Supplier Vetting for Clothing Brands: The 2027 Framework

Supplier vetting is the process of verifying that a factory is what it says it is, can make what you need, and will not hand your order to someone else. It sits between finding a factory and placing an order, and it goes wrong most often when a brand lets a certificate make the judgement for it.

The volume of audit findings shows why paperwork alone is not enough. Sedex reports 67,000 SMETA audits carried out in 2025 and 250,000 SMETA non-compliances closed in the same year (Sedex). Those are problems that were found and fixed, so they say nothing about the ones an auditor never saw.

This guide covers what to check, in what order, what each check actually proves, and where audit paperwork stops being useful. It works for any factory in any country. Where it mentions how our own group is documented, it repeats only what we publish on this site.

---

What Does Supplier Vetting Actually Mean?

Supplier vetting means establishing four things: that the company legally exists, that it owns or controls the production it claims, that it can make your specific product at your volume, and that it will not move your order somewhere you haven't approved. Everything else is detail.

Those four are not equally hard. Legal existence takes about ten minutes in a commercial register. Production control takes a video call. Capability takes a sample. Subcontracting is the difficult one, because it can change after every other check has passed, and a garment made in a facility you never approved carries risks you never priced.

Notice what's missing from that list: sustainability claims. Certifications matter commercially, and buyers ask for them, but they're a separate exercise from establishing whether a factory is real and capable. A brand that opens with certification questions can end up with a tidy folder of PDFs and no idea whether the factory has ever made its product.

It also helps to separate misconduct from fit. A factory can be honest, legal and well run, and still be wrong for your garment. A knitwear specialist will not become a good outerwear factory because it passed an audit. Vetting that only looks for bad actors misses the more ordinary failure, which is an order placed with a capable factory built for something else.

The difference between vetting and auditing

Vetting is your decision. An audit is one piece of evidence that may feed into it, produced by someone else, for a purpose that may not be yours. A SMETA audit, for example, always covers labour standards and health and safety, and the 4-pillar version adds environment and business ethics (Sedex). Those are important questions. Whether the factory can hit your tolerances on a 320 GSM French terry hoodie is not one of them.

---

Why Do Social Audits Miss So Much?

Because audits are scheduled, document-led and can be gamed. Transparentem, which investigates apparel supply chains, describes audit deception as a pervasive problem. It lists falsified documents, workers coached to lie and hidden workers as common tactics, and reports evidence of deception at most worksites in the investigations it has disclosed since 2019 (Transparentem). Its project covers apparel in India, Malaysia and Myanmar, so read it as evidence about how audits can fail, not as a finding about every country.

A July 2026 report from Labour Behind the Label points the same way. Based on interviews with 255 garment workers across eight supplier factories in Pakistan, plus conversations with auditors, it describes suppliers creating and manipulating evidence, coaching and threatening workers, and choosing audit firms they expect to be favourable. Auditors also said worker testimony is often left out because findings need documentary backing (Labour Behind the Label).

The most serious example is older. The Ali Enterprises factory in Pakistan, where more than 250 workers were killed in a fire on 11 September 2012, had been certified as compliant with international social standards only weeks earlier (Clean Clothes Campaign).

None of that is an argument against audits. It's an argument against treating an audit report as the end of the enquiry. Sedex itself describes SMETA as a continuous improvement methodology rather than a certification (Sedex), and a SMETA report is valid for 24 months from its date of issue under the 2025 Sedex guideline (Eurofins). A report you read today can describe a factory as it was almost two years ago. If your real question is "will my 300 hoodies be made here", the report does not answer it.

Audit fatigue and what it produces

There is a second problem: repetition. The International Trade Centre's 2024 report on audit fatigue in garments and textiles (ITC) found that facilities still take several social audits a year. Among facilities using the Converged Assessment Framework, the average fell from 3.1 in 2021 to 2.7 in 2023 (The Financial Express). That is progress, and it still means staff at a typical facility preparing for an audit two or three times a year.

The practical point for a small brand: a factory can be heavily audited and still be a poor fit for your order. Audit count tells you who the factory sells to. It tells you little about your product.

Citation capsule: Transparentem describes audit deception as a pervasive problem in apparel supply chains, including falsified documents, coached workers and hidden workers (Transparentem). A social audit therefore establishes what an auditor observed at one address on particular dates. It does not establish where a specific order will be produced, which is why subcontracting has to be verified separately.

---

Does the EU Actually Require You to Vet Suppliers?

