Reading a factory audit report, and what corrective actions mean
A buyer's real skill in this subject is reading, not collecting. A report with open corrective actions can be more reassuring than one with none, and the difference is visible in a few minutes once you know which fields carry the meaning.
Contents
Start with the conclusion, because it is counterintuitive. Findings in an audit report are not a bad sign. The methodologies are designed to identify where improvement is needed and record what happens next, so a report listing findings alongside actions being worked is the system functioning. A report with nothing in it, from a site that was audited briefly two years ago under a narrow scope, tells you considerably less.
What follows is the order worth reading in. The first six steps are about establishing what the document actually is, which is where many misreadings happen, and only then does the content matter.
Establish what you are holding
- Which methodology or standard. An audit report, a monitoring result and a certificate are different instruments, as set out on the factory audits hub. Identify which one this is before drawing any conclusion from it.
- Which site. Reconcile the address and legal entity against the site your goods would be made in. A group operating several sites is common, and an assessment of one is not evidence about another.
- When it was conducted. Not when the document was issued or sent to you.
- Who conducted it. For SMETA this has to be a Sedex-approved Affiliate Audit Company; for a certification, a certification body accredited for that standard. An assessment by an organisation outside the relevant system may be serious work but is not the thing it is being presented as.
- What scope was assessed. A narrower scope is not a failure on the areas it did not cover; those areas were not examined. Knowing which is which prevents both false alarm and false comfort.
- Whether it is announced, semi-announced or unannounced, where the system records that, since it affects how the assessment should be weighed.
Then read the findings
Findings are observations against the methodology's criteria. Systems use their own vocabulary for categorising them and those vocabularies do not map onto each other, so read the categories the report itself uses rather than translating them into a general major-and-minor scheme borrowed from somewhere else.
What is worth attending to is the character of what was found rather than the count. A cluster of findings in one area suggests a systemic issue; scattered administrative findings usually suggest something different. Findings that touch fundamental labour rights are in a different category of seriousness from record-keeping gaps, and any buyer policy worth having distinguishes between them.
The corrective action cycle
From finding to closure
The cycle a finding is meant to travel. What a buyer is assessing is whether it is genuinely travelling, not whether findings exist.
A corrective action plan records what was found, what will be done about it, by when, and by whom. Where the system captures remediation formally, the plan and its progress are part of the record rather than a side conversation.
Reading it well means looking past whether actions are open. The questions that carry information are whether a root cause was identified rather than only a symptom, whether the action addresses that cause, whether a deadline exists and has been met, and whether evidence of completion has been provided and accepted. An action closed with evidence is a stronger signal than an action that was never raised.
| What you see | What it suggests |
|---|---|
| Findings, with actions closed and evidence accepted | The system is working and the site engages with it |
| Findings, with actions open and deadlines in the future | Normal, particularly on a recent audit. Ask what the progress is |
| Findings, with actions open and deadlines long past | The question worth asking. Not automatically disqualifying, but it needs an explanation |
| Repeated findings across successive assessments | The issue is not being resolved, which is more informative than the original finding |
| No findings at all | Read the scope and the date before treating this as reassurance |
The fourth row is where genuine concerns usually surface. A single finding is a moment; the same finding three assessments running is a pattern, and it is visible only if a buyer looks at more than the most recent report. The same distinction between an incident and a pattern governs production and delivery performance, where it is set out in managing supplier performance.
A worked example
A constructed scenario rather than a real case. A buyer receives a report dated eighteen months ago, showing several findings with corrective actions still recorded as open.
The instinct is to treat this as a red flag. The better response is a short list of questions. Has a subsequent assessment taken place, and what did it find? What is the current status of those actions, and is there evidence of completion? Were deadlines set, and were they met? Does the buyer's own policy accept an assessment of this age? And does the site named on the report match the site the order would run in?
Depending on the answers, the same document supports quite different conclusions. That is the point: the report is an input to a judgement, not the judgement.
What to request, and what not to expect
Reasonable requests
- Confirmation of the production site the assessment covers
- The methodology or standard, and the scope assessed
- The date of the most recent assessment
- The current corrective action status, including anything closed since the report
- Whether a follow-up assessment is scheduled
- Which processes, if any, are subcontracted, and whether your requirement extends to them
- How the evidence can be shared with you through the relevant system
What not to expect is a public document. Reports in these systems are shared through the system that produced them, under its arrangements, and often on terms agreed between the site and the buyer. A supplier who cannot email a report to an early-stage enquiry is generally following the rules of the system rather than avoiding the question, and the workable route is to establish the sharing mechanism rather than to press for an attachment.
What the report cannot tell you
Three limits are worth holding on to, because they define where due diligence continues after the reading is done.
- It describes the site on the days the assessment ran. It is not a statement about conditions today, and no methodology claims otherwise.
- It covers the scope assessed. Processes outside that scope, including subcontracted steps depending on the arrangement, were not examined.
- It is social-compliance evidence only. It says nothing about whether goods will conform to a specification, which is what quality control addresses, and nothing about what a material is, which is what certified materials addresses.
Nor is an audit report a determination that any legal due-diligence obligation has been discharged. It is one evidence input among others, and what satisfies a particular regulatory or customer requirement is assessed against that requirement rather than against the existence of a report.
Read that way, the document does what it is designed to do. It gives a buyer a structured, independent account of a site at a moment, and a record of what is being done about what was found. That is genuinely useful, and it is a good deal more useful than a certificate that does not exist.
Questions this raises
What is a corrective action plan in a factory audit?
A record of what an audit found, what will be done about it, by when and by whom. Where the system captures remediation formally, the plan and its progress form part of the audit record. Reading it means looking at whether a root cause was identified, whether the action addresses it, and whether evidence of completion has been provided.
Are open corrective actions a problem?
Not in themselves, particularly on a recent audit where deadlines are still in the future. What matters is whether the actions are being worked: whether deadlines were set and met, whether evidence has been provided, and whether the same findings recur across successive assessments. Repeated findings are more informative than the original one.
Does an audit report cover subcontractors?
Only where they are within the scope assessed. A report covers a named site and a defined scope, so a buyer with a requirement that extends to subcontracted processes needs to establish which processes leave the site and whether their own policy requires those to be covered. Requirements differ between buyers.
Can an older audit report still be accepted?
That is the buyer's decision against their own policy, and many brands set a limit on how recent an assessment has to be. Beyond the date, ask whether anything material has changed at the site since, and whether a more recent assessment exists. There is no single industry validity period across these systems.
Why will a supplier not just send me the report?
Reports in these systems are generally shared through the system that produced them, under its access arrangements and often on terms agreed between the site and the buyer. It is usually a matter of following the system rather than withholding information, and the productive step is to establish the sharing route.
Bring the policy, not just the question
Social-compliance requirements are easiest to meet when the buyer states the site, the assessment type and the recency their policy needs. Raised at qualification, it is a short conversation.
Start a project