The Supplier Factory Audit, Rewritten for 2026: 25 Checks Worth Running

Why the audit form got longer

On 1 January 2026 the EU's Carbon Border Adjustment Mechanism entered its definitive period. From that date an EU importer of steel-based equipment is no longer just filing a report: it has to obtain third-party verified embedded-emissions data from the works that actually made the goods, with the first annual declaration due 30 September 2027 (source: European Commission, Taxation and Customs Union, 2026). Around the same time CSDDD, CSRD and the German Supply Chain Act (LkSG) pushed ESG due diligence one tier further down, onto the supplier itself.

For anybody buying pressure vessels, shell-and-tube heat exchangers or process skids out of Asia, the consequence is concrete: the factory audit form got longer. The procurement manager who used to walk a shop looking at welding, NDE and quality records now walks the same shop with an extra column on the sheet.

A word on where this is written from. We are on the receiving end of these audits. Our works in Suzhou has been audited, visited or third-party inspected by EPCs and end users including GS E&C, Air Products, Air Liquide Korea and TGE. We are an equipment supplier, not the EPC, not the licensor, not the auditor. Having been on the other side of the table repeatedly is what makes it possible to say which lines on the form separate a genuine audit from a factory tour with a lunch.

First: decide what level of audit this is

Before booking the flight, put the audit in a box. There are broadly three levels, and they demand completely different amounts of time.

Audit level	Trigger	Depth	Duration
Qualification audit	New supplier, entry to the approved vendor list	System and capability, full sweep	1–2 days
Project audit	Before placing a significant order	Focused on this project's material, code and duty	Half a day to 1 day
Witness / surveillance	Hold and Witness points during production	One process only	Per milestone

Half a day of watching welders is not a qualification audit. Re-reading a business licence for a fourth repeat order is not a project audit either.

The 25 checks below are written for the full qualification audit. For a project audit, pull the lines that touch your material, your code and your duty — in practice numbers 6, 10, 14 and 17 — and move quickly through the rest.

The 25 checks, in six blocks

Block 1 — Quality system and licences (5 checks)

#	Check	What to look for
1	Business licence + special equipment manufacturing licence	Class A/B pressure vessel scope; does the scope cover your equipment, and when does it expire?
2	ISO 9001 quality management system	Certificate valid and the floor matches the manual, not a framed poster
3	Product certification scope	ASME U-Stamp, PED 2014/68/EU, class society works approvals: read the scope and validity, not the logo
4	Organisation and key posts	Are quality, welding and inspection staffed by dedicated, qualified people?
5	Subcontractor list and their approvals	Heat treatment, NDE, painting — the sub's licence is your risk

Check 2 is where bluffing shows up first. Everyone has the certificate. Pull two recent projects at random and ask for the quality records: look at signatures, dates, and the traceability of document numbers. Thirty minutes of that tells you whether the system runs or whether it is dusted off for auditors.

On check 3, be precise about what a stamp covers. In our own case, exactly: ASME U-Stamp (Section VIII Div. 1), PED 2014/68/EU and ISO 9001, plus CCS Type and Works Approval and works approval from DNV, LR, BV, NK and RINA, plus KGS for the Korean market. A good auditor makes the supplier state the list in that form — scope, division, market — and then checks the certificate against the statement. Vagueness here is a signal in itself.

Block 2 — Welding capability (4 checks)

#	Check	What to look for
6	WPS / PQR procedure qualification	Does it cover your material and thickness combination?
7	Welder qualification (WPQ)	In date, and the qualified range matches what they are actually welding
8	Consumable control	Baking, issue and return records closed out; grades traceable
9	Welding equipment and traceability	Machines calibrated; base metal and consumable IDs reconcile

Half the quality of a pressure vessel lives in its welds. Check 6 is the highest-yield line on the whole form, and it only works if you bring your own drawing. If the project is duplex 2205 or Inconel and the PQR file has no matching qualification, that is a hard gap. A works that is genuinely capable will hand over the PQR index and let you pick.

Block 3 — NDE and testing (4 checks)

#	Check	What to look for
10	NDE personnel qualification	RT / UT / MT / PT Level II or above, certificates in date
11	Records and independence	RT film and UT reports properly archived; interpretation independent of production
12	Pressure and leak testing	Complete test records; gauges within calibration
13	Post-weld heat treatment	Automatic furnace charts; furnace temperature uniformity survey on file

The tell here is retrieval speed. Ask for the RT film of a specific weld seam on a specific vessel shipped three months ago. A works with a live system produces it in ten minutes. A works with a filing cabinet full of good intentions produces it tomorrow, or never.

