Making the assumptions that :
- This is automotive (based on PPAP language)
- Tier supplier has a significant portion of their business in the automotive industry
You can insist on an audit and full PPAP as a carrot, with the stick being contact with their registrar. You should also notify YOUR customer so that you're not as negligent as YOUR tier 1.
But all this is a quality, not a purchasing function.
I had a very similar situation just over a decade ago (the Friday before Memorial Day weekend, 2013). A metal supplier closed one of their facilities and began shipping from another location without notifying us. It was discovered as a safety question from the floor supervisor. The two locations banded their steel differently, introducing an injury risk with our unbanding method. So I was asked to contact the supplier about their banding method. The reply was "Oh, that's how they do it in Detroit."
"I thought you guys were in Kentucky," And just like that, I didn't get to ease into my long weekend.
We had to report to Ford and Chrysler, and insisted on an on-site audit. Hit them with a corrective action chargeback, and they paid for my travel to go audit their new site.
As an aside, the butterfly effect of this led me to walking in on two production operators literally with their pants down.