What Should You Expect in a Supplier Audit Report Before You Buy Custom Sheet Metal Parts from China?

Every week, our team visits factories across China and Vietnam on behalf of clients who cannot make the trip themselves. What we see on those visits — the gap between a supplier's marketing deck and their actual floor — is often striking.

A supplier audit report for custom sheet metal parts from China should cover legal registration verification, production equipment details, quality management system status, in-process controls, inspection equipment inventory, finishing process ownership, corrective action grading, capacity redundancy, and timestamped photographic evidence gathered by an independent third-party auditor.

If your current audit report does not cover all of those areas, it is not a risk management tool. It is a folder of paperwork.

Which Audit Checkpoints Matter Most When You Qualify a China Sheet Metal Factory?

When our team prepares for a factory audit, we build a structured checklist before we even book the flight. Most supplier failures we have seen in over a decade of sourcing trace back to checkpoints that were skipped or accepted on the supplier's word alone.

The audit checkpoints that matter most when qualifying a China sheet metal factory are: legal entity verification, production equipment condition, ISO 9001 certification status, quality management procedures, inspection equipment inventory, and finishing process ownership — each must be independently verified, not self-reported.

Legal Entity Verification

Start with the business license. Every legitimate Chinese manufacturer must hold a valid business license issued by SAMR (State Administration for Market Regulation). The auditor should record the unified social credit code printed on the license and cross-reference it against the SAMR national enterprise database ¹ at gsxt.gov.cn.

This step takes less than five minutes and eliminates a large category of risk. Trading companies sometimes present themselves as manufacturers. Some entities are legally dissolved but continue to accept orders. Neither situation is visible without a database check.

The audit report should also confirm whether the supplier holds a valid export license ². Not every Chinese company is legally permitted to export directly. If yours is not, your goods will move through a third-party trading company — adding cost, risk, and a layer of accountability that is entirely outside your contract.

Production Equipment — What the Report Must Document

Do not accept a typed equipment list. A credible audit report names each machine by brand, model number, age, and observed condition. For sheet metal, the core equipment set includes fiber laser cutters ³, CNC press brakes, punch presses, and welding stations. The auditor should photograph each machine and record whether a current calibration certificate was visible and dated.

Equipment lists in supplier marketing materials are frequently outdated. Machines break and are not replaced. Capacity numbers are sometimes copied from a sister factory that the supplier does not own.

ISO 9001 and Quality Management System

The audit report should record the supplier's ISO 9001 certificate number, issuing certification body, and expiry date. It should then prompt the auditor to verify that certificate number directly with the issuing body — not just photograph the certificate on the wall. The IAF CertSearch database ⁴ is one of the most reliable tools for cross-checking whether a certificate is currently valid and accredited.

Fraudulent or lapsed ISO certificates circulate in Chinese manufacturing. A certificate that expired eighteen months ago and was never renewed is still hanging on many factory walls.

Beyond the certificate, the auditor should observe and document:

• How incoming raw material (sheet stock, tube, hardware) is inspected before it enters production
• Whether first-article inspection records are generated for new part numbers
• How in-process dimensional checks are recorded
• What happens to a non-conforming part — is it tagged, quarantined, and dispositioned, or is it quietly reworked without a record?

How Can You Use an Audit Report to Reduce Your Quality Risk Before Mass Production?

Our project managers read audit reports the way an engineer reads a drawing — looking for tolerances that are too tight for the process, not just for obvious failures. The same discipline applies when reading a factory audit report before you release a purchase order.

You can reduce quality risk before mass production by using the audit report to map every gap between the supplier's documented process and your drawing requirements, then requiring written corrective action responses with deadlines before issuing any purchase order or tooling deposit.

Match Inspection Equipment to Your Tolerance Requirements

A factory can own a high-quality fiber laser cutter and still be unable to verify that your parts meet a ±0.1 mm tolerance if it has no Coordinate Measuring Machine (CMM) ⁵ or optical comparator on the floor. The audit report must list inspection equipment separately from production equipment, with the same level of detail: brand, model, calibration status, and the date of last calibration.

Here is a standard inspection equipment checklist for sheet metal:

If your parts have tight tolerances and the factory owns none of the above beyond a basic caliper set, the audit report has just told you the supplier cannot verify conformance before shipment. That is a disqualifying finding for most precision applications.

Use the Corrective Action Section as a Negotiating Tool

Every audit report should contain a corrective action section. Non-conformances should be graded by severity — typically critical, major, or minor — and each should carry a required closure timeline. Understanding how a corrective action report ⁶ works as a formal quality management instrument helps buyers evaluate whether a supplier's CAR responses reflect genuine root-cause analysis or surface-level fixes.

An audit report that only describes what the auditor observed without grading findings or requesting a response is not a risk management document. It is a travel log.

When you receive a report with a corrective action section, review each finding before you issue a purchase order. Send the findings to the supplier and request written responses. Their responses tell you two things: whether they take quality seriously, and whether they understand what you are asking them to fix.

Workflow Layout Observations

A competent auditor maps the production flow — how raw sheet stock moves from the receiving dock to cutting, bending, welding, finishing, and final inspection before it is packed. This matters because disorganized material flow is one of the most common causes of mixed-lot defects and missed dimensions in sheet metal shops.

If the audit report contains photographs of machines but no description of how work-in-process moves through the facility, the auditor did not do a full assessment.

What Factory Audit Findings Should Make You Reject a Supplier Immediately?

