Auditing a factory's supplier anti-counterfeit program requires a structured, risk-based approach focusing on program design, implementation, effectiveness, and continuous improvement. Here’s a step-by-step guide:

1. Define Scope & Objectives

   • Identify high-risk suppliers (e.g., raw materials, components with high counterfeit risk).
   • Set audit goals: Verify program maturity, identify gaps, assess compliance with industry standards (e.g., ISO 29119, FDA UDI, AICPA SOC 2).

2. Review Documentation

   • Program Policy: Anti-counterfeit strategy, risk assessment, KPIs.
   • Supplier Controls: Onboarding checks, audit protocols, contract clauses.
   • Incident Response: Procedures for handling counterfeits, recalls, and communication plans.
   • Training Records: Employee training on counterfeit detection.

3. Risk Assessment

   • Prioritize suppliers based on:
     • Product criticality (e.g., life-saving drugs vs. non-critical parts).
     • Historical incidents.
     • Geographic risk (regions with high counterfeit prevalence).

Phase 2: On-Site Audit Activities

A. Program Governance & Strategy

• Interview Leadership:
  • Who owns the program? Is it resourced (budget, staff)?
  • How is counterfeit risk integrated into supplier management?
• Review Risk Assessment:
  • Is it updated annually? Does it cover Tier 2 suppliers?
  • Example: Verify if high-risk suppliers face enhanced scrutiny.

B. Supplier Controls

• Supplier Onboarding:
  • Check if suppliers provide:
    • Anti-counterfeit certifications (e.g., ISO 28000, GS1).
    • Chain-of-custody documentation.
    • Testing reports for materials.
• Supplier Audits:
  • Review audit reports: Are counterfeit controls specifically assessed?
  • Ask: "How do you verify a supplier’s anti-counterfeit claims?"
• Contract Clauses:

  Ensure penalties for counterfeits, traceability requirements, and rights to audit.

C. Operational Controls

• Traceability:
  • Verify serialization (e.g., GS1 standards), batch tracking, and digital records.
  • Test: Can you trace a component back to its origin?
• Testing & Verification:
  • Inspect testing protocols:
    • Physical checks (e.g., holograms, microprinting).
    • Lab testing (e.g., material composition analysis).
  • Review equipment calibration records.
• Inventory Controls:

  Check segregation of high-risk materials, secure storage, and access logs.

D. Training & Awareness

• Interview staff:
  • "How do you identify counterfeits?"
  • "What do you do if you suspect a fake?"
• Verify training frequency and competency assessments.

E. Incident Management

• Review past incidents:
  • Root cause analysis, corrective actions, communication to stakeholders.
  • Test recall procedures: Can you simulate a traceability drill?

Phase 3: Post-Audit Reporting & Follow-Up

1. Document Findings

   • Rate controls as: Effective, Partially Effective, or Ineffective.
   • Highlight critical gaps (e.g., "No verification of Tier 2 suppliers").

2. Recommendations

   • Short-term: Immediate fixes (e.g., enhance testing protocols).
   • Long-term: Program improvements (e.g., implement blockchain for traceability).

3. Verify Corrective Actions

   Schedule follow-up audits to ensure fixes are implemented.

Key Red Flags During Audit

Tools & Standards to Reference

• Frameworks: ISO 28000 (Supply Chain Security), IFSQN (Food/Pharma), AICPA SOC 2.
• Tech: Use QR/RFID scanners to test traceability; digital platforms (e.g., SAP Ariba) for supplier management.
• Guidelines: FDA’s Anti-Counterfeit Guidance, EU Falsified Medicines Directive (FMD).

Example Audit Checklist Snippet

**Risk Assessment**  
   - [ ] Annual review conducted?  
   - [ ] High-risk suppliers identified?  
2. **Supplier Audits**  
   - [ ] Anti-counterfeit controls assessed?  
   - [ ] Tier 2 suppliers verified?  
3. **Traceability**  
   - [ ] Batch/lot tracking functional?  
   - [ ] Digital records accessible?  

Final Tip: Combine desk reviews with surprise on-site checks (e.g., unannounced testing of incoming materials) to uncover hidden vulnerabilities. A robust audit not only identifies risks but also drives collaboration with suppliers to strengthen the entire ecosystem.