BSCI, WRAP, SMETA or SA8000: which social audit does your buyer need?

Which social audit you need depends on your buyer: UK retailers usually ask for Sedex SMETA, EU retailers for amfori BSCI or SMETA, and US retailers for WRAP, while SA8000 is the most demanding of the four. Most retailers will not place an order with a Bangladeshi factory until they have seen a recent audit. The four overlap a lot, but they are not interchangeable: each buyer’s supplier manual names the one it accepts, and the audit must name the exact factory producing your order.

The four audits compared

Which one do you need?

• Selling to a UK retailer: usually SMETA, shared through the Sedex platform.
• Selling to an EU retailer: usually amfori BSCI if the retailer is an amfori member, otherwise SMETA.
• Selling to a US retailer: WRAP is the most common request, although many US brands also accept SMETA or their own audit.
• Selling direct to consumers: no audit is legally required, but a recent SMETA or BSCI report protects your brand and is often requested by marketplaces and wholesale partners later.

If a factory already holds one audit, ask your buyer whether they accept it before paying for another. The Social & Labor Convergence Program (SLCP) exists to reduce duplicate audits: one verified assessment that any buyer can use.

What an audit does and does not prove

An audit is a snapshot of the conditions and records on the audit days. It does not certify your product, and it does not cover a subcontractor or a sister unit at a different address. That is why the audit must name the exact site producing your order, and why buyers combine audits with factory visits and safety inspection records.

How to check an audit is real

• WRAP: search the facility on the certified-facilities list at wrapcompliance.org.
• amfori BSCI: ask for the amfori audit ID; amfori members can open the full report.
• SMETA: ask the factory to share its Sedex reference and report with your company on the Sedex platform.
• SA8000: check the list of certified facilities published by SAAS.

How audits are scored, and what a rating means

The four standards report results differently, and buyers often misread them. amfori BSCI rates a site from A to E across performance areas, so a C is not a pass or a fail but a picture with weak areas identified. How the 13 performance-area grades combine into one letter, and how long each grade counts, is in our BSCI audit ratings guide. WRAP issues a certificate of compliance: since 1 March 2026 a single annual certificate, after years of Silver, Gold and Platinum levels, so an old Platinum certificate you are shown is valid only to its printed expiry. SMETA produces a report with findings graded by severity and a corrective action plan, and no overall rating; the current version, SMETA 7.0, also grades the site’s management systems on a four-step scale. SA8000 is a certification against a management system, which is why it takes longer to achieve and is harder to hold.

Who pays, and how often

Who pays depends on the scheme. A WRAP facility pays both WRAP’s registration fee and the monitoring firm’s audit fee. amfori does not say who pays for a BSCI audit or what it should cost: the member and the supplier agree it between them, and practice varies. Each audit costs the site money and days of disruption, which is one reason factories resist holding four different ones. Audits also repeat on different clocks: WRAP every year; amfori BSCI within two years after a full audit rated A or B, with a follow-up 2 to 12 months after a C, D or E; SMETA yearly for a high-risk site and every two years for a medium-risk one, as Sedex recommends. If your buyer accepts an audit the factory already holds, the cost and the disruption both disappear, which is why asking before you commission a new audit is worth doing.

What changed in 2026: WRAP levels

For years a WRAP certificate came in three levels, Silver for six months, Gold for a year and Platinum for two, and a Platinum certificate was a selling point on a factory profile. On 1 March 2026 WRAP announced it would no longer issue two-year Platinum certificates and that certificates would no longer carry levels: a facility that passes now receives an annual Certification of Compliance, and remains subject to random, unannounced post-certification assessments during the year. Existing Platinum certificates stay valid to their printed expiry, so through 2027 you will still be shown Platinum certificates that are real; check the date, not the colour.

What a WRAP certificate costs comes in two parts. The first is WRAP’s registration fee, set by the number of workers and in force since 1 January 2024 (checked on 23 September 2026):

• 100 workers or fewer: US$650
• 101 to 200 workers: US$950
• 201 to 1,000 workers: US$1,350
• 1,001 workers or more: US$1,550

The second is the audit. The registration fee does not include it: the facility chooses one of WRAP’s accredited monitoring firms and pays that firm directly, at a price the firm sets. If the audit counts more workers than the application gave and that moves the facility into a higher band, WRAP can hold back the certificate until the correct fee is paid. WRAP certifies each production unit separately and does not certify brands or retailers, so a supplier that says its company is WRAP certified should be asked for the certificate of the unit making your goods. WRAP puts the time from application to certificate at 2 to 6 months, and as little as six weeks for a facility that is well prepared.

