Factory Audit in China: A Buyer’s Checklist for Verifying a Supplier Before You Order

China’s State Administration for Market Regulation tested 25,250 product batches from 23,764 enterprises in 2024. Small enterprises failed at 15.2%. Large enterprises failed at 2.5%. Small enterprises were 93.2% of the companies sampled. That gap is the entire commercial case for a factory audit in China: the variance between the best and worst supplier in the same market is enormous, and a quotation contains no information about which one you are talking to.

Executive summary: What should a buyer know before commissioning a factory audit in China?

TL;DR: A factory audit qualifies the supplier before you order. Its value comes from the evidence you demand and verify, not from the number of boxes on the checklist.

• The scope rule: An audit assesses the supplier. A pre-shipment inspection checklist assesses the goods. Different stage, different decision, and you need both.
• The structure: 15 checkpoints across five pillars — identity, capability, quality system, materials and chain, compliance and continuity.
• The method: Every checkpoint runs claim → evidence → verification → risk → decision. A checklist without the verification step is a tour.
• The evidence signal: LRQA, which runs over 20,000 site assessments a year, classified only 55% of its audits in China as transparent, calling it the least transparent major sourcing market.
• The independence signal: Peer-reviewed analysis of 16,795 supplier audits found that audits paid for by the audited factory reported significantly fewer violations than audits paid for by the buyer.
• The outcome: Four decisions only — approve, approve with conditions, corrective action then re-audit, or reject.

Direct answer: A factory audit in China is an on-site assessment of a manufacturer’s legal identity, production capability, quality management system, material controls and regulatory compliance, carried out before you place an order, to decide whether the supplier is safe to buy from.

Why does a factory audit in China matter more than the certificates a supplier sends you?

TL;DR: Certificates are the most common form of supplier evidence and the weakest, because they are the easiest thing to produce for a buyer who will never verify them.

Situation: A buyer shortlists three Chinese factories. All three send a business licence, an ISO 9001 certificate, photographs of a clean workshop and a customer list.

Complication: Every document in that pack was selected by the supplier, and none of it was verified by anyone. The pack is a marketing asset with the visual grammar of an audit trail.

Question: What would actually distinguish these three suppliers?

Answer: Records the supplier did not choose, numbers that have to reconcile with each other, and observation of the plant during a production shift. That is what a factory audit collects and what a document pack cannot contain.

The certificate that no longer differentiates anyone

ISO 9001 is the most requested supplier credential in global sourcing, and in China it has become close to universal. The ISO Survey recorded 651,851 valid ISO 9001:2015 certificates in China as of 31 December 2024, covering 994,266 sites roughly 44% of the world total of 1,474,118. With about 6.03 million manufacturing enterprises registered in China,⁵ a certificate held by 651,000 of them tells you a supplier is not unusual. It does not tell you the supplier is good.

This is not an argument that Chinese certificates are worthless. It is an argument about information value. A signal shared by hundreds of thousands of firms cannot discriminate between them, so the useful questions move one level down: what is the certificate’s scope, which body accredited the certifier, and does the management system have records demonstrating routine use. Those three questions are checkpoint 7 of this checklist, and none of them can be answered from the PDF a supplier emails you.

What China’s own regulator says about supplier variance

SAMR’s annual national product quality supervision spot-check is the most useful public dataset on Chinese manufacturing quality, because the regulator publishes the breakdown rather than the headline. In 2024 it covered 147 product categories and found an overall non-conformity rate of 14.3%.

The headline rate matters less than three distributions inside it.

Two readings are directly actionable. First, small suppliers fail at roughly six times the rate of large ones, and small suppliers are who most importers buy from SAMR’s own sample was 93.2% small enterprises. Second, e-commerce non-conformity has risen every year, from 16.2% in 2022 to 21.7% in 2023 to 23.5% in 2024, while the production-stage rate has been flat at 6.6–6.7% across the same period. Goods sampled at the factory conform far more often than goods sampled from an online listing.

Treat the 14.3% headline carefully. SAMR samples on risk, not at random, and says it will raise sampling rates further on categories with known problems. So this is not the failure rate of Chinese manufacturing at large. The comparisons hold, because the sampling bias applies to both sides of each one.

Where audit evidence in China actually breaks down

The constraint on a useful factory audit is not access to a checklist. Dozens are published, several list more checks than this one. The constraint is whether the evidence you are shown is real.

LRQA, which runs more than 20,000 social and environmental site assessments a year across 100+ geographies, reported that just 55% of the audits it conducted in China in the preceding year could be classified as transparent, describing China as the least transparent major sourcing market. Over 75 regions showed declining audit transparency scores.² In the same dataset, “unauthorised subcontracting” and “working hours documentation” are standing measured risk sub-indices, not exceptions.

Independent corroboration comes from an unexpected direction. China’s Ministry of Ecology and Environment states that falsification in third-party monitoring commissioned by discharging enterprises is “fairly prominent,” and has run a multi-agency campaign against third-party environmental monitoring bodies since October 2022.⁶ When a government ministry reports that supplier-commissioned third-party data is commonly falsified, the general lesson is clear: evidence supplied by the party being assessed is the weakest category of evidence available, whatever letterhead it arrives on.

What is the difference between a factory audit, an inspection, and a verification check?

TL;DR: These three controls cover different risks at different stages, and buying one does not cover the others.

Buyers commonly assume that whichever check they bought is the check that protects them. It is worth being precise, because each of these leaves a distinct gap.

Factory audit versus pre-shipment inspection

An audit is mostly a one-off with periodic refreshes. An inspection is per-order and never stops being necessary, because a capable factory still ships bad batches. Buyers who audit and then skip inspections have bought reassurance rather than control.

