Factory Audit Checklist: Quality, Social, Capability

By ChinaManufacturers.com Editorial Desk · Updated 30 October 2026 · How this page was researched

What a factory audit is, and what it can prove

A factory audit is a structured examination of a manufacturer against a written checklist, carried out on site or partly from documents, to establish whether the company is who it says it is, can make the product at the volume ordered, controls its processes, and treats its workers and environment lawfully. It proves conditions on the day of the audit at the site audited — no more.

Three limits shape how much weight an audit carries. First, it is point-in-time: a factory can pass and later change subcontractors, staff or materials. Second, it covers one legal entity and one site; an audit of a different company or address from the one on the contract protects nothing. Third, who pays matters. A report supplied by the factory was commissioned under the factory's control, which is a reason to read it closely, not a reason to accept it.

A certification is a different thing: a statement by an independent certification body that a management system meets a published standard, valid for a stated period. Some audit schemes lead to certification; the two leading social-audit schemes say plainly that they do not.

The four kinds of factory audit

Industry usage divides audits by what they test. A buyer usually needs more than one.

Factory or supplier verification. Does the company exist, is it the manufacturer rather than a trading company, and what is its capacity? This begins as a desk check of the business license, the Unified Social Credit Code and the GSXT register, and ends with evidence from the floor.
Quality-system or manufacturing audit. Process control, incoming-material checks, calibration, traceability and corrective action, often referenced to ISO 9001 clauses.
Social compliance audit. Labor, wages and hours, health and safety, environment and business ethics, under schemes such as amfori BSCI, SMETA, SA8000 or, in electronics, the RBA code. Current SA8000 and RBA versions were not confirmed for this page.
Technical or capability audit. A process-specific review, such as tooling, molding, machining or surface treatment, against the buyer's drawings and tolerances.

The checklist

The items below are the ones commonly covered across audit types. They are grouped by the question each answers.

Identity and legal status

Business license on display, with a USCC that matches the GSXT record and the contracting entity.
Business scope that includes production or processing of the product category.
Ownership or lease of the premises, and ownership of the production equipment.

Capability and capacity

Production lines that make this product, seen running, not only installed.
Stated capacity compared with the order volume and the factory's other commitments.
Subcontracting: which processes leave the site, and to whom.

Quality control

Incoming quality control on raw materials and components.
In-process checks and final inspection, with records.
Calibration records for measuring equipment.
Handling and segregation of nonconforming product.
Storage conditions for materials and finished goods.

Labor, health and safety

Worker headcount reconciled with payroll records.
Working-hours and wage records.
Fire safety, marked and unobstructed exits, and chemical storage.
Dormitory conditions where workers are housed on site.

Environment

Environmental permits relevant to the processes on site.

ISO 9001 and the ISO 9000 family

ISO 9001 is the requirements standard within the ISO 9000 family of quality-management standards. The current edition, ISO 9001:2015 (edition 5, published September 2015), is listed as "Published" on the ISO catalog as of 30 October 2026. A 2024 climate-change amendment and a further revision have been reported, but neither appeared on the catalog page read for this guide, so both are unconfirmed here.

Two facts limit what an ISO 9001 certificate tells a buyer. ISO does not issue certificates; third-party certification bodies do. And the standard sets requirements for a quality management system, so a certificate attests that a system exists and was assessed, not that the factory makes the buyer's product to specification. A certificate can be checked with the issuing certification body and its accreditation body; the lookup procedure for China's own certification databases was not confirmed for this page.

Social compliance audits: amfori BSCI and SMETA

The two schemes most often met in Chinese consumer-goods factories both describe themselves as something other than a certification.

