Supplier Audit Programme Cost: What Drives Budget and Duration

What determines the cost of a supplier audit programme?

Four decisions the buyer makes before the first audit: the number of suppliers to audit, the frequency set by their risk, the format of each audit and the level of follow-up required. The auditor’s day rate only comes into play afterwards. Two programmes at the same day rate can differ several times over depending on those choices.

How many suppliers really need an audit?

Those whose risk justifies it, not all of them. A buyer certified to BRCGS Food Safety Issue 9 has three approval routes (clause 3.5.1.2): certification to BRCGS or to a standard recognised by the GFSI whose scope covers the materials purchased, a supplier audit, or a questionnaire reserved for suppliers assessed as low risk, with a justification. A questionnaire used for approval is renewed at least every three years: an older questionnaire is one of the gaps a BRCGS auditor looks for.

The first saving is therefore certificate verification. The BRCGS Directory, the FSSC Public Register and the IFS Database let you check a certificate’s validity, version and scope before deciding on an audit.

To rate a supplier’s risk, tick the criteria that apply:

• The product is sensitive: ready to eat, canned (heat-sterilised), fishery product, major allergen.
  
• The product is sold under the buyer’s brand.
  
• The supplier’s certificate does not exactly cover the product, the line or the address.
  
• The supplier is not certified to any GFSI-recognised standard.
  
• A step is subcontracted: packing, storage, processing.
  
• The product carries a claim: origin, free-from allergen, production method.
  
• The material is exposed to fraud: olive oil, spices, seafood.
  
• The history is heavy: complaints, goods-in rejections, non-conforming test results, an incident.
  
• The volume bought is large, or the supplier is the only source for its product.
  

The more boxes ticked, the more an on-site audit is justified, and the more often it should take place.

How does the risk rating set frequency and duration?

The rating decides the approval method and the pace of monitoring; the duration of each audit depends on the site and the checklist. The table gives a qualitative logic, which the buyer adapts in its own procedure.

As for duration, no standard sets the length of a second-party audit. In certification, standard owners calculate it from the characteristics of the site; in a second-party audit, it is set at scoping, from the scope, the number of lines and products, the risk, the tests and the language. ISO 19011:2026, the guidelines for auditing, is the common reference for organising the programme and each audit. ISO 19011:2026 was published on 27 May 2026 (4th edition) and replaces the 2018 edition, according to the ISO committee page.

On-site, remote or blended audit: which to choose?

On site to approve, remote to prepare and follow up. Observing the plant in production, the condition of the premises and interviews with operators cannot be done through a screen; the document review, interviews with management and verification of closure evidence can.

Certification provides a useful benchmark. Under the BRCGS080 procedure, the BRCGS Food Safety blended audit is reserved for announced recertifications: never for a first audit, with the remote part limited to half the total duration and the on-site part within 28 days. BRCGS keeps the same total duration as an on-site audit. For a supplier programme, the consequence is simple: remote auditing reduces travel, not audit time, and it does not replace the first visit to a high-risk supplier. On the other hand, a remote document review may be enough for a low-risk supplier, and remote follow-up can avoid a follow-up audit when the closure evidence is documentary.

Remote auditing requires digitised records, a reliable connection and confidentiality rules for screen sharing: check these at scoping.

Which hidden costs should you plan for?

Those that do not appear on the auditor’s quote but weigh on the budget and the calendar:

• Travel. A supplier in Safi, Agadir, Laayoune or Dakhla, or in West Africa, is not audited like a plant in Casablanca. Grouping audits by region and season cuts journeys and overnight stays.
• Seasonality. A fresh produce packhouse or a cannery is audited during its season, with the product in production; a missed date pushes the audit to the next season.
• Follow-up audits. A serious finding at a high-risk supplier often calls for a new visit; budget for it rather than treating it as an overrun.
• Analyses. Samples taken during the audit to check a residue, an allergen or a claim: a laboratory cost, separate from the audit.
• Translation. An audit conducted in French or Arabic and a report expected in English: choose an auditor who writes in the buyer’s language.
• Internal time. Checklist, risk analysis, approval decisions, follow-up: the programme also takes up the buyer’s purchasing and quality teams.

How do you control the budget without weakening supplier approval?

By spending on-site audits where they truly protect you, and standardising the rest. Five levers are enough:

1. Segment the portfolio every year by risk rating, and take stable, certified, incident-free suppliers out of on-site auditing.
2. Check certificates first in the official databases, so as not to audit what an independent body has already covered.
3. Use a single checklist per product family, targeting only what the certificate does not cover.
4. Group visits by region and by season, Morocco and West Africa included.
5. Follow up remotely on actions whose evidence is documentary, and keep follow-up audits for gaps on the shop floor.

Each supplier’s reports, findings and action status can be tracked in your Inspirra client space, so the history does not have to be rebuilt at each renewal. For the content of an audit and its deliverables, see our guide to supplier audits in Morocco; for a programme applied to three suppliers, read the typical case of a European importer.