Subcontractor Compliance Audits & Supply Chain Traceability

Ask a factory manager to describe the supply chain for a single order and the answer usually starts at the fabric store and ends at the shipping dock. The real chain is longer and less tidy. Fabric may be dyed at one unit, cut at the factory, embroidered at a second unit, washed at a third, and packed back at the factory. Trims may pass through a printer. Buttons may be attached by a small workshop. Each of those units is part of the product, and each carries labour, safety and environmental risk. The buyer approved the main factory, not the hidden parts of the chain, which is exactly why subcontracting attracts such intense audit attention.

The central fact to grasp is responsibility. Buyers hold the main factory responsible for compliance in its subcontracted units, whether or not the factory owns them. A child labour finding at an embroidery workshop, a blocked exit at a washing unit, or wages below the legal minimum at a stitching subcontractor will be recorded against the main factory order. The defence that the unit is independent does not work, because the factory chose the unit, set the price and the deadline, and profited from its work. Subcontractor compliance is therefore not an optional extra. It is part of factory compliance, and it needs the same seriousness.

Everything starts with a map, and the map must be complete before it can be useful. List every unit that touches the product: fabric and trim suppliers, dyeing and washing units, cutting, sewing, embroidery, printing, and packing, including home-based work where it exists. For each unit, record the address, the process performed, the approximate workforce size, and the orders it handles. Home-based work deserves explicit attention, because it is the most commonly omitted part of the map, and auditors specifically probe for it.

A map that is not verified is only a list. Verification means checking the map against reality: production records that show which units handled which orders, site visits that confirm addresses and processes, and capacity checks that confirm the main factory could plausibly have produced what it shipped. The capacity check is powerful and simple. If a factory with a given workforce and machine count ships far more than its own lines could produce in the period, the difference went somewhere, and auditors will ask where. Factories that reconcile own-line capacity against output every week catch overflow early, while it is still a planning problem, rather than at audit, when it is a disclosure problem.

No subcontracted unit should handle buyer work until it has been disclosed to the buyer and approved. Disclosure means submitting the unit, its address, its process and its workforce profile, together with a signed acknowledgement of the buyer code of conduct, before production starts. Approval is buyer-specific: approval from one buyer does not transfer to another, and a unit approved for one process is not automatically approved for a different process. When a unit changes address, changes process or changes ownership, the approval position must be revisited.

The cost of skipping disclosure is disproportionate, and factories need to understand why. An unapproved unit, even a well-run one, is recorded as a trust and integrity issue, because the factory bypassed the buyer control over where products are made. The consequences can include corrective action plans with deadlines, increased monitoring, suspension of orders, or loss of the buyer relationship. By contrast, voluntary disclosure of a problem, with a complete account and a fix, usually preserves the relationship, as the factory example in this lesson shows. The lesson for management is blunt: hiding a subcontractor is always more expensive than disclosing it.

Subcontractor audits should mirror the main factory audit in expectations, scaled to the unit, and scheduled by risk rather than by calendar convenience. Risk ranking considers the process, with chemical washing, dyeing and printing ranking higher than simple cutting or packing. It considers working patterns, with night shifts and peak-season overtime ranking higher than stable day shifts. It considers workforce profile, with migrant or contract labour ranking higher than a stable local workforce. It considers past findings, with repeat or unclosed findings shortening the interval. And it considers transparency itself: a unit reluctant to share records or allow access is signalling risk, and that reluctance should raise its ranking, not lower its priority.

The audit scope for a subcontractor covers the same ground as a main factory audit: child labour and forced labour indicators, wages and working hours, health and safety, and environmental practice, plus traceability records for the orders handled. Findings go into the same CAPA system as main factory findings, with the same discipline of owner, deadline and evidence. A subcontractor that fails to close findings should lose its approval, and that decision should be recorded. Continuing to use a unit with open serious findings, because it is cheap or fast, transfers the risk directly onto the main factory order book.

Traceability is proved by records that balance, not by assertions that the chain is known. For every subcontracted order, the record chain has five links. The approval record shows the unit was approved for the process before work started. The material issue challan shows the quantity, date, style and order reference of what left the factory. The unit production log shows daily output, operators, machines and rejects, in quantities plausible for the unit capacity. The return challan shows what came back, with rejects retained as evidence. And the reconciliation sheet shows the balance: issued minus rejects minus in-transit equals received, with any gap explained in writing and signed by both parties.

The worked example in this lesson shows the pattern for an embroidered order: 20,000 panels issued, 19,850 returned, 150 rejects retained, balance explained. That reconciliation is the single most persuasive traceability document a factory can produce, because it is hard to fake consistently across orders and easy for an auditor to sample. The routine control that supports it is a monthly end-to-end reconciliation of one subcontracted order, performed as normal management practice rather than as audit preparation. When reconciliation becomes routine, drift is caught early, and audit sampling finds a system that already works.

Discovery of unapproved subcontracting, whether by internal check or by auditor, demands immediate and honest action. Stop the work at the unit. Contain any affected goods so their status is clear. Disclose the unit to the buyer in writing, completely and without delay, including which orders were affected. Arrange an audit of the unit. And fix the control that allowed it, such as a rule that no production may leave the factory without a compliance approval check, backed by the weekly capacity reconciliation described above.

What must never happen is backdating. Backdated approvals, attendance records or delivery challans, created to make an undeclared unit look approved, convert a correctable subcontracting finding into a falsification finding. Falsification is treated by buyers as grounds for ending relationships, because it destroys confidence in every other record the factory produces. The factory example in this lesson illustrates the alternative: voluntary, complete disclosure with a corrective plan preserved a relationship that concealment would have ended. Honesty after a mistake is a recoverable position. Dishonesty is usually not.

Subcontractor compliance fails when it is treated as an annual event before a known audit, and succeeds when it is treated as continuous management. Approvals should be revisited when units change address, process or ownership. Risk rankings should be updated when findings close or repeat. Capacity reconciliation should run weekly. One order per month should be reconciled end to end as a routine control. And the subcontractor list itself should be reviewed in management meetings alongside production and quality data, not kept in a drawer until an auditor asks for it.

That routine is also what makes subcontractor management affordable. Auditing every unit at the same depth and frequency wastes effort on low-risk units while high-risk units go unchecked. Risk-based scheduling concentrates effort where it matters, and routine reconciliation catches most problems before they need an audit at all. The result is a supply chain the factory can describe honestly, defend with records, and improve over time, which is exactly what buyers are looking for when they ask about subcontracting.

Subcontractor compliance rests on four disciplines that reinforce each other. Map every unit that touches the product, including home-based work, and verify the map against production reality. Disclose every unit to the buyer and secure approval before use, understanding that approval is buyer-specific and process-specific. Audit on a risk basis to the same standard as the main factory, with findings tracked in the same CAPA system and approval withdrawn from units that do not close them. And prove traceability with records that reconcile, order by order, from material in to goods out. Factories that follow these disciplines can answer the hardest audit question, which is not whether subcontracting exists, but whether the factory knows, controls and can prove every step of its own chain.