Short answer: yes, you can assess a supplier you cannot visit, but only partly. A remote assessment can confirm documents with the bodies that issued them and show you whatever a camera is pointed at on one day. It cannot show what is out of frame, how the site runs when nobody is watching, or whether your goods will come from that site. Use four tiers, in order of cost and depth: documents checked with issuers; a live, unscripted video walkthrough; an appointed local agent; and an independent audit against a named standard. Choose the tier by order value and product risk, and write down what it did not verify. Rules differ by scheme, buyer and market: routine blended food-safety audits retain an on-site component, while FSSC 22000 Version 7 has a tightly scoped full-remote exception for serious events.
What you are actually trying to find out
"Is this a good supplier?" is too broad to verify. Split it into questions a piece of evidence can answer:
- The site exists at the stated address and is run by the company you are contracting with. (Whether the company itself exists is a separate check, done first.)
- The site makes this product, with the equipment and capacity the offer implies.
- The controls are in place: hygiene, segregation, pest control, traceability, testing.
- The certificates are genuine and in scope for this product at this site.
- Performance holds over time, across shifts, seasons and bad days.
Each tier below answers some of these. None answers the fifth.
The four tiers at a glance
| Tier | Verifies | Partly verifies | Does not verify |
|---|---|---|---|
| 1. Documents checked with issuers | Certificates and approvals are genuine and current | Scope, site and product match | Anything physical |
| 2. Live video walkthrough | Areas shown exist and look as claimed today | Capacity, hygiene, lot records | Areas off camera, other shifts, subcontracting |
| 3. Appointed local agent | Premises, stock and people on the day, with samples | Controls, if the agent is competent | Independence and competence of the agent; other days |
| 4. Independent audit against a named standard | System against a named standard, by a qualified auditor | Consistency, through records | Your specific lots; days between audits |
Tier one: documents, checked with the issuer
Ask for the certificates, the latest certification audit report or its summary, any official establishment approval, and records for one recent lot: raw material receipt, production, test results and dispatch. Then confirm each certificate with its issuer or the issuer's public register, reached through contact details you found yourself, not those printed on the document. The same rule protects payments; see payment redirection fraud. Two separate articles in this library cover how to check a scanned certificate and what HACCP, ISO 22000 and BRCGS certificates each mean.
One thing belongs here because it concerns remote auditing: find out how the audit behind the certificate was delivered. BRCGS certificates from a blended audit state "Blended Announced" with the dates of both parts, and the report must clearly identify the extent to which ICT was used BRCGS, BRCGS080 blended audits, v5.1, 6 October 2026. BRCGS says the v5.1 update is a rebrand plus contents and minor grammar changes; the operating limits below are unchanged.
Tier one misses: everything physical. A genuine, in-scope certificate says the system met a standard on audit dates; it does not show the site today.
Tier two: a live walkthrough that is not a showreel
A pre-recorded video is marketing. A live call can be evidence if you, not the supplier, control it. Global Accreditation Cooperation's rule for accredited bodies offers a useful discipline: ICT use must be agreed, its risks identified and documented, and "other methods" used where the conditions are not met Global ACI, TECH-3-003 (M) ICT for conformity assessment, issued 10 July 2026. For a buyer, that means deciding in advance what the call must show and what happens if it cannot.
A walkthrough checklist:
- Short notice. Agree a window, not a time; call within it.
- Start outside. Gate, signage and street, so you can compare them with public map imagery of the stated address.
- One continuous take. Ask for no cuts; if the connection drops, resume where it dropped.
- You choose the route. Raw material store, production line, packing, finished goods, loading bay, then toilets and hand-washing points.
- Ask for specifics live. A lot code on finished stock matched against a document sent earlier; a test or cleaning record for today; the pest-control log.
- Speak to operators, not only the sales manager.
- Record, with consent, and file the recording with the date and names of those present.
Tier two misses: whatever is off camera, including a second building or subcontractor; conditions a screen cannot carry (smell, dust, heat, noise); other shifts; and, without the outside view, proof that it is the stated site at all.