Feature	amfori BSCI	SMETA (Sedex)
Self-description	"Not a certification"; no pass or fail	"A continuous improvement methodology rather than a certification"
Structure	13 Performance Areas in four themes; 81 questions rated Yes, No, Partial or Not applicable	Two-pillar (labor standards, health and safety) or four-pillar (adds environment and business ethics)
Output	Grade A to E	Audit report on the Sedex platform
Cycle and follow-up	Two-year cycle; C, D or E grades need a follow-up audit within 2 to 12 months	Four-pillar used in about 70% of audits; SMETA 7 introduced in 2024
Who commissions	amfori members	Only Sedex members, through an affiliate audit company
Reported scale (self-reported)	2,400+ members; 58,000+ suppliers	67,000 SMETA audits on the platform in 2023

The figures come from each scheme's own pages, read on 30 October 2026 (amfori BSCI; Sedex SMETA page). SMETA 7, the version introduced in 2024, is the current methodology named by Sedex. Calling either report a "certificate" misstates it, and a supplier that describes a BSCI grade or a SMETA report as certification is either careless or overselling.

Sector rules that raise the bar

For some products, US law sets the audit agenda.

Medical devices

The FDA's Quality Management System Regulation (21 CFR Part 820, which incorporates ISO 13485:2016) took effect on 2 February 2026. The same day, the FDA retired its QSIT inspection technique and moved to Compliance Program 7382.850 (FDA). A Chinese device factory is audited against that rule, not against a general ISO 9001 checklist.

Forced labor

Under the Uyghur Forced Labor Prevention Act (UFLPA), goods made wholly or in part in Xinjiang, or by an entity on the UFLPA Entity List, are presumed to be made with forced labor and barred from US entry; the presumption has applied since 21 June 2022. As of 29 October 2026, the Entity List holds 190 entities, per the Federal Register notice of that date (91 FR 68159). A social audit does not rebut that presumption on its own; the supply-chain tracing it requires is covered in the UFLPA guide.

Reading an audit report

Check the entity and site. The legal name, USCC and address in the report should match the contract and the production site named in it.
Check the date and the scope. An old report, or one that covered a different product line, describes a different factory.
Check who commissioned it. A buyer-commissioned audit and a factory-supplied report carry different weight.
Look for subcontracting. Undisclosed subcontracting is how an audited site and the real production site come apart.
Read the follow-up. For BSCI, a C, D or E grade carries a follow-up audit within 2 to 12 months; ask whether it happened.

No official statistic on audit failure rates in China was found. Figures that circulate on how many factories "fail" audits should be treated as unsourced.

Frequently asked questions

Is BSCI a certification?

No. amfori states that amfori BSCI is not a certification and gives no pass or fail verdict. An audit answers 81 questions across 13 Performance Areas and produces a grade from A to E, on a two-year cycle. A supplier that calls its BSCI result a certificate is misdescribing it, and the grade and its date are what to ask for.

How long is a BSCI audit valid?

The amfori BSCI audit cycle is two years, according to amfori's own scheme page read on 30 October 2026. A factory graded C, D or E must have a follow-up audit within 2 to 12 months. When a supplier shares a BSCI report, check its date and, for a low grade, whether the follow-up took place.

What is the difference between SMETA 2-pillar and 4-pillar?

A two-pillar SMETA audit covers labor standards and health and safety; a four-pillar audit adds environment and business ethics. Sedex says the four-pillar form is used in around 70% of SMETA audits. Sedex also describes SMETA as a continuous-improvement methodology rather than a certification, and only Sedex members may commission one.

Does ISO 9001 certification guarantee product quality?

No. ISO 9001 sets requirements for a quality management system, so a certificate shows that a system was assessed by a third-party certification body. It does not test the buyer's product against the buyer's specification. Product quality is checked through samples, process audits and pre-shipment inspection, not through the certificate.

Can I rely on an audit report the factory sends me?

Only with care. A factory-supplied report was commissioned under the factory's control, so check that it names the same legal entity, USCC and site as the contract, that it is recent, and that it covered the product line in question. An audit commissioned by the buyer, on the contracted site, carries more weight.

Factory audit checklist