Supplier Audit Checklist Template

Why this is a different document than onboarding

Onboarding checklists get a lot of attention; ongoing review gets much less, even though risk doesn't stay frozen at whatever level it was when a vendor was first approved. A supplier's insurance can lapse, their financial health can quietly decline, or their security practices can drift — none of which shows up unless someone actively checks. This checklist exists specifically for that ongoing review, on whatever cadence makes sense for that vendor's risk level.

• Compliance and documentation — insurance, licenses, tax forms, signed contracts
• Financial health — credit signals, payment history, pricing accuracy
• Performance and delivery — on-time rate, quality, open issues
• Security and data handling — access review, incident history
• An overall risk assessment with a documented rationale and next audit date

Match audit frequency to actual risk, not a blanket schedule

Auditing every vendor on the same annual schedule regardless of spend or risk level wastes effort on low-stakes relationships and doesn't necessarily catch problems fast enough on high-stakes ones. A more efficient approach: audit your highest-spend or highest-risk vendors annually, and let lower-risk, lower-spend vendors go two to three years between reviews. That prioritization matters more than the specific cadence you choose.

Document specific evidence in the notes column — "insurance certificate reviewed, expires 03/2027" holds up far better later than an unqualified checkmark. Any finding that raises real concern should get a named owner and a follow-up deadline, tracked separately so it doesn't quietly disappear. Our vendor risk assessment template is a useful companion for scoring what this audit uncovers.