How to Audit a Manufacturing Facility: A Factory Visit Checklist for Brand Owners
Most brand owners are shown a factory before they place an order. Far fewer actually audit one. The difference matters: a tour is designed by the host, while an audit is directed by the visitor. This guide sets out how a brand owner without a quality-assurance background can inspect a contract manufacturer methodically — what to request before arriving, what to look at on the day, and which findings should stop a project rather than merely raise a note.
Quick answer: what is a factory audit and how is one done?
A factory audit is a structured verification that a manufacturer can consistently make the product to the agreed specification, under the certifications it claims. It is done in three stages: request documents in advance (licences, certificates, an organisation chart, a sample batch record), verify those documents against what is physically present on the day, then trace one finished batch backwards to its raw materials. A brand owner without technical training can complete a useful audit by following the paperwork trail rather than by judging the machinery.
Key takeaways
- Certificates prove that a system existed on the audit date. Records prove the system was used since.
- The single most revealing exercise is backwards traceability: pick one finished batch and follow it back to raw-material receipt.
- Deviation, complaint and rejection records are more informative than a spotless production floor. A factory reporting zero deviations is usually not recording them.
- Small brands that cannot travel can still run a meaningful desktop audit, but it verifies documents only, not practice.
- An audit is worth little without a written report and an agreed corrective-action deadline.
Who this is for
This article is written for founders, brand managers and sourcing staff who are about to appoint an OEM or ODM manufacturer for cosmetics, supplements, personal-care or hygiene products — particularly those placing a first commercial order, or those who have inherited a supplier relationship and have never verified it. It assumes no quality-assurance qualification.
Why is a factory audit different from a factory tour?
A tour shows a visitor what the host has chosen to show; an audit tests specific claims against evidence. The distinction is practical, not semantic. On a tour, the route runs through the newest production hall, the conversation is led by a sales manager, and the visitor leaves impressed by equipment they cannot assess. On an audit, the visitor arrives with a written list of claims to verify — a certification scope, a stated capacity, a promised lead time — and asks for the document or record that supports each one.
The shift in mindset is the important part. Brand owners are rarely qualified to judge whether a homogeniser is well maintained. They are entirely qualified to ask when it was last calibrated, to be shown the calibration certificate, and to notice whether the date on that certificate has passed. Verification of this kind requires diligence rather than engineering knowledge, which is why an audit is within reach of almost any founder willing to prepare.
This complements, rather than replaces, the commercial screening covered in how to choose the right OEM/ODM manufacturer. Screening decides who is worth visiting; the audit decides who is worth trusting with a production batch.
What should be requested before the visit?
Documents should be requested at least two weeks before the visit, because the response itself is a data point. A manufacturer with a functioning quality system can usually send most of the list within a few working days. One that needs a month is either disorganised or preparing paperwork that does not routinely exist. The request should be specific, and it should include a sample of live records, not only certificates.
| Document to request | What it actually proves | What to check on it |
|---|---|---|
| Company registration and manufacturing licence | The legal entity is permitted to manufacture at that address | That the address matches the site to be visited, not a head office |
| GMP or ISO certificate (for example ISO 22716 for cosmetics) | A third party assessed the quality system on a given date | Expiry date, certification body, and the scope — which product forms it covers |
| Halal certificate, where relevant | The certified scope and issuing authority | Whether the certificate covers the specific line and product category intended |
| Organisation chart with named quality personnel | Quality assurance exists as a function, not a job title | Whether QA reports to production or independently to management |
| A redacted sample batch manufacturing record | How production is actually documented | Signatures, in-process checks, and whether corrections are dated and initialled |
| List of tests done in-house versus outsourced | The real boundary of the factory's testing capability | Which external laboratories are used, and whether they are accredited |
| Last external audit or inspection report | Known weaknesses and how they were closed | Whether findings have documented corrective actions with completion dates |
Reluctance to share a redacted batch record is common and is usually explained as confidentiality. That explanation is reasonable for another client's formula, which is why the request should be for a redacted document. Refusal to share any example of how production is recorded is a different matter, and it is one of the more reliable early warnings available.
What should be examined on the day of the visit?
The visit should follow the material, from goods-in to dispatch, in the same order the product travels. Walking the process in sequence prevents the common failure of spending an hour admiring filling equipment and five minutes in the warehouse, where a surprising share of quality problems begin.
