Audit & assurance · Second-party
A second-party audit tests whether a supplier or outsourced provider meets the requirements you set them - in a contract, a specification, a security schedule or a standard. We plan and carry out the audit for you, report to you, and follow up the findings with the supplier where you ask us to.
Questionnaires tell you what a supplier says. An audit samples what they do. Most clients use both: a questionnaire for every supplier, and an audit for the few whose failure would hurt.
Who it is for
A supplier's ISO certificate covers its own scope. It may not cover the service you buy or the site that produces your goods.
Self-assessment answers are rarely wrong on purpose, but they are rarely tested either.
Many contracts include an audit clause that is never exercised, so the oversight it was meant to give does not exist.
An audit report that is filed and not tracked changes nothing at the supplier.
How it works
We agree with you what the supplier is audited against - contract clauses, your security or quality requirements, a specification or a standard - and which services, sites and processes are in scope.
You notify the supplier under your contract. We send the supplier an audit plan with the agenda, the people needed and the records to have ready.
Policies, certificates and their scope, previous audit results and the records the criteria call for, reviewed before fieldwork.
Interviews and sampling of records at the supplier, remotely or on site. For manufacturing suppliers, a walk-through of the relevant areas.
Findings graded against your criteria, with evidence, and a view of the supplier risk they represent. The report is yours; you decide what to share with the supplier.
Where contracted, we review the supplier's corrective action plan and verify implementation, and give you a closing position.
What you receive
What we need from you
Scope and pricing
Quoted per supplier or per programme. Travel is stated separately.
Delivery
Boundaries
Your internal audit is first-party. An audit of your supplier carried out for you is second-party: it reports to you, against your requirements. A certification audit is third-party and is done only by an accredited certification body. A supplier audit can rely on a supplier's certificate where its scope fits, but it does not replace one, and it does not certify anything.
Related services
Questions
You need a right to audit, usually in the contract, and the supplier's cooperation to schedule it. We work under your contractual arrangements and can sign the supplier's NDA where needed.
You do. The audit is carried out on your behalf, so the report is addressed to you. Many clients share the findings section with the supplier to agree corrective actions.
Yes. Remote audits work anywhere. Onsite audits are planned case by case, with travel costs stated in the proposal.
DORA requires financial entities to manage and monitor ICT third-party risk, including audit and access rights in contracts. A supplier audit is one way to exercise that oversight; it is not the whole of DORA third-party risk management, and the obligation stays with the financial entity.
We will propose criteria, a plan and a price per supplier or per programme.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.