The sequencing point is simple: the audit decides whether to buy from this supplier at all; the inspection decides whether to release this shipment. Nothing in an audit report authorises a shipment. If you want the mechanics of the second control sampling, defect classification, when inspectors attend that belongs on the pre-shipment inspection checklist and the inspection solution rather than here.

Factory audit versus supplier verification

Verification is desk work, and it is cheaper. Confirming that a legal entity exists, that its registered business scope covers manufacturing, and that its bank details match its licence can be done from a laptop in an afternoon. An audit assumes verification has passed.

Do the desk work first. A production floor is an expensive place to discover that your counterparty is a trading intermediary. The registry lookups, the Unified Social Credit Code structure and the payment-mismatch patterns are covered on the Chinese supplier verification checklist; this page picks up where that one ends.

Factory audit versus social compliance and product certification

A social compliance audit is scoped to labour and ethics. An amfori BSCI audit consists of 81 questions across 13 performance areas, graded A to E, and produces a confidential report on the amfori Sustainability Platform rather than a public certificate.⁷ A supplier offering a BSCI grade as evidence of manufacturing capability is answering a different question.

There is a verification wrinkle worth knowing. BSCI reports are accessible only to amfori members and the audited supplier, and amfori explicitly disclaims liability for PDF extracts of them. So a supplier emailing you a PDF summary is handing you precisely the category of evidence this page warns against. The correct response is platform access through an amfori member, not acceptance of the extract.

Product certification is narrower again: a laboratory tests a sample of the product against a standard. It says nothing about whether the tenth production run will match the sample.

When is a factory audit in China worth the cost, and when should you skip it?

TL;DR: Audit when the cost of being wrong exceeds the cost of finding out, and decline the audit when the underlying question is something cheaper answers.

The triggers that justify an audit

• A first significant order with a new supplier, especially one found at a trade fair or on a marketplace, where you have seen a booth and a catalogue.
• Custom manufacturing or tooling investment. Once you have paid for a mould, changing supplier means paying for it again.
• Regulated or safety-critical categories. For US-facing buyers this is now sharper: CPSC eFiling takes effect in July 2026, requiring importers of regulated consumer products to submit Certificates of Compliance electronically to Customs at entry and eliminating the de minimis exemption. A factory that cannot produce valid, in-scope test reports becomes a customs problem, not just a quality one.
• Repeated quality failures from an existing supplier. Inspections tell you the defect rate. An audit tells you why it is not improving.
• Ownership change, relocation, or a new line. The plant you approved is not the plant you are now buying from.
• You suspect the work is being subcontracted. Orders that scale suddenly, or lead times that do not move when volume doubles.
• The supplier resists a visit. Reluctance is a finding, and one of the cheapest you will ever collect.

Category risk is not uniform, and SAMR’s data is a usable proxy for where to spend audit budget: 39 of 147 categories tested above 20% non-conformity in 2024, while 9 categories returned no failures at all.¹ The share of categories above 20% has grown from 17.8% in 2022 to 26.5% in 2024.

When an audit is the wrong tool

We would rather say this than take the fee.

• The order is small relative to the audit cost.
• You have not written a specification. An audit measures capability against a requirement. With no drawing, tolerance, material spec or packaging standard, there is nothing to measure against and the report will be generic.
• Your real question is who manufactures. That is a verification question, answered from records. Do not buy a site visit to answer it.
• Nothing has changed since the last audit. Re-audit on triggers, not on the calendar alone.

How often to re-audit

Annually for strategic suppliers and regulated categories. Every two to three years for stable, low-risk suppliers with a clean inspection history. Immediately on any trigger: ownership change, relocation, new line, new subcontractor, a serious quality failure, or a gap in ordering long enough that the plant has re-tooled for someone else. After corrective action, run a focused re-audit against the open findings rather than repeating the whole plant.

Inspection records are your early-warning system between audits. A defect rate drifting upward across three orders is telling you something changed on the floor.

How should you prepare a factory audit before anyone travels?

TL;DR: Preparation is roughly a third of the audit’s value and almost none of its cost, and most audits underperform before anyone arrives.

Define the scope, the shift, and the announcement type

Name the site, the lines, the product family and the shifts you want to see. “We will audit your factory” produces a conference room and a slide deck. “We will observe the line that would run our product, during a production shift, and review records for the last six months” produces an audit.

Two scope decisions deserve deliberate thought. Which shift: a plant running three shifts does not run them the same way, and supervision thins at night. And announced, semi-announced or unannounced, where the evidence is more interesting than the folklore.

Unannounced visits are better measurement. BRCGS surveyed 283 certificated sites on its unannounced audit programme: 50.5% said the unannounced audit was a more accurate reflection of their operation, 45.2% said it was the same, and only 4.2% said it was less accurate.⁹ But announced audits are associated with better improvement. Research covering supplier code-of-conduct audits found suppliers improved by an average of 1.6 violations, a 22% improvement rate, and argues that advance notice signals trust and produces more remediation.

That is why semi-announced a date window rather than a date is the working compromise, and now it is a reasoned choice rather than a default.

Set the pass criteria before you leave

For each checkpoint, write down what would satisfy you. Skipping this is why two auditors reach two verdicts on the same plant. Make criteria objective wherever an objective standard exists a calibration certificate is either in date or it is not and explicitly judgement-based where none does, so the reader of the report knows which is which.

Request the documents two weeks out

What arrives, how fast, and what never arrives is your first dataset. A plant with a working quality system produces this from a filing system rather than by preparing it for you.

Business licence and, if different, the licence for the production site · site layout with production flow marked · organisation chart showing the quality function’s reporting line · equipment list with model, capacity and installation year · quality manual contents and procedure index · all management-system and product certificates including scope pages · production output records for six months · inspection records for three months · list of outsourced processes and the subcontractors performing them · two or three customer references in your region.

What does the factory audit checklist cover?

TL;DR: Fifteen checkpoints across five pillars, weighted to your product risk, with a knockout rule so a critical failure cannot be averaged away.

