the bracket example, the customer checks before leaving which document, and which section, states the plating thickness and appearance criteria and the rule that a change of plating subcontractor must be notified in advance. For what a delivery specification usually covers, see Delivery Specification (Nonyu Shiyosho).

Related: Quality Assurance Process at Japanese Plants: 8 Steps

This step sometimes exposes gaps on the customer's side: the change-notification rule was never written down, or a requirement missing from the drawing was only given verbally. The buyer is expected to fix the agreement first, because citing a requirement the supplier was never given will not lead to a real corrective action. If you are unsure whether a requirement is actually written somewhere, ask before the audit.

The Self-Assessment Questionnaire and Your Track Record

To save time on the day for checking physical evidence, the customer collects on paper what it can in advance. The self-assessment questionnaire typically asks for your organization chart, process flow, QC process chart, main equipment, outsourced processes and subcontractors, and certifications.

On their side, the customer lines up your history for the past one to two years: incoming rejects (count and type), on-time delivery, earlier corrective action requests and your replies, and the change notifications you sent. Processes with many defects, corrective actions that were answered only on paper, and anything that changed without notice become the focus on the day. They also pick one lot you actually delivered and will ask you to trace it during the audit.

On-Site, Document, or Remote Audit

An on-site visit is not the only option. For low-risk suppliers, a customer may accept the self-assessment questionnaire plus supporting documents, and spend the saved time on on-site audits of critical suppliers. Across the whole supplier base, that approach misses fewer problems.

Figure 5: What Each Audit Method Can and Cannot Confirm

The method is chosen by what needs to be confirmed, not by a fixed rule.

ON-SITEOn-site auditGood for: Actual work practices, identification and placement of parts, condition of equipment and jigs, questions to operatorsWeak at: Travel and time make it costly, so only a limited number can be done
DOCUMENTDocument review (self-assessment)Good for: Anything that can be answered on paper: organization, certifications, process flow, list of subcontractorsWeak at: Whether things really run as answered; self-reported answers tend to be generous
REMOTERemote auditGood for: Records shared on screen, interviews, rechecking the state after a corrective actionWeak at: Places the camera does not show, the overall feel of the floor, how operators naturally work
One typical approach: on-site for new suppliers, critical parts, and after quality problems; documents for stable, low-risk parts; remote added for corrective action checks and distant suppliers.

Among its changes from the 2011 edition, ISO 19011:2018 (JIS Q 19011:2019) added guidance on virtual audits and on auditing supply chains.

The Audit Plan

Once the date is set, the customer should send a written audit plan. It typically states the purpose, the part numbers and processes in scope, the auditors, the timetable, the records to be shown, and whether photos and copies of documents may be taken away.

Your factory also makes products for other customers and holds its own process know-how. What you will show and how information will be handled should be agreed in advance, based on the basic transaction agreement or the non-disclosure agreement. Unannounced visits are generally reserved for cases where the contract provides for them and a serious problem is suspected.

Audit Day: They Walk the Material Flow

Figure 6: The Route Through Your Shop Floor

Auditors walk from incoming material to shipped product, in the same order as the parts.

01ReceivingIncoming checks on materials and outsourced parts
02StorageIdentification, locations, first-in first-out
03Processing and assemblyConditions, work standards, equipment and jigs
04InspectionCriteria, records, measuring equipment
05Nonconforming areaSegregation and disposition records
06Packing and shippingLabels, pre-shipment checks, lot records

If a process is outsourced, the route includes both where parts leave and where they come back.

The day usually runs in this order: opening meeting, shop-floor tour, document review, a private discussion among the auditors, and the closing meeting. The opening meeting confirms the purpose, scope, timetable, and the rules for access and photography. It should be kept short to leave time for the floor.

On the floor, the auditors follow the parts from receiving to shipping. Compared with asking questions clause by clause in a meeting room, this exposes the problems that occur where one process hands off to the next. Unlabeled work in process, an area where nobody can say which parts are inspected, and how boxes returning from a subcontractor are handled are the kinds of things auditors notice only by walking.

Checks and Sample Questions by Area

Figure 7: Checks, Sample Questions, and Records by Area

Questions reveal the procedure, physical evidence shows reality, and records show it is consistent.

