A SMETA audit report can show which supplier site was assessed, what the auditor found and which corrective actions remain unresolved. It cannot certify that a supplier is low risk across every site, product, subcontractor or period. To use the report well, match its scope and evidence to the exact sourcing decision you need to make.
The question is not simply whether the report looks clean. It is what you can reasonably conclude from the assessment, what remains untested and whether the available evidence supports approval, conditions or further due diligence.
What Is a SMETA Audit?
SMETA stands for Sedex Members Ethical Trade Audit. It is an ethical-trade audit methodology used to assess working conditions and management practices at a defined site. Independent auditors from Sedex-approved Affiliate Audit Companies perform the audits; Sedex itself does not conduct them. The main outputs are a SMETA audit report and a Corrective Action Plan Report (CAPR).
SMETA does not award certification or a universal pass or fail. As Sedex’s SMETA guidance makes clear, the purpose is to identify findings that can support corrective action and continuous improvement. Buyers may set their own approval criteria, but those decisions must not be presented as approval or certification granted by Sedex.
What Information Does a SMETA Audit Report Provide?
The report brings together the audited site and activities, audit date, assessment scope, evidence considered, recorded non-compliances and observations. The CAPR explains the actions proposed in response to findings and, where follow-up has taken place, may record progress and verification. Read the two documents together: a finding explains what the auditor identified; an action plan explains how that problem is being addressed.
The distinction matters because a report is evidence about an assessment, not an unlimited statement about the supplier. A management commitment to change a procedure is not the same as evidence that the change has worked. Nor does a follow-up review necessarily reassess every area covered by the original audit.
What Can Buyers Conclude From a SMETA Audit Report?
Which Site and Activities Were Actually Assessed?
Start with the legal entity, site address, production processes, worker groups and audit dates. Compare them with the goods you purchase and the facilities involved in making them. A report for one garment factory cannot automatically support conclusions about a sister site, warehouse, labour agency, homeworking arrangement or unaudited subcontractor.
For example, a supplier may share a report from its main manufacturing site while your order is partly completed at another location. The report is still relevant, but the unassessed work creates a coverage gap. Record that gap before treating the report as sufficient evidence for the whole order.
Audit age is another boundary. In its 2025 consultation outcome, Sedex’s updated audit guidance said SMETA information should no longer be treated as a robust assessment of current workplace conditions after 24 months. This is not a certificate expiry date or an across-the-board rule that an audit must happen every two years. Previous findings, risk level, ownership changes or a serious incident may justify an earlier review.
Why Does 2-Pillar Versus 4-Pillar Coverage Matter?
A 2-Pillar SMETA audit focuses on Labour Standards and Health & Safety, together with a basic environmental assessment and relevant requirements covering responsible recruitment, entitlement to work and subcontracting. A 4-Pillar audit adds fuller assessments of Environment and Business Ethics. The two formats therefore support different depths of conclusion.
Suppose wastewater management is a material concern for the product you buy. A 2-Pillar report may provide useful labour and safety evidence, but its basic environmental check is not equivalent to the fuller Environment pillar. Conversely, a 4-Pillar report is not automatically sufficient if the relevant manufacturing activity or subcontractor was outside the audit scope. Choose the evidence based on the risk, not just the number of pillars.
What Do the Findings Actually Tell You?
A finding identifies a problem against the applicable audit requirements, within the limits of the evidence reviewed. The number of findings is not a reliable supplier-risk score: ten minor documentation gaps may require a different response from one repeated wage violation or a serious machine-safety failure. Consider severity, recurrence, the people affected, underlying causes and how the auditor reached the conclusion.
Imagine payroll records appear complete, but workers describe unpaid overtime. The documents alone do not settle the issue, and the interviews should not be dismissed. Your team should consider the interview conditions, worker groups represented, time records and other corroborating evidence. If a concern remains credible, the appropriate conclusion is that further focused verification is needed—not that every possible allegation has been proved.
Your own buying practices may matter too. Unstable forecasts, late changes or unrealistic lead times can contribute to excessive overtime. Where a finding is linked to purchasing pressure, remediation may require action from both buyer and supplier. This is more useful than reducing the report to a simple supplier score.
How Should Buyers Interpret Open Corrective Actions?
The CAPR deserves as much attention as the initial findings. Distinguish an action that is still open, an action the supplier says it has implemented, and an action whose completion has been supported by suitable verification. A target date is a commitment, not proof of closure. A “closed” status can be informative, but the confidence you place in it depends on what was actually checked and by whom.
For each material issue, ask what caused the problem, who is accountable, what immediate protection is needed and what evidence would show that the underlying practice changed. An overdue action with no credible progress requires a different buyer response from one that has a named owner, dated milestones and operating evidence demonstrating improvement.
How Can You Verify That Corrective Actions Worked?
Take a working-hours finding. A revised policy and training attendance records may demonstrate that the supplier has taken steps, but neither proves overtime has fallen. Stronger evidence could include changes to production planning, representative time and payroll records, worker feedback and a later check for recurrence. The verification method should reflect the seriousness and persistence of the issue.
The same principle applies to safety controls. A purchase order for protective equipment is evidence of spending, not proof that the equipment is installed, used and maintained correctly. Aim for enough evidence to support the decision, rather than requesting every possible document.
What Do SMETA 7 Collaborative Action Required Findings Mean?
SMETA 7 introduced Collaborative Action Required (CAR) findings for complex or systemic issues where remediation may depend on parties beyond the audited site. Sedex’s April 2026 explanation states that CARs have no assigned criticality level, standard remediation deadline or auditor validation. That design should not be mistaken for a finding that can safely be ignored.