Not through the due diligence directive, if you're an emerging brand, and a lot of sourcing advice is now out of date on this. The EU's Omnibus I Directive (EU) 2026/470 entered into force on 18 March 2026. It narrowed the Corporate Sustainability Due Diligence Directive to companies with on average more than 5,000 employees and more than €1.5 billion net worldwide turnover. Member States must transpose it by 26 July 2028, and the changes take effect from 26 July 2029 (DLA Piper).

A brand doing €2 million a year is nowhere near that threshold. There is a side effect worth planning for, though. If you sell wholesale to a large retailer, expect its questions to reach you through the commercial relationship. The revised directive limits information requests to smaller business partners to what is necessary and proportionate, with particular reference to partners under 5,000 employees (CMS). Limited does not mean none.

The Forced Labour Regulation is different

The rule small brands should watch is Regulation (EU) 2024/3015, which applies from 14 December 2027. Mayer Brown describes it as applying to any natural or legal person placing, making available or exporting products on or from the EU market, with manufacturers, importers, distributors and online platforms as examples. That description carries no employee or turnover threshold. Authorities can ban a product from the market and order its withdrawal and disposal (Mayer Brown).

It does not create new due diligence obligations, according to the same analysis, but operators who can show effective due diligence are likely to face lower investigation risk. So a written record of your checks is worth keeping, however small you are. Take legal advice on your own position. This section is a summary and not legal advice.

What that means for an emerging brand

The main reason to vet is still commercial. If you're producing 300 units and your factory subcontracts them to a facility you've never seen, the likely outcome is garments you can't sell on a timeline you can't recover. Our red flags guide sets out what happens next: 30 to 50% deposits are normal in Portugal, and getting one back depends heavily on what your contract says. Vet because a bad placement can cost you a season.

---

What Does the Audit Data Say About Pass Rates?

Public pass-rate data is rare, which is why Fast Retailing's disclosure is useful. During fiscal 2025 the company commenced production with 65 of 76 potential new production partners that underwent pre-production audits, including two that failed an initial audit and were cleared once a follow-up audit confirmed corrections (Fast Retailing).

So 11 of 76, about one in seven, did not start production that year. Read that with care: the page does not say why each of the 11 stayed out, so it is not a clean failure rate. What it does show is that a buyer with a mature audit programme does not assume a candidate will clear. A small brand running no checks has less information and less leverage, not more safety.

How to read the numbers

The same page shows that existing suppliers need watching too. Fast Retailing reports that 28 sewing factories received an E rating in fiscal 2025, its grade for serious human rights risks, and that three of them were terminated. Unauthorised subcontracting is listed among the E-rated issues, and the company checks each year that garment factories use only authorised processing factories (Fast Retailing). Note what that implies: a company of that size treats subcontracting as a standing check, not a one-off question.

The Sedex figures need similar care. Closed non-compliances are problems that were raised and resolved, so a large number is not proof that factories are getting worse. What it does establish is that findings are routine rather than exceptional. A clean-sounding "we've been audited" is the start of a conversation, and the useful reply is to ask for the report.

For scale on the improvement side, the ILO and IFC's Better Work programme reports 2,250 factories and 3.7 million workers (Better Work). Coverage like that is meaningful, but it only tells you something about a factory that is actually in the programme.

---

Which Checks Should You Run First?

Run the cheap checks first. Company registration, a live video walk of the floor and a named production contact cost little more than an hour, and they stop you spending sample money on a factory you would have ruled out anyway. There is no published study ranking these checks by how many bad factories they catch, so treat the order below as our recommendation, not a measurement.

#	Check	What it proves	Cost	Time
1	Company registration and VAT number	The legal entity exists and the number is active	Free	About 10 min
2	Live video walk of the production floor	They can show you a working facility, today	Free	30-60 min
3	Named production contact, not a sales inbox	You can reach someone who runs the line	Free	An email
4	Machine list against your product	They say they have the equipment for your garment	Free	An email
5	Reference calls in your category	Someone else has received this product from them	Free	2-3 days
6	Written subcontracting answer	Where your order may and may not go	Free	An email
7	Certificate lookup at the issuer	The certificate is listed and covers this company	Free	Under 5 min each
8	Paid proto sample to spec	They can work from your tech pack	€150-€400	7-14 days
9	Third-party social audit report	Conditions on the audited dates	Per man-day, get quotes	2-5 man-days on site
10	Factory visit	Everything above, confirmed in person	€600-€1,200 for two days	1 day on site

Times for checks 1, 2, 5, 7 and 10 from our red flags guide. Sample cost for a moderate-complexity style in Portugal from how to order a clothing sample, sample time and trip cost from how to find a clothing manufacturer. Audit man-days are a typical SMETA range from Eurofins, which says rates vary by location and provider.