Tier three: an appointed local agent
A person in the building can open doors, look behind stock, draw samples and talk to people without the supplier choosing who. The value depends on the brief. Write it down:
- the questions from the first section that the visit must answer, and the evidence for each;
- the areas and stock the video did not show, photographed with date and location and matched to lot marks on your documents;
- samples to draw and seal, with who holds each portion;
- people to speak to, by role;
- a short-notice or unannounced arrival, where the supplier agrees;
- a declaration that the agent receives nothing from the supplier.
Tier three misses: anything the agent cannot recognise; independence you cannot confirm; and, again, every other day. An agent's report is not an accredited audit and should not be described as one.
Tier four: an independent audit
The deepest tier is an audit against a named standard: either the supplier's accredited certification audit, read carefully, or a second-party audit you commission from a qualified auditor. The second kind is not accredited certification and should not be described as such. ISO 19011 is the international guideline for auditing management systems; its fourth edition was published in May 2026 ISO, ISO 19011:2026.
Remote delivery of these audits is limited. The Global Accreditation Cooperation ICT document, based on IAF MD 4:2025, says ICT "is not mandatory" and that schemes and legislation "may impose limitations" and "may take precedence" Global ACI, TECH-3-003 (M). Food schemes do limit it:
- GFSI Benchmarking Requirements, version 2024: at least part of the annual audit must be on site (a broker scope excepted); the on-site part includes, as a minimum, physical verification of Good Manufacturing Practices; the remote part needs mutual agreement; all audit activities must fall within a scheme-set period of no more than 30 days, extendable to 90 only by a risk-assessed dispensation GFSI, Benchmarking Requirements v2024, Part II, clauses 5.31–5.34.
- BRCGS (BRCGS080, v5.1): blended audits apply to re-certification only, not the first BRCGS audit at a site, are announced, and the on-site part normally follows within 28 days BRCGS, BRCGS080.
- FSSC 22000 (Version 7, May 2026): the scheme allows an ICT approach that combines remote and on-site work. A full remote audit is a separate, non-GFSI-recognised option only where a serious event prevents access, the risk of maintaining certification is low, and risk, feasibility and mutual-agreement conditions are met. Version 7 allows no more than two consecutive full remote audits before an on-site audit is required FSSC, Version 7 scheme documents FSSC, Full Remote Audit Addendum v3.
Regulators may go further. Under the US Foreign Supplier Verification Program, where a supplier controls a hazard that can cause serious adverse health consequences or death, the importer must conduct or obtain documentation of an onsite audit before first importing and at least annually, by a qualified auditor, unless it makes an adequate written determination that other verification activities or less frequent onsite audits are appropriate; certain FDA or foreign food-authority inspections can substitute eCFR, 21 CFR 1.506. That is one market's rule. Your customer or importing authority decides what it accepts, so ask before you design the programme.
Tier four misses: your specific lots (that is inspection and testing), and the time between audits.
What no remote tier verifies
- Continuity. Next season's raw material, a key operator leaving, a change of owner.
- Staffing reality. Whether the people on camera run the night shift.
- The bad day. A breakdown, a power cut, rain on an open yard, a rush order.
- Where your goods are made. Peak orders may go to a subcontractor the tiers never saw.
- The lot you receive. Site assessment is not a pre-shipment inspection or a laboratory result.
These gaps shrink only with repeat evidence over time: performance on each delivery, complaints, test results and re-assessment.
Matching the tier to order value and product risk
Scale assessment to what you would lose, including money paid before you control the goods; see how much advance payment is reasonable.
| Situation | Minimum tier | Consider adding |
|---|---|---|
| Low-hazard, shelf-stable product; trial volume | 1 and 2 | Agent visit if the video leaves gaps |
| Known safety hazard, or first regular volume | 1, 2 and 3 | Lot inspection before shipment |
| Long programme, private label, or customer-named scheme | 4 | Unannounced follow-up; subcontractor sites |
| Importing-country rule requires onsite audit | As the rule states | Keep the audit record for inspection |
Then write a decision record: tier used, date, who took part, what was verified, what was not, the residual risk accepted, who accepted it and when it will be reviewed. Keep it alongside the shipment files described in the document set behind one shipment.
Worked example: escalating from video to audit
Hypothetical teaching example. All names, figures and findings are invented.
