The first supplier I ever had to disqualify made beautiful parts, and that supplier taught me more about the supplier qualification process than any training course ever did. I mean that. The first article housings came in on foam trays, and every dimension sat dead center of tolerance. In addition, a clean inspection report was stapled to the packing slip. Their ISO 9001 certificate hung in a frame in the lobby, and the quality manager walked me through a document control system that was, honestly, tidier than ours.
However, six weeks into production, our assembly line started finding porosity in the sealing faces. It was not on every part. In fact, it was maybe one in forty. Still, that was enough to cause leaks at end of line testing, and it was enough to burn two weekends of overtime sorting stock.
What Those Housings Taught Me About the Supplier Qualification Process
It took a containment visit and a very uncomfortable conversation to learn the truth. To keep up with volume, they had quietly moved the casting step to a foundry two hours away. That foundry was never audited, never mentioned on the quote, and never told what the part was for. So the machining shop we qualified was still excellent. It just was not the only shop making our part anymore.
That was nearly fifteen years ago, early in my time as a Supplier Quality Engineer. Since then, I have run supplier quality teams for industrial equipment and automotive programs. Even so, I still think about those housings whenever someone tells me a supplier qualification process is “just paperwork.” After all, a certificate tells you a supplier has a quality system. However, it does not tell you that system works for your part, at your volume, with your tolerances, when nobody from your company is watching.
What follows, therefore, is how I build and run a supplier qualification process that holds up. It is not the textbook version. Instead, it is the version that has to survive a launch schedule, a purchasing team under cost pressure, and suppliers who are honest people with real constraints.
What the Supplier Qualification Process Actually Covers
People often use “qualification,” “selection,” and “approval” as if they mean the same thing. They overlap, but it helps to keep them separate in your head.
Selection is the commercial and strategic choice. In other words, can this company make the thing at a price and lead time that works, and do we want a relationship with them?
Qualification is the evidence. Specifically, it is the structured work of proving that a supplier can meet your quality, regulatory, and operational requirements before you trust them with production. One widely used definition frames it as a systematic, risk based verification and approval activity performed before a supplier is onboarded and any purchase orders are issued. I like that framing because of the word “before.” Qualification after the purchase order is already cut is not qualification. Rather, it is hope with a checklist attached.
Approval is the decision and the record. As a result, the supplier goes onto the approved supplier list for a defined scope, with a signature and a date.
Monitoring and requalification then keep the approval honest over time.
A rigorous supplier qualification process connects all four. When they live in different departments with different spreadsheets, though, gaps open up. That is exactly where my foundry problem lived.
Why a Rigorous Supplier Qualification Process Is Not Optional
There are two reasons to take this seriously. The first is regulatory, and the second is money.
The Regulatory Case for a Supplier Qualification Process
On the regulatory side, nearly every quality standard in industrial work puts the responsibility on you, not the supplier. For example, ISO 9001 Clause 8.4 requires that the organization shall ensure that externally provided processes, products and services conform to requirements. The 2015 revision also widened the old purchasing clause, so it now covers all externally provided processes, products, and services, including suppliers, subcontractors, and outsourced processes. That means your calibration lab, your heat treater, your plating house, and your logistics provider all count when they can affect conformity.
Automotive goes further. IATF 16949 added much tighter requirements around supplier selection, supplier development, and second party audits. Similarly, a DQS analysis notes that the IATF has recognized the need to enhance the requirements related to supplier selection, development and monitoring. Medical device and pharmaceutical work sit under similar expectations, which is why supplier qualification is a regulatory requirement for most FDA regulated manufacturers.
What a Weak Supplier Qualification Process Costs
On the money side, the math is simple and brutal. A defect caught at receiving costs you a return label. Meanwhile, the same defect caught on your assembly line costs you sorting, rework, line downtime, and expedited replacement stock. When your customer catches it, it costs you all of that plus a corrective action, a scorecard hit, and maybe a controlled shipping level. Finally, caught in the field, it can cost you a recall. For this reason, every dollar spent qualifying a supplier properly buys down that risk at the cheapest possible point.
