Supplier Document Review Checklist for B2B Buyers
This checklist helps a buyer organize the review of supplier-provided business, facility, quality, product, and social-responsibility documents. It is designed to produce traceable questions and next actions, not a binary “approved” or “failed” label. A document can be authentic yet irrelevant, current yet incomplete, or applicable to one entity while production occurs at another facility.
Use the matching CSV as the review log. Avoid storing unnecessary personal data; record business contact roles instead of personal supplier identities wherever possible.
1. Define the review scope
Start with the decision the review supports: onboarding, quotation comparison, sample release, purchase approval, shipment release, or periodic monitoring. Record the product category, destination markets, anticipated processes, nominated manufacturing site, known subcontracting, and review date. Set the evidence period and risk priorities before collecting files.
Request only documents needed for the decision. Typical categories include business registration, manufacturing or facility information, quality-system evidence, product or material test reports, inspection reports, restricted-substance declarations, traceability records, licenses relevant to the process, and social or environmental audit materials. The buyer should determine applicable requirements with qualified advisers where necessary.
2. Log source and chain of custody
For every item, record the filename, document type, date received, source channel, supplying organization, issuing organization, document number, language, and whether a complete original-format file or a cropped image was received. Preserve the received file without editing it and review a working copy.
Distinguish clearly among:
- Supplier-provided evidence: received from the supplier or intermediary.
- Issuer-confirmed evidence: independently matched through an issuer directory, verification portal, or direct issuer contact using independently obtained details.
- Public-profile information: found on a marketplace, association, directory, or website.
A public profile is not evidence of partnership, endorsement, authorization, ownership, or current production capability. Capture the URL and access date if public information is used, because web content can change.
3. Match the legal entity and facility
Compare the legal name, registration number, address, and named entity across documents, quotation, bank details, contract, and order records. Normalize transliterations or abbreviations but do not assume similar names represent the same organization. Record who will contract, invoice, receive payment, manufacture, test, inspect, and export.
Match facility-specific evidence to the actual proposed production address. Confirm whether the scope covers the relevant product and process. If coating, printing, assembly, packing, testing, or another material step is subcontracted, identify the performing facility and decide what evidence is required from it. A headquarters certificate does not automatically cover a separate plant.
4. Check issuer, dates, validity, and scope
Identify the issuer and document owner. Note issue date, expiry date, audit date, surveillance requirement, status, scope statement, sites covered, products or processes covered, standard or method, report pages, and referenced attachments. Look for missing pages, inconsistent fonts or formatting, altered fields, unreadable seals, unexplained redactions, or QR codes and links that resolve somewhere unexpected.
Use independent issuer contact details or official verification tools when the decision risk warrants it. Do not rely only on a telephone number, email address, or link printed in the submitted file. Record the confirmation method, date, result, limits, and reviewer. “Not found” is not automatically proof of fraud: the database may be incomplete, delayed, regional, or require a different identifier. Escalate for clarification and corroboration.
5. Interpret evidence without overclaiming
Read each document according to its stated scope. An ISO management-system certificate does not substitute for a social-compliance audit, prove product conformity, or guarantee every shipment. Sedex membership or a Sedex profile does not mean that a SMETA audit occurred or that an audit was approved; review the actual audit status, scope, site, date, findings, and permitted sharing terms. Test reports apply only to the tested sample, method, specification, and report conditions. Inspection reports describe the inspected lot and sampling plan, not all production.
Record limitations and residual questions in plain language. Use statuses such as “received,” “under review,” “independently confirmed,” “clarification requested,” “additional evidence needed,” “accepted for this decision with limitations,” or “not applicable.” Avoid a universal supplier-approval flag.
6. Reconcile discrepancies
Compare key fields across all evidence. Common discrepancies include different legal names, addresses, registration numbers, site lists, product scopes, issue or expiry dates, report numbers, signatures, and audit windows. Also compare document claims with commercial behavior: proposed payment beneficiary, email domain, quotation issuer, shipping party, and production location.
For each discrepancy, log the exact conflicting fields, why they matter, the supplier's explanation, corroborating evidence requested, action owner, due date, and purchasing impact. Preserve earlier versions rather than overwriting them. Do not accuse or clear a supplier based on one inconsistency; assess the explanation and independent evidence proportionate to the risk.
7. Assign the next action
Every reviewed item should end with a concrete next step. Examples include obtaining a complete file, requesting a certified translation, confirming a report with the issuer, matching the facility through a live video or inspection, reviewing corrective-action evidence, adding a contract condition, limiting an initial order, scheduling testing, or pausing a decision pending clarification. Record who owns the action, when it is due, and what evidence will close it.
At the decision point, summarize verified facts, unverified claims, discrepancies, limitations, open actions, and the business owner who accepts any residual risk. Set a review trigger such as expiry, facility change, product change, adverse finding, or elapsed time. Document review should feed into broader due diligence, sampling, quality control, contracting, and ongoing supplier management.
Responsible use and attribution
This checklist is not a certification, audit, assurance opinion, legal advice, or regulatory advice. It does not establish that a supplier or product is qualified, compliant, ethical, authentic, or suitable. Use proportionate independent verification and qualified advisers for the relevant product and market.
Optional attribution: “Buyer resource prepared with reference to CZWX.” Attribution is voluntary; no backlink is required. No search-ranking benefit is promised, and use is not a condition of supplier selection or service eligibility.
Method reference: Sedex explains SMETA as an audit methodology, not certification. CZWX is not presented as a Sedex affiliate or audit provider.