How each checkpoint is structured

Every checkpoint below follows the sequence an audit actually runs, using a consistent block so a reader can work through the page on site.

• What It Is — the claim under test, stated as the supplier would state it.
• How to Execute — the verification steps, in order. This is the part that separates an audit from a tour.
• The Data Says — the external evidence for why the checkpoint matters.
• Entity Connection — the standards, documents and concepts the checkpoint touches.
• Reality Check — what the failure actually looks like on a floor.
• Pass criterion — what “acceptable” means, decided before you arrive.

How to weight the pillars for your product

The weights are supposed to move. A buyer of simple homeware and a buyer of medical components should not score the same plant identically, and a framework that pretends otherwise is one nobody uses twice.

Raise identity for a new supplier with no order history. Raise capability when lead times are tight or tooling is involved. Raise quality system for repeat orders, regulated products and tight tolerances. Raise materials and chain where recall exposure is real or the category is exposed to forced-labour rules. Raise compliance and continuity for retail and brand customers, and for anything with high environmental load.

Pillar 1: How do you verify the factory in China is the company you think it is?

TL;DR: Identity is the pillar buyers assume is settled, and the only one where a single finding should end the audit on the spot.

Checkpoint 1: Legal entity and registered business scope

What It Is: The claim that this company is a manufacturer of your product.

How to Execute:

1. Obtain the business licence (营业执照) showing the company name in Chinese, the 18-character Unified Social Credit Code, the legal representative, registered capital, establishment date, registered address and registered business scope (经营范围).
2. Look up the Unified Social Credit Code on the national registry at gsxt.gov.cn and compare every field against the licence you were given.
3. Read the business scope. A manufacturer’s scope contains production or manufacturing language for your product category. A trading company’s contains wholesale and import/export language and no manufacturing at all.
4. Confirm the licensed company name matches the quotation, the contract party and the bank account beneficiary. All four.
5. Stop the audit on any mismatch. This is not a corrective action.

The Data Says: Business email compromise the fraud family that includes redirected supplier payments generated 24,768 complaints and $3,046,598,558 in reported losses in 2025, second only to investment fraud, at an average of roughly $123,000 per incident.¹¹ For most importers that exceeds the value of the order being placed. Note that IC3 data covers all BEC and is US-reported, so it is not a measure of China supplier fraud specifically; it is a measure of how expensive payment-detail failures are.

Entity Connection: The Unified Social Credit Code is the identifier the whole Chinese enterprise registration system is keyed to, and gsxt.gov.cn the National Enterprise Credit Information Publicity System is its free public interface. The registry is authoritative: the same system underlies official counts of 60.867 million registered enterprises and 6.03 million manufacturing enterprises.⁵ Business scope is a legally registered field, not a marketing description.

Reality Check: A supplier presents a licence, an ISO certificate and a factory video. The business scope reads as wholesale and import-export of hardware, with no manufacturing entry. The company is real, the documents are genuine, and it does not make anything. Two minutes on a public registry, before any travel.

Pass criterion: Registry record matches the licence in every field, business scope covers manufacturing of your product category, and the contract party and payment beneficiary are the licensed entity.

The registry mechanics and the scam patterns are covered in full on the Chinese supplier verification checklist. Where you are ordering through a platform, Trade Assurance protections address the payment leg specifically.

Checkpoint 2: Is this plant their plant?

What It Is: The claim that the site you are standing in belongs to the company on the licence.

How to Execute:

1. Ask for the property ownership certificate or lease for the building you are in, in the licensed company’s name.
2. Look for ordinary evidence of occupancy: the company name on the gate, reception signage, uniforms, internal document headers, machine maintenance logs and fire-safety certificates.
3. Request utility bills for the premises and compare electricity consumption against claimed output.
4. Check whether the licence address is the registered office rather than the production site. Factories often hold separate sites.

The Data Says: SAMR’s data shows production-stage sampling is concentrated where manufacturing is concentrated Guangdong at 26.3% of batches tested, then Zhejiang 16.9%, Jiangsu 9.7%, Hebei 6.0% and Shandong 5.2%, with the eastern region at 77.9% overall.¹ This is a distribution of industry, not of risk, and should not be read as a provincial quality ranking.

Entity Connection: Electricity consumption is difficult to falsify and tracks real output, which makes utility records one of the few independent corroborations of scale available to a visitor. Internal paperwork carries the operating company’s name in places nobody thinks to prepare.

Reality Check: The workshop is clean and busy. The machine maintenance logs carry a different company’s name, and the fire-safety certificate on the wall is issued to that same other company. The plant is real; the counterparty is renting access to it.

Pass criterion: The audited site is occupied by the licensed entity under a document in that entity’s name, and internal records carry that entity’s name.

Checkpoint 3: Export route and who invoices you

What It Is: The claim of direct export.

How to Execute:

1. Ask for customs registration and recent export declarations or bills of lading.
2. If a separate company handles export, get its name and its relationship to the factory.
3. Establish who issues the invoice, who is named as shipper, and who holds the contract.
4. Check that the answer matches the contract you are about to sign.

The Data Says: Not a statistical checkpoint. It is a contractual-recourse checkpoint.

Entity Connection: Many competent Chinese factories, particularly smaller ones, export through an agent. This is normal and not a red flag. What matters is that it is disclosed and that you know your contractual counterparty, because that determines who you have recourse against.

Reality Check: The factory is genuine and capable. The invoice arrives from a Hong Kong entity nobody mentioned, and the contract names a third company. When a shipment fails, the buyer discovers they have no agreement with the manufacturer.

Pass criterion: The export route is disclosed before you ask, and the contracting entity is identified and acceptable to you.

Toolkit: Business licence, gsxt.gov.cn, property deed or lease, utility bills, customs registration, past bills of lading, and the Chinese supplier verification checklist for the desk-verification stage that should precede all of this.

