Your Pack Supplier Audit Belongs in the Records Room, Not the Conference Room

A pack supplier audit should be scheduled as a records day, not a meeting day. Send the document request list two weeks before you travel, cut the opening presentation to twenty minutes or turn it into a pre-read, and spend the hours you save pulling nonconformance reports, material review dispositions, corrective actions, rework and scrap logs, then tracing two or three shipped serial numbers backward through incoming inspection, assembly, and end-of-line test. The slide deck tells you what the supplier wishes its system looked like. The records tell you what actually happened on the floor in March.

I build the day around a folding table in the quality office, not the conference room with the projector. Six feet of laminate, a power strip, and whatever the document controller can wheel in on a cart. The conference room gets twenty minutes at 8:30 and then we leave it. I have sat through audits where the whole morning went to an org chart, a process flow with rounded boxes, and a slide called something like "Our Zero Defect Culture," and by lunch nobody had opened a single record. You learn nothing in that room except how well the supplier rehearses.

The records room is different, and it is uncomfortable in a useful way. Fluorescent tubes, a fan, a cart of binders with handwritten spine labels, a shared drive open on someone's laptop with folders named by year. That is where the real audit happens.

The request list goes out before the flight

I send the list with the agenda attached, and I ask for raw exports rather than a curated summary PDF. Roughly this:

• The complete nonconformance log for the last twelve months, not a sample the supplier picks.
• MRB dispositions tied to those NCR numbers, including concessions and use-as-is calls.
• The corrective action register with open date, containment date, root cause date, and effectiveness check date for each entry.
• Rework and scrap logs by work order, with the pack serial numbers or lot codes affected.
• Incoming inspection records for two named cell lots.
• Calibration status for the end-of-line testers, spot welders, and torque tools.
• The traveler or MES export for one work order I name in advance.

Two things I look at before I even read the content. First, file naming. A folder full of files called NCRfinalv2_ACTUAL.xlsx tells me version control is being done by whoever is annoyed that day. Second, timestamps on scanned records. If forty NCRs were all scanned into the system on the same afternoon, those were reconstructed for the audit, and I want to know that going in rather than discovering it at four o'clock.

I also ask who the document controller is and where the physical records live. If the answer is vague, the audit is going to be a scavenger hunt, and that itself is a finding about how the QMS is resourced.

Twenty minutes on the slides, then the table

A workable agenda looks like this: a short opening where I explain that we are going to spend the day in records and on the line, two hours of document pulls with the QC engineer and document controller in the room, a line walk with a printed work order in my hand, an afternoon trace on two or three serial numbers, an hour with the quality manager on dispositions and corrective actions, and thirty minutes at the end to name the documents I still want and agree on a response date.

When a supplier pushes back on shortening the presentation, that is information. Sometimes it is just pride, and the plant manager wants to show you the new line. Sometimes it is a system that only exists on slides. Either way, I would rather find out at 8:45 than at 5:00.

I keep the line walk tied to a specific work order rather than a general tour. Walking a line with no anchor turns into watching machines move. Walking it with the traveler for pack serial 4471 in my hand turns into questions: where is this pack right now, who touched it last, where does the weld parameter record for this station live, and can you hand it to me in the next ten minutes.

Pull one serial number and walk it backward

Pick a pack you can physically hold, from a shipment still in your warehouse or in transit, and ask for everything behind it. Work order, cell lot numbers, incoming inspection record for those lots, formation and grading data if the supplier does that, spot weld parameter logs by station and shift, torque records for busbar fasteners, end-of-line results including capacity, internal resistance, open circuit voltage, insulation resistance or hipot, and a leak check if the enclosure is sealed. Then the traveler with operator stamps.

The chain always breaks somewhere. The most common break I run into is that the end-of-line data exports with a timestamp but no operator ID or station ID, so the record proves a test happened but not who ran it or on which fixture. The second most common is a lot number mismatch between the traveler and the incoming inspection record, usually because someone substituted cells to keep the line running and the paperwork caught up later. Neither of those is fatal on its own. Both are fatal if the supplier cannot explain them when you are sitting there with the paper in front of you.

