Factory Audit Checklist for EV Charging Hardware: What to Verify Before You Approve a Supplier

---

An EV charger factory audit should do more than confirm that a building, assembly line, and quality certificate exist. Its purpose is to test whether the facility that will build your order can control the exact product, components, firmware, processes, tests, and changes that affect your business risk.

That requires objective evidence. A polished presentation can describe a quality system; an audit should follow a real work order, inspect current records, select samples independently, and compare written procedures with what operators and equipment actually do. The result is not a general impression of the factory. It is a documented decision about whether identified risks are controlled well enough to move to the next sourcing stage.

Audit principle: Connect every supplier claim to observable evidence at the actual manufacturing site. If the product is built, tested, programmed, or packed elsewhere, that location and the supplier's control over it belong in scope.

A factory audit evaluates how a management and production system operates at a point in time. It can show whether procedures are implemented, whether records are traceable, whether equipment is controlled, and whether the audited site appears capable of executing the agreed process. It cannot, by itself, validate every product certificate, predict long-term field reliability, guarantee future capacity, or establish the financial health of the supplier.

Supplier approval is strongest when these methods are combined. The audit identifies system risk, certificate review checks the compliance claim, sample testing challenges product performance, and pilot production shows whether the intended process works before volume is released.

The audit scope should be built around the product and market requirement, not around a generic factory checklist. Send the supplier a written agenda, but keep the right to select records, work orders, and samples during the visit. A useful preparation sequence is:

1. Define the product baseline. Name the model, power class, connector, target market, certification path, hardware revision, firmware expectations, forecast volume, and any ODM changes.
2. Map the manufacturing route. Identify which site performs PCB assembly, final assembly, software loading, safety and functional testing, packaging, storage, and shipment. Include subcontracted steps.
3. Request documents in advance. Ask for the quality-manual scope, organization chart, process flow, control plan, recent internal-audit summary, calibration list, major nonconformance process, and one anonymized traceability record.
4. Assign an audit team. Procurement can review ownership and capacity, but electrical safety, software provisioning, production testing, and supplier quality may require engineering or quality specialists.
5. Set evidence and access rules. Agree on photography, confidential records, translations, data export, operator interviews, and the method for selecting samples without disrupting safety or production.
6. Define finding severity. Decide before the visit what counts as critical, major, or minor, who can stop approval, and what evidence is required to close each type of finding.

Start by confirming that the company in the quotation, contract, quality certificate, product certificate, invoice, and factory address is understood. Names do not always match because of parent companies, export entities, contract manufacturers, or multiple plants. A mismatch is not automatically a failure, but it must be explained and documented.

• Confirm the legal company name, registration, site address, factory lease or ownership status, and relationship between the sales entity and manufacturing entity.
• Walk the actual route for the product under evaluation, including any separate warehouse, test laboratory, programming station, or packing area.
• List every outsourced process and verify how the audited supplier qualifies, monitors, and approves the subcontractor and resulting product.
• Compare the audited site with the manufacturing location shown in relevant certificates, audit reports, and customer documents.

Red flag: A supplier presents a showcase facility but will build your order at another undisclosed site, or cannot explain which legal entity controls production and product records.

ISO 9001 certification can be useful evidence that a quality management system has been assessed within a stated scope, but the certificate is not the audit conclusion. Verify the certificate holder, site, scope, certification body, accreditation, status, and dates. IAF CertSearch can support validation of accredited management-system certifications where records are available.

Then test implementation. Select a current procedure and follow it to the shop floor. Check whether the revision in use matches the controlled document, whether affected personnel were trained, whether obsolete versions are prevented from use, and whether records are complete. Repeat the exercise with a recent internal audit or management review action to see whether findings lead to verified closure rather than paperwork only.

• Document control: approval, revision history, distribution, obsolete-copy control, and retention.
• Competence: role requirements, initial training, authorization, refresher training, and effectiveness checks.
• Internal audit and management review: risk coverage, independence, actions, due dates, and closure evidence.
• Customer requirements: method for converting specifications, drawings, approved samples, and contract terms into controlled production requirements.

EV charging hardware depends on components whose failure or substitution can affect safety, metering, communication, durability, certification, and serviceability. The audit should focus on how critical parts are defined and controlled, not on the length of an approved-supplier list.

Select several critical or high-risk components from the product BOM and trace them backward. Review the approved manufacturer and part number, purchase record, incoming lot, inspection or certificate requirements, storage status, and disposition of any nonconforming lot. If the part has an approved alternate, inspect the evidence and customer or certification review required before substitution.

• Supplier qualification and periodic performance review for critical components and outsourced processes.
• Incoming inspection plans based on component risk, supplier history, and applicable specifications.
• Lot identification, quarantine, shelf-life control, moisture sensitivity, environmental storage, and first-in/first-out rules where relevant.
• Controls against counterfeit, mixed, remarked, damaged, or unauthorized components.

