What to Do When Your Supplier Fails a Factory Audit

Receiving a factory audit report filled with non-conformances is uncomfortable, but it is also exactly what independent auditing is supposed to surface. The real test of your sourcing process is not whether your supplier passes first time — many capable factories carry correctable gaps — but whether you have a structured method to resolve supplier audit non-conformance corrective action before it becomes a shipment failure, a compliance breach, or a brand incident. Most audit content stops at findings. This guide starts there.

The terms CAPA and non-conformance report (NCR) originate in quality management systems such as ISO 9001, but they apply equally to social compliance audits conducted under SMETA, BSCI, or SA8000 frameworks, and to environmental and process maturity assessments. Whatever the audit type, the underlying discipline is the same: classify the gap, assign accountability, set a verifiable deadline, and close the loop with evidence. Skipping any of those steps leaves the finding open in practice even if it is marked resolved on paper.

This guide is written for procurement managers, sourcing directors, and ethical trade leads who commission audits of Asian suppliers — whether in Guangdong, Zhejiang, Vietnam, Bangladesh, or Indonesia — and who need to convert audit reports into supplier action rather than filing cabinet entries. If you are still selecting an audit approach, start withthe Factory Inspection pillar guidebefore returning here.

An NCR is not a verdict. It is a documented gap between an observed condition and a defined standard. That standard might be your own supplier code of conduct, an ISO 9001 clause, an SA8000 requirement on working hours, or a BSCI benchmark on health and safety. The NCR describes the gap, provides objective evidence (photographs, document samples, worker interview summaries), and typically assigns a severity grade.

Most audit frameworks use a three-tier severity classification:

The severity grade determines your response timeline, not your overall confidence in the supplier. A factory with three minor findings and a clear management system is often a stronger partner than one with a single major finding and no evident quality infrastructure.

How to Classify Findings Before You Build a CAPA Plan

Before assigning deadlines, categorise each finding by two dimensions: severity (as above) and root cause type. Root cause types commonly fall into three groups:

Systemic gaps

The factory lacks a documented procedure, a trained responsible person, or a functioning management system for the relevant requirement. Systemic gaps take longer to close because they require process design, not just corrective action. Examples include the absence of a grievance mechanism, no calibration records for testing equipment, or no internal audit programme.

Implementation gaps

A procedure exists but is not consistently followed. These are often faster to close because the solution is retraining, supervision improvement, or record-keeping enforcement rather than building something from scratch.

Documentation gaps

Practice may be correct but evidence is missing or poorly maintained. These are typically the fastest to remediate, though auditors rightly treat undocumented compliance with scepticism until records are established over a meaningful period.

Mapping each NCR to a root cause type helps you evaluate the supplier's own CAPA response. If a factory responds to a systemic gap with a documentation fix, that is a red flag — they have misunderstood or misrepresented the finding.

Writing and Issuing the CAPA Request to Your Supplier

A CAPA request is a formal document you issue to the supplier. It should reference each NCR by its audit report number, state the applicable standard or requirement, describe the evidence observed, and request the supplier's response in a structured format. A workable CAPA response template asks the supplier to provide:

1. Root cause analysis — their own assessment of why the gap occurred 2. Immediate corrective action — what they have done or will do to fix the specific instance 3. Preventive action — what system changes will prevent recurrence 4. Evidence of completion — documents, photographs, records, or third-party verification 5. Target completion date — realistic and tied to severity grade

Timeline expectations vary by severity. Critical findings typically require immediate containment with a resolution plan submitted within days. Major findings are commonly given a window of four to twelve weeks depending on the complexity of the root cause. Minor findings are often consolidated into a ninety-day improvement cycle.

Be explicit about what constitutes acceptable evidence. For a working hours finding under SMETA or SA8000, acceptable evidence is typically payroll records, time attendance logs, and a revised scheduling policy — not a letter stating that hours will be reduced. For a fire safety finding, it is a completion certificate from a qualified contractor plus photographic evidence, not a supplier's declaration.

Setting Realistic Timelines That Suppliers Can Actually Meet

One of the most common reasons supplier audit non-conformance corrective action plans fail is timeline mismatch. Buyers set deadlines based on commercial urgency rather than what the remediation realistically requires. This creates two failure modes: suppliers submit superficial evidence to meet the deadline, or they miss the deadline and the finding drifts unresolved.

