Supplier Second-Party Audit Pages on Changzhou Manufacturer Websites: How Should They Be Accepted?

Direct answer: A supplier audit (second-party audit) page cannot just say "we audit suppliers regularly and have an audit process." It should state which audit type (system/process/product/special), scope and criteria, frequency, who audits, how auditor competence and independence are assured, how the plan and sampling are set, what checklists and evidence are kept, how nonconformities are graded, how corrective action/CAPA is verified and closed, how results feed grading/tightening/exit, the limits of remote/hybrid audits, and what must not be published. Otherwise, when a customer asks "how do you audit subcontractors, what happens with a major nonconformity, is a corrective-action report enough to close," the answer becomes an ad-hoc explanation.

This guide is for procurement, quality, process, production and website teams at manufacturers in Changzhou and nearby industrial areas. It explains how to build and accept a supplier second-party audit page. Information is current to 2026-11-02. It is a review of public standards and project practice, not an audit, certification or legal opinion; the specific audit programme, criteria, grading, frequency and closure requirements depend on customer requirements, the contract/quality agreement, the audit programme and company procedures.

How does the supplier audit page relate to AVL, IQC, 8D and factory-visit pages?

The supplier onboarding/AVL page answers "how a supplier is admitted and what documents it submits"; the IQC page answers "how each incoming lot is inspected"; the 8D page answers "how customer complaints are closed"; the factory-visit page answers "how customer visits are hosted"; the supplier audit page answers "how we go on site to audit system/process/product, raise nonconformities, verify correction and use the result." Admission is "getting in"; audit is "watching after entry"; IQC is "watching each lot"—none replaces the others.

The common break is: once a supplier joins the AVL it is not audited for years; the auditor is purchasing staff who only look at documents, not the floor; the checklist is the same every year and ignores customer complaints/changes/new processes; nonconformities say only "recommend strengthening" with no grade or deadline; a corrective-action report closes the finding without verifying root cause/effect; audit results are not linked to orders/tightening/downgrade; when a customer audits, the supplier audit records cannot be produced. A page that states scope, criteria, plan, sampling, grading, CAPA and result use gives procurement, quality and SQE one rulebook.

This page map is editorial; a second-party audit is a type of external audit, and its principles/programme/conduct may follow GB/T 19011-2021.

Which types of second-party audit exist: system, process, product, special, remote

Five common types: system audit (QMS/EHS/social responsibility), process audit (a line/process/project, in the spirit of VDA 6.3), product audit (finished part/product conformity), special audit (change, complaint, capacity, EHS, confidentiality) and remote/hybrid audit (documents + video + remote interviews, with on-site follow-up where needed). Each type has different objectives, scope, criteria, samples and auditors and cannot all use one checklist. The page can say "system/process/product/special audits supported", but should explain each type's use and limits.

Customers sometimes ask to share a supplier audit report or to use a second-party audit instead of third-party certification—distinguish them: a second-party audit is the buyer's evaluation of the supplier; third-party certification is a certification body's certification of the system. A customer may accept a second-party report as a reference, but that does not mean "no certification/no customer audit". Remote audit cannot fully replace on-site: equipment condition, floor execution, material segregation and safety conditions need on-site confirmation; remote fits documents/records/part of interviews, and key items need on-site verification.

This type split is editorial; specific types, methods and remote applicability follow the audit programme, customer requirements and standards.

How should audit scope, criteria and frequency be set?

Scope should state which products/lines/processes/sites are covered, which departments/shifts, whether subcontracting/warehouse/lab are included, and whether new projects/changes are included; criteria should state the ISO/GB standards, customer CSR, contract/quality agreement, regulations, company procedures and previous audit nonconformities; frequency should be risk-based: new supplier/new project/high risk/many complaints/post-change get more audits, stable suppliers can be extended. "Every supplier once a year" or "audit only after an incident" is not a programme.

Frequency also depends on performance: PPM/lot acceptance, complaints, SCAR closure, delivery, audit history, certification status and capacity/process changes. Where the customer specifies frequency/scope, follow the customer; where the customer requires attendance/shared reports, agree confidentiality and scope in advance. The page can say "frequency by risk/performance, covering system/process/product", but not "all suppliers audited annually/audit passed means permanently qualified".