Step 1 of the Supplier Qualification Process: Define What Qualified Means
The most common mistake I see is starting the supplier qualification process with the supplier. Instead, you should start with your own requirements.
Questions to Answer First
Before I send a single questionnaire, I want answers to a few questions:
- What exactly is being purchased, and what are the critical characteristics?
- What happens downstream when this part or service fails?
- Which regulatory or customer specific requirements flow down?
- What special processes are involved, such as welding, heat treat, plating, or nondestructive testing?
- What volume and ramp rate do we need, and over what period?
Assigning a Risk Tier
From there, I assign a risk tier. My teams use three, and most companies I have worked with land on something similar.
- Tier A (critical): Safety items, regulatory items, parts with special characteristics, special processes, and anything where a failure stops a customer’s line or hurts someone. Consequently, these get the full treatment: desktop review, onsite audit, PPAP or equivalent first article approval, and a signed quality agreement.
- Tier B (significant): Functional parts and services that matter, but where a failure is contained and recoverable. These usually get a desktop review, a remote or targeted audit, and first article inspection.
- Tier C (low risk): Commodity hardware from established distributors, packaging, and office services. For these, a desktop review and certificate check are usually enough.
Why Tiering Strengthens the Supplier Qualification Process
ISO 9001 actually expects this kind of scaling. In particular, Clause 8.4 asks you to weigh the potential impact of externally provided outputs on your ability to consistently meet customer and regulatory requirements when you decide the type and extent of control. Unfortunately, a common audit finding is the opposite: controls that never change based on how critical the purchased item is.
Tiering also protects your team’s time. I have watched SQEs burn a full week auditing a cardboard box supplier while a new die casting source went through on a questionnaire. In short, rigor means putting the effort where the risk is.
Step 2: The Desktop Review in the Supplier Qualification Process
The desktop review is where you screen out the obvious misses before anyone books a flight.
My standard request package includes a supplier self assessment questionnaire and copies of current quality certifications. In addition, I ask for an organization chart for quality and operations, a list of their own key suppliers and subcontractors, a capacity statement, a sample control plan for a similar part, and recent financial indicators when we can get them.
Habits That Make the Review Useful
A few habits make this step far more useful.
Verify every certificate. Do not just look at the PDF. Instead, check the certification body, the scope statement, the sites covered, and the expiry date. Over the years, I have caught certificates that covered a different address, certificates for “distribution of fasteners” attached to a quote for machined parts, and one that had expired eleven months earlier. Likewise, auditors who review approved vendor lists commonly flag expired certificates, missing evidence for approved parts, and undocumented subcontractors.
Read the scope like a lawyer. For instance, a certificate that covers “assembly” does not cover the plating they plan to outsource.
Ask about subcontractors directly and in writing. This is the question I failed to ask hard enough back in my foundry story. So now it is a required field with a signature.
Reading Between the Lines
Look at how they answered, not just what they answered. A questionnaire with every box ticked “yes” and no supporting detail tells me very little. On the other hand, a questionnaire where someone wrote “partial, we are rolling out SPC on lines 3 and 4 this quarter” tells me the person filling it out is being straight with me. As a result, I trust that supplier more.
For Tier C suppliers, the supplier qualification process may end here with an approval. For Tier A and B, however, the desktop review mostly tells me where to look during the audit.
Step 3: The Onsite Audit, the Heart of the Supplier Qualification Process
There is no substitute for walking the floor. A good second party audit covers the quality system basics. For example, one study guide for quality engineers lists management commitment, document control, traceability, calibration systems, nonconformance control, and corrective action workflows as the core areas, and that is a fair baseline.
But after a few hundred audits, the things that tell me the most are rarely on the agenda.
Follow the Parts, Not the Presentation
Walk traceability backwards. First, I pick a recent shipment and trace it in reverse, from the packing list to the final inspection record, then the traveler, the in process checks, the lot or heat numbers, and finally the mill certificate. If the chain breaks, I want to know where and why. Clearly, a supplier who can produce that chain in ten minutes runs a different shop from one who needs until after lunch.
