Supplier Audits, Inspections and Document Control: A QMS Guide for UK Manufacturers

Most UK manufacturers under 100 people run quality the same way: a document folder that has quietly become three folders, a supplier list in a spreadsheet, inspection records on paper or in photos on someone's phone, and an audit binder that gets rebuilt in a panic the week before the certification visit.

None of that means the quality is bad. It usually means the system around the quality is manual — and manual systems fail quietly: a procedure gets revised but the shop floor keeps the old copy; a supplier's audit lapses without anyone noticing; an inspection failure gets fixed but never recorded, so the same defect returns in six months.

This guide covers the three processes where that manual overhead concentrates — supplier audits, inspections and document control — plus the corrective-action loop that ties them together, and what to expect from QMS software at each step.

Supplier Audits and Approved Supplier Tracking

ISO 9001 (clause 8.4) expects you to control externally provided processes, products and services — in practice: know who your approved suppliers are, evaluate them against defined criteria, and keep evidence of the evaluation. For most SME manufacturers the pain isn't the auditing, it's the tracking:

• An approved supplier register that says who is approved, for what scope, since when, and on what evidence — not a spreadsheet tab last touched in 2024.
• An audit schedule driven by risk: critical suppliers audited more often, commodity suppliers on a lighter cycle. The schedule should surface what is due, not rely on someone remembering.
• Scored findings so a supplier's trajectory is visible across audits — improving, stable, or slipping.
• A link from findings to corrective actions, so "raised with supplier" has an owner, a due date and a close-out, not just a line in an email.

Quality Inspections: Incoming, In-Process and Final

Inspection regimes differ by product, but the record-keeping problem is universal. A UK production auditor will ask the same three questions about any inspection point: what was checked, against what criteria, and what happened when it failed?

Incoming goods

Goods-in checks against the PO and the supplier's certificate of conformity. A failed delivery should raise a non-conformance against the supplier — feeding directly back into the supplier scoring above. If your goods-in failures and your supplier audits live in different systems, that loop never closes.

In-process and final inspection

Checks at defined stages against drawings, tolerances or workmanship standards, with the result recorded against the job or batch. The record matters as much as the check: when a customer complaint arrives months later, traceability is the difference between a one-hour investigation and a two-day one.

Machinery and equipment checks

Planned maintenance checks, calibration schedules and pre-use equipment inspections sit at the border of quality and health & safety — and both audiences will ask for the records. Run them as scheduled, evidenced checks with the same discipline as product inspections.

Document Control: Policies, Procedures and the Shop Floor

Document control is the QMS process auditors test first, because it fails most often. The classic finding: the controlled procedure is at revision D, and the laminated copy at the workstation is revision B.

For a UK manufacturer, workable document control means:

• One current version of every policy, procedure and work instruction, with superseded versions archived but retrievable.
• Approval workflow — a revision doesn't become current until the right person has signed it off, and the approval is recorded.
• Distribution you can prove. "It's on the shared drive" convinces nobody. You want to show who has read the current version — especially for safety-critical procedures.
• Review dates so documents get re-examined on a cycle instead of fossilising.

This is also where "policy and procedure software" earns its keep for manufacturers: the writing is the easy half. Version control, approval and proof of distribution are what separate a document system from a document folder.

NCRs and CAPAs: Closing the Loop

Everything above produces findings — a failed inspection, a supplier issue, an internal audit observation. The corrective and preventive action (CAPA) process is what turns findings into fewer future findings, and it's the part spreadsheets handle worst, because a CAPA is a workflow, not a row: it has an owner, a root cause, actions, evidence and a close-out decision.

Two habits make CAPAs work in a small manufacturer:

• Make raising an NCR cheap. If logging a non-conformance takes ten minutes of form-filling, the shop floor stops logging them, and your QMS goes blind. Thirty seconds with a photo is the target.
• Review open CAPAs weekly, briefly. The failure mode is not bad CAPAs — it's CAPAs that quietly go stale. A ten-minute standing review of what's open and overdue keeps the loop honest.

What the ISO 9001 Auditor Will Actually Ask For

Certification and surveillance audits in UK manufacturing follow a predictable evidence trail. Whatever system you run, you should be able to produce, quickly:

• The approved supplier list, with evaluation evidence and audit history per supplier
• The current revision of any named procedure — and proof of who approved it and when
• Inspection records for a batch the auditor picks, traceable to the job
• Open and closed NCRs, each linked to its corrective action and close-out
• Your internal audit schedule and the findings from the last cycle

If assembling that list takes a week of preparation, the QMS is a filing exercise. If it takes an afternoon, the system is doing its job — audit-ready by default is the standard worth holding software to.

One layer deeper: auditors increasingly ask who changed a record, not just what it says. OpSemble writes every sign-in and data change to a searchable audit log you can filter by user and date and export to CSV — so "who approved this revision and when" is a query, not an investigation.

Choosing QMS Software as a Small UK Manufacturer

Enterprise QMS platforms exist for regulated giants and price accordingly. At the other end, spreadsheets cost nothing until the first lost audit trail. In between, look for:

• The full loop in one system: suppliers, audits, documents, NCRs and CAPAs that reference each other — not five modules that merely coexist.
• Low friction at the point of capture: if raising an NCR or completing a check is hard, records stop being made.
• Traceability across the business: quality doesn't stop at the QMS. A defect traces to a supplier and a job; training records prove the inspector was competent. That's the case for quality living inside the same platform as inventory, training and projects — the argument our unified business software guide makes in full.
• SME pricing: OpSemble's QMS module is £7 per user per month plus a flat £29/month platform fee — quality managers and shop-floor users on seats, not the whole company.