Establishing secure connection…Loading editor…Preparing document…

Supplier Control Audit Form

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

SUPPLIER CONTROL AUDIT FORM

Parties and Background

Company Name:

Supplier Name:

Audit Reference No.:     Effective Date:

WHEREAS, the Company procures goods and/or services from the Supplier and requires periodic evaluation of the Supplier's internal controls, processes and compliance that directly affect product quality, data security, and continuity of supply; and

WHEREAS, the Supplier agrees to permit the Company, or its designated auditors, to perform an audit of Supplier controls under the terms set forth herein in order to verify compliance with contractual, regulatory, and Company-imposed control requirements; and

WHEREAS, the parties intend this Supplier Control Audit Form to document the scope, procedures, findings, corrective actions and payment terms associated with the audit engagement described below.

Scope of Work

Audit Areas to be Evaluated (check all that apply):

Information Security    Quality Management    Business Continuity    Subcontractor Controls

Financial Controls    Environmental / Health / Safety    Other:

Audit Details

Start Date:     End Date:

Audit Method: Onsite    Remote    Hybrid

Findings and Corrective Actions

Finding 1 — Title:

Risk Rating: High Medium Low

Target Completion Date:

Finding 2 — Title:

Risk Rating: High Medium Low

Target Completion Date:

Finding 3 — Title:

Risk Rating: High Medium Low

Target Completion Date:

Payment Terms

Audit Fee (Total):

Late Payment Fee:

Term and Termination

Term Commences:     Term Ends:

Termination Notice Period (days):

Either party may terminate this engagement for material breach by the other party where such breach is not cured within the notice period specified above. Termination for cause shall be without prejudice to any remedies available at law or in equity.

Confidentiality

All non-public information obtained by the Auditor or Company during the course of the audit, including records, system access data, and Supplier internal documents, shall be treated as Confidential Information of the disclosing party. The receiving party shall: (a) restrict disclosure to those employees and agents who have a need to know and are bound by confidentiality obligations at least as protective as those herein; (b) use Confidential Information solely for purposes of performing or reviewing the audit; and (c) return or destroy Confidential Information upon written request or termination of this engagement. Confidentiality obligations shall survive termination of this form for a period of three (3) years.

Governing Law

This Supplier Control Audit Form and any disputes arising out of or related to it shall be governed by and construed in accordance with the laws of:

Entire Agreement

This Supplier Control Audit Form, together with any attachments or schedules executed by the parties, constitutes the entire agreement between the Company and Supplier with respect to the audit engagement and supersedes all prior oral or written representations, proposals, agreements or understandings relating to the subject matter hereof. Any modification must be in writing and signed by authorized representatives of both parties.

Auditor Certification

By checking the box below, the named Auditor certifies that the audit was conducted in accordance with the scope and methodology set forth in this form and that the findings reported above are true and accurate to the Auditor's best knowledge.

I certify the above

Attachments

Signatures

Company Printed Name:

By:

Date:

Title:

Supplier Printed Name:

By:

Date:

Title:

Enter text✕
Prepare your document for signing right on this page
  • 01 Edit the text and complete the fields
  • 02 Click Sign Now and on the next screen add recipients and signature fields in SignNow
  • 03 Start your free trial to sign and send your doc
Sign Now

What the Supplier Control Audit Form Is and when it's used

The Supplier Control Audit Form is a structured checklist and record used by procurement, quality, and compliance teams to document supplier controls, performance, and remediation. It captures supplier identity, scope of goods or services, control objectives, test results, evidence references, corrective actions, and approver signatures. Organizations use this form to demonstrate due diligence, support contract renewals, and satisfy internal audit or regulator requests. The form is typically integrated into vendor management workflows and may be stored with contracts, purchase orders, and supplier qualification files.

Why this form matters for procurement and compliance

A Supplier Control Audit Form centralizes evidence of supplier controls, reduces regulatory and operational risk, and creates an auditable trail for vendor performance and remediation. Accurate records support dispute resolution, continuity planning, and third-party risk reporting.

Why this form matters for procurement and compliance

Typical teams and roles that complete the form

The form is completed by procurement, supplier quality, compliance, and contract managers as part of vendor onboarding and periodic reviews.

  • Procurement teams: run supplier selection checks and capture contract terms for procurement records.
  • Compliance and risk: evaluate control effectiveness, document gaps, and log corrective action plans.
  • Supplier quality managers: verify product/process controls, nonconformance history, and inspection results.

Legal, internal audit, and business unit owners commonly review completed forms to accept risk or require further mitigation.

Essential sections to include in a professional Supplier Control Audit Form

A complete form groups supplier details, control criteria, test evidence, nonconformance items, corrective actions, and sign-off to ensure traceability and consistent reviews across suppliers.

Supplier Details

Legal name, DBA, address, contact name, phone, email, DUNS or vendor ID, and contract reference to uniquely identify the supplier and link records.

Scope of Services

Clear description of goods or services covered, SKU or service codes, delivery locations, and applicable contract or purchase order numbers for scope control.

Control Criteria

List of required controls such as quality standards, cybersecurity controls, data handling, business continuity, and compliance obligations mapped to contract clauses.

