How to Conduct a Vendor Audit for Oil and Gas Equipment

A vendor audit for oil and gas equipment is not a certificate review. It is an on-site assessment of whether the vendor's quality management system, personnel, processes, and records are capable of producing equipment that meets your specifications. Certificates confirm a system existed at the time of the last audit. An on-site assessment confirms the system is functioning today, on your order.

This guide covers how to plan, conduct, and report a vendor audit for pressure equipment, rotating machinery, and instrumentation suppliers. It is written for procurement engineers, project QA managers, and owner's representatives who are authorizing or leading supplier qualification activities.

Why Audit, Not Just Certify

ISO 9001, API Q1, and similar quality certifications tell you that a certification body found the vendor's documented quality system to be in conformance with the standard requirements at the last assessment. Surveillance assessments occur annually; the certificate cycle is three years.

What a certificate does not tell you: whether the system is actually being followed today, whether key personnel have changed since the audit, whether subcontractors who are critical to your order scope are controlled per the QMS, or whether the specific manufacturing process required for your equipment is within the vendor's demonstrated capability.

For low-consequence, off-the-shelf products, certificate review may be sufficient. For custom-fabricated, coded pressure equipment with safety-critical service, an on-site audit before order placement and source inspection during fabrication provide a level of assurance that certificates alone cannot.

Pre-Audit Planning

An effective vendor audit requires preparation. Arriving at a supplier's facility without a defined audit scope and checklist produces an unfocused conversation rather than a systematic assessment.

• -Define the audit scope: What specific process or capability are you auditing? A welding capability audit has a different focus than a general QMS audit or a NDE capability audit. Define the scope in the audit notification to the vendor.
• -Request documentation in advance: Request key documents before the audit: the quality manual, a list of current WPS and PQR numbers, the ASME U-stamp or applicable certification scope, NDE procedure list, key personnel CVs and certifications, and the most recent internal audit results. Review these before arrival to identify any concerns for on-site follow-up.
• -Define the audit criteria: What standard or standards is the audit against? Your own supplier qualification requirements, an industry standard (API Q1, ISO 9001), the applicable construction code (ASME VIII), or a combination? Communicate the criteria to the vendor in advance.
• -Plan the on-site visit time: A thorough quality system audit of a medium-size fabrication shop requires at least one full day. If you are auditing specific manufacturing processes (welding demonstration, NDE capability), allow additional time. Half-day supplier audits rarely go beyond surface-level assessment.

Key Areas to Assess On-Site

The on-site audit covers the quality system elements most relevant to manufacturing pressure equipment and oil and gas components:

• -Document control: Review whether controlled documents (procedures, drawings, specifications) are at current revisions. Obsolete procedures still in circulation is a reliable indicator of a QMS that is not being maintained. Check whether personnel on the shop floor have access to and are using current procedure revisions.
• -Material traceability: Follow a material from receipt through fabrication. Verify that mill test reports are on file, that material markings are present and transfer to cut pieces, and that the traceability chain from raw material to final component is intact. This is particularly important for ASME-coded pressure equipment where material specifications are part of the code compliance record.
• -Welding procedures and qualification: Verify that WPS documents are available at welding stations, that production welding conditions (preheat, interpass temperature, heat input) are being monitored and recorded, and that welder qualification records are current. Ask to see the PQR supporting the primary WPS in use and verify that the PQR test weld parameters fall within the WPS specified ranges.
• -NDT procedures and personnel: Request the written NDE procedures for the methods to be used on your equipment. Confirm they are signed by a current Level III and reference the applicable code and edition. Verify that NDE personnel performing examinations hold current certifications in the applicable methods at the required level.
• -Calibration system: Review calibration records for measurement instruments used in the audit scope: thickness gauges, temperature recorders, hardness testers, NDE instruments. Instruments must be calibrated at defined intervals and removed from service when calibration is due or when found out of calibration. Instruments with expired calibration stickers still on the shop floor is a significant finding.
• -Sub-supplier control: Identify any sub-suppliers providing critical materials or services for your scope: heat treatment, PWHT, specialized coating, NDE if subcontracted. Verify that these suppliers are on an approved supplier list with documented qualification records, and that the vendor has quality requirements flowing down to them.
• -Non-conformance and corrective action: Review recent non-conformance records. A supplier that has no non-conformances on file almost certainly has a system where defects are being resolved informally without documentation. A well-functioning QMS captures non-conformances and tracks corrective actions to closure. Review a sample of recent NCRs for adequate root cause analysis and effective corrective action.

Red Flags to Watch For

Experienced auditors recognize patterns that indicate a QMS that exists on paper but is not functioning in practice:

• -Unfamiliar personnel with procedures: Operators, welders, and inspectors who cannot describe their own quality requirements or do not know where to find the applicable procedure are a warning sign that the QMS is not effectively communicated to the people doing the work.
• -Verbal quality systems: When the answer to process questions is 'we always do it this way' rather than referencing a written procedure, the process is not under documented control. This may be acceptable for non-critical aspects; it is not acceptable for welding, NDE, or critical dimension verification.
• -Certificate scope that does not match the work: A supplier whose ISO 9001 certificate scope is 'structural steel fabrication' producing pressure vessels is working outside their certified scope. Their QMS was not audited against ASME pressure equipment requirements.
• -Signed but undated records: Quality records without dates create traceability gaps. An NDE report without a date cannot be correlated to the calibration records in effect at that time. Undated records suggest a QMS where record content has been back-filled.
• -ASME stamp with unfamiliar staff: The ASME U-stamp is issued to a company, not a person. But the Authorized Inspector and Authorized Inspection Agency listed on the ASME certificate must be current and the facility's scope of authorization must cover what is being manufactured. Request the current ASME Certification of Authorization and verify it is current.

The Audit Report

The audit report should capture every finding with enough detail that an engineer who was not present can evaluate its significance:

• -Finding category: Major non-conformance (systemic failure; requires corrective action before awarding orders), minor non-conformance (isolated or administrative gap; corrective action required but order can proceed with follow-up), and observation (information without mandatory corrective action).
• -Evidence description: Specifically what was found, not a general statement. 'NDE procedure Rev 3 referenced on the current WPS; procedure on file is Rev 2' is a finding. 'Some procedures were out of date' is not.
• -Applicable requirement: What code, standard, or specification is the finding against? This anchors the finding to a requirement rather than an auditor's preference.
• -Vendor response and timeline: For major non-conformances, document the vendor's corrective action plan and the required closure date before the audit report is finalized.

Norman QC provides vendor audit services for oil and gas equipment suppliers in Canada and, where source inspection is combined with audit activities, at international fabrication facilities. For scope and fee information, contact via the contact page.

FAQs