Chain of Custody · Free resource
The supply chain audit question bank
Twenty-five questions an auditor would ask about your supplier records and the hand-offs between your teams, with the evidence that answers each one. A free PDF from Chain of Custody, my newsletter on practical supply chain assurance.
The PDF is free to download, with no sign-up. Chain of Custody is my weekly newsletter on practical supply chain assurance, and you can unsubscribe in one click.
What's inside
- 01Twenty-five questions across seven areas, from knowing who you buy from to correcting past errors.
- 02For each question, the evidence that answers it and the warning sign that it won't.
- 03The rules and standards behind each question, cited by clause.
- 04A one-page worksheet for recording gaps, owners and dates.
One of the twenty-five
Q03 · Knowing who you buy from
When a supplier changes factory, sub-supplier or ownership, how do you find out, and how quickly?
Evidence that answers it
- A contractual duty on the supplier to notify changes
- A change log comparing the date notified with the date the change took effect
- The re-assessments each change triggered
Warning sign
Changes are discovered from shipping documents after the goods have moved.
Anchored in · ISO/IEC 27001:2022 Annex A 5.22 · ISO 9001:2015 clause 8.4
Why these questions
Most supply chain controls fail quietly, at the point where a record stops matching the goods, the supplier or the team that is meant to act on it. The questions are written to find those points before a regulator, a customer or an auditor does, and a strong answer to any of them is a document, a log or a record, whilst a weak answer is a description of what is supposed to happen.
I wrote them as a lead auditor for ISO/IEC 27001, ISO/IEC 42001 and ISO/IEC 27701, and as someone who has spent a career running first-line supply chain controls.
Get the question bank
Download the PDF free. Chain of Custody brings one practical problem and the evidence needed to settle it, every week.