Area
What they look at
Sample question
Records checked
Receiving
What they look atHow materials and outsourced parts are accepted or rejected
Sample question"When this material arrives, what do you check before using it?"
Records checkedMaterial certificates (mill sheets), incoming inspection records
Storage
What they look atIdentification, separation of accepted and uninspected parts, storage conditions
Sample question"Which lot is the oldest, and in what order do you use them?"
Records checkedPart tags, stock in/out records
Process
What they look atWhether QC process chart conditions match machine settings and actual work
Sample question"Who can change the conditions, and where is the change recorded?"
Records checkedQC process chart, work standards, condition records, start-up check sheets
Special processes
What they look atCondition control and operator qualification for processes hard to verify afterward, such as heat treatment, welding, and plating
Sample question"What happens to a lot when conditions go out of range?"
Records checkedContinuous condition records, operator qualification records, periodic verification tests
Inspection
What they look atWhether inspection criteria match the latest drawing; control of boundary samples
Sample question"When you are unsure about a judgment, who decides, and what do you show them?"
Records checkedInspection standards, inspection reports, boundary sample register
Measuring equipment
What they look atCalibration due dates, identification, storage
Sample question"When a calibration found an instrument out of tolerance, what did you do with parts already measured?"
Records checkedCalibration records, measuring equipment register
Nonconforming product
What they look atSegregation area and labels, who decides disposition, reinspection after rework
Sample question"Who decides what happens to the parts in this box, and when?"
Records checkedDisposition records, past corrective action reports
Change control
What they look atHow changes are identified, and who decides whether to notify the customer
Sample question"Pick one recent equipment or material change and show us how it went from notification to the floor."
Records checkedChange log, change requests and approvals, first-piece inspection records
Sub-suppliers and outsourcing
What they look atList of outsourced processes, subcontractor evaluation, checks on returned parts
Sample question"When you change a subcontractor, who approves it, and when do we hear about it?"
Records checkedSubcontractor list, evaluation records, receiving records for outsourced parts
Traceability and shipping
What they look atWhether a shipped lot traces back to material lot, processing date, and inspection records
Sample question"Can you pull up the material, processing date, and inspection results for this lot number now?"
Records checkedProduction records, final inspection records, shipping log

Questions are examples. Good checklists include "not applicable" and "not checked" alongside "conforms" and "does not conform," so that items the auditor could not see are not left vague.

Questions, Physical Evidence, and Records

Yes/no checklist items only get "Yes, we do that" as an answer. Instead, auditors ask operators and supervisors to explain the procedure, then check whether the explanation matches what is in front of them, and whether the records show it is done consistently.

In the bracket example, an auditor stands at the press and asks, "After a die change, what do you check on the first piece?" Then they ask for that day's first-piece inspection record, pull several records from a month earlier, and look for gaps or entries that were filled in afterward in one sitting. When a check procedure exists on paper but is not followed, the causes often overlap with the reasons work standards are not followed in general. Blaming the individual operator does not fix it.

Related: Standardized Work Instructions: Sagyo Hyojunsho Template

Auditors choose which records to see, by date or lot, rather than letting you pick. They note what they saw, the job title of the person they spoke to, and the name and date of each record, because these become the evidence when they write findings.

Five Areas a Buyer Probes Hardest

Change control. The question is less whether you have a notification rule than where your people draw the line on what counts as a change. Switching material makers, replacing a die, moving a machine, changing an operator, and changing a subcontractor are all changes. Japanese customers group them as 4M henko (4M変更, 4M changes): man, machine, material, and method. Expect to be asked to pick one recent change and walk through it from notifying the customer, through approval and first-piece inspection, to the update on the floor.

Sub-suppliers and outsourcing. The customer first checks how you evaluate your subcontractors and how you inspect parts when they come back. In the bracket example, it makes a big difference whether you measure plating thickness yourself or simply accept the plater's certificate. The customer considers visiting your sub-supplier directly only when that process determines quality and your controls leave doubts. Since there is usually no contract between the customer and your sub-supplier, such a visit is normally requested through you, with you attending, and access and disclosure depend on the contracts in place.

Traceability. This is checked by demonstration, not by asking. The auditor gives you the number of the delivered lot chosen in advance and asks you to produce, on the spot, the material lot, the processing date and machine, the inspection records, and the dates the parts went to and came back from the subcontractor. How far back you can trace, and how long it takes, shows how well you could narrow down the affected range if a defect occurred.