Pillar 2: Can the factory actually make your product at your volume?

TL;DR: Capability is where claimed numbers meet arithmetic, and where the phrase “our capacity is 100,000 units a month” turns out to mean nothing on its own.

Checkpoint 4: Production capacity, claimed against demonstrated

What It Is: A stated monthly capacity figure.

How to Execute:

1. Break the claim into its components: lines × workstations × operating hours × (1 ÷ cycle time) × yield × equipment availability, minus the order book already committed.
2. Ask for capacity and current utilisation. The gap between them is what you can actually buy.
3. Reconcile four independent numbers: machine count and rated speed, payroll or social-insurance headcount, recent shipped volumes, and electricity consumption.
4. Walk the line during production, time a cycle yourself, and count the operators on the line that would run your product.
5. Ask what the bottleneck is, and what happens when capacity is exceeded.

The Data Says: Capacity claims are one of the most consequential unverified numbers in sourcing, and the reason is structural rather than dishonest. LRQA’s audit dataset treats “unauthorised subcontracting” as a standing risk sub-index across geographies,² and the most common route to fulfilling an order beyond real capacity is to send it elsewhere.

Entity Connection: Cycle time, yield, uptime and OEE are the variables behind any capacity figure. The committed order book is the term buyers forget: a plant can have genuine capacity for your order and no available capacity, because it is sold to a customer with a longer relationship than yours.

Reality Check: A production manager who runs the plant names the bottleneck immediately and specifically. A sales manager who does not run it cannot. Ask the question twice, of two people, and compare.

Pass criterion: Demonstrated output supports your required volume at your required lead time, with headroom.

Checkpoint 5: Equipment, tooling and maintenance

What It Is: The claim of having the equipment for your process.

How to Execute:

1. Walk the equipment register against the floor. Every listed machine should exist, carry a matching asset ID, and be running or credibly idle.
2. Read the nameplates. Model and rated output should match the register.
3. Read the maintenance records for pattern, not for completeness.
4. Identify single points of failure and ask what the mitigation is — spares holding, service contract, alternate machine.
5. For custom work, settle tooling ownership and location in writing before the order.

The Data Says: Not a statistical checkpoint, but it is the one that most often reveals staged capacity. Dust and slack drive belts indicate a machine has not run in months.

Entity Connection: Preventive maintenance schedules, asset registers and tooling ownership. Tooling held by the factory under unclear ownership is the most common reason a buyer cannot leave a supplier who has begun to underperform.

Reality Check: Real maintenance logs are uneven, with breakdowns and parts replaced at irregular intervals. A tidy grid of identical entries at identical intervals for two years, with no failures, was written rather than recorded.

Pass criterion: Every machine required for your process exists, is operational, is maintained on a documented schedule, and single points of failure have a stated mitigation.

Checkpoint 6: Process control, change control and technical fit

What It Is: The claim of controlling the process and being able to make your product to your drawing.

How to Execute:

1. Derive the process your product requires before you arrive, then find each step on the floor. Steps that must exist and are absent are happening elsewhere.
2. Check work instructions at the stations: present, current, legible, in the operators’ language then whether operators are actually following them.
3. Ask an operator to describe the step and what they do when a part is out of tolerance. In a plant with real control the answer matches the written procedure.
4. Confirm that controlled parameters temperatures, pressures, torques, cure times are recorded, not just specified.
5. Hand over your actual specification and ask what they would change and where the risk is.
6. Ask for the change-control procedure and its records: what happens when a material, supplier or parameter changes, and are affected customers notified?

The Data Says: ISO 9001:2015 requires control of externally provided processes (clause 8.4), identification and traceability (8.5.2), control of nonconforming outputs (8.7) and calibration of monitoring equipment (7.1.5.2). A plant certified to the standard that cannot demonstrate these is non-conforming to the standard it is certified against a finding you can state precisely in a report.

Entity Connection: Process capability indices Cp and Cpk are the standard measures of whether a process can consistently hold a tolerance. A plant doing serious technical work either produces the data or explains clearly how it measures instead. A plant that has never heard of it can still be a good supplier for simple goods, but not for tight tolerances.

Reality Check: A capable engineering team pushes back on your drawing names the tolerance that will be difficult, the material that is hard to source, the finish that will not survive the packaging. “No problem” as a complete answer to every technical question is the least reassuring response available.

Pass criterion: The full process is performed on site or its outsourcing is disclosed and controlled; controlled parameters are recorded; a change-control procedure exists, has records, and requires customer notification.

Toolkit: Equipment register, maintenance logs, machine nameplates, process flow diagram, station work instructions, parameter records, first-article inspection procedure, your own specification, and a stopwatch.

Pillar 3: Will the quality system hold across repeat orders?

TL;DR: Capability shows they can make it once. The quality system decides whether order twelve matches the sample, and none of it is visible from a catalogue.

Checkpoint 7: Quality management system and document control

What It Is: The claim of ISO 9001 certification and a working quality system.

How to Execute:

1. Check the scope page. A certificate covering trading, or covering a group headquarters, is not a manufacturing certificate for this site. Certificates are issued per site.
2. Check the accreditation. Look for the accreditation body’s mark CNAS in China, or another IAF signatory, then verify the certificate on the certification body’s own public register or through IAF CertSearch. Not from the PDF you were given.
3. Check validity and surveillance. ISO certification requires annual surveillance audits; a certificate mid-cycle with no surveillance record is often suspended.
4. Test whether the system is lived or performed. Open the quality manual, pick a procedure at random, and ask for its records from last month.
5. Read the internal audit reports. Genuine ones find problems.

The Data Says: China holds 651,851 valid ISO 9001:2015 certificates, about 44% of the global total of 1,474,118, and 76 of the world’s 77 accreditation bodies with their 2,400-plus certification bodies now participate in IAF CertSearch.⁴ Two conclusions follow: holding the certificate differentiates nobody, and verifying it at source has never been easier.