Traceability should allow the factory to answer two questions: what went into this charger, and which chargers may be affected by a specific component, process, firmware, or test problem? The required depth depends on risk and contract terms, but it should be demonstrated with a live example rather than described in a flowchart.

Choose a finished unit or serial number and trace it back to the work order, product revision, BOM or approved configuration, key component lots, firmware version, line and date, relevant operators or equipment, and end-of-line test record. Then choose one component lot or process deviation and trace forward to the potentially affected finished units and shipment status.

Change control belongs inside traceability

Review recent engineering changes, supplier changes, process changes, firmware releases, and temporary deviations. Each should identify the reason, affected products, risk review, approvals, validation, implementation date, inventory disposition, documentation update, and customer or certification notification when required. A controlled change is not simply a new revision number; it is evidence that the impact was assessed before release.

Follow the actual process from material issue through assembly, programming, test, labeling, and packing. Compare the control plan and work instructions with operator behavior. Look for the parameters that influence product conformity, such as torque, crimp quality, sealing, adhesive or coating application, curing, cable routing, electrical clearances, cleanliness, software selection, and line clearance between models. The applicable controls depend on the product design and process; the audit should not assume every factory uses the same route.

• Workstation documents show the correct model, revision, tools, parameters, inspection points, and reaction plan.
• Operators can explain acceptance criteria and what they do when a result is outside the limit.
• Fixtures, programs, and recipes are identified and protected against unauthorized change.
• Rework and repair use approved instructions, qualified personnel, recorded results, and defined retesting.
• Electrostatic-discharge, environmental, contamination, and material-handling controls match the sensitivity of the product and process.

A calibration sticker is a starting point, not sufficient evidence. Select equipment used for safety-critical or acceptance decisions and review its unique ID, range, accuracy, calibration status, standard or service provider, intermediate checks, protection from adjustment, and record of maintenance. ISO/IEC 17025 defines competence requirements for testing and calibration laboratories; where external laboratory results are relied on, review whether the laboratory scope covers the actual method.

Ask what happens when equipment is found out of tolerance. A mature system identifies the affected measurement period and products, assesses impact, contains risk, and records the decision. Simply recalibrating the instrument without reviewing prior accepted units leaves the core risk unresolved.

• Match instrument capability and range to the specification and measurement uncertainty needed for the decision.
• Verify that calibration and check standards are traceable and within their own validity periods.
• Observe whether failed, expired, or damaged equipment is clearly blocked from use.
• Review one recent out-of-tolerance case or ask the team to demonstrate the documented response process.

End-of-line testing should be defined for the exact model and revision, not described only as a general station capability. Review the approved test specification, limits, fixture and software version, sample or 100-percent coverage decision, failure handling, retest rules, and data retention. Required tests vary by charger type, design, market, and production stage, so the supplier should be able to connect each test to a controlled requirement.

Select passing and failing records. For a passing unit, confirm the data belongs to the serial number and the correct test recipe. For a failing unit, follow the disposition through diagnosis, repair or scrap, approval, and required retest. Check whether operators can bypass steps, edit limits, or reuse results, and whether the system records such actions.

• Safety and protective-function checks appropriate to the design and controlled product requirements.
• Functional charging, communication, user-interface, metering, connector, and accessory checks required by the specification.
• Automatic capture of serial number, product revision, firmware, test program, result, timestamp, and equipment identity where the risk justifies it.
• Defined reaction to repeated failures, abnormal yield, fixture drift, and suspected escapes.

For connected charging equipment, the factory is also a software-release environment. Verify how approved firmware reaches the line, how versions are locked to the product configuration, who can change a programming package, and how the loaded version is recorded against the unit. Debug builds, default passwords, test certificates, and unsecured service ports should not move into finished inventory without controlled disposition.

Where devices receive unique credentials, keys, certificates, SIM profiles, or backend endpoints, review access control, segregation of duties, secure transfer and storage, failed-provisioning handling, audit logs, backup, and revocation. The audit should confirm the process and responsibility boundary without requiring exposure of sensitive secrets.

• Approved firmware release, checksum or signature, release note, compatibility matrix, and rollback rule.
• Controlled programming tools and user permissions, including temporary engineering access.
• Unit-level record of firmware and configuration loaded at production and after any repair.
• Separation of production, test, demo, and customer environments and credentials.

Do not audit the corrective-action process through a blank form. Select recent examples from incoming inspection, production, end-of-line test, final inspection, customer complaint, and internal audit. Check whether the factory contained affected material, defined the population at risk, identified root cause with evidence, corrected the immediate issue, prevented recurrence, and verified effectiveness after enough time or production volume.

