Vendor Audits and Compliance Checks in India

The vendor auditing processes conducted via procurement intermediaries, industry groups, or shared service solutions often contain built-in conflicts of interests, in the sense that an auditor with a business relationship with a vendor being audited cannot provide an objective audit output that is required for effective supply chain risk management. IMARC Engineering has no business relationships whatsoever with any suppliers, manufacturers, or vendors in India. The audit work fee will be paid for each audit assignment solely by the audit commissioning party, while each audit finding provided will faithfully reflect the true situation of the audited vendor without bias resulting from business, referral, or reputational connections that exist in related audit programs.

A generic vendor audit checklist that uses the same set of criteria for assessing vendors from different supply categories fails to capture the industry-specific regulatory requirements that make a supplier eligible for the respective manufacturing process. An API supplier for the pharmaceuticals sector needs to be assessed based on the criteria specified in Schedule M and CDSCO license, whereas a food ingredient supplier has to meet the FSSAI licensing criteria along with the implementation of HACCP procedures. A chemical supplier will have to undergo an evaluation of PESO and CPCB compliance, while a packaging supplier has to comply with the regulatory requirements for food contact materials and obtain a BIS license. At IMARC Engineering, we perform category-specific evaluations based on the relevant regulatory guidelines, thus ensuring that the audit results capture the industry-specific requirements for evaluating a vendor.

The vendor compliance profile stated in the GST registration, website of the company, and business-to-business portal is typically exaggerated when it comes to the extent of certification, manufacturing capabilities, and maturity of quality systems. The on-paper review of documents and questionnaire answers do not assure the implementation of the quality management system under normal production conditions and the actual status of the manufacturing facility as well as the sanitary and safety standard maintained by food and drug suppliers. IMARC Engineering conducts on-site inspection of facilities for suppliers based in India's major manufacturing hubs, which include equipment status, implementation of quality management systems, material handling and storage, documentation practices, and laboratory testing capabilities under normal working conditions.

Compliance information related to vendors that is usually included in the process of supplier qualification, GMP certification, FSSAI licensing, BIS certification, ISO certification, and CDSCO manufacturing license, often expires, has limited scope, becomes suspended, or is falsified without detection due to reliance on mere document reviews. IMARC Engineering does a thorough verification of all such certifications/licenses by cross-checking them against issuing authorities, CDSCO, FSSAI licenses data base, BIS certification data base, PESO data base, and ISO certified bodies list. It does not rely on certificates provided by suppliers which might not necessarily be an updated status for compliance. It uncovers any regulatory violation that is missed through mere document audit.

Audits performed only at one cycle for evaluating suppliers just once at the time of onboarding without any follow-up audit lead to a misconception about the risk situation, as suppliers may fail in maintaining their quality systems, their certification expires, their financial position may have changed or ownership structure might have changed since the last audit and all of this leads to a change in compliance risk status of the vendors. IMARC Engineering provides risk stratified continuous audit programs where re-audits are done depending on the criticality of the supplier type, findings of the last audit and the overall risk profile of the vendor with yearly audits for critical pharmaceutical and food suppliers, biannual audits for industrial and targeted surveillance audits depending on compliance risk indicators.

Supplier audits that recognize non-conformances without addressing the closure of any corrective actions provide little value within the supply chain because there will be no resolution to the identified problems, no improvement on the supplier's compliance record, and the cost of the audit will not translate into actual reduction of supply chain risks. At IMARC Engineering, we handle the entire process of corrective action closure once non-conformances have been discovered during supplier audit, including classification of non-conformances based on severity, generation of corrective action request along with its closure schedule, evaluation of the proposed corrective action plan by the supplier, verification of implemented corrective actions and finally, issuance of corrective action closure notice when the problem is effectively fixed.