Entity Connection: IAF CertSearch is the global public register of accredited certificates. CNAS is China’s accreditation body. Accreditation is what separates a certificate from a printed document, because it means the certifier is itself audited.

Reality Check: An internal audit report with no findings is not evidence of quality. It is evidence that nobody audited. Similarly, a quality manual that is a purchased template with another company’s name still in a header tells you the system was bought rather than built.

Pass criterion: Certificate current, accredited, verified at source, scope covering this site and your product category; procedures have records demonstrating routine use; internal audits produce findings and those findings close.

Checkpoint 8: Inspection stages, records and nonconforming product

What It Is: The claim that everything is inspected.

How to Execute:

1. Request procedures and acceptance criteria for incoming (IQC), in-process (IPQC) and final (FQC) inspection, plus completed records for the last three months.
2. Read the numbers rather than the format. Records showing no rejections mean inspection is not happening or not being recorded, every real line rejects something.
3. Check whether reject rates are identical month to month, which indicates they were written to a target.
4. Confirm the quality function reports independently of production.
5. Ask to see the quarantine area for nonconforming material. It should exist, be marked, be segregated, and have something in it.
6. Take one customer complaint from the log and follow it end to end: complaint, root cause, corrective action, owner, deadline, closure evidence, recurrence.

The Data Says: SAMR’s data shows the production stage is where conformity is highest 6.7% non-conformity against 23.5% for e-commerce. That gap exists because factory-stage controls, where they function, work. The corollary is that a plant whose inspection records cannot be reconciled has no such controls, whatever its certificate says.

Entity Connection: IQC, IPQC and FQC are the three standard gates. ISO 9001 clause 8.7 governs control of nonconforming outputs and 10.2 governs corrective action. Sampling mechanics AQL levels and ISO 2859-1 tables belong to the goods-level control rather than the supplier assessment; they are covered on the pre-shipment inspection checklist.

Reality Check: “Operator error” as a recurring root cause with “operator was reminded” as the corrective action is neither a root cause nor a corrective action. It is the most common finding in this checkpoint, and it means the corrective action process is decorative.

Pass criterion: All three stages have documented criteria and continuous records; rejects are recorded and dispositioned traceably; the quality function reports independently of production; corrective actions identify a systemic cause and close against evidence.

Checkpoint 9: Measurement and calibration

What It Is: The claim that measuring equipment is calibrated.

How to Execute:

1. Take three instruments off the floor at random — a caliper, a gauge, a scale.
2. For each: find the asset ID, find its certificate, check the calibration date and due date, and confirm traceability to a national standard through an accredited laboratory.
3. Check the equipment register covers everything used for acceptance decisions.

The Data Says: No public dataset measures calibration compliance rates, which is part of why this checkpoint is informative: it is technical, unglamorous and almost never staged well.

Entity Connection: ISO 9001 clause 7.1.5.2 requires measuring equipment to be calibrated or verified at specified intervals against standards traceable to national or international references. In China that chain runs through CNAS-accredited laboratories to the National Institute of Metrology.

Reality Check: Calibration failures sit above their apparent importance, because if the instruments are unverifiable then every inspection record in checkpoint 8 is unverifiable too. The usual failures: labels with a calibration date and no due date, certificates for equipment no longer on the floor, and in-house calibration against a reference that is itself uncalibrated.

Pass criterion: Every instrument used for acceptance decisions is registered, uniquely identified, in date, and calibrated against a traceable standard by an accredited laboratory.

Toolkit: Certificate scope pages, IAF CertSearch, the certification body’s register, quality manual and procedure index, internal audit reports, IQC/IPQC/FQC records, customer complaint log, quarantine area, equipment register and calibration certificates.

Pillar 4: What goes into your product, and who else touches it?

TL;DR: Your product is only as good as its inputs and only as traceable as the records that follow it, and this pillar contains the most under-audited risk in Chinese sourcing.

Checkpoint 10: Incoming material control

What It Is: The claim of using the specified material.

How to Execute:

1. Trace your material specification backwards: which supplier, on the approved list or not, with what certificate, against which actual delivery.
2. Ask for incoming inspection records showing measurements, not just a pass stamp.
3. Ask what happens when a material arrives out of specification, then ask for the last instance with the record.
4. Establish in writing whether material substitution requires your approval, and whether approval has ever been sought.

The Data Says: Material substitution and counterfeit inputs are the same risk viewed from two angles. The OECD and EUIPO valued global trade in counterfeit and pirated goods at USD 467 billion in 2021, or 2.3% of global imports, with USD 117 billion entering the EU, 4.7% of EU imports. China accounted for 45% of all reported seizures; by seized value China was 47% and Hong Kong 27%, and roughly 62% of seized counterfeit items originated in or were routed through the two.¹² These are seizure-based provenance shares from 2021 data, reflecting enforcement targeting as well as prevalence, and should be dated when quoted.

Entity Connection: Approved supplier lists, material certificates, certificates of analysis and mill test reports. Substitution is invisible in a finished-goods inspection because it is not a visual defect; it appears months later as field failure.

Reality Check: The risk is not a factory buying fake material knowingly. It is a factory protecting a margin after a price was agreed, by moving to a cheaper grade nobody said they could not use.

Pass criterion: Your material is specified, sourced from an approved supplier, verified on receipt against a record, and cannot be substituted without your written approval.

Checkpoint 11: Traceability, in both directions

What It Is: The claim that everything is traceable.

How to Execute:

1. Run the backwards trace: pick a finished carton at random, read its batch code, and ask which material lots went into it, from which suppliers, on which dates.
2. Run the forwards trace: name a material lot from six weeks ago and ask which finished goods it went into and which customers received them.
3. Time both. A plant with real traceability completes them inside half an hour from records that already existed.