Scope/criteria/frequency are editorial; specifics follow the audit programme, customer CSR, contract and risk assessment.

How should the audit plan and sampling be arranged?

The plan should cover opening meeting, document/record review, site walk, interviews, sampling, closing meeting, report and correction deadline; sampling should be representative across shifts/equipment/orders/batches/warehouse locations/outsourced processes, not just "the model line/model lot". Audit sampling combines judgement and statistics; the sample must support the conclusion, and anomalies require additional samples/traceability rather than "one good sample ends the audit".

On-site auditing looks beyond "is there a document" to "is the document current, is it executed, are records real, are exceptions closed": control plan vs floor parameters, high-risk FMEA items vs poka-yoke, incoming segregation vs stock, calibration labels vs certificates, training records vs operation. Remote audits require documents in advance, video walk-throughs, screen sharing to check systems, and a note of which items need on-site verification.

Audit planning and sampling methods are editorial; specifics follow the audit programme, GB/T 19011-2021 and customer requirements.

How should auditor competence and independence be described?

Auditors need knowledge of the applicable standards/regulations, the audited process/product/technology, audit methods (questioning/observation/sampling/evidence), communication and reporting; key areas (welding/heat treatment/calibration/EHS) may need a technical expert. Auditors must be independent of the audited activity (not auditing their own work/department/purchasing decision), objective and confidential; the team needs roles and a lead auditor. Customers may ask for auditor qualifications/training records, which the company must provide.

"Purchasing also audits" is not automatically wrong, but independence/competence must be evidenced: a supplier developed by the auditor cannot be treated more leniently; the audited department cannot write its own nonconformity; the conclusion should be approved by the lead auditor/quality head. The page can say "auditors are trained/authorised, assigned by expertise, independent and objective", but not "anyone can audit/purchasing decides".

Auditor competence/independence may follow GB/T 19011-2021; specific qualifications follow customer/company requirements.

How should checklists, questions and evidence be accepted?

The checklist should cover system documents/records, management responsibility, procurement/suppliers, design/change, production/process control, inspection/calibration, nonconformance/traceability, complaints/CAPA, EHS/confidentiality; questions should land on "requirement—evidence—conclusion", not just "yes/no". Evidence includes documents, records, photos, interviews, site observation and system data; a nonconformity should state the fact, requirement/clause, evidence and impact, not "recommend strengthening management", which cannot be verified.

Questions should be open and followed up: "who sets this parameter, how is it monitored, what happens on abnormality, what was the last abnormality, where is the record"; sampling must trace to a specific order/batch/equipment/person. Audit records should retain checklist, sample list, photos, interviews, nonconformities, report and correction. The page can say "audit by checklist/evidence", but must not publish the full checklist/customer-specific requirements/supplier nonconformity details.

Checklist/evidence requirements are editorial; specific clauses/questions follow the audit criteria, customer CSR and company checklist.

How should nonconformities be graded?

Common grading: major nonconformity (system failure/likely batch, safety or regulatory risk/key item missing), minor nonconformity (isolated/local/no serious consequence), observation/opportunity for improvement (not a nonconformity but recommended). Grading rules belong in the audit programme/procedure and should align with customer/system requirements; a major nonconformity usually requires immediate containment, a deadline, possible new-order hold/tightening/re-audit; a minor one is corrected by deadline; an observation is tracked but may not need CAPA.

Grading is not "how the supplier behaves": the same fact may be graded differently under different customer/system rules, so follow the criteria and risk. A major nonconformity cannot be closed by "add a record"; investigate root cause, scope (other batches/customers), containment, corrective action and verification. The page can say "graded major/minor/observation, major requires immediate containment", but must not publish supplier/nonconformity details.

Grade names/rules follow the audit programme, customer CSR, system standard and company procedure; this article does not replace a specific audit judgment.

How should CAPA/corrective action and verification be closed?

Correction has two parts: correction (containment/correction) and corrective action (root cause/prevention). Contain first (segregate/sort/stop line/notify), then root cause (5 Why/fishbone/data), corrective action (process/document/training/poka-yoke), verification (subsequent lots/audit/data) and closure. A supplier report is not closure: review whether the root cause holds, actions are implemented, effectiveness is verified, and other products/customers are affected. Major/repeat findings need on-site re-audit or tightening.