Visit the reject area. The quarantine cage is the most honest place in any factory. Is it locked? Is material tagged with a reason and a date? Or, instead, is it a pile of mystery parts that have been sitting there since last spring? After all, how a supplier treats bad parts tells you how they will treat yours.
Talk to the People Doing the Work
Talk to operators, not just managers. I ask the person at the machine what they do when a part measures out of tolerance. When the answer matches the procedure I read that morning, good. However, when the answer is “I tell my lead and he decides,” I dig further.
Check the gauges. Pick three gauges at random from the floor. Are they in calibration? Also, has anyone done a gauge study on the ones measuring critical features? A process can look capable on paper and still ship bad parts because the measurement system cannot tell good from bad.
Look Upstream and at Change Control
Ask how they qualify their own suppliers. A supplier with no real supplier qualification process of their own is a supplier whose risk you are inheriting, sight unseen. In fact, IATF 16949 customers like Ford explicitly expect this; according to DQS, Ford’s supplier selection process should include evaluation of the supplier’s supply chain management system.
Watch the change control process. Ask to see the last three engineering or process changes. Who approved them? Were customers notified? This is where silent changes, like moving a casting to a new foundry, either get caught or slip through.
I score audits on a weighted checklist, but I always write a narrative summary too. Scores are good for comparing suppliers. The narrative, on the other hand, is what the next SQE will actually read when something goes wrong two years later.
Step 4: Proving the Supplier Qualification Process With Real Parts
An audit tells you the system exists. Parts, however, tell you the system works.
First Article Inspection for Lower Risk Items
For lower risk items, a first article inspection is often enough. That means a full dimensional layout, material certifications, and any functional tests, all reviewed against the drawing.
PPAP for Critical Parts
For critical parts, especially in automotive and heavy equipment, we use the Production Part Approval Process. PPAP is a standardized process that gives the customer evidence of a reliable and repeatable process. The AIAG manual defines 18 possible elements, and the submission level then determines how many come to you versus being retained at the supplier. In practice, Level 3, which includes the warrant, samples, and full supporting documents, is the most commonly requested default.
The elements that get the most attention from my team are the process flow diagram, the PFMEA, the control plan, the measurement system analysis, and the initial process studies. Together, those five tell me whether the supplier understood the part, thought about how it could fail, put controls in place, and can measure what they claim to measure.
A point that trips up a lot of suppliers is that even when you ask for a lower submission level, the work still has to be done. As one training resource notes, all 18 elements must still be completed and retained, even when a lower level is selected.
Holding the Line on Capability
On capability, the AIAG PPAP manual’s general guidance for initial studies is a preliminary process performance index of 1.67 or better on special characteristics. Values between 1.33 and 1.67 may be acceptable with customer agreement and a plan. Therefore, I hold the line on that number for critical features. A supplier that shows me 1.1 and promises it will improve during ramp up is, in effect, asking me to absorb their learning curve on my assembly line.
I also insist that PPAP parts come from a significant production run, on production tooling, with production operators, at production rate. Hand built samples prove a supplier can make one good part. Of course, that was never the question.
Step 5: Closing the Supplier Qualification Process With an Approval Decision
Once the evidence is in, someone has to decide. In my teams, that decision is cross functional, so quality, engineering, and purchasing all sign. IATF 16949 pushes in the same direction. Likewise, a contributor on an IATF forum put it well, noting that risk assessment happens twice: once at selection and again during ongoing performance evaluation.
Approve Narrowly
The approval itself should be specific. In other words, I do not approve suppliers in general. I approve a supplier, at a specific site, for specific part numbers or commodities, with specific processes, and sometimes with specific limits. For instance, a machine shop might be approved for turned steel parts but not for anything requiring outsourced heat treat until we audit their heat treater.
Three Statuses
We use three statuses, which line up with common industry practice of keeping strict Approved, Conditional, and Disqualified categories on the approved supplier list.
Approved means full authorization within the defined scope.
Conditional means we can buy, but with extra controls: tightened incoming inspection, a corrective action plan with dates, and a follow up audit. For example, in medical manufacturing a buyer will often place the supplier in conditional approval, require a corrective action plan with validated evidence, and then conduct a follow up audit before moving to full approval.
Disqualified means no new orders. Period.