How to check the company exists

Ask for the full legal name, address and tax number in the first email. Then check them yourself instead of relying on what the factory sends back:

• EU company search. The European e-Justice portal links the business registers of all EU countries and lets you search across them.
• EU VAT number. The European Commission's VIES tool checks a number against the national VAT records of the issuing country. It only reads those records, so treat it as one signal and not as proof on its own.
• Facility location. Open Supply Hub is free to search and maps more than 2.5 million production locations. Being absent proves nothing, but an entry can show who else has disclosed the site.

Then compare the three names you end up with: the one in the register, the one on the quote and the one that will go on the invoice. They should be the same legal entity, or the factory should be able to explain clearly why not.

Verify certificates at the issuing body

Verify certificates at the issuer, not from the PDF. A PDF proves a document exists. A register entry shows it is listed for that company.

• OEKO-TEX: enter the label number in Label Check. The numbers are case sensitive, and OEKO-TEX also publishes a list of withdrawn certificates and labels. More in our OEKO-TEX Standard 100 guide.
• GOTS: the certified suppliers database shows each entity's location, fields of operation and certified products. GOTS notes that certification bodies are still updating entries, so if one is missing, ask the certification body before you conclude anything.
• SMETA: there is no certificate to look up, because SMETA is not a certification. Reports sit on the Sedex membership platform, so ask the factory to share the report itself, and read the findings and date.

Also check scope. Our red flags guide notes that many GOTS certificates cover specific lines, not the whole factory, so ask which products and fabrics are covered and when the certificate expires.

Citation capsule: During fiscal 2025 Fast Retailing commenced production with 65 of 76 potential new production partners that underwent pre-production audits, and two of the 65 cleared only after a follow-up audit confirmed corrections (Fast Retailing). The company also lists unauthorised subcontracting among its most serious audit issues and checks it annually.

---

What Should You Get in Writing on Subcontracting?

Get the production site, every subcontracted step and an approval rule in writing before you pay a deposit. Subcontracting itself is not the problem. It is common in Portugal, where many small factories send knitting, embroidery, washing or finishing to specialist facilities, and that can be a perfectly good way to make a garment. The risk is the step you were never told about.

Fast Retailing's rules are a useful model, scaled down. Its code prohibits production at unauthorised subcontractors, garment factories must get its approval for the processing factories they use, and it checks this every year (Fast Retailing). A brand ordering 300 pieces cannot run that programme. It can still ask for the same answers:

1. The site. The address where cutting and sewing for this order will happen.
2. The specialist steps. Which steps, if any, go elsewhere, such as printing, embroidery or washing, and to whom.
3. The approval rule. Any new subcontractor or site needs your written approval first, including when capacity runs short at peak season.
4. The responsibility. The main factory remains responsible for quality on every step, wherever it happens.

Put those four lines in the purchase order or contract. A factory that answers them plainly has told you a lot. One that says subcontracting never happens at all, and then quotes a wash finish it has no equipment for, has told you more. Check the answer against the video walk: if you saw no embroidery heads or wash room, those steps are going somewhere.

---

How Do You Vet a Factory Without an Audit Budget?

Checks one to eight in the table cost you a sample fee and a few hours of your own time, spread over a couple of weeks. That gets you most of the way for a first production run.

What you give up by skipping a third-party audit is independent evidence on working conditions and wage records. That's a real gap and you shouldn't pretend otherwise to your customers. Don't claim your supply chain is "audited" or "ethical" on the strength of a video call. What you do keep is most of what determines whether the order arrives correct and on time.

Specificity substitutes for budget

The substitute for an audit budget is specificity. A factory that answers "what's your minimum for a 320 GSM French terry hoodie in three colourways, and which machine runs the flatlock" with precise numbers is telling you more than a certificate does. A factory that answers vaguely, or sends a generic capability deck, has told you something too.

Three questions that separate operators from intermediaries:

1. "Which of these styles would you decline, and why?" A factory with a clear specialism has an answer. A seller who accepts everything may not be the one making it.
2. "If this ran late, what's the first thing you'd tell me?" People who run a line tend to name a specific bottleneck.
3. "Can I speak to whoever will run this on the floor?" You will learn a lot from how this request is handled.

