How to
How to pass a procurement audit — merch compliance in Mexico
A working checklist for corporate procurement teams in Mexico City, Monterrey and Guadalajara: the documents auditors actually ask for, how to structure the procurement file, and the gaps that turn a routine review into a 90-day observation letter.
What a procurement audit actually checks on a merch program
A procurement audit on a corporate merch program is not a quality inspection and it is not a brand review. It is a documentation audit. The auditor — internal or external — is checking whether the file behind a purchase order can be reconstructed six, twelve or twenty-four months after the fact, without interviews and without recourse to the original buyer. Three things have to be reconstructible: the decision to buy, the decision to pay, and the decision that what was paid for is what was actually received.
In Mexico, the documentation layer that matters most is the CFDI 4.0 trail. Every merch invoice, every prepayment, every credit note (nota de crédito) and every complementary CFDI for a partial delivery carries a UUID that must match the underlying purchase order and the receiving log. SAT's own audit tooling cross-references UUIDs at line-item level, and any mismatch between what was billed and what was received is an open observation.
The other layer that matters is traceability of the goods themselves. For textile merch, NOM-050-SCFI requires fiber-composition labels in Spanish, with country of origin, care instructions and lot identifier on every unit or master polybag. For hard goods, NOM-024 governs the foreign trade documents; for electronics, NOM-003 and NOM-001 cover safety and labelling. If the merch program touches any of these categories, the audit file has to include the corresponding certificate or test report.
The third layer is the people layer: a documented approval chain. Even on a perfectly executed PO, an auditor will ask who approved the supplier, who approved the price, who signed the strike-off and who signed the receipt of goods. Without a clear chain, the file is technically complete but procedurally fragile.
The 7 steps that get a merch file through audit
- Build the supplier file before the first PO. Capture the supplier's acta constitutiva, RFC, opinión de cumplimiento 32-D (positive, no older than 30 days), bank account CLABE on the supplier's letterhead, ISO 9001 certificate if claimed, and at least three verifiable references. The audit almost always asks for these, and asking for them after the fact slows the close-out.
- Issue a written RFQ with technical brief. A quotation request that includes the artwork file, Pantone references, materials, quantities, delivery window and required certifications creates the documentary trail that justifies the supplier choice. The auditor needs to see at least three competing quotes for purchases above the internal threshold.
- Generate the CFDI 4.0 at the right moment. The merch CFDI should be issued at the moment of physical delivery or service completion, not earlier and not later. For partial deliveries, the supplier issues a CFDI for the partial and a complementary one at the close-out. For foreign-trade purchases, the CFDI is paired with a pedimento.
- Match the receiving log to the CFDI line items. Maintain a receiving log that lists every carton, its count, the date it arrived, who received it and any visible damage. Reconcile the receiving log against the CFDI line items at the close of each delivery. Mismatches are how 3% of an order ends up "missing" in the file.
- File the strike-off sign-off in the same folder. The strike-off email with the APPROVED, APPROVED WITH NOTES or REJECTED reply lives next to the PO and the CFDI. If the strike-off was waived (which it should not be), document the waiver and the approver. An audit with no strike-off record for a custom program is a red flag.
- Capture compliance evidence by category. For textiles: NOM-050 label photograph on finished goods. For electronics: NOM-003 certificate and the importer's Registro Federal de Consumidores. For food and beverage: COFEPRIS notification and expiration-date traceability. For cross-border: pedimento, commercial invoice, packing list and, where applicable, the ATA Carnet.
- Close the file with a lessons-learned note. A one-page memo describing what worked, what slipped and the corrective action for the next program. Auditors read these. They are the cheapest way to demonstrate that the procurement function is improving quarter over quarter.
What changes when the audit is from SAT, not internal
An SAT (Servicio de Administración Tributaria) audit on a merch program is not the same as an internal procurement review. SAT will ask for the CFDI file at line-item level, will check that the IVA was correctly transferred, will check that the IEPS (where applicable on certain beverages or sugar-sweetened products) was calculated correctly, and will compare the declared customs value against the pedimento and the commercial invoice. The penalty for a mismatch is not a memo: it is a determined contribution (determinación de contribuciones), plus inflation and surcharges, plus the possibility of an outright criminal referral under Article 69 of the Federal Tax Code if the amounts are material.
For programs above roughly MXN 2,000,000 in annual merch spend, a formal opinion (dictamen) by a registered public accountant is often the right move. The dictamen does not prevent an audit, but it changes the procedural posture and frequently reduces the depth of the SAT visit when one occurs.
For the merchant supplier side, the equivalent preparation is the same — keep CFDI files, reconcile receiving logs, archive strike-offs, hold opinions de cumplimiento current, and answer the auditor's questions in writing with the underlying file attached. Audits are won or lost on the documentation file, not on the relationship with the auditor.
Common gaps that turn audits into findings
The first gap is a supplier file that is missing the 32-D opinion or has one that expired during the program. The 32-D opinión de cumplimiento must be positive and recent — generally under 30 days old — at every invoicing moment, not just at the start of the relationship.
The second gap is a PO with three competing quotes that are all from the same supplier under different trade names. The auditor will see through this immediately. Three real quotes means three different RFCs, three different supplier files and three real price points.
The third gap is missing or partial receiving logs. The CFDI says 1,000 units, the receiving log shows 980 and there is no nota de crédito for the 20. That is a finding waiting to happen. Either reconcile the receiving log to the CFDI or issue the credit note before the auditor asks for it.
The fourth gap is a strike-off file that lives in someone's inbox. The strike-off email, the reply, the photos and the Pantone chip comparison all need to be in the procurement folder, with the PO number in the file name. An inbox is not an audit folder.
The fifth gap is treating the audit as a one-time event. Audits are continuous. The most efficient programs run a monthly self-audit using this same checklist, so when the formal audit arrives the file is already clean.
Tools, references and templates
Reference documents: NOM-050-SCFI for textile labelling; NOM-024 for foreign trade; NOM-003 for electronics safety; ISO 9001 for supplier QMS; ISO 14001 for environmental management; ISO 26000 for social responsibility guidance.
SAT tools: the SAT portal's "Verificación de CFDI" for UUID-level validation; the 32-D opinión de cumplimiento download; the "Visor de nómina" for any staff involved in merch gifting that crosses compensation thresholds.
Recommended templates: a supplier master-file template, an RFQ template with technical brief, a receiving log template aligned to CFDI line items, a strike-off sign-off template, and a one-page lessons-learned memo template.
External support: for SAT-facing work, a registered public accountant (despacho contable registrado) with experience in merch, eventos and trade-show spend; for NOM work, an authorised test laboratory (OCPs Organismos de Certificación de Producto); for customs work, an agencia aduanal.
Suggested audit cadence: monthly self-audit on programs above MXN 500,000; quarterly internal audit; annual external audit on programs above MXN 5,000,000. The cadence is set by the spend, not by calendar.