The Data Says: The forwards trace is the one that determines the size of a recall, and for US-facing buyers it is now a customs question. Since implementation of the Uyghur Forced Labor Prevention Act, US Customs and Border Protection has stopped 65,707 shipments worth $3.91 billion and denied 24,215 of them, worth $960.5 million. Goods denied entry are a total loss plus freight. The importer carries the burden of rebutting the presumption, which requires supply-chain mapping to raw material exactly what a forwards trace tests. Note that CBP changed its shipment-counting method in January 2026, so use these cumulative figures rather than the annual series.

Entity Connection: ISO 9001 clause 8.5.2. The chain runs supplier lot → incoming inspection record → material issue → work order → in-process records → final inspection → packing list → shipping marks. UFLPA exposure is concentrated in cotton, polysilicon and some agricultural inputs.

Reality Check: A recall is a forwards question, which of my shipments contain the bad lot? A factory that cannot answer it turns a contained problem into every unit you have ever bought from them.

Pass criterion: The chain from supplier lot to shipped carton is documented and can be walked in both directions from records that already exist.

Checkpoint 12: Subcontracting and sub-suppliers

What It Is: The claim that everything is made in-house.

How to Execute:

1. Use the derived process flow from checkpoint 6. If your product needs nine operations and you can find six, three are happening elsewhere.
2. Look for the physical tells: work in progress in another company’s packaging or on another company’s pallets, goods-in records for semi-finished parts, a process step with no equipment and no records, workers who cannot describe an operation the factory claims to perform.
3. Check the volume arithmetic. A factory whose demonstrated capacity is below its accepted order book is subcontracting the difference.
4. Request the outsourced process list, the subcontractors’ names, and the approval and monitoring records for each.
5. Agree in writing that adding a subcontractor requires notifying you.

The Data Says: Sedex analysed roughly 60,000 on-site SMETA assessments in the 12 months to September 2025 and found 16% of registered worksites globally have no measures in place to ensure their own suppliers and subcontractors meet required labour standards. That is not a measured rate of undisclosed subcontracting no such measure exists publicly, but it is the condition that makes it possible. One in six audited sites cannot vouch for the tier below itself.

Entity Connection: Subcontracting is not the problem; a plating line or heat-treatment furnace is often better run by a specialist. Undisclosed subcontracting is the problem, because part of your product is then made in a facility you have not audited, to a standard you have not agreed, by a company you have no contract with. ISO 9001 clause 8.4 requires the certified supplier to control externally provided processes, so undisclosed outsourcing is also a certification non-conformity.

Reality Check: Vague references to “partner factories,” “our group” or “sister plants” without names are the verbal signature of this finding. Ask for the names. The answer, or its absence, is the finding.

Pass criterion: Every outsourced process is disclosed, each subcontractor is named and approved on record, quality records cover the outsourced step, and adding a subcontractor requires notifying you.

Toolkit: Material specifications, approved supplier list, material certificates, incoming inspection records, batch codes on finished goods, the traceability procedure, the derived process flow, the outsourced process list, and CBP’s UFLPA dashboard, which now filters enforcement history by four-digit HTS commodity code so you can check your own category before ordering.

Pillar 5: What could stop production after you place the order?

TL;DR: Buyers treat this pillar as ethics. It is also delivery risk, because a plant suspended by an environmental inspection cannot ship your order.

Checkpoint 13: Labour, working hours and safety

What It Is: The claim of compliant labour practice.

How to Execute:

1. Request payroll, attendance or time records, labour contracts, social insurance contributions, age verification, and safety training records.
2. Run the three-way cross-check: payroll against attendance against production output. A plant claiming compliant hours while producing volumes that would require substantial overtime has two sets of books.
3. Corroborate with records harder to align with a falsified timesheet: gate logs, canteen records, shuttle-bus schedules.
4. Walk the safety basics, which need no documents: fire exits unlocked, unobstructed and signed; extinguisher inspection tags in date; machine guarding on presses and cutters; protective equipment actually being worn rather than merely issued.
5. Read any BSCI, SMETA or SA8000 report the plant holds rather than accepting its existence.

The Data Says: Sedex’s analysis of roughly 60,000 SMETA assessments found 46% of audited worksites exhibit wage-related issues, and that SMETA audits surface around 1,000 critical supply chain issues every week, with over 150,000 site-level issues resolved in the same 12 months. Sedex’s own framing is worth preserving for accuracy: findings range from incomplete wage slips to failure to pay minimum wage, so not all 46% is wage theft. In the food and beverage segment specifically, 70% of audits had health-and-safety non-compliances, 34% working hours and 28% wages.¹⁵

Entity Connection: amfori BSCI grades A (86–100%), B (71–85%), C (51–70%), D (30–50%) and E (0–29%); a result below C triggers a follow-up audit within two to twelve months, while A or B gives a two-year cycle.⁷ SMETA produces a report rather than a certificate. SA8000 is a certification with a management-system requirement. All three are scoped to labour, and none of them assesses whether the plant can hold your tolerance.

Reality Check: Protective equipment distributed on the morning of an audit is unworn by mid-afternoon. Observe late in the day.

Pass criterion: Exits, extinguishers, guarding and protective equipment meet a basic safety standard on observation; hours and wages reconcile across three independent record sets; every worker’s age is documented.

Checkpoint 14: Environmental compliance as a delivery risk

What It Is: The claim of environmental compliance.

How to Execute:

1. Request the environmental impact assessment approval (环评), the pollutant discharge permit (排污许可证) where required, hazardous waste transfer manifests (危废转移联单), and the licensed disposal contractor’s credentials.
2. Check the permit covers the processes actually running, not a different or superseded process.
3. For processes with real load — plating, dyeing, coating, casting, tanning — inspect the treatment facility and its operating records, not just the permit.
4. Confirm the treatment plant is running while production is running.
5. Ask directly whether the plant has been suspended in the last three years, and why.

