Comment by s0rce

Yes, you would also audit the quality system for your suppliers to confirm they are sufficiently controlling for upstream changes. In theory you can have all your ducks in a row.