Getting audit-ready for vendor prequalification

For a Nigerian supplier, prequalification is often the gate to the work that matters most: oil and gas service contracts, supply to banks and telecoms companies, or a place on a multinational’s approved vendor list. The documents requested vary a great deal, but the buyer’s underlying question is the same. Does this company run a management system that will hold up on our contract? This guide covers what buyers can ask for, which records to keep ready, and how to test yourself before they do.

What prequalification can ask for

There is no single national list. Each buyer, and often each tender, sets its own requirements, so treat the examples below as illustrations rather than rules.

Oil and gas. Upstream operators in Nigeria run much of their procurement through NipeX, which describes itself as the upstream industry platform for e-procurement, tendering and vendor management. A February 2026 prequalification notice from Shell Nigeria Exploration and Production Company (NipeX reference NIPEX.A.260212.0009) asked respondents, among other things, for:

• CAC registration documents and tax clearance for the past three years
• a valid ISO 9001 certificate from an approved registrar
• documentation of an HSSE management system implemented on major projects over the past ten years
• NOGIC JQS registration and other Nigerian Content documentation
• audited financial statements

By contrast, an NLNG notice for supply chain management services asked for NOGIC JQS registration but did not ask for ISO certificates. The lesson is to read each notice line by line.

NOGIC JQS. The Nigerian Oil and Gas Industry Content Joint Qualification System is an electronic platform of the Nigerian Content Development and Monitoring Board (NCDMB), created under the Nigerian Oil and Gas Industry Content Development Act 2010. It describes itself as an industry databank of capabilities and the sole system for Nigerian Content registration and prequalification of contractors in the industry. Its registration is separate from ISO certification.

Banks. The Central Bank of Nigeria’s 2024 risk-based cybersecurity framework for deposit money banks and payment service banks expects banks to manage third-party risk, and, as reported by Mondaq, lists ISO 27001 among examples of standards third-party providers may need to comply with, depending on the services they offer. Expect security questionnaires, and requests for evidence of how you protect data, if you supply IT or data services to a bank.

Data protection. Large data controllers that file compliance audit returns with the Nigeria Data Protection Commission are assessed on how they manage third-party processors. If you process personal data for such a customer, you can expect questions on that too. The guide on NDPA 2023 and ISO 27001 covers the overlap.

Multinationals generally apply their group supplier standards, which commonly combine a questionnaire, certificates and a supplier audit for higher-risk categories.

What a certificate does and does not prove

A certificate from an accredited certification body tells a buyer that an independent auditor found your system conforming on the days sampled. Buyers know its limits: the scope may not cover the activity they are buying, and the surveillance audit may be months away. That is why prequalification teams and supplier auditors look behind the certificate at your own records. Before submitting, check the certificate is current, that its scope covers the service tendered, and that it can be verified. The guide on ISO certification in Nigeria explains how buyers check accreditation.

The evidence to keep ready

Buyers’ supplier auditors look for records that show the system runs between certification audits. Keep these current, dated and easy to retrieve:

• Internal audit records. The programme, the reports, and the findings, covering every process in scope over the cycle.
• Remediation records. Findings, root cause analysis, actions, verification and effectiveness checks, with dates. A buyer will often pick one closed nonconformity and follow it end to end.
• Management review minutes. Showing that audit results, customer feedback, HSSE performance and objectives were reviewed and acted on.
• Certificates and their scope. Current ISO certificates, and the latest certification body report if the buyer asks.
• HSSE performance. Incident statistics, investigations and the actions taken, for oil and gas and construction buyers in particular.
• Competence records. Qualifications and training for the people named in your bid.
• Controlled documented information. Current policies and procedures with revision history.

