Supplier audits: turn a yes answer into reliable evidence

“Backups are tested regularly.” The supplier questionnaire answer sounds reassuring. What remains unclear is what was tested, whether your service was included and whether identified errors were resolved.

A supplier audit examines such claims against agreed criteria and suitable evidence. This guide provides a compact information security workflow. It does not replace the general supplier assessment: that prioritises relationships. Here, you examine a specific issue.

Define an assignment you can examine

Before the meeting, write down which service you want to assess. “The cloud provider” is too broad. “Restoring our hosted order application, including the agreed underlying data” can be examined.

Also record:

• Which security requirement is the criterion?
• Which systems, locations and periods are included?
• Which documents or interviews are needed?
• Who assesses the results and decides on unresolved issues?

Section 3.3 of the ENISA guidance on supply-chain cybersecurity covers agreed security requirements, assessments and contractual audit rights. This does not establish a blanket obligation to audit every supplier on site. Choose the depth based on risk, existing assurance and your agreements.

A document review can suffice for a narrowly defined question. An unresolved critical claim may need further evidence or a discussion with those responsible. Technical tests and access require an explicitly agreed scope.

Request evidence that answers the question

A certificate can provide an important foundation. Check its scope and the service covered, however. A questionnaire initially represents a self-declaration. A test record can demonstrate a particular test. These evidence types are not interchangeable.

Fictional evidence sample for recovery:

Agree on a secure form of inspection. Redacted documents or controlled screen sharing may be more appropriate than emailing complete operational data. Record the limits too: what did you see, and what could you not assess?

Separate observation, criterion and assessment

A traceable finding combines a verified observation and the relevant criterion. Do not write only “Backup inadequate”.

A more precise fictional example:

A recovery test was provided for the commissioned application. It covered the database but not the additionally agreed document repository. No result for that component is present in the sample examined.

This initially calls for further evidence or review. Whether a deviation actually exists depends on the criterion and additional evidence. Lack of access and demonstrated non-fulfilment are different results.

Avoid blanket scores that hide this uncertainty. Explain what the unanswered question means for your service.

Follow findings through to retesting

Use a short record for each finding:

“The supplier promised” is not evidence of effectiveness. A retest does not necessarily require repeating the entire audit. Examine whether the specific issue has been resolved and whether the change has further effects.

When should you look again?

A new subcontractor, a changed service or a relevant incident can change the previous assessment. Define these triggers alongside regular reviews. For automotive suppliers, the ISA2027 guide separately covers that version transition.

Start with one critical claim in an existing questionnaire. Follow it from criterion through evidence to decision. If doing so requires several disconnected email threads, you have a clear opportunity to improve how the work is organised.

Use this case to assess Kopexa: do the supplier, outstanding measure and associated evidence stay traceably connected? The benefit appears in the resolved review case, not the number of completed questions.