Reports and quality
When your client wants to audit your supplier
Three parties, two contracts and an awkward question: how far your duty to disclose reaches.
It happens more and more: a large client is not content auditing you, they want to see who supplies you too. The request is legitimate and the answer is not automatic, because your supplier has no contract with your client — they have one with you.
The three ways to respond
| Way | What it involves | When it fits |
|---|---|---|
| You answer on their behalf | You show your control over that supplier, not their documents | Most cases |
| The supplier answers directly | With their consent, and knowing what is being asked | When the client demands traceability to origin |
| On-site audit by the client | Requires all three parties to agree | Regulated sectors or large contracts |
Important
The first usually settles it and is the least attempted. What your client needs to know is not what your supplier's certificate says: it is that **you request it, check it and act when it is missing**. You can evidence that from your own record without showing a single third-party document.
What to agree before it is asked
- 1
What you may share about your suppliers
Ideally agreed in your contract with them, not improvised under pressure.
- 2
What your client requires contractually
Sometimes the obligation to give chain access is already signed and nobody has read it.
- 3
Who talks to whom
Letting your client contact your supplier directly without you brings commercial problems that are not worth it.
- 4
And what happens if the supplier refuses
It is a real possibility and it helps to have decided whether that forces a change of supplier.
Watch out
The risk almost nobody sees coming is commercial, not documentary: if you put your client in direct contact with your supplier, you have introduced them. In sectors where the intermediary supplies the relationship rather than the product, that has cost entire accounts. Not a reason to refuse, but a reason to decide it deliberately rather than in a hurried email.
What can be shown without exposing anyone
That last point convinces more than any list: showing that last year you blocked a supplier over expired documentation proves the control genuinely exists. A percentage does not prove that.
Worth knowing
Certification schemes and supply-chain requirements vary widely by sector and by client, and they change. **What you are obliged to provide and what you are not is a conversation for your adviser and your contract**, not something to infer from the client's request — which will always ask for the maximum.
›Can I refuse?
It depends what you signed. If it is not in the contract, it is negotiable.
›What if my supplier does not want to?
That is useful information: a supplier who cannot evidence what you require is also your risk.
›Is showing my supplier's certificate enough?
It helps, but it only proves that document. What defends you is the ongoing control.
A real case
The situation
A large client demands to audit the subcontractor making a component.
What you do
- Shows its own control over that subcontractor with check dates
- Agrees with the supplier what may be shared before replying
What you get
The client considers the requirement met with no direct contact between the two companies.
The situation
A client announces they want to audit your transport supplier and nobody knows what can be shown.
What you do
- Checks what you agreed with that supplier about third-party audits
- Warns the supplier before the request reaches them
- Shares only what concerns that client
What you get
The audit is arranged without damaging the supplier relationship or over-disclosing.
The situation
The client asks to audit and the supplier contract does not provide for it.
What you do
- Negotiates it with the supplier before committing them
- Writes the outcome down for future contracts
What you get
The commitment to the client is realistic and the supplier is not ambushed.
The situation
Supplier documentation is handed over containing their other clients' data.
What you do
- Reviews the content before sharing
What you get
Nothing is leaked that was not yours to give.
The situation
Three clients want to audit the same supplier.
What you do
- Gathers what is asked and negotiates a single audit
What you get
The supplier receives one visit, not three.
The situation
The audit finds something and nobody knows who answers.
What you do
- Writes down beforehand who owns which finding
What you get
The action plan has an owner from day one.
The situation
The audit happens and there is no record of what was shown.
What you do
- Records the bundle handed over, with its date
What you get
The handover is demonstrable afterwards.
The situation
The supplier refuses and the client reads it as opacity.
What you do
- Offers the control evidence instead of the document
What you get
The client verifies without the supplier exposing what they should not.
This article answers
- my client wants to audit my supplier
- second-tier supply chain audit
- they ask for data about my subcontractors
- how far must i disclose my chain