The first step is understanding the goals and ensuring the proper risk management. Not all suppliers need to have a formal and/or on-site ‘audit’.