A vendor audit checklist is a structured list for testing whether an existing supplier's quality, security and operational controls still meet your requirements, recording who inspected each area, what evidence they saw and which findings need corrective action.
Updated 13 Oct 2026 · Reviewed by the Spendflo procurement team
Choose the audit depth first: a desk review shows only the core checks, a full audit shows all of them. Open any check to see the evidence to inspect and the red flag that should become a finding.
Get the vendor audit checklist as an Excel tracker with owners, status drop-downs and a progress score.
A vendor audit checklist sets out what to inspect when you review a supplier you already use, so you can confirm its quality systems, security and day-to-day operations still match what it promised and what the contract requires.
An audit is not due diligence repeated. Due diligence happens before signature and asks whether a vendor is safe to hire; an audit happens during the relationship and tests whether controls work in practice, using records, samples and interviews rather than a questionnaire alone.
Audits come in three depths: a desk review of documents, a remote audit with screen-shared walkthroughs, and a full on-site audit for critical suppliers. The checklist below tags each check so a desk review stays short and a full audit misses nothing.
This checklist is a starting point, not legal advice.
A complete audit covers the nine areas in the checklist, grouped here into seven. Each one tests a different promise the vendor made.
| Audit area | What you are testing | Usual owner |
|---|---|---|
| Scope and company information | Are we auditing the right entity, sites and services? | Procurement |
| Quality management systems | Do certified processes, document control and inspections actually run? | Quality |
| Information security and data protection | Are SOC 2 controls, encryption, access and breach notice working? | Security |
| Production, capacity and traceability | Can the vendor make, scale and trace what it supplies? | Quality, Business owner |
| Regulatory, EHS and compliance | Are sanctions, labour, environmental and industry rules met? | Compliance |
| Financial health and continuity | Is the vendor stable, insured and able to recover from an outage? | Finance, IT |
| Contract, delivery and findings | Do SLAs, invoices and KPIs match the contract, and are gaps fixed? | Business owner, Internal audit |
Suppliers that make or handle physical goods need an on-site look at the shop floor. Use these twelve checks on top of the core list when you audit a manufacturer or distributor.
Walk the process from goods-in to dispatch and ask the people doing the work to show you, not describe, each step. A supplier audit checklist filled from a meeting room misses most findings.
Compliance drifts after onboarding. Certificates lapse, laws change and subcontractors arrive, so re-test these ten points at every audit.
The same ten points work as a supplier compliance checklist for goods suppliers; add the on-site checks above for anything you inspect physically.
Download the vendor audit checklist so every owner can work their own rows in Excel or Google Sheets, with status and dates.
Set the bar before the audit starts. This vendor requirements checklist states the minimum evidence each depth of audit needs before you can close it.
| Requirement | Full audit | Standard | Desk review |
|---|---|---|---|
| Security assurance | SOC 2 Type II plus pen test summary | SOC 2 Type II or ISO 27001 | Security questionnaire |
| Quality system | Certificate plus on-site inspection | Certificate and internal audit report | Certificate only |
| Continuity | Tested BCP and restore test | BCP with test date | Signed statement |
| Performance | 12 months of SLA and KPI data | Last two quarters of SLA data | Business owner sign-off |
| Interviews | Managers and frontline staff | Account team | None |
| Findings follow-up | On-site or remote re-test | Evidence of closure | Vendor confirmation |
Internal audit and regulators also test your own programme, not just single vendors. Use this vendor management audit checklist to check the programme is ready.
Write every finding the same way so the vendor cannot argue about what was found, and grade it so the deadline matches the risk.
| Part of the finding | What to write | Example |
|---|---|---|
| Condition | What you saw | Two leavers still had admin access |
| Criteria | The rule or clause it breaks | Access policy: removal within one day |
| Cause | Why it happened | HR leaver list not sent to IT |
| Consequence | The risk to you | Former staff could reach customer data |
| Corrective action | The fix, owner and date | Automate leaver feed, IT lead, 30 days |
| Grade | Meaning | Fix within |
|---|---|---|
| Major non-conformance | Control missing or failing, real exposure | 30 days, then re-test |
| Minor non-conformance | Control exists but is applied inconsistently | 90 days |
| Observation | Improvement idea, no breach | Next audit |
Each step ends with something you can file, so the audit trail is complete when the report goes out.
Set the risk level and choose on-site or remote.
Ask for policies, reports and the self-assessment at once.
Inspect records and interview frontline staff, not just managers.
Classify findings as major, minor or observation.
Assign owners and deadlines, then re-test major findings.
Here is a filled-in standard audit of a logistics vendor, with the two findings it produced and the outcome. The companies and figures are illustrative.
| Check | Owner | Evidence received | Status |
|---|---|---|---|
| Right-to-audit clause covers this audit | Legal | Clause 14.2, 10 days' notice given | Done |
| SLA reports delivered as required | Business owner | Reports for 12 months received | Done |
| Access to your data limited and reviewed | Security | Two leavers still active in the WMS | Flagged |
| Business continuity plan tested | Business owner | Test report dated March | Done |
| Service credits claimed where SLAs missed | Finance | Two breaches, no credits applied | Flagged |
| Sanctions screening still clear | Compliance | No match, 6 Oct | Done |
+ 25 more checks done, evidence filed
All 51 checks, the supplier and compliance parts and a findings log, ready to fill in. Free, no credit card.
FreeNo credit cardWork email only
| # | Check | Owner | Status |
|---|---|---|---|
| 1 | Audit scope, type and risk level agreed in writing | Procurement, Internal audit | Done |
| 2 | Legal name, facility addresses and key contacts confirmed | Procurement | In progress |
| 3 | Services and data in scope mapped to the contract | Business owner | Flagged |
| 4 | Major clients and ownership changes since last audit noted | Procurement | Done |
Agree the scope and audit depth, request policies and reports, then inspect records and interview the people doing the work. Grade each finding as major, minor or observation and agree an owner and due date for every fix, re-testing the major ones.
A vendor checklist is a list of the checks and documents you need to approve or keep using a supplier. This page's version is for audits: the download holds 51 checks with an owner, evidence and red flag for each.
They are condition, criteria, cause, consequence and corrective action, the five parts of a well-written audit finding. The findings log in the download has a column for each, so every finding is written the same way.
The seven standard procedures are inspection, observation, inquiry, confirmation, recalculation, reperformance and analytical review. A vendor audit mostly uses inspection of records, observation on site and inquiry through interviews.
Yes, you can download it free as an Excel file, a Google Sheet or a printable PDF. Each version includes the supplier audit, compliance and programme audit parts plus the findings log.
Start every audit from an accurate vendor list
Spendflo routes purchase requests through intake and approvals, stores certificates and questionnaires from supplier onboarding, and its Contracts Agent surfaces audit rights, SLA and exit terms. Third-party risk management keeps watch between audits, and renewals give you the natural audit date. Spendflo has handled 15,000+ agreements.
Enter your work email and your download starts straight away.
Need another format? Pick one below.
Google Sheets: upload the Excel file to Drive and open it with Google Sheets.