Goods receipt and raw material storage
Incoming materials should be physically segregated by status — quarantine, approved, rejected — and the status should be visible without asking. A brand owner can check that labels carry a material code, a batch or lot number, a receipt date and a retest or expiry date. Materials stacked directly on the floor, mixed status in one rack, or handwritten labels without batch numbers indicate that traceability will break under pressure, however good the production hall looks.
The production area itself
The question is not whether the floor is clean but whether cleanliness is documented and scheduled. Cleaning logs should be posted or retrievable, line clearance between products should be recorded, and a single product name and batch number should be displayed at each active line. Two different batches open at one workstation is a genuine mix-up risk and is worth raising immediately.
Equipment, calibration and utilities
Every measuring instrument that affects the product — scales, thermometers, pH meters, filling volume checks — should carry a calibration sticker with a due date that has not passed. Water treatment deserves particular attention in cosmetics and supplements, because purified water is an ingredient in most formulations. The factory should be able to show water system test results at a stated frequency, not simply assert that the water is treated.
Packing, coding and finished goods
Batch coding and expiry printing are where documentation errors most often become customer-visible defects. The audit should confirm that printed codes are verified against the batch record at the start of a run, that surplus printed packaging is reconciled and destroyed rather than stored loose, and that finished goods are released by quality assurance before dispatch rather than after.
The quality control laboratory
A laboratory should be judged on what it is asked to do, not on how much equipment it contains. The useful questions are which tests are performed on every batch, which are performed periodically, which are sent out, and where the retained samples are kept. Retention samples are quietly one of the strongest indicators of a serious operation, because keeping them costs money and space and pays back only when something goes wrong. Their role in later disputes is discussed in product recalls and quality complaints.
Why do records matter more than machinery?
Records are the only evidence that a quality system operated on days when no visitor was present. Equipment can be borrowed, floors can be cleaned for a visit, and staff can be briefed. Twelve months of consistently completed batch records cannot be reconstructed the night before an audit.
The most productive single exercise available to a non-technical auditor is a backwards traceability test. The method is simple: select one finished batch at random from the warehouse, then ask to see its batch manufacturing record, the raw material lot numbers used, the goods-receipt records and certificates of analysis for those lots, the in-process check results, the finished-product test result, and the quality release signature. A competent factory produces this chain within roughly thirty to sixty minutes. A factory that needs a week, or that produces documents with gaps, has answered the central question of the audit regardless of what else was seen.
Deviation and complaint records deserve equal attention, and they are frequently misread. A brand owner who sees a deviation log with entries often assumes the factory has problems. In practice, an empty deviation log usually means deviations are not recorded rather than that none occurred, since every manufacturing operation experiences yield shortfalls, equipment stoppages and out-of-specification results. What matters is whether each entry has an investigation, a root cause and a corrective action that was verified as effective. Certificate interpretation is covered separately in certificates of analysis explained.
Can a small brand audit a factory it cannot visit?
A brand that cannot travel can still verify a great deal, provided it is honest about what a remote review does and does not establish. The three practical options differ in cost and in the type of assurance produced.
| Approach | Typical effort | What it can verify | What it cannot verify |
|---|---|---|---|
| Desktop or remote audit (documents plus a live video walkthrough) | A few days of correspondence; minimal cost | Licences, certificate scope and validity, documentation format, organisational structure | Daily practice, segregation discipline, housekeeping, staff behaviour when unobserved |
| One-day site visit by the brand owner | One to two days plus travel | Everything above, plus material flow, storage conditions, calibration status and one traceability exercise | Technical adequacy of validation, cleaning validation, microbiological control |
| Third-party technical audit by a qualified auditor | Commissioned engagement; a defined professional fee | System-level compliance against a named standard, with a formal findings report | Commercial fit, responsiveness and working relationship |
For a first small order, a desktop audit combined with a video walkthrough is a defensible level of diligence, particularly if the brand also purchases and independently tests a retained sample of the first batch. For regulated exports, sensitive claims, or volumes large enough that a failed batch would threaten the business, a third-party technical audit is the proportionate choice. The decision is a risk judgement rather than a matter of company size.
What are the warning signs that should stop a project?
Some findings are ordinary improvement points; others indicate that the underlying system does not exist. The following belong in the second category and warrant pausing the appointment rather than negotiating around it: an expired certificate presented as current; a certificate whose scope excludes the intended product form; refusal to allow any view of production areas; batch records completed in a single handwriting and a single ink at one sitting; no visible segregation between quarantined and released materials; an inability to produce any traceability chain for a chosen batch; and calibration stickers that are absent, expired or clearly recent across the entire site.
