Social Compliance Audits for B2B Buyers: BSCI vs SMETA vs SA8000, and How to Read an Audit Report That's Hiding Something

Q: What is the difference between BSCI, SMETA, and SA8000?

They are three competing social audit frameworks. BSCI (amfori) is the most common in China and Southeast Asia and produces a grade from A to E. SMETA is the Sedex audit, widely accepted by UK and EU retailers and built around the ETI Base Code. SA8000 is a certification, not just an audit: the factory must build a permanent management system and gets a three-year certificate. WRAP is a US-focused standard common in apparel. Pick based on what your buyer actually accepts, not which looks most impressive.

Q: How much does a social compliance audit cost and who pays?

A single-day BSCI or SMETA audit typically runs US$800 to US$2,000 depending on factory size and location, and the factory usually pays. That cost arrangement is exactly why reports can be optimistic: the audited party is the paying customer of the audit firm. For high-risk orders, consider commissioning your own audit or an unannounced follow-up so the money is not a conflict of interest.

Q: What are the red flags in a social audit report?

A missing or heavily redacted finding section, an audit scope that excludes dormitories or a second production building, wages listed only as a range instead of payslips, and a certificate valid for exactly one year with no mid-cycle surveillance. Also watch for an auditor name that appears on many reports from the same factory, which suggests a long-running relationship rather than independent verification.

A Perfect Report and a Factory That Wasn't

A distributor we work with bought from a Guangdong garment factory for two years. The BSCI report came back every year with a solid B grade. Overtime looked reasonable, wages were listed, the dormitory photos were clean. Then a retail client ran an unannounced SMETA audit of their own and found 60-hour weeks, two sets of pay records, and a fire exit that had been unblocked just for the announced visit.

Nothing about the original report was forged. It was simply a picture of the factory on its best day, taken after three weeks of preparation. That's the thing about social audits: the report is a real document. The question is whether it describes the factory you'll actually be buying from in month two.

The Four Standards Buyers Actually Use

BSCI, SMETA, SA8000, and WRAP all look similar from the outside. They are not interchangeable, and picking the wrong one wastes money or leaves you holding a certificate your customer won't accept.

Social Audit Standards Compared

Standard	Governance	Type	Result Format	Best Known In
BSCI (amfori)	amfori (EU/global)	Audit + grading	Grade A-E	China, EU retail
SMETA	Sedex	Audit	Findings report	UK/EU retail, grocery
SA8000	SAI	Certification	3-year certificate	US/EU brand programs
WRAP	WRAP (US)	Certification	Certificate levels	US apparel

The practical difference is between an audit and a certification. BSCI and SMETA are point-in-time audits: someone checks the factory on a given day. SA8000 and WRAP are certifications that require the factory to build an ongoing management system and get re-verified. An audit tells you how the factory looked on one day; a certification tells you it has a system designed to keep conditions legal every day.

Announced, Semi-Announced, Unannounced

The single biggest lever on audit quality is how much notice the factory gets. This is where a report earns or loses its credibility.

Audit Notice Windows

Type	Notice	What It Actually Measures	Reliability
Announced	2-4 weeks	Factory's ability to prepare	Low
Semi-announced	1-2 weeks	Partial preparation	Medium
Unannounced	None	Everyday conditions	High

Most BSCI and SMETA audits in China are still announced, because the factory commissions them and the factory schedules them. If you're buying anything with meaningful volume or reputational exposure, push for at least semi-announced, and budget for your own unannounced check on high-risk categories.

Reading the Report for What's Missing

You don't need to be an auditor to catch a weak report. Most red flags are about what's not there, not what's written.

Scope. Does the audit cover every building on the site, including the dormitory and any satellite workshop? A report that only covers the main hall is telling you it didn't look at the rest.
Wages. Real reports cite payslip samples and overtime records. A report that lists only a wage range without payroll data hasn't verified payment.
Findings section. A genuinely perfect factory is rare. A report with zero findings, or a findings section that's heavily redacted, is more suspicious than one with minor findings honestly listed.
Validity window. A certificate valid for exactly one year with no mid-cycle surveillance is a point-in-time snapshot being sold as ongoing compliance.
Auditor. If the same auditor name appears across multiple years and multiple factories owned by the same group, you're looking at a long-term relationship, not independent verification.

Cost and Who Pays

A one-day BSCI or SMETA audit runs roughly US$800 to US$2,000 depending on factory size and location, and the factory typically pays. That cost structure is worth sitting with for a second: the audited party is the audit firm's paying customer. It's not proof of fraud, but it's a structural reason reports skew optimistic. For high-value or high-risk orders, the money you spend on your own unannounced audit is the cheapest insurance you'll buy all year.

Common Questions from Buyers

What is the difference between BSCI, SMETA, and SA8000?

BSCI produces a grade from A to E and dominates China and Southeast Asia. SMETA is the Sedex audit, built on the ETI Base Code, and is widely accepted by UK and EU retailers. SA8000 is a certification with a three-year certificate and a permanent management system, not just a one-day check. WRAP is US-focused and common in apparel. Pick the one your buyer accepts.

Announced or unannounced audit, which is more reliable?

Unannounced, by a wide margin. An announced audit gives the factory two to four weeks to fix visible problems, move workers, and prepare answers. If a buyer only accepts announced audits, treat the report as the factory's best face and add your own spot checks.

How much does a social compliance audit cost and who pays?

A single-day BSCI or SMETA audit runs US$800 to US$2,000, and the factory usually pays. That's why reports can be optimistic: the audited party is the audit firm's customer. For high-risk orders, commission your own audit so the money isn't a conflict of interest.

What are the red flags in a social audit report?

A missing or redacted findings section, an audit scope that excludes dormitories or a second building, wages listed as a range without payslips, a one-year certificate with no surveillance, and the same auditor name across many reports from the same factory group.

Do I still need a social audit if my order is small?

It depends on the buyer, not the order size. EU retailers under the CSDDD and US brands under forced-labor rules increasingly require due-diligence evidence regardless of value. For small orders, a lighter SMETA or a supplier self-assessment plus your own video walkthrough covers the basics.

Audit the audit before you trust the report. Compare suppliers with verified compliance history on Compare2Best before your next order.

This article is produced by the Compare2Best knowledge team and reviewed by cross-border procurement and compliance professionals. Updated September 2026. Audit costs, standard names, and buyer requirements vary by region and change over time; this is general guidance, not legal or compliance advice.