Supplier qualification: managing your own supply chain

Every product you deliver carries the quality of the firms that supplied you. When a supplier ships late or ships a defect, your customer sees your name on the delivery, not theirs. Managing your suppliers, and the sub-suppliers below them, is how you keep control of the delivery time and quality you have promised.

This is not optional housekeeping. Supplier control is a requirement of ISO 9001 clause 8.4 and of AQAP quality requirements, and it is general best practice regardless of the standard you work to. Your customers, whether a prime contractor, a defence procurement agency or a commercial buyer, hold you accountable for the parts and processes you source, not just the ones you make in-house. This guide sets out how to qualify, approve and monitor sub-suppliers, and which records an auditor will ask to see.

What supplier qualification actually means

Qualification is the evidence-based decision that a supplier can meet your requirements before you place an order. It is not the same as approval. Approval is the recorded outcome of that decision. A supplier can be evaluated, fail, and never reach your approved list. Keep the two steps distinct in your records so an auditor can trace the decision.

The scope of qualification depends on risk. A sub-supplier of raw material with a certificate of conformity needs less scrutiny than a firm doing special-process welding on a flight-critical part. Grade your suppliers by the impact of a defect, then set the qualification depth to match.

The qualification steps

Start with a defined set of criteria. Typical checks include a completed supplier questionnaire, evidence of a quality management system, relevant certifications, financial stability where the risk warrants it, and a review of past performance if you have history with the firm. For higher-risk suppliers, add a document review or an on-site audit.

If you use ComplyTrain, the QMS module ships with a standard supplier questionnaire that you can modify to your own criteria, so you are not building the check from scratch. Adjust the fields to match the commodity and the risk grade, then reuse it across suppliers for consistent evidence.

Record who carried out each check, the date, and the result. If you accept a supplier with an open finding, write down the justification and the deadline for closure. An auditor will read that as evidence you manage risk rather than ignore it.

Close the loop with a formal approval. State the scope of approval: which parts, processes or services the supplier is cleared to provide. A supplier approved for one commodity is not automatically approved for another.

Flowing down requirements

Your customer passes requirements to you. You pass the relevant ones to your sub-suppliers. This is flow-down, and it is where most audit findings originate. The rule is simple: any requirement that affects the product or the records must reach the firm that does the work.

Build a short flow-down clause into your purchase orders. Cover the specification, applicable standards, record retention, right of access for you and your customer, notification of change, and the requirement to flow the same clauses to the next tier. Keep it plain. A clause the supplier does not understand is a clause the supplier will not follow.

Ongoing monitoring

Qualification is a snapshot. Monitoring keeps it current. Track delivery performance, nonconformance rates, and corrective-action response times. Set a re-evaluation interval, for example annually for critical suppliers, and record each review.

When a supplier's performance drops below your threshold, trigger a documented action: a warning, an audit, or removal from the approved list. The record of that action is what shows an auditor you act on the data you collect.

The records an auditor expects

An auditor, whether from your customer or a certification body, will ask for your approved supplier list, the qualification evidence behind each entry, purchase orders showing flow-down clauses, incoming inspection records, and your monitoring and re-evaluation history. Keep these in one place, indexed by supplier, with the retention period your customer specifies.

Our QMS module structures these records around clause 8.4 of the standard, so the evidence trail is ready when the audit arrives. See how we handle this in our /product/qms and read the underlying requirements in our /standards/iso-9001 overview.

Next step

Book a walkthrough of the ComplyTrain QMS to see the supplier controls in action.