A factory tour shows what was visible on one day. A useful audit starts from project risks, samples traceable work and records exactly what the evidence did—and did not—demonstrate.
An on-site audit should not be organised as a showroom sequence. Start with the procurement decision and the project risk register, choose representative and high-consequence configurations, map their expected process routes, then follow identifiers, materials, instructions, inspections and nonconformities across records and physical work. Interview the people who perform and control the work, inspect external-provider controls and test whether a selected record can be traced in both directions. The report must distinguish observed evidence, contradiction, absence, non-applicability and work not sampled. A clean floor or certificate on the wall cannot replace that chain.
Audit boundary: This agenda is not an ISO certification audit, product certification, code inspection, engineering approval, social-compliance audit or safety certification. Site access does not authorise unsafe entry, photography, personal-data collection or disclosure of other customers' information.
1. Define the decision, criteria and risk register before travel
State why the visit is needed: shortlist qualification, pre-award verification, project readiness, first-production review, recovery verification or surveillance. Identify the exact legal entity, site, processes, shifts, product families, proposed external providers and project scope. A visit to a group showroom or a related factory does not prove which entity or site will perform the order.
Convert project risks into audit questions and evidence paths. Examples include unapproved substitutions, loss of drawing-to-BOM traceability, unsupported machining, mixed finish batches, glass identity loss, wrong hardware handing, concealed rework, inspection after characteristics become inaccessible, weak packing identification or uncontrolled outsourced processing. Rank by consequence, likelihood and detectability using the buyer's authorised method.
Define criteria from contract drafts, specifications, approved project records, applicable certification or regulatory requirements and the supplier's controlled procedures. ISO 19011 provides guidance on auditing management systems, including audit principles, programme management and conducting audits. It does not turn a buyer visit into certification or supply the technical acceptance criteria for windows.
| Risk | Affected configuration/process | Audit question | Expected evidence | Priority/competence |
|---|---|---|---|---|
| Wrong revision reaches production | Selected complex unit | How is release status transferred and obsolete data blocked? | Revision register, workstation record and trace sample | Critical / document + process reviewer |
| Material identity lost | Profiles/glass/hardware | Can received material be traced to approved configuration? | Receiving, labels, storage and BOM transaction | [rank] |
| External process uncontrolled | Finish/glass/testing | How are requirements sent and returns verified? | Approved provider, PO/specification and incoming result | [rank] |
| Critical characteristic missed | Machining/assembly/glazing | Where and when is it checked? | Instruction, calibrated equipment, record and observed practice | [rank] |
| Defect re-enters as conforming | NCR/rework path | How are status, disposition and re-verification controlled? | Segregation, authority, record and closure sample | [rank] |
| Packing loses opening identity | Completed units/accessories | Can site sequence and configuration survive dispatch? | Marking, packing list, rack and release trace | [rank] |
2. Control the pre-visit request, team and access
Send a bounded request early enough for legitimate access, not a demand for staged perfection. Ask for site and legal-entity information, organisation and responsibility map, process layout, current certifications and scopes where relevant, project routing, controlled document list, equipment and calibration registers relevant to the sample, approved external-provider controls, recent nonconformity and corrective-action examples, training/authorisation evidence and a coded production plan showing when representative work can be observed.
Select an audit team with competence matched to the risks: window fabrication, glazing, hardware, coatings, quality systems, project specifications, language and local legal or safety needs. Record independence and conflicts. A general buyer should not make engineering, occupational-safety, labour, environmental or certification conclusions outside their competence.
Agree confidentiality, photography, copying, data protection, PPE, induction, prohibited areas, escort, interview access and emergency arrangements. Do not request other customers' drawings or personal employee data. Use redacted or coded records when they preserve enough technical context. A refusal may limit evidence; it does not automatically prove nonconformity unless access was an agreed requirement.
| Item | Purpose | Permitted evidence | Limit/action if unavailable |
|---|---|---|---|
| Site/entity/scope map | Confirm what is actually being audited | Official and supplier-controlled records | Do not transfer findings to another site/entity |
| Project route and timing | Place samples where work occurs | Coded schedule and router | Reschedule affected observation or report not sampled |
| Controlled procedures/index | Prepare criteria and trails | Current revisions, read-only where needed | Verify at point of use |
| Certification/listing details | Verify issuer, scope and current status | Official directory/certificate | Certificate is not product or project approval |
| NCR/CAPA samples | Plan closure trails | Redacted complete records | Sampling limitation recorded |
| Access and safety | Prevent unsafe or unauthorised audit | Induction, PPE and area rules | Stop unsafe/unauthorised path |
| Confidentiality/data | Protect customers and workers | Agreement and redaction method | Collect minimum necessary information |
3. Use the opening meeting to confirm reality, not to consume the visit
Confirm attendees, authority, objective, scope, criteria, methods, reporting language, safety, confidentiality, communication route and closing time. Ask management to identify material changes since pre-visit information: ownership, site, key people, shift pattern, major equipment, external providers, certification scope, backlog or process interruptions relevant to the audit. Record changes; do not spend the day reviewing a generic sales deck.