Special processes. Heat treatment, welding, plating, and painting are processes whose results are hard to verify by inspecting the finished part. Auditors therefore look less at final inspection records and more at whether conditions such as temperature, time, and bath concentration are recorded continuously, and whether there is a defined procedure for lots processed outside the specified conditions. They also check that the process FMEA, which lists the conditions that lead to defects, matches the control items in your QC process chart.

Measuring equipment. Auditors pick a few instruments in use on the floor and check that the calibration due date on each matches the equipment register. They also ask what you did with parts already measured when a calibration found an instrument out of tolerance.

Related: JCSS Calibration: Certificates, Intervals, and Records

The Closing Meeting

After the floor and documents, the auditors meet privately to compare what they found. In the closing meeting, they present each potential finding with the requirement it relates to and where they saw what. The purpose is not to announce a verdict but to agree on the facts with you. If you can produce a record they missed, the finding should be withdrawn, so have the right people and records at hand. The deadline for your corrective action reply and the contact person on each side are also set here.

After the Audit: Findings and the Corrective Action Request

Four people in work uniforms discussing documents in a meeting room next to the factory floor

The customer should send the audit report and the zesei yokyu-sho (是正要求書, corrective action request) as soon as possible, because memories and momentum fade on both sides. Setting an internal target, such as within one week, helps.

How a Finding Is Written

A well-written finding separates three things: the facts observed, the requirement they were compared with, and the judgment. For the bracket example, it might look like this (dates and wording are fictional):

  • Facts observed: The plating subcontractor changed to a different company in April 2026. There was no change request record, and the customer was not notified. (Confirmed by interviewing the production section manager and from the receiving records for plated parts.)
  • Requirement: The clause in the quality assurance agreement stating, "When changing a subcontractor, notify the customer in writing in advance and obtain approval."
  • Judgment: Nonconformity (change control).

A finding like "change control is inadequate" does not tell you what to fix. If you receive one, ask the customer for the specific facts and requirement behind it.

How Findings Are Graded

Many companies grade findings in three levels: major nonconformity, minor nonconformity, and observation (opportunity for improvement). No standard fixes these levels for everyone. Each company sets the number of levels and the criteria.

In supplier audits, grading is most consistent when it is based on whether the issue affects delivered product or the customer's own customers. By that test, changing a subcontractor without notice affects parts already delivered, so it is an example of a finding treated as a major nonconformity. A one-off gap, such as one day missing from a check sheet, is typically a minor nonconformity. Something that breaks no agreed requirement but could become a problem is passed on as an observation.

What the Corrective Action Request Asks For

Besides the finding, the request states what your reply must include and the deadline. The basic contents are four items:

  • Containment: immediate action, including checking how far the problem reaches into parts already delivered.
  • Root cause.
  • Permanent corrective action and its implementation date.
  • How effectiveness will be verified.

Deadlines are usually tiered by severity. For a major nonconformity, for example, the containment reply might be due within a few days and the root cause and permanent action within two to four weeks. These numbers are only illustrations; the actual deadlines follow the quality assurance agreement or similar. In automotive, many customers specify the 8D report as the reply format.

Related: How to Write an 8D Report: D0–D8 and the Toyota 8-Step

Scores and Ratings

Some customers convert audit results into a score to compare suppliers or track changes from the last audit. A well-known example is VDA 6.3, the process audit standard of the German Association of the Automotive Industry (VDA). The current edition, VDA 6.3:2023, was published in January 2023 and has 59 questions.

Each question is scored 10, 8, 6, 4, or 0. The overall result is classified A (90% or higher), B (80% to under 90%), or C (below 80%). However, downgrading rules can lower the class when key questions score poorly, even if the overall percentage is high, so the score alone does not decide the outcome. The same idea is useful for an in-house scoring system: the score shows trends, while business decisions rest on the severity of individual findings and the progress of corrective actions.

Closing Findings: How Your Reply Will Be Judged

Worker checking parts hung on racks over a plating line

Sending the report does not finish the audit. Your quality changes only when the findings are corrected and the correction holds.

Four Points Your Corrective Action Reply Must Cover

Your reply will be read against these four points and sent back, with reasons, if any is missing:

  • Scope of impact: Did you check parts already delivered, work in process, and stock?
  • Cause: Did you address both why it happened and why it was not detected?
  • Permanent action: Did a system or procedure change, rather than only "informed all staff" or "retrained"?
  • Effectiveness check: Is it defined what will be checked, until when, and with which records?