Block 4 — Material and traceability (3 checks)

#	Check	What to look for
14	Incoming verification and mill certificates	Incoming re-testing; EN 10204 3.1 / 3.2 certificates complete
15	Marking transfer	Hard stamp or colour code after cutting; the ID chain never breaks
16	Offcuts and non-conforming material	Segregated, labelled, disposal recorded

Traceability is where export orders die. At final acceptance an overseas owner takes the mill certificate out of the completion file and walks it back to a hard stamp on the steel. If any link fails to reconcile, the whole batch is in question. This block also quietly determines whether carbon data will ever be verifiable — the embedded carbon of a plate whose origin cannot be proven cannot be certified either.

Block 5 — Project execution and inspection plan (4 checks)

#	Check	What to look for
17	ITP (Inspection and Test Plan)	Are the Hold / Witness / Review points set sensibly?
18	Dimensional and nozzle control	Nozzle orientation, flange facing, overall length controlled in-process
19	Schedule and long-lead items	Forgings and tubes requisitioned ahead of the production node
20	Completion documentation package	As-built drawings, quality records and certificates assembled at delivery, not after

Check 19 is the one procurement should own, and the one most often skipped. The equipment can be flawless and the project still slips because the tube bundle material landed three weeks late. Asking when the order for those tubes was actually placed is worth more than reading ten certificates.

Block 6 — Compliance, carbon and ESG (5 checks, the new block)

#	Check	What to look for
21	HSE and process safety	Safety record, emergency plans, PPE actually worn on the floor
22	Labour and employment compliance	Can they support CSDDD / LkSG supply chain due diligence?
23	Business compliance	Anti-bribery, export control, sanctions screening declarations
24	Product carbon accounting	With CBAM definitive from 2026, can they provide third-party verifiable embedded-emissions data?
25	Environmental management	ISO 14001, waste and hazardous substance controls

This block did not exist in most audit forms two years ago. Check 24 is the sharp end. For steel pressure equipment going into the EU, the importer needs verified embedded-emissions figures from 2026 onwards. If a works cannot calculate the embedded emissions of a single vessel and produce a defensible ledger, the importer either buys CBAM certificates against default values and carries the cost, or changes supplier. Write line 24 into the vendor qualification standard now, rather than after the purchase order is signed.

What check 24 looks like in practice

Because this is the newest line, it is the one where both sides are still learning what a good answer sounds like. Concretely, a works that can support CBAM should be able to produce the following without a two-week delay:

• Installation identity. Which plant produced the goods, its address and operator. A package built across more than one shop involves more than one installation.
• Goods identified by CN code, reconciled to the same line as the emissions figure.
• Direct process emissions and indirect emissions from purchased electricity, per tonne of goods.
• Precursor data from the steel mill. For a fabricated vessel this dominates the total, and it is upstream of the fabricator.
• The calculation basis — measured data or default values, and the monitoring methodology used.

Two observations worth carrying into an audit. The largest determinant sits with the plate mill, not the fabrication shop: an electric arc furnace route on a low-carbon grid produces a materially different figure from a blast-furnace route for identical plate. And the data is slow to assemble the first time and quick on repeat orders, which means a supplier who started before being asked is simply further along, not necessarily more virtuous.

What it looks like from the other side of the table

The failure mode of most audit checklist content is that it is written by someone who has never been audited. A few concrete examples of what auditors actually focused on here:

GS E&C, MFC project. A cluster of heat exchangers to ASME and KGS requirements; the largest DN1000 and around 15.8 tonnes, materials ranging from SA516 to 304L. With that material spread the audit went straight to welding procedure coverage and material traceability — change the material on the drawing and the PQR and the mill certificate have to follow.

Air Products, Samsung project. A steam generator with an Inconel and duplex 2205 shell and SB-163 tubes, difficult materials to weld. The audit weight landed on welder qualification and NDE records.

Air Liquide Korea (intercoolers) and TGE (LNG skid packages for dual-fuel vessels). Each came with class society or KGS witnessing, so the emphasis was on ITP witness points and the completion documentation package.

How to spend the day

A qualification audit is a time budget. Spending it evenly across 25 lines is the most common way to end up with a thick report and no conclusion. A rough allocation that works:

• Documents first, on arrival, for around two hours. Certificates, PQR index, welder register, NDE personnel list, ITP samples. This determines what to look for on the floor.
• Floor walk against a live job, not a showcase. Ask to see a vessel currently in production and follow it backwards: drawing, material certificate, marking transfer, welding record.
• Two random retrieval tests. One RT film and one mill certificate, both for units already shipped. Time the retrieval.
• Close with the open questions written down, with dates. An audit that ends verbally ends nowhere.

What separates a real audit from a factory tour is not the length of the checklist. It is whether the auditor traced one real unit end to end.