Evidence Collected

Records of test results, certificates, audit reports, screenshots, or attachments with dates and reviewer names establishing the factual basis for findings.

Findings & Actions

Nonconformance descriptions, severity rating, root-cause notes, corrective action plan with owner, due date, and follow-up verification steps.

Approvals & Sign-off

Designated approver names, titles, signature blocks and dates to document responsibility and accept residual risk after mitigation.

Step-by-step: completing the Supplier Control Audit Form

Follow these steps to complete the form from preparation through sign-off.

  • 01
    Prepare: Gather contract, scope, previous audit reports, and contact details before starting the form.
  • 02
    Record supplier info: Enter vendor identifiers, contract numbers, and scope to link records.
  • 03
    Test controls: Perform checks, collect evidence, and note findings against each control.
  • 04
    Assign actions: Log corrective actions with owners, due dates, and schedule verification steps.

How the review and submission workflow typically moves

A typical workflow routes the completed form through reviewers, risk acceptance, and archiving; automation can shorten each handoff.

  • Initiate: Form started by procurement or vendor manager with supporting documents attached.
  • Review: Compliance and quality review entries, request clarifications if evidence is incomplete.
  • Approve: Authorized approver accepts residual risk or requires more remediation.
  • Archive: Final form and evidence stored in vendor management system for retention.

Typical online workflow settings to configure

Configure workflow fields and routing to ensure the right reviewers get notifications and the audit trail is preserved.

Field Configuration
Routing order Set sequential reviewers and fallback approvers for each stage.
Notifications Enable email and in-app reminders for pending actions and due dates.
Authentication Require email code or multi-factor authentication for high-risk supplier approvals.
Evidence attachments Set allowed file types, size limits, and automatic naming conventions.

Digital signing and document platform considerations

Confirm the platform meets privacy and regulatory needs, can export audit reports, and supports long-term retention workflows.

  • File formats: PDF, DOCX, and image formats are commonly supported for attachments.
  • Integrations: Look for connectors to ERP, procurement, and document storage systems.
  • Security: Ensure TLS in transit and AES-256 at rest for evidence protection.

Typical timelines and processing expectations

Define internal deadlines for audit completion, corrective action, and verification to keep supplier risk current.

Initial audit completion:

Complete within 30–60 days of contract start or supplier onboarding.

Corrective action deadline:

Set owner deadlines typically 30–90 days depending on severity.

Follow-up verification:

Verify remediation within 30 days after action completion.

Periodic reassessment:

Schedule periodic audits annually or upon material changes.

Record delivery to stakeholders:

Distribute final report within 7 business days after sign-off.

Key milestones in the supplier audit lifecycle

Track these milestones from planning through closure to maintain accountability and visibility.

01

Audit planning

Define scope, objectives, resources, and schedule for the audit engagement.

02

Field testing

Perform control tests, collect evidence, and record observations.

03

Reporting

Document findings, risk ratings, and proposed corrective actions.

04

Closure

Confirm remediation, update risk rating, and archive the completed file.

Common mistakes to avoid when preparing the form

  • Incomplete evidence: attaching a summary instead of source documents that demonstrate control performance.
  • Vague findings: using non-specific language like 'issue found' without severity, root cause, or dates.
  • Missed sign-offs: failing to collect required approvals or to document who accepted residual risk.
  • Incorrect supplier identity: using a trade name instead of the legal entity, which can complicate contract enforcement.

Security and compliance items to capture on the form

Encryption: TLS 1.2/1.3 in transit
Data at rest: AES-256 encryption
Access controls: Role-based access
Audit trail: Timestamps and IP
HIPAA status: BAA required if PHI
Retention policy: Specify retention duration

Penalties and risks if the form is inaccurate or missing

Contract exposure: Disputes and unenforceable terms
Regulatory fines: Industry regulators may levy penalties
Operational failure: Undetected supplier risk leads to outages
Data breach risk: Noncompliant data handling may incur liability
Payment delays: Missing vendor IDs can hold payments
Audit findings: adverse internal/external audit reports

Examples: how organizations use Supplier Control Audit Forms

Real-world examples show how different teams rely on completed forms to manage vendor risk and support decisions.

Optica Ventures — Procurement

Procurement required annual supplier audits to meet contract terms

  • Findings were tracked in a shared repository
  • The completed forms allowed faster renewals and clearer remediation accountability across portfolios.

Fertility Centers — Healthcare

Healthcare compliance used the form to confirm BAA and HIPAA controls

  • Evidence included security reports and training logs
  • This reduced privacy risk and supported regulator reviews with documented proof.

Representative eSignature vendor pricing and capabilities

Compare basic pricing and common capabilities for signing supplier audit forms; signNow is listed first per vendor ordering requirements.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial 7-day free trial Varies by vendor Varies by vendor Varies by vendor Varies by vendor
Bulk Send Yes Yes Yes Yes Yes
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No
Envelope Cap No cap 100 envelopes/user/year Varies Varies Varies

Frequently asked questions about the Supplier Control Audit Form

Answers to common questions on legality, signatures, storage, and practical completion issues.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users
Sign Now
Company
Forms
Pricing
Resources
Knowledge base
Other Products
© 2026 airSlate Inc. All rights reserved.