I agree with the past performance (try to avoid the word "Grandfather") for existing suppliers and surveys. For "mission critical" suppliers I try to do my own audit. Even if they are ISO/QS, it does not mean they are meeting all of MY requirements. I like to do product/process specific audits. During my toy train SQE days I would often drive for four hours to do a 30 minute audit, buy off on production samples, and drive home. Long day, but it was much cheaper than rejection, sort, scrap, remake, late production start, sort some more, scrap some more, late shipment, customer complaints, etc.
Too bad I could never find many manufacturing facilities in Hawaii or Las Vegas.
Tom