1. Verbally, ask your relevant colleagues to discreetly pause contact with the supplier and any reseller or service provider. Keep supplier staff away from your sites for now.
2. Don't involve anyone not already involved.
3. Write nothing down about your concerns and ask colleagues to do the same. No documents, emails, instant messages or TXTs
4. Make no increased or non-essential use of the material of concern.
5. Finally, get help from your boss, legal team and perhaps, an outside specialist under confidential terms.
If you have been served notice of an audit, do not respond to it without the advice of your legal team and an outside specialist.