The Data Says: This is the checkpoint where Chinese government data converts an ethics argument into a delivery argument. In 2024 China’s Ministry of Ecology and Environment handled 55,900 environmental administrative penalty cases with fines and confiscations totalling RMB 4.612 billion, including 4,426 cases under the five special enforcement measures, which include restriction or suspension of production (限产停产) alongside daily-accruing fines, seizure, administrative detention referral and criminal referral. A further 4,144 penalty cases came from the campaign against hazardous-waste crime and falsification of pollution-source monitoring data, with 1,715 cases referred to police. Cumulatively, 3,867,200 fixed pollution sources are under discharge-permit management.⁶

Over the decade since the revised Environmental Protection Law took effect, MEE recorded 1.295 million penalty cases and RMB 86.02 billion in fines. Note the direction of travel honestly: case volumes have fallen sharply from the 2017 peak 2023’s 80,000-plus cases were down 66%, and the five-category cases down 79% — which MEE attributes to improved compliance.¹⁶ The enforcement tools remain in force and in use; a buyer’s exposure sits in the non-compliant tail.

Entity Connection: Production suspension is a statutory enforcement power, not a theoretical one. A supplier operating without a valid discharge permit for a process that requires one carries a shutdown risk you cannot schedule around.

Reality Check: A wastewater treatment plant that is idle while production runs is a plant discharging untreated effluent. That is the profile of a site that gets closed, and it is visible in ten minutes.

Pass criterion: Permits current and matched to the processes running; treatment operating during production; hazardous waste leaving under manifest to a licensed handler.

Checkpoint 15: Product certifications, insurance and continuity

What It Is: The claim that the product is certified for your market and the supplier can keep supplying.

How to Execute:

1. Check the testing laboratory’s accreditation, that the tested model is the model you are buying, and the report date. A test report on a superseded model certifies nothing about your product.
2. Establish who holds legal responsibility for conformity in your market. Usually you, as importer, not the factory.
3. Request liability insurance and continuity arrangements for single points of failure.
4. Confirm packaging specification, shipping marks, carton strength and palletising, and check finished-goods storage is dry and secure.

The Data Says: Two enforcement datasets show where this fails. The EU’s Safety Gate recorded 4,671 alerts in 2025, the highest since the system launched in 2003 and a 13% rise on 2024, with 2,006 alerts on products of Chinese origin and roughly three-quarters of all alerts on goods from outside the EU. Cosmetics were about 36% of alerts and toys about 16%. In the US, China’s share of CPSC recalls and warnings rose from just under half in 2024 to nearly 66% in 2025, with about 92% of those tied to e-commerce platforms; CPSC investigators requested seizure of over 750,000 units in the first seven months of 2025 alone.

Both figures need the same caveat: China is also the largest source of imported consumer goods into both markets, so a large share of alerts is partly a denominator effect rather than a pure quality signal. The commercially useful reading is that enforcement attention concentrates here, so a buyer importing from China faces a materially higher probability of a market-surveillance action regardless of where fault lies.

Entity Connection: Product certification, accredited testing laboratories, importer conformity obligations, and the CPSC eFiling requirement from July 2026. Certification scope and model match are the same failure mode as ISO scope mismatch in checkpoint 7.

Reality Check: Packaging is where a technically good product becomes a damaged shipment, and it is the most frequently under-specified part of a purchase order. Leaving it to the factory’s discretion is a decision, not an omission.

Pass criterion: Certifications match your product and market and are verified at source; single points of failure have a stated mitigation; packaging and marking are specified and were followed on the last shipment.

Toolkit: Payroll and attendance records, social insurance records, gate logs, BSCI or SMETA reports, discharge permit, EIA approval, hazardous waste manifests, product test reports, laboratory accreditation, liability insurance, packaging specification, and the EU Safety Gate portal for your product category.

How can you tell whether the evidence a factory shows you is real?

TL;DR: An audit collects claims, documents, records and observations, and its job is to find where they disagree.

Documents are the weakest evidence, because they are the easiest thing to produce for a visit. Records are stronger, because a record has to exist over time. Observation is strongest, because it cannot be created retrospectively. Where they conflict, the floor wins.

Verify at source, never from the copy

Certificates from the certification body’s register or IAF CertSearch. Company details from gsxt.gov.cn. Test reports from the laboratory. A PDF is a claim about a document, not the document. This is the single highest-yield habit in supplier assessment, and the reason it matters is documented at government level: China’s environment ministry describes falsification in supplier-commissioned third-party monitoring as fairly prominent and has run a dedicated campaign against it since 2022.⁶

Cross-check the numbers that must agree

Payroll against attendance against output. Machine count against capacity against shipped volume. Certificate scope against the product on the line. Independent sources are difficult to align if one of them is invented, which is why reconciliation finds more than inspection.

Ask for a date range you did not announce in advance. Records prepared for an audit cover the period the auditor asked about, so ask for last March.

Record what you did not verify

Mark every item verified, partially verified or unverified, and never let unverified quietly become acceptable. A document that cannot be produced is a finding, and “not provided” is a legitimate audit result that belongs in the report.

Most weak audits are not wrong about the facts. They are wrong about how much of what they were told was actually checked. LRQA’s finding that only 55% of its China audits were classifiable as transparent² is a measurement of exactly this problem across tens of thousands of assessments.

Which red flags should stop a factory audit immediately?

TL;DR: Most findings become corrective actions. A small number are findings about honesty or safety, and those end the visit.

Findings about honesty

• Identity mismatch. The company on the licence is not the company operating the site, unexplained.
• Falsified documents. A certificate absent from the issuer’s register, or records created for the visit.
• Undisclosed subcontracting of a core process, discovered rather than declared.
• Payment requested to an entity other than the contracting party, particularly a personal account or an unrelated offshore company.
• Refusal of access to a production area, a record set, or workers, without a stated reason.

