Chapter 28: Supplier Corrective Action Audit: Verifying Your Supplier's Fix Actually Worked

Here's the step most manufacturers skip, and it costs them dearly.

Your supplier submits a completed 8D on day 8. It looks complete: D1 (team composition), D2 (containment), D3 (root cause — "worn tooling"), D4–D7 (corrective action — "replaced tooling, re-qualified with SPC"), D8 (preventive action). You review it, it looks reasonable, and you mark the SCAR as closed.

Three months later, the same defect appears in a new lot from the same supplier. Your customer calls. You have no evidence that you ever verified the supplier's corrective action actually prevented the defect.

You must verify. This is Clause 8.5.2 of ISO 9001: "When an organization determines that nonconforming outputs have been produced, it shall ensure that these outputs are controlled to prevent their unintended use or delivery."

A three-level verification system works for most Tier 1 manufacturers:

Level 1: Desk Review (SCAR Response)

• Review the supplier's 8D documentation for completeness: all eight D's addressed, signatures, dates.
• Verify the root cause makes logical sense and matches the nonconformance evidence (e.g., if worn tooling caused dimensional drift, are the tooling replacement dates and revised SPC data included?).
• Confirm the corrective action is preventive, not just reactive (e.g., "We re-inspected all parts from the lot" is containment, not correction; "We replaced tooling and implemented tool-wear monitoring" is correction).
• Check that timelines and milestones align with your SCAR response deadline.
• Red flags: vague root causes ("human error," "miscommunication"), corrective actions that duplicate previous actions from an earlier SCAR, or missing supporting data.

Level 2: On-Site Verification Audit

For high-risk suppliers or critical parts, schedule a follow-up audit at the supplier's facility within 2–4 weeks of SCAR submission. You're not doing a full re-certification audit; you're doing a SCAR verification audit. Scope:

• Walk the process with the supplier's quality manager. Observe the "corrected" process in operation. Ask: "Show me the new tooling. When was it installed? What's the qualification date? What SPC data have you collected since installation?"
• Request production records, SPC charts, and inspection logs from the lot following the corrective action implementation. Compare process capability before and after. Is Cpk now ≥1.33?
• Interview production and quality staff: "What changed in your process? How was the team trained on the change?" If the staff can't articulate the change, the fix probably won't stick.
• Photograph or document the corrected process as evidence.

Level 3: Incoming Data Monitoring (90-Day Verification Period)

After the supplier implements the corrective action, monitor incoming inspection data for the affected part number over a defined period—typically 90 calendar days or five shipments, whichever is longer.

• Plot incoming inspection data on a control chart. Are measurements stable and within specification?
• If you use a supplier data portal (e.g., supplier self-certification or automated data upload), review the supplier's outgoing quality data for the same period.
• If you see even one measurement drifting toward the nonconformance limit, or if you detect a similar defect in a new lot, escalate immediately. The corrective action hasn't worked; you need a second SCAR or a deeper investigation.
• Document the verification period in your SCAR closure record. Write something like: "SCAR closed 2026-05-17. Verification period: 2026-03-15 to 2026-06-15. Incoming inspection of part 45-002, lots [list lot numbers], 100% inspected. All measurements within specification limits. SPC data stable. Corrective action confirmed effective. — [Quality Manager signature]"

Documenting Supplier CA Verification in Your QMS

Your own auditor—whether an internal auditor or an external certification body auditor during a surveillance visit—will ask: "Show me how you verify that supplier corrective actions actually work."

Create a SCAR closure checklist or log template in your QMS that includes:

• SCAR number, date issued, supplier name, part number
• Problem description (one-line summary)
• Supplier's 8D submission date
• Level 1 desk review: Completed by [name], date, findings
• Level 2 audit: Scheduled date (if applicable), audit performed by [name], date, findings
• Level 3 verification period: Start date, end date, incoming data reviewed, result (pass/fail)
• SCAR closure date and signature
• Linked to incoming inspection records and SPC data

When your auditor sees this documented trail—SCAR issued → 8D received → verification audit conducted → 90-day monitoring completed → closure documented—they see a company that takes supplier quality seriously. You're not just collecting SCARs; you're actually preventing repeat nonconformances.