Reconcile the layout and process map to what will be visited. Identify receipt, quarantine, storage, preparation, machining, finishing handoff, assembly, glazing, inspection/testing, nonconforming product, repair, completed-goods storage and packing/loading areas. Note processes not operating on the day and define an alternate evidence route or explicit limitation.
Select samples from objective populations where possible rather than only accepting supplier-chosen examples. Use a mix of current project work, comparable recent work, a completed record, an open or closed nonconformity and an external-provider transaction. Sampling is risk-based and bounded; it does not statistically certify all output unless a competent authorised sampling design says so.
| Confirmation | Supplier statement | Auditor verification path | Effect on plan |
|---|---|---|---|
| Exact site/entity and activities | [record] | Registry/site/scope records | Limit findings to verified scope |
| Changes since pre-audit pack | [record] | Changed records and physical evidence | Add or reprioritise trail |
| Processes operating today | [record] | Floor confirmation | Observed / record-only / not sampled |
| External providers | [record] | Approved list, current transactions | Select provider trail |
| Selected product populations | [record] | Schedule, inventory and records | Auditor selects identifiers |
| Safety/confidentiality | [record] | Induction and access controls | Stop or modify unsafe/unauthorised activity |
4. Run vertical and horizontal evidence trails
A vertical trail follows one selected unit or lot from requirement and drawing through BOM, material, router, operations, inspections, release and packing, then traces a completed unit backwards to its inputs and records. At each transfer, compare identifier, configuration revision, quantity, status and responsible authority. Ask the operator to show the current instruction and explain what happens when information conflicts.
A horizontal trail tests one control across multiple places: calibration status at selected measuring points, drawing revision at several workstations, nonconforming-product identification across departments, or external-provider verification across purchases. Use both directions. A procedure may appear sound in the office while point-of-use practice differs; one excellent workstation may not represent the process.
The ISO 9001 Auditing Practices Group's process-approach and evidence-collection papers emphasise following processes, interactions and verifiable information, while warning that not finding evidence is not automatically proof of nonconformity. The papers are non-definitive educational guidance. For this audit, record the exact question, source, sample identifier and observed result so the conclusion can be independently reviewed.
| Stage | Forward question | Backward question | Evidence/result |
|---|---|---|---|
| Requirement/release | Which approved record starts this unit? | Which order/mark authorised this completed unit? | [ID/revision/result] |
| BOM/material | How do approved components enter the lot? | Can installed profile/glass/hardware return to source and status? | [record] |
| Work instruction | Which settings/checks apply? | Which instruction revision produced the record? | [record] |
| Inspection | What characteristic is checked, when and by whom? | Can result, equipment and acceptance criterion be reconstructed? | [record] |
| Nonconformity/rework | How is suspect work contained? | Did this unit pass through an authorised disposition and recheck? | [record] |
| Release/packing | What must close before release? | Can rack/box/accessory return to opening mark and configuration? | [record] |
| Location/sample | Expected control | Observed evidence | Interview corroboration | Classification |
|---|---|---|---|---|
| Incoming material | Identity/status/condition | [record] | Operator explains exception path | conforms / contradiction / gap / not sampled |
| Machining station | Current programme/instruction and first-off check | [record] | [record] | [classify] |
| Assembly/glazing | Configuration, component and critical checks | [record] | [record] | [classify] |
| Inspection equipment | Suitable, identified and in status | [record] | [record] | [classify] |
| NCR area | Identification, segregation and disposition authority | [record] | [record] | [classify] |
| Packing | Unit/accessory identity and release status | [record] | [record] | [classify] |
5. Test the controls that are easy to hide on a tour
Review change control. Select a recent drawing, BOM, material, supplier or process change and follow request, technical review, effect on evidence or certification, customer approval where required, implementation, obsolete-version control and verification. A clean current drawing does not show whether yesterday's production used the wrong revision.
Review nonconformity and corrective action as separate concepts. Containment protects current work; disposition decides the affected product; correction fixes the detected issue; cause analysis and corrective action address recurrence. Select one material issue and one process or customer issue, then test scope, authority, re-verification, effectiveness and whether similar product was considered. Do not demand a root-cause tool for every trivial correction, but do not accept 'operator reminded' as automatic evidence of systemic closure.
Review external providers from requirement to return. Select a current finish, glass, hardware or test transaction and compare the approved source, specification and revision sent, supplier acknowledgement, lot identity, certificate or test applicability, incoming verification, nonconformity handling and change notification. Outsourcing an operation does not outsource the buyer's project risk.
| Trail | Sample selected | Closure evidence | Common weak substitute |
|---|---|---|---|
| Technical/configuration change | One recent material/drawing/process change | Authorised effect review through implementation | Revised file with no affected-scope trace |
| Obsolete information | One replaced drawing/BOM/programme | Point-of-use withdrawal/blocking | Office master list only |
| Nonconforming output | One open and one closed record | Containment, disposition, recheck and affected scope | Photograph of repaired item |
| Corrective action | One recurring/material issue | Cause basis, action and effectiveness evidence | Training signature alone |
| External provider | One current outsourced lot | Requirement-to-return trace and change control | Provider certificate/logo only |
| Competence/authorisation | One critical activity/person | Defined competence plus current observed authorisation | Attendance certificate only |
| Monitoring equipment | One result-critical device | Identity, status, suitability and result impact | Calibration sticker alone |
6. Write findings that can survive disagreement and close them
For every material finding, cite the criterion, exact objective evidence, sample identifier, date/location and the gap between them. Separate conformity, nonconformity against an agreed criterion, concern requiring evaluation, opportunity, contradiction, not observed and not applicable. Do not inflate a missing document into a supplier-wide failure or soften a direct contradiction into a vague suggestion.