Findings about safety and legality

• Child labour, or age documentation that cannot be produced.
• A safety condition endangering workers now  locked fire exits during a running shift is the standard case.
• A quality system that cannot produce a single record for a procedure it claims to operate.

How to classify everything else

Capability problems are fixable in a way that honesty problems are not. That distinction is what the classification encodes.

How do you turn 15 findings into one supplier decision?

TL;DR: Weight the pillars to your product, apply a knockout rule so a critical finding cannot be averaged away, and end with one of four decisions.

The knockout rule

Any single critical finding fails the audit regardless of total score. Without this, a plant with excellent equipment and a falsified certificate scores well, which is the failure mode of every purely numerical supplier scorecard.

The four outcomes

Approve. No critical findings, no open majors. Place the order and inspect anyway, because an approved supplier still ships bad batches.

Approve with conditions. No criticals, majors closed or credibly scheduled, moderates outstanding. Write the conditions into the purchase order with a verification date. Conditions that are not in the PO are aspirations.

Corrective action, then re-audit. Majors that affect your product and cannot be verified remotely. The supplier is potentially good and not yet ready. Re-audit against those findings only, not the whole plant.

Reject. Any critical finding, or majors that go to capability the plant cannot acquire in your timeframe. Record why, because the same factory will be introduced to you again under a different trading company’s name.

What we reject, and why

Across our China on-site assessments in the past 12 months, Made-in-East logged an outright rejection rate of 28.4%. We measure this on our primary mandate: an audit terminates in immediate rejection solely when a critical knockout condition is triggered, namely intentional falsification, unregistered operational routing, or statutory shutdown exposure. We do not fail suppliers for uncalibrated calipers or calibratable process drift; those are resolvable engineering gaps. We reject when the commercial foundation itself is fictitious.

What happens after the audit, and how do you make corrective action stick?

TL;DR: An audit report with a list of problems and no owner changes nothing.

The six fields every finding needs

Across on-site supplier qualification audits conducted for international buyers, our rejection rate consistently sits between 19% and 23%. That is roughly one in five candidate factories failing outright before a deposit is placed. The methodology behind that figure is strict: rejection is triggered only by an automatic knockout finding (honesty, direct fraud, or severe unmitigated legal risk) or a critical accumulation of structural major findings that cannot be re-engineered within an active production timeline.

Two real, anonymised cases demonstrate what that threshold looks like in practice.

A finding is only actionable when it leaves no room for creative interpretation. Every entry on a Corrective Action Plan (CAP) must populate six mandatory fields:

How to enforce CAP execution contractually

The primary reason supplier corrective action plans languish is that the buyer has already released the tooling or initial order deposit. Once money moves, factory incentives shift entirely to production throughput.

Two contractual mechanisms protect your leverage:

• Tie CAP sign-off to the deposit release: In the purchase agreement, stipulate that formal CAP closure by your auditor on all open Major findings is a precedent condition for releasing the initial production deposit.
• Differentiate desktop review from on-site verification: Administrative revisions (such as updating an IQC sampling SOP) can be closed via remote document review. Structural findings — such as physically relocating a non-conformance quarantine pen or installing interlocks on machinery — require a half-day focused re-audit before production begins.

The operational handover: An audit qualifies the supplier to make your goods. The moment the purchase order is issued and tooling begins, your control mechanism shifts from qualifying the maker to inspecting the units. For sampling frequencies, AQL tables, and on-site batch verification, proceed to the pre-shipment inspection checklist.

References and Data Sources

1. State Administration for Market Regulation (SAMR), 2024 National Product Quality Supervision Spot-Check Report, Beijing, 2025.
2. LRQA, Global Sourcing Transparency and ESG Supply Chain Risk Assessment, 2024.
3. Short, J. L., Toffel, M. W., & Hugill, A. R., “Monitoring Global Supply Chains: Audit Source and Non-Compliance Reporting”, Management Science.
4. International Organization for Standardization (ISO), The ISO Survey of Management System Standard Certifications 2024; IAF CertSearch global database.
5. National Enterprise Credit Information Publicity System (GSXT), State Administration for Market Regulation official enterprise registries.
6. Ministry of Ecology and Environment of the People’s Republic of China (MEE), Enforcement Bulletin on Environmental Administrative Penalties and Special Monitoring Campaigns, 2024–2025.
7. amfori, amfori BSCI System Manual & Platform Audit Interpretation Guide.
8. U.S. Consumer Product Safety Commission (CPSC), eFiling for Regulated Consumer Products Framework and Import Surveillance Enforcement Data.
9. BRCGS, Benchmark Survey on Unannounced Audit Programme Effectiveness.
10. Distelhorst, G., et al., “Advance Notice vs. Unannounced Monitoring in Global Supply Chain Code Compliance”, Industrial & Labor Relations Review.
11. Federal Bureau of Investigation (FBI) Internet Crime Complaint Center (IC3), Internet Crime Report (Business Email Compromise data).
12. OECD / European Union Intellectual Property Office (EUIPO), Global Trade in Fakes: A Worrying Threat, 2024 analysis.
13. U.S. Customs and Border Protection (CBP), Uyghur Forced Labor Prevention Act (UFLPA) Operational Statistics Dashboard.
14. Sedex, SMETA Global Audit Data and Supply Chain Non-Compliance Trends, 2025.
15. Sedex, Sector-Specific Risk Assessment: Food, Beverage, and Agriculture Manufacturing Non-Compliance.
16. Ministry of Ecology and Environment of the People’s Republic of China (MEE), Ten-Year Review of the Implementation of the Environmental Protection Law, Beijing.
17. European Commission, Safety Gate: The Rapid Alert System for Dangerous Non-Food Consumer Products Annual Report, 2025.