How we run an audit

1. The basis

We follow the approach of ISO 19011, the international guidance for auditing management systems: planned scope, evidence-based findings, sampling stated openly, and auditors who are independent of what they audit.

If your own quality system follows IATF 16949, clause 7.2.4 asks you to show that your second-party auditors are competent. Our verification records for each auditor are designed to give you that evidence.

The requirements we audit against are always stated in the report: your supplier requirements, the supplier’s own control plans and procedures, and any standard you name.

2. Before the audit

Scoping call

We start with what you’re worried about, not with a checklist. We agree the processes, product, standard and dates, then send a quotation with travel at cost.

Who tells the supplier

Usually you do, because it’s your supplier relationship. If you prefer, we contact the supplier on your behalf. Audits are announced. We don’t run unannounced audits unless your contract with the supplier allows them and you ask for one in writing.

Confidentiality

You, Datum Quality Network and the auditor sign a non-disclosure agreement before the auditor’s identity is shared. If the supplier requires its own NDA, the auditor signs that too.

Conflict check

The auditor declares any link to the supplier before accepting: current or former employment, a financial interest, or a family connection. See our independence policy.

Audit plan

The supplier receives the plan and a document request list at least five working days before the audit, so the records are ready and the time on site goes on the process, not on searching for files.

Photography

Many semiconductor and electronics sites don’t allow cameras on the floor. Our default is no photographs. Where the site agrees in advance, we photograph evidence only, never people, and remove location data from the files. Otherwise evidence is recorded as document references and written observations.

3. On site

1. StartOpening meetingScope, plan, confidentiality, and how findings will be raised. No surprises later.
2. Most of the timeFollow the productWe walk the process in the order the product flows, comparing what happens on the floor with the control plan and work instructions.
3. ThroughoutSample the recordsRecords are sampled at random from a defined population, and the sample size and basis are stated in the report, so you can judge how far a finding extends.
4. ThroughoutTalk to the people doing the workInterviews are recorded by role, never by name. Line operators often know where a control is weak.
5. Each dayDaily wrap-upPossible findings are raised with the supplier the same day, so facts can be checked while people and records are at hand.
6. EndClosing meetingEach finding is read out with its requirement and evidence, and the supplier confirms the facts. Severity is explained using the written rules. Nothing appears in the report that wasn’t raised here.

What counts as a finding

A finding needs two things: a requirement it doesn’t meet, and objective evidence that it doesn’t. Anything without both is recorded as an observation, separately. Severity is assigned by written rules, and related minor lapses are combined and raised as one larger finding, so the report doesn’t understate a pattern.

4. After the audit

The report

Our target is the report within five working days of the last day on site, in the standard format.

Second review before release

Before any report goes out, someone other than the auditor checks it against a written checklist: every finding cites a requirement and evidence, severities follow the rules, no individual is named, and the limits of the audit are stated. Reports with a Critical finding or a do-not-meet result are reviewed by a senior auditor.

Root-cause review

The supplier responds to each finding by a deadline set by its severity. We review every response and send it back, with a reason, if the root cause:

• restates the finding instead of explaining it,
• names a person as the cause,
• stops at the first “why”,
• doesn’t explain why the existing control failed to catch the problem, or
• relies only on retraining or reminders.

The sample report shows a rejected response and the revised one that was accepted.

Closure

Minor findings are usually closed by reviewing the supplier’s evidence. Major and Critical findings are verified on site at a follow-up visit, which is quoted separately. We record closure; you accept it.

5. Confidentiality and records

• Who sees the report: you, and the supplier for the parts you agree to share. Nobody else.
• What we keep: the report, evidence references and corrective action records, for the retention period agreed in our contract with you.
• Who owns it: you may use the report internally and share it with the supplier. Our method and templates stay ours.
• Combined data: we use audit data only in anonymised, combined form (for example, how long corrective actions take to close across many audits), and only where our contract with you allows it. No supplier or client is ever identifiable.

6. Disputed findings

If you or the supplier disputes a finding, a senior auditor who didn’t perform the audit re-checks it against the recorded evidence. If the evidence doesn’t support it, we withdraw it and explain why. If it does, it stands, whoever objects.

7. What we don’t do

• Issue certificates or claim accreditation. These are second-party and internal audits.
• Decide whether to approve a supplier. We recommend; you decide.
• Design the supplier’s corrective actions. The supplier owns its fixes; we judge whether they work.
• Send an auditor who has a conflict with the site.

Ready to scope an audit? Start an audit request.