Run three traces if the day allows. One from a routine shipment, one from a shipment right after a change such as a new cell source, a new shift, or a line modification, and one where you already suspect there was a problem. The third one is where you learn the most, because you get to see how the supplier behaved when something went wrong rather than how it behaves when nothing did.

The NCR that closes too cleanly

Read ten nonconformances in full rather than reading the summary. For each one, I want to see how the defect was described, who found it, who dispositioned it, whether the root cause field has anything in it beyond a phrase, and what the corrective action actually was.

The two corrective actions I see most often are "operator retrained" and "added to inspection checklist." Neither is a root cause analysis. They are ways of putting the problem back on the person who found it. A closed NCR with an empty root cause field is not a closed NCR, it is a stamp.

Then count use-as-is dispositions and sort them by defect code. Use-as-is is a legitimate disposition, and a supplier that never uses it is probably scrapping good product. But when the same defect code gets a use-as-is three or four times in a quarter, the supplier has effectively decided that defect is acceptable without ever revising the specification or the process. That is a design and process-control problem wearing the costume of a disposition decision. I would rather see a hard concession with a customer notification and a dated engineering change than a quiet string of use-as-is calls nobody upstream ever heard about.

Clause 8.7 lives on the line, not in the binder

Control of nonconforming outputs is one of those requirements that is easy to write a procedure for and hard to actually run. On a real pack line it shows up as physical segregation and a paper trail that matches it. So I go look.

Is there a defined hold area, and is it actually controlled, meaning a rack or a cage with a log of what went in and what came out, not a shelf with masking tape and a handwritten sign? Are held packs red-tagged with a number that appears in the NCR log? When a pack is reworked, is there a rework work order, and does the reworked pack keep its original serial number with the rework appended, or does it quietly get a new one? Who has authority to sign a concession, and can the person in front of me name that authority level without checking?

The distance between the written procedure and what is on the floor is the single most useful thing I measure all day. A procedure binder that describes a beautiful quarantine process while the actual hold area is three untagged packs behind a spot welder is a more honest picture of the system than any slide.

Count the clock, not the open findings

The number of open findings is the least useful metric a supplier will offer you, and they will offer it, usually in the opening presentation. What matters is how fast corrective actions move and whether the same failure comes back.

Ask for the register as a spreadsheet and compute two things. First, days from open to containment, containment to documented root cause, and root cause to effectiveness check. Second, recurrence: the same failure mode against the same part number or station within twelve months. Twenty rows will show you the shape of the system without any scoring formula. A supplier whose containment is fast but whose root cause dates lag by weeks is containing well and analyzing badly. A supplier with fast root causes and recurring failure modes is writing plausible analyses that do not change anything.

Recurrence is the harder conversation and the more valuable one. I will pull three repeat failure modes and ask, in the room, why the last corrective action did not hold. The answer tells me more about the quality manager than any certification they can hand me.

What the records cannot tell you

Records are a lagging indicator and they arrive curated. A supplier with a clean record set and a line full of people who will not make eye contact is still a risk, and you will only see that by standing at the end-of-line station watching how the operator handles a reject. Ask the operator what they do when the tester throws a fail code and see whether the answer matches the procedure. Check the calibration stickers on the tester yourself.

Volume matters when you normalize. A shop building two hundred packs a month may have fifteen NCRs in a year and that is a different signal than fifteen in a shop building twenty thousand. Compare against throughput and against the consequence of failure, because a pack for a medical cart and a pack for a consumer scooter do not warrant the same tolerance for a loose busbar.

Language is the other practical constraint. If the records are maintained in a language nobody on your team reads, request the export in advance, get it translated, or bring someone who can read it. Reading a translated summary during the audit and calling it record review is how people end up signing off on a system they never actually examined.

Before I leave, I write down the specific documents I still want, with names and dates, and I get a response date in the closing meeting. Then I put that record request list into the supply agreement as a defined right of access with a response window, so next year's audit opens with a folder instead of a slide deck.