Many replies are sent back because the root cause stops at "operator's lack of awareness." The customer will want you to dig into why the process did not stop the error even though awareness was lacking. If process variation is part of the cause, showing before-and-after control charts or process capability indexes (Cp/Cpk) makes the reply much easier to accept.

"Implemented" Is Not "Effective"

The customer should set the conditions for closing a finding when it issues the finding. The key distinction is that putting a fix in place is not the same as showing it works. Revising a procedure proves only that the action was implemented.

Figure 8: Closing One Finding, Step by Step (Example)

How a finding of an unnotified subcontractor change moves to closure.

STEP 1Corrective action requestFacts, requirement, and judgment issued in writing, with required reply items and deadlinesOpen
STEP 2Containment replyRange of lots delivered after the change, plus recheck results for plating thickness and appearanceNot closed
STEP 3Root cause and permanent actionSubcontractor changes were not covered by change control; the scope list and request form will be revisedNot closed
STEP 4Evidence of implementationRevised rules and form, plus training records for the people involvedNot closed
STEP 5Effectiveness checkReview three months of the change log to confirm that outsourcing-related changes were requested and notifiedClosed if conditions are met
STEP 6Feedback to ratingResults recorded in the supplier rating and the next audit plan, with this item as a focus next timeDone

The three months is an example. The review period and number of records are set for each finding, based on how often changes and production happen.

Effectiveness can be confirmed through documents and evidence, through records shown remotely, or by another visit. For major nonconformities and for fixes that change the work on the floor, a revisit is the most reliable. For findings linked to defects in delivered parts, the customer also looks at incoming inspection results for a period after the fix.

When Deadlines Slip or Progress Stalls

If your reply is late, the customer typically stops chasing at the working level and escalates in a set order, from the working-level contact to a manager, then to the person in overall charge. At the same time, they tighten their own incoming inspection to stop defects from getting through.

If there is still no improvement, business measures come into play, such as holding off on orders for new part numbers or looking for an alternative source. That decision should not rest with the auditors or the quality department alone. Stopping orders can stop the customer's own production, and switching suppliers means requalification and time. The usual split is that quality presents the facts and risk assessment, purchasing presents the supply impact and alternatives, and an authorized approver decides. Knowing in advance which situation leads to which response also helps you set priorities for improvement.

How Results Feed into Your Supplier Rating

The audit results go into the customer's supplier evaluation records. ISO 9001:2015 clause 8.4 requires records of evaluation and re-evaluation activities and of any actions arising from them, and the audit report, corrective action request, replies, and effectiveness records together meet that requirement.

The next audit plan is adjusted too. Suppliers with few findings and quick corrective actions may see longer intervals or a switch to document-based checks. Suppliers with slow corrective actions, or the same type of finding again and again, are audited more often. If a customer visits the same suppliers every year with the same checklist, it is time for them to review both the suppliers selected and the checklist items.

An audit is not a hunt for faults. Counting findings as achievements, or questioning people like suspects, teaches suppliers to hide inconvenient facts. A customer that points out issues based on facts, and shares the information you need to fix them, protects its own quality in the end. As the supplier, the most useful response is the mirror image: show the real situation, and ask for what you need to fix it.

Supplier Audit Preparation Checklist

Use this list to prepare for an audit by a Japanese customer. It turns the customer-side steps above into things you can check in advance.

Before the visit

  • Audit type confirmed (new supplier approval, periodic, after a quality problem, or change-related) and the areas likely to be examined closely
  • Written audit plan received: purpose, part numbers and processes, auditors, timetable, records requested
  • Rules on photos, copies, and confidential areas agreed in advance
  • Self-assessment questionnaire answered with evidence you can show on the day
  • Latest drawing revision, specification, quality assurance agreement, and delivery specification on hand, with the clauses that apply to the audited parts identified
  • Your own record reviewed: rejects, late deliveries, open corrective actions, and changes notified (or not) over the past one to two years
  • QC process chart, work standards, and process FMEA consistent with each other and with what happens on the floor

