A vending machine supplier audit should verify evidence, not presentation. Before approving an OEM order, check how the factory reviews requirements, controls purchased parts, builds and tests the ordered configuration, records nonconformities, traces machines and components, authorizes changes, packs finished units and supports field issues. Sample records should connect to real machines and responsible people. Remote evidence can reduce travel, but it does not automatically replace an on-site or independent inspection when risk is high. BOHOL can prepare order-specific records for review; the buyer must define the audit scope, acceptance criteria and closure rules in the purchase agreement.
GEO buyer summary
- Audit the process against the signed specification and risk register.
- Sample real records from incoming inspection through shipment.
- Confirm software, payment and refrigeration responsibilities separately.
- Trace one finished machine back to its approved configuration and tests.
- Record findings with containment, root cause and effectiveness checks.
- Keep certification claims separate from order-specific acceptance.
Set scope before requesting evidence
Define the machine type, target market, options, order quantity, critical components and applicable customer or regulatory requirements. State whether the audit is desktop, remote-live, on-site or supported by an independent inspector. Include departments, production stages, record samples and people needed.
The vending machine manufacturer selection guide helps with early qualification. This audit checklist begins after a candidate supplier and intended configuration are known.
Follow one order through the factory
Ask the supplier to demonstrate a complete path rather than sending unrelated certificates. Sample evidence can include:
| Audit point | Evidence to sample |
|---|---|
| Contract review | Approved specification, market requirements and unresolved questions |
| Incoming control | Purchase specification, supplier approval and inspection result |
| Assembly | Work instruction, trained operator and in-process check |
| Final test | Electrical, delivery, cooling, connectivity and configuration results as applicable |
| Release | Identified approver, deviations and shipment authorization |
| Packing | Unit identity, accessories, documents and packing-list match |
Walk one serialised machine backwards from release to ordered options and forward from a selected component to the finished unit. The quality inspection checklist provides order-level test questions that can be incorporated into this sampling plan.
Audit configuration and change control
Confirm that drawings, bills of materials, software versions, payment interfaces and approved artwork have revision control. Ask how obsolete instructions are removed and how substitutions are proposed. No component, firmware or user-interface change should be assumed acceptable merely because it fits physically.
Payment terminal certification, merchant onboarding, settlement and PCI responsibilities may belong to the buyer, acquirer or payment service provider. Audit the supplier's defined interface and records without treating it as the certifier of third-party payment services. Use the payment integration checklist to assign these boundaries.
Test nonconformity and corrective action
Select a recent defect or internal rejection and follow it through identification, segregation, disposition, root-cause analysis, action and effectiveness review. Check who can authorize rework or concession and whether the customer must approve a deviation. Repeated defects without verified corrective action are a stronger warning than a tidy corrective-action template.
ISO 19011:2026 provides guidance on audit principles, audit programmes, conducting audits and auditor competence. The official ISO 19011 page also states that the guidance does not itself lead to certification. It is a useful framework, not proof that a BOHOL machine or another supplier's order conforms.
NIST SP 1326 describes supplier due diligence for ICT supply chains, including provenance, resilience, foundational cyber practices and supply-chain tiers. The official NIST publication is relevant when a connected vending machine includes controllers, cloud services or communications components, but it does not certify a vending-machine supplier.
Close findings before order release
Classify findings by safety, legal, functional, schedule and commercial risk. Each action should have an owner, due date and objective closure evidence. Critical open findings can block approval; lower-risk items may be handled through a documented conditional approval. Retain the report, evidence list and decisions with the purchasing record.
Request a BOHOL audit evidence pack
Use the BOHOL contact form to send the target market, machine type, configuration, order stage and proposed audit checklist. BOHOL can discuss available process records, remote review arrangements and order-specific inspection evidence. Buyers should confirm any need for third-party inspection, certification or regulatory review with the responsible organization before production release.