Some findings in an audit report are fixable. Others are not. The difference matters before you wire a tooling deposit or commit to a long-term supplier relationship. In our experience reviewing audit reports on behalf of clients, a handful of findings consistently predict serious downstream problems.

You should reject a supplier immediately if the audit report reveals an unverifiable or invalid business registration, fabricated or expired certification documents, no functioning inspection equipment for your tolerance class, a documented history of falsified records, or a single-machine production line with no backup capacity or subcontractor plan.

Hard Stop: Legal and Documentation Failures

If the auditor cannot verify the business license number in the SAMR database, stop immediately. This is not a paperwork error. It means the legal entity you are planning to contract with may not exist as described — or may be a trading company misrepresenting itself as a manufacturer.

Similarly, if a certificate number does not appear in the issuing body's registry, the certificate is fraudulent or lapsed. Do not accept an explanation. Move to the next supplier. The ISO organization's certification guidance ⁷ explains how accreditation works and why checking with the certification body — not just the supplier — is the only defensible verification method.

Hard Stop: No Independent Photographic Evidence

Some suppliers commission their own audit reports and present them to buyers as independent assessments. An audit report relying on factory-supplied photographs is not independent verification. Genuine third-party audit reports include timestamped photographs taken by the auditor on the day of the visit. If the report lacks timestamped photos — or if image metadata shows dates that do not match the stated audit date — the report cannot be trusted.

Hard Stop: Subcontracted Core Processes Without Disclosure

Sheet metal fabrication often involves finishing steps — powder coating, anodizing, electroplating ⁸ — that are subcontracted to specialty shops. This is normal. What is not acceptable is when a supplier does not disclose subcontracting in their quoted capabilities.

If the audit report reveals undisclosed subcontracting of any core process, reject or pause. The primary supplier remains responsible for quality and lead time on subcontracted work, but they often cannot control it. If they hid it during qualification, they will hide problems during production.

Can an Audit Report Tell You If a Supplier Can Meet Your Delivery and QC Requirements?

Delivery failures and quality escapes share a common root cause: a supplier that looks capable on paper but has no backup plan when something goes wrong. We have seen it repeatedly — a factory wins a contract on price, runs into a machine breakdown at week three, and has no subcontractor to call and no redundant equipment on the floor.

An audit report can reveal delivery and QC risk if it includes a capacity stress-test finding — specifically documenting what the supplier's recovery plan is if primary equipment fails — along with evidence of subcontractor relationships, buffer stock practices, and whether their quoted lead times are based on actual observed capacity or marketing estimates.

Capacity Stress-Test: The Question Most Reports Skip

A good auditor does not just count machines. They ask one simple question: what happens to my client's order if your primary CNC press brake goes down for two weeks?

A supplier with one press brake and no answer to that question is a schedule risk at any order volume. The audit report should document:

• Whether the factory owns redundant equipment for critical operations
• Whether the factory has a vetted subcontractor relationship for overflow or emergency capacity
• What the supplier's average lead time has actually been over the past six months — not their quoted lead time

This distinction matters. Quoted lead time is a sales number. Actual lead time is an operations number. Only the latter is useful for planning.

QC Requirements: Aligning the Report to Your Drawing

Before you order a third-party audit, you should provide your auditor with your top three or four part drawings or a tolerance summary. A generic audit covers general quality systems. A targeted audit checks whether the factory's specific equipment and processes can hold your specific requirements.

Ask the audit firm to assess:

• Whether the factory's laser cutter kerf width and positioning accuracy support your cut tolerances
• Whether the press brake's repeatability is sufficient for your bend angle tolerances
• Whether the factory's inspection equipment can measure the features on your drawings

Third-Party Auditor Accreditation

Not all audit reports carry equal weight. Reports from SGS, Bureau Veritas, Intertek ⁹, or equivalently accredited regional firms are significantly more credible than self-audits or audits the supplier commissions and presents themselves.

Supplier-provided audit documents have a documented history of falsification in Chinese manufacturing contexts. Before you rely on any report, verify the auditing firm's accreditation independently — not through a link the supplier sends you. The Intertek certification services page ¹⁰ is one example of how a globally accredited firm publishes the scope and standards backing their inspection and audit programs.

Conclusion

A supplier audit report is only as useful as the checkpoints it covers and the independence of the person who wrote it. Verify the legal entity, inspect the equipment, check the certificates, and always commission the audit yourself.

Footnotes

1. China's official SAMR enterprise registry for verifying business license status and legal entity existence. ↩︎

2. Explains which Chinese companies require an export license and what happens when a supplier relies on a trading agent. ↩︎

3. Overview of fiber laser cutter specifications, wattage ranges, and cutting capabilities for sheet metal fabrication. ↩︎

4. The International Accreditation Forum's global database for verifying accredited management system certifications including ISO 9001. ↩︎

5. Comprehensive guide to how CMM inspection works and why it is essential for tight-tolerance dimensional verification. ↩︎

6. Explains how corrective action reports are structured, graded by severity, and used to prevent nonconformance recurrence. ↩︎

7. ISO's official guidance on how certification and accreditation work, and how to find a legitimate certification body. ↩︎

8. Compares powder coating and anodizing finishing processes, helping buyers understand when subcontracting these steps is standard practice. ↩︎

9. Overview of the world's leading third-party inspection and certification firms used for supplier qualification. ↩︎

10. Intertek's certification services page showing the scope of accreditations backing their global audit and inspection programs. ↩︎