For social compliance issues — particularly those involving wages, working hours, or freedom of association — behavioural and cultural change takes time, and a thirty-day deadline for a systemic finding is usually insufficient. For physical infrastructure findings — blocked exits, missing machine guards — the constraint is often contractor availability and local permitting, not supplier willingness.

When setting deadlines, factor in:

- Lead time for physical works — contractors in high-density manufacturing regions such as Guangdong or Ho Chi Minh City can have backlogs of several weeks - Regulatory filings — some environmental compliance actions require government inspection or certification before evidence is available - Audit framework rules — SMETA, BSCI, and similar programmes have their own guidance on maximum re-audit intervals for major and critical findings; check the relevant scheme rules - Your own purchase order timeline — if a shipment is conditional on CAPA closure, build that dependency explicitly into your supplier contract

Verifying Corrective Action: Why Desk Review Is Not Enough

The most consequential step in supplier audit non-conformance corrective action management is verification — and it is where the process most commonly breaks down. Many buyers accept a supplier's CAPA submission at face value, mark the finding closed, and move on. This leaves the underlying risk unchecked.

Document review by your own team is a starting point, not a finish line. Photographs can be staged. Records can be backdated. Policy documents can be issued without implementation. The only reliable verification for major or critical findings is an independent on-site check conducted by a third party with no commercial relationship to the factory.

This is sometimes called a CAPA verification audit or a follow-up inspection. Its scope is narrower than a full factory audit — it focuses specifically on the NCR items, reviews updated records, interviews relevant workers or supervisors, and confirms that the physical or procedural conditions described in the CAPA evidence match observable reality.

Our Factory Inspection serviceincludes follow-up verification audits scoped specifically to open NCR items, which is more cost-efficient than commissioning a full repeat audit when only a subset of areas requires re-examination.

Managing Repeat or Unresolved Non-Conformances Over Time

A supplier who presents the same major finding across two consecutive audit cycles is communicating something important: either they lack the management capability to implement change, or they are not prioritising it. Both are commercially relevant signals.

For managing repeat non-conformances, consider a graduated response structure:

- First occurrence: Issue CAPA request with standard deadline; schedule verification audit - Second occurrence of same finding: Escalate internally; require a corrective action plan signed by factory senior management; consider conditioning next purchase order on verified closure - Third occurrence or critical finding not resolved: Formal supplier improvement programme or sourcing review

Documenting this progression matters not only for your own decision-making but for demonstrating due diligence to investors, boards, or retail partners who scrutinise supply chain governance. The evidence trail — audit report, CAPA request, supplier response, verification result — should be retained and accessible.

For enterprise category managers standardising audit methodology across multiple Asian countries, linking CAPA closure status to supplier scorecards and onboarding approval gates is a practical way to ensure that audit findings produce commercial consequences rather than paperwork cycles.

When to Walk Away: Non-Conformance as a Sourcing Decision

Not every NCR leads to a CAPA. Some findings should trigger a sourcing review rather than a remediation cycle. The clearest cases are critical zero-tolerance findings involving labour rights violations, deliberate falsification of audit records, or structural product safety failures. In these situations, the question is not how to fix the supplier but whether you should continue the relationship at all.

Less obvious are situations where a supplier demonstrates consistent inability to close major findings across multiple categories — quality management, environmental practice, and social compliance simultaneously. This pattern often indicates a management system that is too immature to support the compliance demands of your programme, regardless of the factory's production capacity.

That distinction — between a capable factory with correctable gaps and one with systemic management failure — is something a well-structured audit can reveal. The supplier audit non-conformance corrective action process only works when the underlying audit is robust enough to distinguish between the two. Surface-level checklist audits frequently miss systemic gaps entirely, which is why audit methodology and auditor independence matter as much as the findings themselves.

For guidance on selecting the right audit scope and framework before any of this becomes relevant, seethe Factory Inspection pillar guideor exploreour Factory Inspection serviceto understand how MTS structures independent audits across Asia.

A factory audit that surfaces non-conformances has done its job. The question that determines whether it adds commercial value is what you do with the findings. A disciplined CAPA process — with clear classification, structured supplier requests, realistic timelines, and independent verification — converts audit evidence into genuine supply chain improvement rather than a report that satisfies a box-tick and nothing more.