Supplier audit

What it means

A supplier audit is a check on a counterparty before signing or during the relationship: can they deliver, are they meeting the terms, and does working with them carry legal or reputational risk.

The depth follows the importance of the supply. For a critical supplier you review financial stability from the published accounts, insurance, certifications, references and the subcontracting chain behind them.

A supplier audit differs from due diligence in both aim and depth. Due diligence is a one-off, detailed review before buying a company or investing, whereas a supplier audit recurs throughout the relationship and its scope matches what a supplier’s failure or outage would cost the business.

How it works in practice

For an ordinary company a repeatable routine is enough: an extract from the commercial register, a check of the VAT ID and payer reliability, arrears with the insurers, sanctions screening, and for services an agreed SLA.

The findings do not go into a drawer - they go into the contract: delivery times, penalties, escalation and termination terms. That is what makes the audit a tool rather than a formality.

Companies within the scope of NIS2 have to assess security when using IT service providers: who has access to systems, how the supplier handles incidents and where it keeps data. A questionnaire covering these points is worth preparing in advance and updating whenever the contract is renewed or changed.

What to watch out for

For VAT the check has a tax dimension too: deducting from a document issued by an unreliable payer, or on a supply that never happened, is your risk. A short record of the check performed is evidence of diligence in an inspection.

If on the date of supply the supplier appears on the list of VAT payers for whom grounds for deregistration have arisen, the customer can be made liable for its unpaid VAT. Checking the list as of the supply date, not just when the contract is signed, costs little and protects against liability for tax the company never had in its hands.