Preparation for an unannounced supplier audit should focus on normal process control and a practical response to an unexpected visit. A customer audit is a second-party assessment governed by its relevant contractual and access arrangements. It should not be confused with accredited ISO 9001 certification or treated as permission to bypass safety, security or confidentiality controls.
The external audit guide explains the different audit relationships. The organisation should understand the customer’s rights and its own responsibilities before an unannounced visit occurs, rather than improvise those decisions at reception.
Understand the applicable agreement
Review relevant customer contracts, supplier-quality arrangements and agreed audit provisions. Confirm who may request access, which activities are covered and what restrictions apply. Obtain appropriate advice where contractual interpretation is uncertain.
Do not assume that the words unannounced audit create unlimited access to every record or customer project. Different agreements and sectors can have different arrangements. Equally, do not promise access in a contract that the organisation cannot practically support.
Identify how visits will be verified. Reception or security staff need a route to confirm identity and authority without making unsupported decisions about commercial obligations.
Establish a controlled arrival process
Nominate an audit coordinator and suitable alternates. Ensure people know how to contact them when an unexpected team arrives. The coordinator can confirm the audit purpose, scope and applicable arrangements while organising access.
Maintain ordinary visitor controls. Site induction, protective equipment, photography rules, escort requirements and restricted areas remain relevant. Explain genuine constraints and discuss appropriate methods for obtaining evidence.
If the responsible manager is absent, an alternate should understand the escalation route. Dependence on one person can turn a manageable visit into confusion even when the underlying process is well controlled.
Keep normal evidence retrievable
A functioning system should not rely on a special folder created just before a scheduled visit. Current instructions, relevant records and responsibilities should be accessible through normal controls.
Employees should be able to explain actual work and identify where reliable information can be found. They do not need to invent answers when uncertain. Help them understand who can authorise exceptions and how to seek clarification.
| Readiness area | Practical arrangement |
|---|---|
| Arrival | Identity verification and contact route |
| Scope | Agreement and relevant customer criteria available |
| Safety | Normal induction and access controls |
| Evidence | Controlled retrieval of relevant records |
| Confidentiality | Protection of other customers’ information |
| Follow-up | Findings routed to accountable owners |
This is a practical framework, not a mandatory checklist for every supplier relationship.
Protect confidential and restricted information
An audit may need customer-related evidence without justifying access to unrelated projects or personal data. Agree suitable viewing, redaction or controlled transfer where necessary. Keep the evidence sufficiently complete to answer the audit question.
Do not use confidentiality as a blanket excuse to conceal relevant failures. Explain the actual restriction and seek an appropriate way to evaluate the issue. Conversely, do not disclose information simply because a visitor requests it without confirming authority.
Photography, recordings and electronic exports can require particular controls. Staff should know who can authorise these activities and how retained copies are handled.
Support evidence-based assessment
Ask the auditor to clarify relevant criteria where a request is unclear. A customer’s contractual requirement may legitimately differ from general ISO 9001 practice, but it should be identifiable and applicable to the audited work.
Follow actual transactions and exceptions. Avoid staging a misleading demonstration or changing records retrospectively to present a false history. If a gap exists, assess affected work and explain the response honestly.
Material disagreements should be recorded and handled through the agreed relationship. Respectful clarification protects both parties more effectively than treating every difficult question as a confrontation.
Close the visit with clear next steps
Confirm the findings, evidence and response arrangements. Distinguish customer requests, nonconformities against agreed criteria and optional suggestions. Identify responsible people and applicable deadlines without assuming they match certification-body procedures.
The opening and closing meetings article explains how to preserve factual clarity at these points. An unannounced arrival does not remove the need for a clear final understanding.
After the visit, review whether the arrival process, evidence access and communication worked. Improve weaknesses that affected the audit while continuing to address substantive findings. Sustainable readiness comes from controlled everyday work and clear authority, not from maintaining a rehearsed performance for an unknown date.
What if the visitor cannot establish authority?
Use the agreed verification and escalation route before releasing restricted information or granting access. Record the request and actions taken. This is different from refusing a valid contractual audit merely because it is inconvenient. Staff need a workable way to verify the relationship without being expected to interpret the entire contract at reception.
For multi-customer facilities, prepare an escort route that can expose the relevant work while protecting unrelated activities. The arrangement should preserve the customer’s legitimate evidence access rather than create a staged route that conceals relevant conditions. Review any limitation with the responsible audit coordinator.