Also review how recurring defects are detected. A closed corrective action that reappears in yield, repair, or complaint data is not effective. Management should be able to show how defect trends, first-pass yield, scrap, rework, escapes, returns, and supplier performance lead to action rather than being reported without decisions.

Capacity claims should be rebuilt from evidence. Review the intended line, shift pattern, staffing assumptions, cycle time, bottleneck process, yield, planned maintenance, changeover, test-station throughput, and material constraints. Separate demonstrated capacity from theoretical maximum and from capacity that depends on overtime, unqualified labor, uninstalled equipment, or unapproved suppliers.

Business-continuity review should cover the risks that could interrupt the agreed product: single-source components, tooling damage, test-fixture failure, data or firmware loss, utility interruption, fire or flood exposure, subcontractor dependence, logistics disruption, and loss of key technical personnel. The plan should name recovery actions, owners, backups, and tested assumptions, not only state that a plan exists.

• Compare demand forecast and ramp plan with demonstrated line and test capacity.
• Confirm preventive maintenance, critical spares, backup fixtures, tooling ownership, and recovery time for bottleneck equipment.
• Review launch readiness for the exact BOM, firmware, artwork, packaging, inspection plan, training, and golden sample.
• Identify conditions that require a new pilot, capacity review, or re-audit before volume increases.

A supplier can prepare one perfect record. Sampling should test whether the system works consistently across products, dates, shifts, and outcomes. The auditor should choose examples independently where practical and avoid relying only on records selected in advance by the supplier.

A numeric score can help compare suppliers, but it should not average away a critical risk. Define severity from the potential consequence and the strength of containment. A factory with attractive facilities and complete presentations should not pass if product identity, safety tests, firmware, critical components, or records cannot be controlled.

Examples of critical or approval-blocking findings

• The audited site or manufacturing route is materially misrepresented or an undisclosed site will build the order.
• Records appear falsified, backdated, copied, or disconnected from the physical product and process.
• A required safety or acceptance test is routinely bypassed, limits can be changed without control, or failed units can ship without authorized disposition.
• Critical components, certified construction, or firmware are substituted without required technical, customer, or conformity-assessment review.
• Traceability cannot define the potentially affected units after a critical component, process, firmware, or test failure.
• Production credentials, signing material, or customer configurations are exposed to unauthorized access without effective containment.

Major and minor findings still need context

A major finding is a systemic weakness or significant failure that could allow nonconforming product or uncontrolled change. A minor finding is a limited lapse that does not indicate system failure. One missing signature should not automatically carry the same severity as an untraceable safety-critical substitution, but repeated minor lapses can reveal a major system problem.

The closing meeting should confirm facts, not negotiate away evidence. Each finding should state the requirement or agreed control, the objective evidence, the risk, and the affected scope. The supplier response should separate immediate containment from root cause, correction, corrective action, owner, due date, and effectiveness verification.

• Critical finding: contain affected product and block approval or shipment until risk is controlled and closure is verified.
• Major finding: require a documented CAPA with evidence; decide whether remote verification is sufficient or an on-site re-audit is needed.
• Minor finding: track correction and recurrence risk within the supplier-quality process.
• Open evidence request: do not record an unverified supplier statement as a closed finding.

Supplier approval should name conditions and expiry or review triggers. A change of site, critical process, certified construction, ownership, key subcontractor, firmware-provisioning method, or major capacity ramp may justify a targeted re-audit even if the initial audit passed.

A remote audit can screen a supplier, review documents, follow a live process route, and verify selected records when travel is impractical. It is weaker where camera access is restricted, sampling is controlled by the supplier, network quality prevents continuous observation, records cannot be exported, or physical conditions such as identification, segregation, workmanship, and storage are hard to inspect.

For remote audits, request a live, continuous tour; independently select serial numbers and records during the session; confirm time, location, and participants; and document every area or record that could not be verified. Use the gaps to decide whether approval can be conditional or whether an on-site audit is required before tooling, pilot, or volume release.

The checklist should be tailored to the exact sourcing stage. Before samples, focus on site identity, process ownership, QMS implementation, product route, and major risks. Before tooling or ODM development, add change control, design transfer, firmware ownership, supplier controls, and validation planning. Before volume release, audit the final BOM, line, fixtures, test recipe, programming package, documentation, packaging, and pilot records.

ULandPower currently holds ISO 9001 certification and focuses on B2B OEM/ODM, white-label, and complete-unit EV charging partnerships, with manufacturing operations in China and Thailand. Its current stated annual production capacity is 200,000 units. During supplier qualification, buyers should still verify the current certificate holder, covered site, scope, certification body, and validity, and confirm product- and site-specific available capacity against the intended manufacturing route, forecast, and launch schedule. A useful audit request should also identify the target market, order stage, and evidence required, so the audit can address the actual manufacturing scope rather than a generic company presentation.