What a SMETA audit is, and why it is not a certification

Answering the question people arrive with: no, SMETA is not a certification. Sedex is explicit that it is an audit methodology, that it assesses performance and produces corrective actions, and that it does not award certified status. The phrases SMETA certified and SMETA certification describe something that does not exist.

That is not a technicality. A certificate is a conclusion; an audit report is a set of observations with actions attached. Reading one as the other is how a buyer ends up either over-reassured by a document or unnecessarily alarmed by findings that were the point of the exercise.

Sedex and SMETA are two different things

Sedex is the organisation and the platform: a membership system through which responsible-sourcing data is held and shared between businesses. SMETA is the audit methodology Sedex publishes.

The relationship between them matters practically. Membership is required before a SMETA audit can be conducted and uploaded, which means a site being on the platform and a site having been audited are different states. A supplier saying they are a Sedex member has told you they participate in the system, not that an assessment has taken place.

The current version of the methodology is SMETA 7. Version matters when comparing reports, because terminology and process detail have changed between editions and an older report was produced under the rules that applied at the time.

Who is allowed to conduct one

This is worth checking and easy to check. SMETA audits may only be conducted by Sedex-approved Affiliate Audit Companies and their auditors. Sedex states that companies which are not Affiliate Audit Companies, and individuals not affiliated with Sedex or an approved one, are not authorised to offer Sedex or SMETA-related services.

So the audit company named on a report is part of the evidence rather than a formality. If a report was produced by an organisation outside that system, it may be a perfectly serious piece of work, but it is not a SMETA audit and should not be described as one. The current list of approved companies is maintained by Sedex and is the place to check rather than a list republished elsewhere.

What it assesses, and against what

SMETA measures a site against the ETI Base Code, ILO Conventions and local law. Those three references together are why an audit is not purely a check against a private code: it is anchored in an established labour-standards framework and in the law of the country the site operates in.

The methodology covers labour standards, health and safety, environmental performance and business ethics, and it is offered in two scope options.

The wider scope is not automatically the right choice. It is a broader and more demanding assessment, and whether a buyer needs it depends on their own policy and on what they have to account for. What matters when reading a report is knowing which was performed, because a 2-Pillar report is not a silent failure on the additional areas, they were not in scope.

What the report gives you

A SMETA audit produces findings and corrective actions rather than a score presented as a verdict. That design reflects the purpose: the methodology is built to identify where improvement is needed and to track it, which is why a report with open actions is a normal working document rather than a failure notice.

What a buyer should do with it, including how to read the corrective action cycle and what to ask when actions are still open, is covered in reading a factory audit report.

On access: SMETA reports are shared through the Sedex platform under its sharing arrangements, and between the parties concerned. They are not public documents, and a supplier declining to email a report to an unqualified enquiry is following the system rather than avoiding a question.

How long is a report good for?

There is no single industry answer, and treating one as though there were is a common error. Reassessment expectations are set by the system's own requirements and, in practice, by the buyer's policy: many brands specify how recent an assessment has to be before they will accept it.

So the useful question is not whether a report has expired but whether it is recent enough for the party relying on it, and whether anything material has changed at the site since. A report from a site that has since moved premises, changed ownership or substantially changed its workforce is dated in a way the calendar alone does not capture.

One report can serve several buyers, which is much of the reason the shared-platform model exists: it reduces repeated auditing of the same site. Whether a given buyer accepts a given report remains their decision, made against their own policy.