Factory audit vs. supplier screening — what each one proves

The template above shows the shape of a factory audit report: who was audited and how, an overall score and rating with a validity date, scores by section, the findings, and the corrective actions and follow-up. The first block deserves the most attention. The auditee is the factory, and the factory can be a different legal entity from the vendor you quoted with and will pay. Both names belong in your records exactly as written.

A manufacturing audit scores capacity, machinery, workflow and the quality system, and answers whether the order can be made and made consistently. A social or ethical audit records working hours, wages, insurance, health and safety and hiring practices found on the day. A security audit checks the same areas a supply-chain security programme does, such as personnel, physical access, shipment controls and records; CBP's own CTPAT programme, which is voluntary, covers those areas for companies that join it.

Each kind answers a different buyer question. A strong manufacturing score says nothing about working conditions, and a clean social audit says nothing about whether the factory can hold your tolerances.

A supplier screening checks names against government lists: the UFLPA Entity List kept by the Forced Labor Enforcement Task Force, CBP's Withhold Release Orders and Findings, and the sanctions and export-control lists such as OFAC's. It resolves the typed name to a legal entity, checks aliases and known parents, and reports which lists were searched and what was found, with the source and the date. It is a legal-status check, and it can be repeated in minutes when a list changes.

A screening does not visit the factory and cannot see working conditions. An audit visits the factory and cannot see a government list. That is the whole difference.

CBP's operational guidance for importers describes the information CBP may ask for when an importer seeks an exception to the UFLPA's rebuttable presumption: information about the importer's due-diligence system, supply-chain tracing, supply-chain management measures, and evidence about the goods themselves. Credible audits to identify forced-labor indicators, and remediation of any found, appear on that list as one item among the others.

Read that carefully. An audit is one input into a due-diligence system. It is not, on its own, the clear and convincing evidence about the goods' supply chain that an exception requires, and an audit score cannot show whether a company or its parent is on the Entity List. Anyone who presents an audit as a forced-labor clearance is selling more than the document can carry.

Check whether the audit was announced. An announced audit is prepared for, and the score describes that prepared day. Check the validity date; scores expire. Check the auditee's legal name against the vendor's, and against the names on your invoices. And read the findings before the score: three findings about overtime and insurance tell you more than a social accountability score of 4.8 out of 5.

Then look at what happened next. Findings without a corrective action plan, dates and a follow-up audit are a snapshot. The plan and the re-audit are what a broker or an attorney would later ask to see.

Screening comes first, because it is cheap, fast and repeatable, and because it belongs before the deposit is paid: a supplier on a list is a supplier not to pay. An audit comes when the volume justifies a site visit, or when a buyer's own programme requires one. Both go in the same file, alongside the test reports and inspection reports, because that file is what due diligence looks like when someone asks to see it.