A buyer considers a ground-spice supplier it cannot visit. Before an 18,000 CU trial container it runs tiers one and two. Staff time costs about 600 CU, 3.3% of the order. Certificates check out with the issuer; the live walkthrough shows a clean grinding hall and stock with lot codes matching the documents sent. The trial arrives to specification.
Before a twelve-month programme of twelve similar containers, 216,000 CU, the buyer commissions a tier-four audit:
| Item | CU |
|---|---|
| Audit fee | 3,200 |
| Auditor travel | 900 |
| Buyer's preparation time | 400 |
| Total | 4,500 |
That is 2.1% of the programme value. The audit found two things the video had not: peak-season grinding was sent to a second, uncertified unit across town, and the metal-detector check records had gaps on the night shift. The buyer made approval conditional on either auditing the second unit (2,800 CU more, bringing assessment to 7,300 CU, 3.4% of the programme) or a contract term excluding it, and on corrected night-shift records at the next review.
The video was not wrong; it showed only what was on screen.
Common mistakes
- Treating a supplier-made video as an assessment.
- Letting the supplier choose the route, the time or the people on the call.
- Reading "certified" without asking whether the audit was on site, blended or remote.
- Sending an agent without a written brief, or one paid by the supplier.
- Assessing the site once and never again.
- Recording what was checked but not what was left unchecked.
Limits and what to recheck
This article describes buyer-side assessment, not how certification bodies must run audits. Scheme rules on ICT change: recheck the current GFSI, BRCGS and FSSC documents before relying on the rules above. A full-remote exception in one scheme does not make the result acceptable to every customer, regulator or GFSI programme. Regulators and customers in other markets set their own requirements; the US rule quoted is one example. Local agents' legal status and access rights differ by country. More guides in Sourcing & Supplier Management.
FAQ
How do you do a supplier quality audit remotely? Start with documents confirmed with their issuers, then a live walkthrough you direct, then an agent visit or an independent audit as order value and risk rise. Record what each step did not see.
Can a virtual audit replace an on-site audit? Usually not for routine certification. GFSI-benchmarked blended audits retain an on-site part. FSSC 22000 Version 7 permits a full-remote audit only under its serious-event addendum and limits consecutive use. For a buyer's own small trial, a remote assessment may be proportionate if the residual risk is written down.
What should a supplier audit checklist cover? Site identity, the product and capacity, hygiene and pest control, segregation, traceability for a recent lot, testing, certificates in scope, and subcontracting.
Next step
Before approving a supplier remotely, create a one-page decision record: questions asked, evidence seen, gaps left open, approval tier, decision owner and review date. If the physical production risk remains material, limit approval to a trial order until an on-site visit, lot inspection or other direct evidence closes the gap.
Resources
- Global Accreditation Cooperation Incorporated — TECH-3-003 (M), v1.0 — https://sys.global-aci.org/uploads/documents/Global_ACI_TECH-3-003_%28M%29_v1_0.pdf (rechecked 21 October 2026)
- GFSI — Benchmarking Requirements version 2024, Part II — https://mygfsi.com/wp-content/uploads/2024/12/Benchmarking_Requirements_v2024_Implementation_Handbook_Part_II.pdf (rechecked 21 October 2026)
- BRCGS — BRCGS080 blended audits, v5.1 — https://www.brcgs.com/media/zpupsdz5/brcgs080-blended-audit-remote-audit-using-ict-v51.pdf (published 6 October 2026; checked 21 October 2026)
- FSSC — FSSC 22000 Version 7 scheme documents and Annex 5 — https://www.fssc.com/fssc-22000/scheme-documents/ (rechecked 21 October 2026)
- FSSC — Full Remote Audit Addendum, Version 3 — https://www.fssc.com/wp-content/uploads/2026/04/FSSC-Full-Remote-Audit-Addendum_Version-3.pdf (rechecked 21 October 2026)
- eCFR — 21 CFR 1.506, Foreign supplier verification and related activities — https://www.ecfr.gov/current/title-21/chapter-I/subchapter-A/part-1/subpart-L/section-1.506 (rechecked 21 October 2026)
- ISO — ISO 19011:2026 Guidelines for auditing management systems — https://www.iso.org/standard/19011 (rechecked 21 October 2026)