How to run the video walk

Don't accept a pre-recorded tour. Ask for a live call during working hours, and ask the person holding the phone to walk from cutting to sewing to finishing without stopping. Ask how many machines run your fabric and where fabric inspection happens. Ask to see work in progress with the labels covered, if the factory needs to protect its clients. Record the call if the factory agrees, so you have a dated record for your own file.

How to use a reference call

References work best when you ask for facts rather than opinions. Ask what the brand ordered and in what quantity, whether the first sample was close, how late the delivery was and what happened when something went wrong. A factory may reasonably hold back some client names under confidentiality, so ask for one or two in your category and not its whole client list. A complete refusal is the signal to take seriously.

---

What Does Vetting Cost and How Long Does It Take?

In Portugal, budget €150 to €400 for a proto sample of a moderate-complexity style, and about three to six weeks from first sample to pre-production sample. Our sampling timeline adds up to 20 to 38 days: 7 to 14 for the proto, 3 to 7 for your review, 5 to 10 for the revision and 5 to 7 for the pre-production sample. A full three-stage sampling cycle runs €470 to €1,250 per style, as set out in how to order a clothing sample.

Audit pricing is harder to pin down, so we are not quoting a band here. Eurofins puts a SMETA audit at two to five man-days on average, depending on workers, buildings and site area, and says the fee is a per man-day rate that varies by location and provider (Eurofins). Get written quotes from several providers. If you can't travel for the first run, a third-party inspection in Portugal runs roughly €150 to €400 per day, covered in our quality control guide.

The timeline is the part brands underestimate. Reference calls take days because other brands answer slowly, and samples queue behind production. Run the checks in parallel, not in sequence, so vetting does not eat your development calendar.

One scheduling trap specific to Portugal: most factories close for two to three weeks in August, and capacity drops across July and August, as our lead times guide explains. A vetting cycle that crosses early August effectively pauses. If you're planning an autumn or winter launch, start well before summer, and don't fix a launch date until a factory has passed your checks.

---

What Are the Red Flags That End a Conversation?

Some findings warrant a question. Others end the conversation, and knowing the difference saves weeks. We would treat these as disqualifying rather than negotiable.

• No company registration you can independently confirm. Nothing else matters until this clears.
• Refusal of a live video walk. It takes under an hour and a phone. A factory that only offers "come and visit" is using travel cost as a barrier.
• No written answer on subcontracting. Verbal assurances on this are hard to enforce.
• A certificate that doesn't appear with its issuer. It may be expired, withdrawn or someone else's. Ask once, and check with the issuer.
• Pricing far below every other quote. Someone is absorbing a cost you can't see.
• A request for 100% payment up front. In Portugal, 30 to 50% as a deposit with the balance against shipping documents or after final QC is the normal pattern.
• A different company name on the invoice than on the contract. Ask once. If it isn't resolved cleanly, stop.

The pricing one causes the most arguments, so here's the reasoning. A quote well below the rest of your shortlist means either a subsidy you don't understand, a quality shortcut you haven't been told about, or an order headed for a cheaper facility. It may also just mean the factory misread your spec. None of those is good news, and they tend to show up after you've paid the deposit. You can pressure-test a quote against our garment cost calculator and clothing manufacturing costs in Portugal.

---

How Does Portugal Change the Vetting Calculus?

Portugal shortens some of the list rather than all of it. Company details can be checked through the EU tools above and the Portuguese commercial register. A factory visit is practical, because the country is reachable from any major EU city in under four hours. EU and Portuguese labour law applies, including a national minimum wage of €920 a month in 2026 on the mainland, which gives you a floor to reason from when a quote looks impossible. A law applying does not prove a given factory follows it, so the checks still matter.

What Portugal does not solve

What Portugal doesn't solve is capability fit. The northern cluster has factories built for very different products. A knitwear specialist in Guimarães can be excellent and still entirely wrong for your technical outerwear brief. It doesn't remove the subcontracting question either, because using specialist facilities for some steps is common here. Ask the same four questions you would ask anywhere.

How our group is documented

So you can compare, here is what we publish about our own group. Each factory is documented from Portuguese company registries, ATP membership records, trade fair rosters and public certification bodies, including CAE, NIF and ATP membership. A subset of 25 holds current social-audit certificates on file (SMETA, BSCI, SA8000 or equivalent) and is flagged as verified, with certificate expiry dates tracked. Contact data, minimums and certifications are re-validated every quarter. The details are on our factory directory page.