SMETA 7.0 and how old a SMETA report can be

As of 23 September 2026 the current version of SMETA is 7.0, which Sedex released in June 2024 and describes as the biggest overhaul since the audit was launched in 2004. Sedex calls SMETA a continuous improvement methodology rather than a certification. There is no certificate, no pass mark and no printed expiry date, so ‘SMETA certification’, a phrase still repeated on sourcing sites, can only mean an audit report.

How old a report can be

Sedex consulted members and other stakeholders from 24 February to 31 March 2025 and published its decisions in June 2025:

• 24 months is the outer limit. Sedex no longer accepts a SMETA audit as a robust assessment of current workplace conditions once it is more than 24 months old, and its guidance is that what an audit records holds good for up to two years. Older reports stay visible on the Sedex platform.
• How often depends on risk. Sedex recommends a yearly audit for a site its risk tools rate high risk and one every two years for a medium-risk site. Low-risk sites are left to the buyer, who may audit a sample of them, audit when needed or not audit at all.
• No automatic audit for new suppliers. A proposal that every new supplier on the platform be audited within 12 months was dropped after pushback from members.

So a 12-month validity is a buyer’s rule, not a Sedex rule. If your customer’s supplier manual sets a shorter window, that is the one your order has to meet, and the date to check it against is your shipment date, not the day you place the order.

Announced, semi-announced or unannounced

Sedex also considered removing announced SMETA audits in 2025 and decided against a ban. Its guidance now recommends semi-announced or unannounced audits unless there is a logistical or other valid reason for an announced one, the platform offers semi-announced by default when an audit is scheduled, and anyone booking an announced audit has to record why.

What a SMETA 7.0 report contains

Who can carry one out

Only Sedex’s approved Affiliate Audit Companies may run SMETA audits, and Sedex says other firms are not authorised to offer SMETA services; Sedex does not audit sites itself. The site must be a Sedex member with an active account for its report to be uploaded and shared. Reports are written in English, Spanish or Mandarin, and a report in any other language must also include English. To check the report you are sent, follow how to verify a factory certificate; to have your order placed with a factory that holds the audit your buyer requires, see our compliance and factory audits page.

What an audit day looks like in a Bangladeshi factory

The four standards share a shape. An opening meeting with management sets the scope and the site boundary. A document review follows: business licence, factory licence, wage records against the legal minimum of Tk 12,500 a month, time records, overtime, leave, age verification for young workers, and the fire and building safety records. A site walk checks exits, alarms, extinguishers, chemical storage, machine guarding, canteens, toilets and dormitories where they exist. Private worker interviews, chosen by the auditor rather than by management, test whether the records match the day. A closing meeting presents the findings, and a corrective action plan with dates follows. Announced, semi-announced and unannounced versions exist, and the report says which it was; an unannounced audit is worth more.

Common audit findings

• Working hours and overtime beyond the legal limit, especially in the months before a season ships, and time records that do not match production records.
• Wage calculations: overtime rates, grade classifications and deductions not matching the legal structure, even where the base wage is paid.
• Fire safety housekeeping: a blocked exit, a missing extinguisher inspection tag, a fire drill not recorded.
• Worker representation: a participation committee that exists on paper and has not met.
• Chemical storage and personal protective equipment in washing and printing sections.
• Subcontracting without disclosure, which no audit of the main site can see and which is why the factory named on your order must be the one producing it.

How to read a corrective action plan

The rating is the least useful line in the report. Read the corrective action plan: each finding, its severity, the action agreed, the date, and whether it was closed with evidence at a follow-up. A factory with a C rating and a closed plan is often a better bet than one with a B and an open plan, because the first has shown it fixes things. Two questions to ask of every plan: did the follow-up happen, and were the closures verified on site or accepted from photographs? amfori BSCI requires a follow-up audit between two and twelve months after a full audit rated C, D or E; a full audit rated A or B is valid for two years.

Preparing a factory for a first audit

If your buyer names an audit the factory does not hold, the factory pays for it and the lead time is real: booking the audit firm, preparing records and closing obvious gaps beforehand. The common preparation is a self-assessment against the standard, a check that wage and hour records will reconcile, a fire drill with a record, and a briefing so that workers know an auditor may interview them and that nothing is scripted. Before production we name the factory making your order in writing, with its address, certificates and audit reports, so that you can ask your buyer whether one of them is accepted before anyone commissions another.

How to use an audit report properly

• Check the site name and address match the factory making your goods.
• Read the findings, not just the rating, and look at how severe they were.
• Check whether the corrective action plan was closed, with evidence.
• Note the audit date and whether it was announced, semi-announced or unannounced.
• Ask whether workers have a grievance channel, since that is what buyers such as German brands under the supply chain law will ask you. The largest EU groups will ask the same under the EU due diligence directive from July 2029; our guide to the EU CSDDD after the 2026 changes explains who is in scope.

Every standard, with where to verify it, is in our certifications guide. When we place an order, we share the audit of the factory producing it before cutting starts. Ask about your product.