Factory audits and what a vetted supplier means

What an audit actually is

An audit is a structured examination of a site against a written standard, carried out on a date, producing findings. That is the whole of it: evidence about a place at a moment, gathered by someone who was there. Three things follow, and each is where buyers go wrong.

An audit is dated, so it decays: a report from two years ago describes a factory that may since have changed owners or trebled its volume. It is scoped, so it covers only what it says, perhaps one building of four. And it is performed against a standard, so the question is never whether a factory was audited, but against what and by whom.

The four kinds compared

These get offered interchangeably and answer different questions. Read the last column first, because it is the one people forget.

Types of factory assessment compared

Type	What it examines	Who normally performs it	What you receive	What it does not tell you
Quality management system audit	Procedures, records, training, calibration, control of nonconforming product, corrective action	An accredited certification body, against a published standard such as ISO 9001	A certificate with a scope and expiry, and a report of findings	Whether your specific product meets your specific specification
Social and ethical audit	Working hours, pay records, age verification, freedom of association, health and safety on the floor	A scheme-approved auditor, often booked through the buyer's programme	A graded report with findings and corrective action deadlines	Anything about product quality, engineering capability or output consistency
Environmental and safety audit	Permits, waste handling, chemical storage, emissions, fire and electrical safety	A certification body or a specialist consultancy	A certificate or a findings report against a named standard	Whether the factory can hold your tolerances or hit your dates
Technical or capability assessment	Machines, tooling, line layout, in-process controls, test equipment, measured output	An engineer acting for the buyer, or a technical inspector	A written assessment against your own requirements	Nothing about labour conditions or legal standing
Supplier self-assessment	Whatever the factory chooses to answer on a form	The factory itself	A completed questionnaire	Anything verified. A starting point, never evidence

ISO 9001:2015 is the one you will meet most often. ISO states on its own page for the standard that certification is optional and that a buyer may instead audit the supplier directly. Two consequences follow: a factory without the certificate is not automatically worse, and a factory with it has proved nothing about your part. ISO also states that a revised edition is expected in September 2026, so certificates quoted today are against the 2015 edition. Environmental and occupational health and safety sit in the same family, ISO 14001 and ISO 45001, certified separately. For social compliance you will see scheme names such as amfori BSCI and Sedex SMETA; treat those as names to look up, because they produce graded reports rather than pass or fail certificates.

What the word vetted covers

Nothing, by itself. There is no register, no definition and no body that awards it. When a supplier says vetted, it may mean any of these, and the distance between the first and the last is the whole decision.

• Someone checked the business licence and the export history.
• Someone visited the site.
• Someone has bought from them repeatedly without incident.
• A third party audited them against a named standard and the report was read.
• Nothing, and the word is decoration.

So stop asking whether a factory is vetted and ask what was done, by whom, when, and whether you can see it. A supplier who has done the work finds that easy. One who has not changes the subject.

What Empty Vapes publishes is per-SKU compliance documentation, available on request. Audit reports belong to the site that was audited and to whoever commissioned them, so if a specific report or certificate matters to your decision, name it in your enquiry rather than assuming it sits behind the word vetted. See compliance for what is held per SKU.

Audit against inspection

These are the two halves of supplier assurance and they are constantly confused. An audit looks at the system that makes the product; an inspection looks at the product. A factory can hold every certificate on the list and still ship a batch with the wrong intake diameter, because a certificate covers how decisions are controlled, not what came off the line on Tuesday.

An audit is done once and refreshed; inspection is done per run. For a first order inspection is the more valuable, because it produces evidence about the goods you are buying. Our cartridge quality control checklist and disposable quality control guide set out what to check.

The questions to ask, in order

1. Which legal entity will make my goods, and at which address? Get the site, not the trading company. Much of the confusion in this trade is a certificate in one name and production in another.
2. What assessments exist for that site, of which type, on what dates? A social audit does not answer a quality question.
3. Can I see the report rather than the certificate, and what was the scope? Certificates state a conclusion; reports state findings. Scope means which buildings, processes and product families.
4. What was raised, and what is still open? A report with zero findings is either a very mature site or a very shallow audit. Findings with closed corrective actions are a good sign.
5. Is any part of my order subcontracted? Anodising, printing, moulding and cell supply commonly sit outside the assembling site. Ask which steps leave the audited address.
6. What happens on a defect claim? Get it in writing before you need it. The supplier documentation guide lists what should already be on file.
7. Can I have a first-article sample from the production tool? This is where paperwork becomes an object you can measure. See hardware sampling.

What an audit cannot tell you

• What happens on a normal day. Announced audits are prepared for. That does not make them worthless: a site that cannot present well even when warned is telling you something loudly.
• Which line runs your order. A large factory has lines at different ages and levels of control. The audit averaged them.
• Whether capacity is committed. A factory that sold your production window to a larger buyer is still capable and still late. See the lead time guide.
• Whether your specification is buildable. A sample answers that, not a report. Write the specification down first: see the spec sheet guide.

The documents you need regardless

The compliance file is a separate obligation and does not transfer to the factory. The business placing the finished product on the EU market carries producer registration under WEEE and under the battery rules, and a responsible person under GPSR. An audit report substitutes for none of them.

Stock hardware starts from around 500 units with no container minimum and made-to-order runs take around six weeks after sign-off, so there is room to inspect a first batch before committing to a second. Browse 510 cartridges or read OEM and white-label.

FAQ

Does a factory audit mean my product will be good?

No. An audit examines a management system or a site condition on a given date. Your product is made on a particular line, from a particular batch of components, usually months later. A quality system makes a good outcome more likely by making the factory's own controls visible, but the only evidence about your goods is inspection of your goods.

What is the difference between an audit and an inspection?

An audit looks at the system that makes the product: procedures, records, training, calibration, how nonconforming parts are handled. An inspection looks at the product itself, against a sampling plan and a defect standard, while it is being made or before it ships. Neither substitutes for the other. Most buyers need the audit once and the inspection every run.

Is a certificate the same as an audit report?

No. A certificate states that a body found conformity, names a scope and carries an expiry. A report contains the findings, including what was raised and what is still open. A certificate whose scope does not cover your product line, or one issued to a trading company rather than the site building your order, tells you very little. Ask for the report, the scope and the certificate number, and verify the number with the issuing body.

Sources

• ISO 9001:2015, Quality management systems, Requirements, the catalogue entry at ISO, including its published statements that certification is optional and that a revised edition is expected in September 2026.
• Regulation (EU) 2023/988 on general product safety (GPSR), the official text on EUR-Lex.
• Directive 2012/19/EU on waste electrical and electronic equipment (WEEE) (recast), the official text on EUR-Lex.

Trade guidance for B2B buyers, not legal advice. We sell empty hardware only; you are responsible for the fill and for finished-product compliance in your market.