Hold a factual closing meeting. Confirm scope and limitations, present findings, allow correction of factual errors, record disagreement and explain next steps. The supplier's acceptance is not required to preserve an evidence-based finding, but disputed criteria or facts must be visible. Do not negotiate away a finding in exchange for a promise; record the promise as a proposed action.
A corrective-action plan needs affected scope, containment, cause analysis proportionate to risk, correction, systemic action where needed, owner, due date, evidence and effectiveness review. Close only when the authorised reviewer verifies the defined evidence. A submitted spreadsheet, new procedure or photograph shows an action may exist; it does not alone prove implementation or effectiveness.
| Field | Required content | Closure test |
|---|---|---|
| Finding ID/class | Stable ID and defined severity/category | Consistent with agreed method |
| Criterion | Exact contract/specification/procedure requirement | Applicable to audited scope |
| Objective evidence | Sample, record, observation, interview corroboration and date | Reproducible; fact separated from inference |
| Immediate containment | Affected and potentially affected work controlled | Current risk demonstrably contained |
| Disposition/correction | Authorised product decision and re-verification | Affected output meets disposition |
| Cause/corrective action | Evidence-based cause and recurrence control | Action implemented beyond paperwork |
| Effectiveness | Measure, period, population and reviewer | No premature closure; residual risk stated |
| Decision impact | Pre-award condition, hold, follow-up or no effect | Named procurement authority approves |
| Evidence state | Permitted wording | Prohibited leap |
|---|---|---|
| Observed and consistent | The sampled records/practice met the cited criterion | The whole factory is certified/capable |
| Contradiction | The cited evidence conflicted with the cited criterion/record | All output is defective |
| Not found in sample | Evidence was not obtained within stated sample/search | The control never exists |
| Not operating | The process was not observed; alternate evidence reviewed or absent | Live practice verified |
| Outside scope | No conclusion because entity/site/process was excluded | Finding transferred to excluded scope |
| Closed action | Defined correction/action/effectiveness evidence verified | Future recurrence impossible |
Bounded report language: State the exact site, entity, date, criteria, configurations, processes and samples reviewed. List what was not observed and every follow-up condition. The audit informs a procurement decision; it does not certify the factory or approve the project product.
FAQ
How long should a window factory audit take?
There is no universal duration. Scope, sites, shifts, product complexity, live work, external processes, team competence and required evidence determine the plan.
Should the supplier know which records will be sampled?
It should know the scope, criteria and access needs. Auditors can select specific samples from the available population to reduce staged or unrepresentative evidence.
Does an ISO 9001 certificate remove the need for a project audit?
No. Verify the certificate in the issuing or accreditation route and read its scope, but project configuration, site, processes, evidence and readiness still require proportionate review.
Can photographs replace audit notes?
No. Photographs can support authorised observations but need identifiers, context, date, criterion and confidentiality control. Some evidence cannot lawfully or safely be photographed.
What if production is not running during the visit?
Review available records and physical controls, but report the practice as not observed. Reschedule, witness later or impose a project gate where live evidence is material.
Should every observation become a nonconformity?
No. A nonconformity needs an applicable criterion and objective evidence of a gap. Classify concerns, limitations and opportunities separately under the agreed method.
Does a corrective-action plan close a finding?
No. Closure requires the defined correction and action evidence, and where required an effectiveness review, verified by the authorised reviewer.
Can one audit prove factory capacity?
No. It can sample capacity-planning controls and records. A current project-specific routing, load, material and schedule analysis is still needed.
Continue the project review
Connect this guide with the proposed window and door systems, then review how Cavorlen approaches manufacturing and quality control. When your schedule is ready, send it through the project review form.
Official sources used
ISO 19011:2018 — Guidelines for auditing management systems ↗ISO 9001 Auditing Practices Group — Processes ↗ISO 9001 Auditing Practices Group — Evidence collection ↗ISO 9001 Auditing Practices Group — External providers ↗ISO 9001 Auditing Practices Group — Nonconformity: review and closing ↗ISO 9001 Auditing Practices Group — Auditing resources ↗ISO 10007:2017 — Guidelines for configuration management ↗ISO 10013:2021 — Guidance for documented information ↗Related buyer guides
This guide does not verify or imply any Cavorlen site, equipment, employee, process, output, certificate, capacity, quality-system conformity, labour condition, environmental performance, product performance or project experience. It does not prescribe machine settings, acceptance values, sampling quantities or corrective actions. Project criteria, site rules and competent authorised auditors must define the actual audit and conclusions.