ISO & compliance · Guide
ISO audit evidence checklist for supplier management
Most audit stress comes from evidence that exists somewhere but cannot be found quickly. This checklist lists the supplier evidence auditors commonly ask for, so you can keep it ready as you work.
Updated · Nexus Digital Ireland
Why audits feel hard
Auditors work by sampling. They pick a supplier, a purchase or an invoice and ask to see the evidence behind it. If that evidence is in someone's inbox or a folder nobody maintains, a simple question takes an afternoon. Keeping evidence with the supplier as you go is what makes the audit routine.
The supplier evidence checklist
- Supplier list
- Every active supplier, what they provide, who owns the relationship and their status.
- Selection and approval
- Why each important supplier was chosen and who approved it, with the date.
- Risk or criticality rating
- Which suppliers matter most to quality or information security, and why.
- Due diligence
- Questionnaires, certificates, insurance and data processing terms for higher-risk suppliers.
- Agreements
- Contracts or terms covering quality, security, confidentiality and data handling where relevant.
- Performance records
- Late deliveries, quality issues, complaints and price changes recorded against the supplier.
- Reviews and re-evaluations
- Dated reviews with the outcome and the reviewer, on the schedule your procedure sets.
- Purchase approvals
- Who requested and approved purchases, especially above your approval limits.
- Invoices and payments
- Supplier invoices linked to the purchase and the approval, with any disputes resolved.
- Changes, incidents and exits
- What changed, what went wrong, what you did, and how access and data were handled when a supplier left.
Auditors decide what to sample, and your own procedures set some of the requirements. Use this as a starting point, not a guarantee of what will be asked.
Keeping it ready all year
- Record approvals, reviews and supplier problems when they happen, not before the audit.
- Keep evidence attached to the supplier it belongs to, not in personal inboxes.
- Put review dates in a calendar or system, with a named owner.
- Do a short internal check each quarter: pick three suppliers and see whether you could answer an auditor's questions in five minutes.
The week before an audit
- Check the list is currentAdd suppliers in use that are missing, and mark former suppliers as exited.
- Close overdue reviewsComplete any reviews that slipped, honestly dated.
- Sample yourselfPick a few purchases and trace them from request to approval to invoice to payment.
- Know where everything isMake sure whoever meets the auditor can find each item on the checklist quickly.
How the Operations Register keeps audit evidence ready
The Nexus Business Operations Register records supplier approvals, reviews, purchases and invoices with their evidence as you work, so the checklist above is filled in by everyday activity. Nexus does not award certification.
- Every supplier, purchase approval, review and invoice is kept together with its evidence.
- An audit trail shows who did what and when, in plain English.
- Governance records can be exported for an auditor or a customer.
- Review dates and renewals are visible before they become overdue.
Questions
What supplier evidence do ISO auditors ask for?
Typically a supplier list, how suppliers were selected and approved, risk ratings, due diligence, agreements, performance records, periodic reviews, purchase approvals and invoices, and records of changes or exits.
How far back do auditors look?
Usually across the period since the last audit, sampling records from it. Keep records for at least as long as your procedures and legal obligations require.
Can evidence be electronic?
Yes. Electronic records are normal, as long as they are complete, dated, attributable to a person and can be found when asked.
Related guides
ISO 27001 supplier security: what auditors expect
ISO 27001 expects you to know which suppliers can affect your information security, to agree security terms with them, and to keep checking. Auditors look for evidence that this happens, not just a policy that says it should.
Read the guide →ISO 9001 supplier evaluation for small businesses
ISO 9001 asks you to control what you buy in: choose suppliers against criteria, check they keep delivering, and keep a record of it. For a small business that can be simple, as long as it is done consistently.
Read the guide →