That is documentation, and it has limits like everything else in this guide. It doesn't replace a sample of your own garment or a written answer on where your order will be made.

Citation capsule: Vetting a factory inside the EU changes some steps but removes none of them. Company details can be checked through EU registers and a visit is practical, but specialist subcontracting remains common in Portugal and capability fit still has to be tested with a sample of your own garment. EU labour law applying to a factory does not prove that factory follows it.

---

Frequently Asked Questions

What's the difference between supplier vetting and a factory audit?

Vetting is the whole decision: legal existence, production control, capability and subcontracting. An audit is one input into it, covering conditions at one site on particular dates. Fast Retailing started production with 65 of 76 audited candidates in fiscal 2025, which shows an audit is a filter and not a verdict.

How long does supplier vetting take?

About three to six weeks for a first production run if you run the steps in parallel. Sampling from proto to pre-production takes roughly 20 to 38 days, and reference calls take two or three days. A third-party audit is extra and depends on the auditor's availability. Running the steps one after another can stretch the calendar.

Do I legally have to vet my suppliers?

The EU due diligence directive does not reach most emerging brands: since Omnibus I it covers companies with more than 5,000 employees and more than €1.5 billion turnover. The Forced Labour Regulation, applying from 14 December 2027, bans forced-labour products from the EU market and is described without a size threshold. It creates no new due diligence duty, but records help. Take legal advice on your own case.

Can I trust a factory's certificates?

Only after you've checked them with the issuer. OEKO-TEX has Label Check and GOTS has a certified suppliers database. SMETA is not a certification, so ask for the audit report instead. A PDF confirms a document exists, not that it's current or belongs to that site, and the lookup takes only minutes.

What's the riskiest thing to leave unchecked?

Unauthorised subcontracting, because a social audit of one site says nothing about where your order will actually be made. Fast Retailing lists it among its most serious issues and checks it every year. Ask for the site, the specialist steps and an approval rule in writing.

How much should supplier vetting cost?

A proto sample in Portugal runs about €150 to €400 for a moderate-complexity style, and most of the other checks are free. A two-day factory trip runs about €600 to €1,200. A SMETA audit is typically priced per man-day over two to five man-days, with rates varying by location and provider, so get written quotes.

---

What to Do With This

Vetting is cheap at the start and expensive at the end. The first checks are free, and the costs tend to appear only when a step gets skipped and shows up as a late, wrong or unsellable delivery.

Three things to take away. Run the free checks before you spend anything on samples. Look up every certificate with its issuer rather than trusting a PDF. And get the subcontracting answer in writing, since no audit report answers it for your order. Keep a dated record of each check, too, with December 2027 in mind.

If you're still assembling a shortlist, how to find a clothing manufacturer covers the stage before this one. If you've got a factory and you're pricing the run, clothing manufacturing costs in Portugal has the cost bands.

---

Sources

• Sedex, SMETA audit: 67,000 audits and 250,000 non-compliances closed in 2025, 2-pillar and 4-pillar scope, not a certification.
• Fast Retailing, production partner monitoring: 65 of 76 pre-production candidates in fiscal 2025, two cleared on follow-up, 28 E ratings and three terminations, rules on unauthorised subcontracting.
• Transparentem, Hidden Harm: audit deception tactics and prevalence in its disclosed investigations.
• Labour Behind the Label, Silenced (23 July 2026): interviews with 255 workers across eight supplier factories in Pakistan, and auditors' accounts.
• Clean Clothes Campaign: the Ali Enterprises fire and the certification weeks before it.
• International Trade Centre, Audit Fatigue in the Garment and Textile Industry (2024), figures as reported by The Financial Express.
• Eurofins, SMETA audit FAQs: man-days, per man-day pricing, 24-month report validity.
• ILO and IFC Better Work: 2,250 factories and 3.7 million workers, undated on the page.
• Directive (EU) 2026/470, with DLA Piper and CMS: thresholds, dates and limits on information requests.
• Regulation (EU) 2024/3015, with Mayer Brown: scope, application date and consequences.
• VIES, European e-Justice business registers, Open Supply Hub, OEKO-TEX Label Check and GOTS certified suppliers: verification tools.
• Renascença: Portuguese national minimum wage for 2026.
• Portugal Clothing Factory: directory methodology for how our group is documented, and the linked PCF guides for sample costs, sample timing, check times, deposits, inspection costs and the August closure.

---

Written by João Oliveira, Brands Manager at Portugal Clothing Factory.