Shop floor and records

  • Every lot on the floor identified, with inspected and uninspected parts clearly separated
  • Nonconforming product area labeled, with records of who decided the disposition
  • Measuring equipment in use within its calibration date and listed in the register; a recorded response for any out-of-tolerance results
  • Continuous condition records for special processes (heat treatment, welding, plating, painting) and a defined rule for lots out of condition
  • Operators able to explain their own procedure, including first-piece checks after a die or tool change
  • Inspection criteria matched to the latest drawing revision, and boundary samples (gendo mihon, 限度見本) under control

Buyer-priority areas

  • 4M change log up to date; one recent change ready to walk through from notification to the floor
  • List of outsourced processes and subcontractors, with evaluation records and receiving checks for returned parts
  • Traceability drill done: from a delivered lot number back to material lot, processing date and machine, inspection records, and subcontractor shipping and return dates

After the audit

  • Each finding stated as facts, requirement, and judgment; ask for clarification if it is not
  • Reply covers scope of impact, cause (occurrence and detection), permanent action, and effectiveness check
  • Reply deadlines and the customer's contact person recorded
  • Evidence ready to show both implementation and effectiveness, in line with the agreed closure conditions

Questions to Ask Your Japanese Customer Before the Audit

  • What is the purpose of this audit, and which part numbers and processes are in scope?
  • Which agreement or document will findings be judged against? Is there a requirement we have received only verbally?
  • Which records should we have ready, and which delivered lot will you trace?
  • Is the audit on-site, document-based, or remote, and will a revisit be needed?
  • Can auditors take photos or copies? Which areas are off-limits because of other customers' products?
  • Do you need to visit our plating (or other) subcontractor? If so, how should we arrange it?
  • How are findings graded, and what reply format do you expect (your own form, 8D, or another)?
  • What are the reply deadlines for containment and for permanent corrective action?
  • How will results affect our supplier rating and the next audit interval?

Limits of This Guide

  • Practices vary. Document names, how findings are graded, reply deadlines, and how results link to business decisions differ between customers, industries, and projects. Your quality assurance agreement and your customer's instructions take priority over anything here.
  • The deadlines, intervals, and the bracket example are illustrations. They show how the process works, not values you can expect from a particular customer.
  • Automotive customers add their own requirements. IATF 16949 sets requirements for second-party auditor competence, VDA 6.3 provides a scored process audit, and many customers specify 8D for corrective action replies. Customer-specific requirements can add more.
  • Contract and legal questions are not covered. What you must disclose, and whether an unannounced visit or a visit to your sub-supplier is allowed, depends on your contracts. Check with your own legal or contracts team.

FAQ

What Is a Second-Party Audit?

A second-party audit is an audit a customer carries out on its supplier. A first-party audit is an internal audit, and a third-party audit is carried out by a certification body. ISO 19011 gives guidance that applies to second-party audits.

Does ISO 9001 Require Customers to Audit Their Suppliers On-Site?

No. ISO 9001:2015 clause 8.4 requires criteria for evaluating, selecting, monitoring, and re-evaluating suppliers, and records of those activities. The customer chooses the method, such as on-site audits, document reviews, or performance monitoring, according to risk.

What Is a 4M Change?

A 4M change is a change to man, machine, material, or method: for example, a new operator, a moved or replaced machine, a different material maker, or a revised process. Japanese customers usually expect advance notice of such changes, as set out in the quality assurance agreement.

How Do I Respond to a Corrective Action Request from a Japanese Customer?

Cover four points: containment (including parts already delivered), the root cause of both the occurrence and why it was not detected, a permanent action that changes the system or procedure, and how and when you will verify that it works. Replies that stop at "retrained the operator" are often sent back.

What Is a Passing Score in a VDA 6.3 Process Audit?

VDA 6.3 classifies results as A (90% or higher), B (80% to under 90%), or C (below 80%). Downgrading rules can lower the class when key questions score poorly, so a high percentage does not guarantee an A.

Sources

Found this useful? Share it

About the editor

MONOSCOPE EditorFOUNDER & EDITOR

Spent about ten years at a plant equipment maker and a plant engineering company, proposing, designing, and commissioning equipment, then moved into web marketing. Now a web consultant for B2B manufacturers, helping them explain their products and technology. Licensed in Japan as an Energy Manager and a Third-Class Chief Electrical Engineer.

Has run an engineering blog since 2017 (500+ articles) and a Japanese YouTube channel with about 20,000 subscribers. Each English guide is written from the Japanese shop-floor point of view and checked against the cited standards.

MoreRelated

More guides

All guides