Two softer signals are worth recording as well. When every answer is given by a salesperson and no quality representative can be produced, quality assurance may not be independent. When a factory agrees immediately to every timeline, formulation change and price reduction requested, the constraint that should exist somewhere in the system is likely being absorbed silently — a pattern examined in why a formula that works in the lab can fail in the factory.
What should happen after the audit?
An audit produces value only when it ends in a written report with dated actions and an agreed follow-up. The report need not be elaborate. A one-page summary listing each finding, its severity, the agreed corrective action, the responsible person and a completion date is sufficient for a brand owner, and it converts a set of impressions into a commitment that can be checked at the next order.
The findings should then be reflected in the commercial documents. Points that matter — retention sample periods, notification before any formulation or supplier change, batch documentation to be supplied with each delivery, the right to re-audit — belong in the quality section of the supply agreement rather than in an email thread. The relevant clauses are set out in contract manufacturing agreements. A re-audit interval of twelve to twenty-four months is a common commercial practice for active suppliers, shortened after a serious quality event.
Frequently asked questions
Can a factory refuse to let me audit it?
Yes, and some do, usually citing confidentiality obligations to other clients or the protection of proprietary processes. Restricted access to specific areas is normal and reasonable. A blanket refusal to allow any structured verification before a first order is a commercial signal in itself, and it is better received before payment than afterwards.
I have no technical background. Is an audit still worth doing?
Yes. Most of what a first audit establishes is documentary rather than technical: whether certificates are valid and in scope, whether materials are segregated by status, whether instruments are calibrated, and whether one batch can be traced end to end. None of these require a science qualification. Technical judgements about validation and microbiological control are where a qualified auditor adds capability an owner cannot substitute.
How long should a factory audit take?
A focused first audit of a single production area generally occupies half a day to a full day, of which a meaningful portion should be spent reading records rather than walking. A multi-category site, or one being assessed against a formal standard, typically requires one to three days with a qualified auditor. Time spent seated with documents is usually more productive than additional time on the floor.
Is a GMP certificate enough on its own?
No. A certificate records that an assessment was passed on a specific date, within a specific scope, by a specific body. It does not confirm that the system was maintained afterwards, that it covers the product form intended, or that the certifying body is recognised in the destination market. The certificate is the starting point of verification, not its conclusion, as discussed in GMP explained.
Should the audit happen before or after samples are approved?
Ideally between sample approval and the first production order. Auditing earlier risks spending effort on a manufacturer whose samples turn out to be unsuitable. Auditing later removes the leverage to have findings corrected, because commitments have already been made and deposits paid. The window after a sample is accepted and before a purchase order is issued is where the brand owner holds the most influence.
What if problems are found at a factory already in production?
Findings should be classified by whether they affect product already supplied. Issues touching released stock require a decision on those batches before anything else, including whether independent testing is warranted. Systemic issues that do not affect existing stock can reasonably be handled through a corrective-action plan with deadlines. Ending a supply relationship abruptly on the basis of an audit is rarely the immediate answer, but continuing without a written plan and a verification date is not a plan either.
Sources and further reading
- PIC/S GMP Guide publications — the internationally referenced good manufacturing practice guidance used by many inspectorates.
- ISO 22716 — Cosmetics, Good Manufacturing Practices, the cosmetics-specific GMP standard commonly cited by contract manufacturers.
- National Pharmaceutical Regulatory Agency (NPRA), Malaysia — notification, licensing and GMP requirements applicable to cosmetics, traditional products and health supplements in Malaysia.
- 21 CFR Part 111 — the United States current good manufacturing practice rule for dietary supplements, a useful reference for export-oriented brands.
- Malaysian halal certification portal (JAKIM) — for verifying halal certification scope and validity.
Limitations of this article
This article describes general audit practice for consumer health, beauty and personal-care manufacturing and is educational in nature. It is not regulatory or legal advice. Requirements differ by product category, by destination market and by the standard against which a factory is certified, and they change over time. Brand owners with regulated products, medical devices or export obligations should verify current requirements with the relevant authority and engage a qualified auditor where the technical scope exceeds what an internal review can responsibly cover.
Disclosure: Creaton Poh is the pen name of Poh Tze Kheng, founder of the ORIZI Group, a Malaysian OEM/ODM manufacturer. This article is educational and independent, and is not promotional.
Written by Creaton Poh
Industry Researcher • Author • Vlogger • Manufacturing Strategist
Turning ideas into products. Turning experience into knowledge.
Connect with Poh Tze Kheng on LinkedIn.
Comments
Post a Comment