Readiness checklist

Area	Ready when	Typical gap
Certificate	Current, verifiable, scope covers the tendered service	Scope written for head office only
Registrations	CAC, tax, NOGIC JQS (for oil and gas) and others named in the notice are current	Registration lapsed or product codes not categorised
Internal audit programme	Planned for the year; every process audited in the cycle	Audits bunched before the certification visit
Audit reports	Signed, dated, with evidence and findings	Checklists with ticks and no evidence
Corrective action	Each finding has a cause, an action, verification and an effectiveness check	Actions closed on the owner’s word
Management review	Held at planned intervals, inputs and outputs recorded	Minutes that list attendees and little else
HSSE system	Policy, risk assessments, incident records and investigations for recent projects	Records held by individual project managers
Data and security	Answers ready for security and data processing questionnaires	No named owner for questionnaires
Competence	Training and qualifications for named key staff	CVs without certificates

Running a pre-assessment internal audit

A pre-assessment is an internal audit run against the buyer’s likely criteria rather than only the standard. Done well, it gives you the same view the buyer’s auditor will have.

1. Collect the criteria. Use the actual prequalification notice or questionnaire if you have it, and the buyer’s supplier standards if published. Add the clauses of the standards you hold.
2. Choose an auditor who did not do the work. A colleague from another department, or an external auditor, finds more than the process owner will.
3. Sample as the buyer would. Pick a recent project similar to the one tendered. Trace one nonconformity from finding to verified closure. Pull the last management review and check its actions were done.
4. Grade honestly. Record gaps as findings with the same structure you would expect from a customer: requirement, audit evidence, statement. See writing audit findings.
5. Fix and verify. Raise corrective actions with owners and dates, then check them with a short follow-up audit before the submission or supplier audit.
6. Assemble the pack. Put the documents the notice names, in the order it names them, with a contents page. Missing or mislabelled documents can delay or end an application before anyone reads your evidence.

A worked example

Kestrel Metals, a fictional fabrication company, is preparing to respond to an operator’s prequalification for structural steel work. The quality manager, A. Mensah, asks R. Patel from the finance team, who has completed internal auditor training, to run the pre-assessment against the notice and ISO 9001.

R. Patel samples the most recent comparable project. The certificate scope covers fabrication at the main yard but not the second site where some of the work would be done. Two of five welders named in the draft bid have qualification certificates that expired during the year. One closed corrective action from the last internal audit, FND-0142, was closed on the owner’s confirmation with no evidence that the fix was checked. The HSSE incident register is complete, but the investigations for two near misses sit in a project manager’s email.

None of these would have stopped the bid on paper, but each is the kind of thing a supplier auditor finds in the first hour. Kestrel Metals asks its certification body about extending the scope, renews the welder qualifications, reopens FND-0142 for verification, and moves the near-miss investigations into the controlled register. A follow-up audit three weeks later confirms the changes.

In Orisynx, the audit type can be set as supplier, follow-up or internal, and each corrective action passes through verification before it can close, so the trail a buyer asks to follow is in one record.

Keeping ready all year

Prequalification windows can be short, and a rushed audit tends to find more than you can close in time. The organisations that respond well usually treat readiness as routine: an annual audit programme that covers every process, findings closed with evidence, management review held on schedule, and registrations renewed before they lapse. When the next notice appears, the work is assembling the pack, not creating the records.

It also helps to name one person who owns the prequalification pack and keeps a register of what each regular buyer has asked for in the past: which certificates, which registrations, which questionnaire versions and when each document expires. Reviewing that register quarterly, alongside the internal audit programme, shows gaps while there is still time to close them, and gives management review a clear view of the organisation’s readiness to bid. For the weeks before an external audit, see preparing for a certification audit.

Sources

• TenderDetail: Shell Nigeria Exploration and Production Company prequalification via NipeX, ref. NIPEX.A.260212.0009
• Africa Oil and Gas Report: NLNG calls for EOI and prequalification for supply chain management services
• NipeX
• NOGIC JQS
• Mondaq: Overview of the NOGICD Act 2010
• Mondaq: Overview of the CBN risk-based cybersecurity framework for DMBs and PSBs
• Templars: Data protection compliance in Nigeria, audit return obligations for 2026