Tie the List to Purchasing
The approved supplier list has to connect to purchasing in a way that is hard to bypass. The best setup I have worked with blocked purchase orders in the ERP system for any supplier and part combination that was not approved. At first, it caused friction for about a month. Then it stopped a buyer from placing an emergency order with an unqualified source during a shortage, which is exactly the moment a sound industrial procurement strategy should hold firm, and nobody complained after that. Automated controls like this are easy to justify once you run a manufacturing automation ROI calculation against the cost of a single escape.
Step 6: Lock In the Supplier Qualification Process With a Quality Agreement
The audit and the PPAP describe how the supplier operates today. A quality agreement, by contrast, controls what they are allowed to change tomorrow.
Every Tier A supplier on my list signs one before production orders begin. At minimum, it covers:
- Change notification requirements, including what counts as a change (site, process, subcontractor, material source, key equipment, and key personnel for special processes) and how much notice is required.
- Control of their subcontractors and flow down of our requirements.
- Our right to audit, including unannounced audits for cause.
- Record retention periods.
- Nonconforming material handling and how fast they must notify us of suspect shipments.
- Corrective action response times.
Clause 8.4 of ISO 9001 supports this, too. It expects you to communicate requirements around approval of products, methods, processes, and equipment, competence of persons, interactions with your organization, performance monitoring, and verification activities.
If my old machining supplier had signed an agreement with a clear change notification clause, moving the casting to a new foundry would have been a contract breach, not just a bad surprise. Most suppliers will honor a clear agreement. The problem, usually, is that nobody wrote one.
Step 7: Keeping the Supplier Qualification Process Alive After Approval
Qualification is not a finish line. Instead, it is the start of a relationship that needs data.
Scorecards That Mean Something
Our supplier scorecards track quality (parts per million defective), delivery (on time and in full), responsiveness to corrective action requests, and audit findings. Scores go to suppliers monthly or quarterly. Good suppliers usually welcome this because it gives them evidence to take to their own leadership.
Requalification Triggers
Requalification happens on a schedule based on risk tier. In addition, it happens on triggers. The triggers I use most often are:
- A significant quality escape or repeated defects.
- Any notified change to site, process, or subcontractor.
- A change in ownership or a major layoff.
- Missed corrective action deadlines.
- A long gap in orders (I usually treat twelve months or more as a reason to verify again).
When to Walk Away
A good program, as one manufacturing reference describes it, defines approval criteria, requalification triggers, and the process for removal from the approved list. Removal, though, is the part companies avoid. It is uncomfortable, and switching suppliers is expensive. Even so, a supplier qualification process with no real consequence for poor performance stops being a process. Instead, it becomes a ritual.
I have walked away from suppliers three times in my career after development efforts failed. Each time, the decision was easier because we had the scorecard data, the corrective action history, and the audit narratives to show it was not personal.
Supplier Qualification Process Mistakes I See Most Often
After years of cleaning up after weak programs, I notice a few patterns repeat.
Shortcuts That Backfire
Treating certification as qualification. It is a starting point, not an answer. As one supplier quality reference puts it, certification is a baseline, not a complete qualification.
Letting urgency bypass the system. “We need it Friday, qualify them later” is exactly how my foundry story started. So if you must use an unqualified source in an emergency, document it as a deviation, apply 100 percent inspection, and close the qualification within a set deadline.
Ignoring directed buys. When a customer tells you which supplier to use, you still own the quality of what comes in. In fact, DQS notes that under IATF, directed buys do not remove your responsibility to monitor supplier performance and act when it falls short.
Blind Spots in Ownership
Auditing the sales office. If the quote came from one site and the parts come from another, then audit the site making the parts.
Qualifying once and forgetting. Suppliers change owners, lose key people, and add product lines. Therefore, an approval from four years ago tells you about a company that may not exist anymore.
Letting quality own it alone. Purchasing knows the commercial pressure, while engineering knows what the critical characteristics really mean. Consequently, a supplier qualification process run only by quality tends to be thorough but slow, and slow processes get bypassed.