Correction deadlines are risk-based; overdue items escalate (tightening/hold/downgrade/second source). CAPA should feed performance and the next audit focus; if the same problem recurs, the root cause/action was ineffective and another report does not help. The page can say "correction plan/CAPA/effectiveness verification/closure", but not "report received means closed/all corrections accepted".

CAPA/correction requirements are editorial; specific deadlines, verification and closure follow the audit programme, quality agreement and customer requirements.

How should audit results feed grading, tightening and exit?

Audit results should enter supplier grading/performance: score/number of nonconformities/major findings/correction timeliness/repeat findings, linked to order allocation, tightened inspection, new-project eligibility, re-audit frequency, downgrade/exit. It is not "audit, file, done". Grading rules should be transparent and appealable; a supplier disputing the conclusion needs a review/appeal channel, not "the auditor decides".

Results should also feed internal actions: incoming inspection plan, sourcing strategy, second source, customer notification where required. A customer may ask to share the audit report/correction evidence; redact/confidentiality before sharing. The page can say "results used for grading/tightening/re-audit", but must not publish supplier scores/orders/penalties.

Result use/grading is editorial; specific rules follow the supplier management procedure, contract and customer requirements.

How should remote/hybrid audits and confidentiality be described?

Remote audits suit documents/records/systems/part of interviews and can reduce cost/time, but cannot fully replace on-site work: equipment condition, floor execution, material segregation, safety/fire protection and actual shifts need on-site confirmation. A hybrid audit must state what is remote, what is on-site and what needs follow-up; remote work should use controlled platforms/screen sharing/video, keep records and protect cybersecurity/trade secrets.

Audits touch supplier customer lists, prices, processes, drawings and defect data; auditors should sign confidentiality/observe access rights, and report distribution should be limited. Where a customer asks to share, redact/obtain consent as the contract allows. The page can say "remote/on-site/hybrid audits supported, confidentiality observed", but not "remote replaces all on-site work/all reports can be public".

Remote/hybrid applicability and confidentiality follow the audit programme, customer requirements, contract and cybersecurity policy.

What should the page say, and what must not be published?

A public page should include: audit types, scope/criteria/frequency principle, auditor competence and independence, plan/sampling method, checklist/evidence, nonconformity grading, CAPA/verification, result use, remote/hybrid limits, confidentiality and a contact route. Do not publish: supplier names/scores/nonconformity details, customer lists/drawings/special characteristics, full audit reports, prices/orders, or open disputes.

Wording must be precise: "audit programme set by risk/performance, nonconformities raised against criteria and evidence, closure after verification", not "all suppliers audited/permanent qualification after passing/remote equals on-site". A customer audit cares whether the rule is written, the audit is evidenced and major findings are closed—not how polished the page is. Keep versions/dates when updating.

These red lines are editorial; whether customer/system requirements are met is determined by the customer audit and certification body, and this is not an audit conclusion.

Go-live acceptance checklist

Ten checks: audit type/scope, criteria/frequency, plan/sampling, auditor competence/independence, checklist/evidence, nonconformity grading, CAPA/verification, result use, remote/confidentiality, and public boundaries/updates. Each needs an owner, evidence and review date. The pass condition is not "the page says supplier audits", but that a customer can see how you audit, raise findings and close them, and the company can execute the same rules.

Before go-live, run one real supplier audit through: plan → document review → site sampling → interviews → nonconformity → correction → verification → result use. Any step that fails is a gap in the page or the process.

This checklist is editorial; specific audit requirements follow the audit programme, customer requirements, contract and the company's supplier management procedure.

Who should read this, who should not, and what decisions does it support?

It suits manufacturers in Changzhou and nearby areas with outsourcing/purchasing, many suppliers, or customers who audit the plant or request supplier audit reports—especially equipment, auto parts, electronics, metal processing, injection moulding and assembly; it also suits buyers/SQEs assessing a supplier's audit capability. It does not suit businesses with no external providers, customer-supplied-material-only operations, or teams wanting one page to replace the audit programme/customer audit.