Consider recruitment-fee practices involving labour intermediaries. The supplier may need buyer support, changes by recruitment agencies and safe involvement of affected workers. The buyer and supplier should agree on responsibilities, milestones and ways to assess progress. Check current Sedex guidance as its 2026 consultation proposed refinements to how CARs are managed and monitored.
What Can Buyers Not Conclude From a SMETA Report?
Even a report with no material non-compliances cannot prove that every relevant risk is absent. The audit reflects particular evidence, worker samples, activities and conditions during the assessed period. It does not show that every worker was interviewed, every issue was detected or conditions have remained unchanged since the visit.
It also cannot establish that every site, product line, labour intermediary or subcontractor operates at the same standard. A clean report for one factory should never become a group-wide claim that a supplier is “Sedex approved”, “SMETA certified” or low risk across its entire value chain. Those statements go beyond what the methodology provides.
The opposite conclusion is also too simple: a report containing findings does not automatically mean the relationship must end. A supplier that acknowledges a serious issue, investigates the root cause and demonstrates effective remediation may support a conditional sourcing decision. A superficially clean report with narrow scope or contradictory evidence may warrant closer scrutiny.
How Should Buyers Use the Report to Make Supplier Decisions?
Make the approval decision for a named legal entity, site, product or service—not for a supplier brand in general. Weigh the report scope, material findings, corrective-action evidence and information from other sources. Record what the report supports, the conditions you have set, who owns the follow-up and when the decision must be revisited.
| Report situation | Proportionate buyer response |
| Relevant audit scope; no material concerns open | Consider approval alongside wider due diligence; record remaining limits |
| Corrective actions open; credible progress demonstrated | Set specific conditions, review dates and evidence requirements |
| Site, date or evidence does not match the sourcing decision | Request focused verification before relying on the report |
| Severe or repeated issues remain unresolved | Escalate; assess remediation and whether sourcing should be paused |
A condition should be specific enough to test. “Improve working hours” gives neither party a clear acceptance standard. Naming the affected site, the change required, the source of evidence and a review date makes the decision accountable. VECTRA’s Supplier Risk Assessment Checklist offers a broader framework when the SMETA report is only one input to supplier approval.
When Is Further Due Diligence Necessary?
Further work is justified when the report excludes your purchased activity, is too old to represent current conditions, contains serious or repeated findings without credible progress, or conflicts with other evidence. A worker complaint, site incident or grievance does not automatically invalidate an audit; it does mean the buyer should examine the discrepancy instead of treating the original report as conclusive.
Do not automatically order another full audit. Define the unanswered question first. If the gap concerns recruitment fees, investigate recruitment practices and worker experience. If a closed safety action has not been tested, arrange a focused verification of the control. The OECD Due Diligence Guidance for Responsible Business Conduct frames this as continuing risk-based work: identify adverse impacts, take action, track effectiveness and support appropriate remedy.
VECTRA’s supplier engagement guide explains how to request targeted evidence and agree improvements without burdening suppliers with repeated general questionnaires. The objective is a better-supported decision, not a bigger document folder.
How Can VECTRA Support Supplier Audit Readiness and Remediation?
VECTRA’s Pre & Post Audit Assistance service helps companies prepare evidence, identify audit-readiness gaps, plan corrective actions and strengthen controls after an assessment. Its Compliance, Risk & Due Diligence service supports the wider supplier-risk questions that one site audit cannot answer, including risk assessment and mitigation planning.
The roles should remain distinct. Sedex-approved audit companies carry out SMETA audits; suppliers implement corrective actions; buyers decide how the evidence affects their purchasing relationship. VECTRA International can support preparation, supplier assessment and practical remediation, without claiming to conduct or certify SMETA audits.
Frequently Asked Questions
Is SMETA a Certification?
No. SMETA is an audit methodology, not a certification scheme. It produces audit findings and a corrective-action record, not a universal pass, fail or Sedex-issued approval.
Does a 2-Pillar SMETA Audit Cover Environmental Issues?
It includes a basic environmental assessment. A 4-Pillar audit adds fuller Environment and Business Ethics assessments, so buyers should check the format against the risks they need evaluated.
Does a SMETA Audit Report Expire After 24 Months?
There is no certificate-style expiry date. Sedex’s 2025 guidance says information older than 24 months should not be relied on as a robust assessment of current workplace conditions. Audit timing should also reflect risk and material changes.
Does a Clean SMETA Audit Report Remove the Need for Due Diligence?
No. It provides evidence for the site, period and assessed scope. Other sites, subcontractors, changes and information from workers or other sources may require further review.
Next step: Before approving your next high-risk supplier, use the Supplier Risk Assessment Checklist to record the audited site, 2-Pillar or 4-Pillar coverage, unresolved corrective actions and the decision supported by the evidence.
View related posts
· Supplier Risk Assessment Checklist: How to Score and Prioritize Suppliers
· Supplier Engagement: How to Get Better Evidence and Close Risk Gaps
· How to Prepare for ESG Audits: A Complete Guide for Global Supply Chains
VECTRA International is a trusted Business Resilience & Operational Capability Building Partner. Through our ecosystem of integrated solutions, we help organizations transform operational complexity into resilient performance, measurable business impact, and sustainable growth.
Chaussée de Wavre 1517B, 1160 Brussels, Belgium.
A Note on Our Visuals: At VECTRA, we combine human expertise with advanced technology. Some of the supportive imagery in this article was generated using artificial intelligence tools like Google Gemini. We ensure all conceptual AI assets align with our brand standards and accurately reflect our data.