Making the Supplier Qualification Process Work Across the Business
The best programs I have run had a few things in common. First, purchasing was involved from the first conversation, not after the supplier was chosen. Second, engineering defined critical characteristics on the drawing so SQEs were not guessing. Third, the approved supplier list was tied into the ERP. Finally, leadership backed the quality team when the answer was “not yet.”
That last point matters more than any checklist. A rigorous supplier qualification process will sometimes delay a launch by a few weeks. Leadership, therefore, has to understand that a few weeks of delay is cheap compared with six months of containment, sorting, and customer escalations.
If you are building or rebuilding your program, start small. To begin with, tier your current supplier base. Then pick your five highest risk suppliers and confirm you have current audits, signed quality agreements, and real performance data for each. Fix those first, and after that, extend the process outward.
Final Thoughts on the Supplier Qualification Process
Those porous housings taught me something I repeat to every new SQE I train: suppliers rarely fail on purpose. Rather, they fail because of pressure, change, and gaps nobody was asked to close. A rigorous supplier qualification process exists to find those gaps while they are still cheap to fix.
So define what qualified means before you look. Tier your risk honestly. Walk the floor and trace the parts. Make suppliers prove capability with production runs, not samples. Approve narrowly, write it into an agreement, and keep measuring after the purchase order goes out.
When you do that consistently, your incoming inspection becomes a formality instead of your last line of defense.
Supplier Qualification Process FAQs
What is a supplier qualification process?
It is the structured set of checks a company completes to confirm a supplier can meet quality, regulatory, and operational requirements before purchase orders are issued. Typically, it covers risk tiering, document review, audits, product approval, and ongoing monitoring. Learn more: SimplerQMS, Supplier Qualification Guide
How long does supplier qualification usually take?
For low risk commodity suppliers, a desktop review can be finished in days. For critical suppliers needing an onsite audit and full PPAP, however, expect several weeks to a few months depending on tooling and capability studies. Learn more: QC Advisor, Supplier Qualification Framework
Is ISO 9001 certification enough to qualify a supplier?
No. Certification shows a quality management system exists, but it does not prove the supplier can make your specific part to your requirements. So treat it as a baseline. Learn more: Racklify, How to Build an Approved Supplier Program
What does ISO 9001 require for supplier control?
Clause 8.4 requires organizations to ensure externally provided processes, products, and services conform to requirements. In addition, it expects controls to scale with risk and impact. Learn more: Auditor Training Online, ISO 9001 Clause 8.4
What is the difference between PPAP and first article inspection?
First article inspection verifies a single part or small sample against the drawing. PPAP, on the other hand, proves that the full production process, under real conditions and at rate, can consistently produce conforming parts, and it includes up to 18 elements. Learn more: Wikipedia, Production Part Approval Process
How often should suppliers be requalified?
It depends on risk tier and performance. Critical suppliers are commonly audited again every one to three years. Also, quality escapes, process changes, or ownership changes should trigger requalification. Learn more: The FDA Group, 5 Step Guide to Qualifying Suppliers
References
- SimplerQMS. Supplier Qualification: Definition, Process, and Guidelines
- QC Advisor. What Is Supplier Qualification?
- The FDA Group. A 5 Step Guide to Qualifying FDA Regulated Suppliers
- Auditor Training Online. ISO 9001 Clause 8.4 Control of Externally Provided Processes, Products and Services
- Ecesis. Control of External Providers
- DQS. Expectations for IATF Supply Chain Management, Section 8.4
- Elsmar Cove Forum. IATF 16949 Cl. 8.4.1.2 Supplier Selection Process
- Wikipedia. Production Part Approval Process
- Plexus International. What Is the Production Part Approval Process (PPAP)?
- Quality Training Portal. AIAG PPAP Resource Center
- Fabrico. PPAP Production Part Approval Process Guide
- Open Exam Prep. Supplier Quality Management (CQE Study Guide)
- Racklify. How to Build an Approved Supplier Program for Manufacturing
- Racklify. Approved Vendor List Compliance and Audit
- Racklify. How to Qualify and Audit Suppliers for Manufacturing
- Manifestly. Supplier Quality Audit Checklist
- ASQ. Supplier Management