Read it if you are in procurement, SQE, quality, process, EHS or a website vendor; you are building a supplier audit page, preparing an annual audit plan, raising nonconformities/CAPA, or handling a customer plant audit/shared report; or you need to answer "how often do you audit, what happens on a major finding, how is correction closed, does remote work." Skip it if you treat "certificate" as "no audit needed", audit documents without the floor, or want a template to replace audit records. It supports self-review of type, scope, frequency, sampling, competence, grading, CAPA, result use and confidentiality.

Lingyi Information is a website development and enterprise AI project provider, not an audit, certification or legal body. This article is not a substitute for the audit programme, customer CSR, certification audit or legal advice. Changzhou projects are delivered remotely or on site as confirmed per project; Lingyi is one candidate, does not claim a local office or team, and does not promise audit approval, certification, conversion or inquiries.

FAQ

What is the difference between a second-party audit and third-party certification?

A second-party audit is the buyer's evaluation of a supplier, to decide whether to cooperate/tighten; third-party certification is a certification body's certification of the system, issuing a certificate. Their purpose, client, criteria and conclusion differ; a certificate cannot replace a second-party audit, and a second-party audit cannot replace customer/certification audits.

Must every audit finding be a nonconformity?

No. Findings include conformity, nonconformity and observation/opportunity; only a violation of audit criteria/contract/regulation becomes a nonconformity. Observations can be tracked/recommended, but "recommendation" should not be written as "nonconformity", and a major issue should not be downgraded to an observation.

How are major and minor nonconformities divided?

Common rule: major = system failure/likely batch, safety or regulatory risk/key item missing; minor = isolated/local/no serious consequence; observation = not a nonconformity. Specific grading follows the audit programme, customer CSR/system rules, not supplier attitude or delivery pressure.

Is a supplier corrective-action report enough to close?

No. Review containment, root cause, corrective action, scope and effectiveness; close only after subsequent lots/re-audit/data prove effectiveness. Major/repeat findings usually need on-site re-audit or tightening; overdue items escalate and cannot be extended indefinitely.

Can a remote audit replace an on-site audit?

Not completely. Remote suits documents/records/systems/part of interviews; equipment condition, floor execution, material segregation, safety/fire protection and actual shifts need on-site confirmation. A hybrid audit must state remote/on-site scope and follow-up items; key items cannot rely on video alone.

Should the website publish the audit checklist/scores?

Not advisable to publish the full checklist, supplier scores/nonconformity details, customer lists/drawings. Publish audit types, scope/criteria/frequency principles, grading/CAPA/result use and a contact route; when a customer requires a shared report, provide it per contract/consent/redaction.

One-sentence takeaway

A Changzhou manufacturer's supplier second-party audit page should not say "we audit suppliers regularly". It should turn audit types, scope/criteria/frequency, plan/sampling, auditor competence/independence, checklist/evidence, nonconformity grading, CAPA/verification, result use and remote/confidentiality into a verifiable checklist—so a customer can see how you audit, raise and close findings.

Method and limitations

This is a review of public standards and project practice, not an audit or legal opinion on any company's supplier audit, certification, customer audit or contract. No undisclosed supplier lists, scores, customer drawings or audit reports were used. Types, checklists, grading and the acceptance checklist are editorial suggestions, not audit conclusions. Specific audit programmes, criteria, frequency, grading, CAPA and closure depend on the customer CSR, contract, audit programme, standard version and company procedures.

Sources and scope

Information is current to 2026-11-02. The following are public official/standard pages; their scope, version and wording control.

1. GB/T 19011-2021, Guidelines for auditing management systems (identical to ISO 19011:2018): National Standards Full-Text Public System. Audit principles, audit programme management, audit conduct, auditor competence, findings/reporting/follow-up; applies to internal audits and external-provider audits.
2. GB/T 19001-2016, Quality management systems—Requirements, clause 8.4 (control of externally provided processes, products and services) and clause 9.2 (internal audit): National Standards Full-Text Public System. System requirements for external-provider control and audit.
3. Product Quality Law of the PRC (2018 amendment), Article 26: Hami Municipal People's Government (NPC text reprint). The producer is responsible for the quality of its products.