Reducing Risk Through Supplier Quality Audits

For companies with products that are not entirely vertically integrated, there are necessary dependencies with outside companies that, if not managed properly, can create added risks. These risks derive from outside supplier processes, procedures, people, and performances that are not 100 percent visible because many suppliers are remotely located, speak languages other than the company’s native language, and have their own supply chains upon which they too are dependent.

You may not be able to influence your suppliers' suppliers, but you can considerably reduce your exposure to these risks by getting to know as much as possible about the internal controls and quality management of every company that keeps your company’s boat afloat.

Before you purchase any production material from an unknown source, you should perform the appropriate level of supplier survey. The formal procedure is known as a Supplier Quality Audit. Some companies just call them supplier surveys. Not all items in the following list may apply to your contract manufacturers (CMs) or service suppliers, so feel free to pick and choose the procedures that are relevant to the nature of the company you will be auditing.

Are the following procedures or practices documented and readily available?

  • Process introduction/installation. (Training and special instructions for your product.)
  • Inspection. (Should be a separate work center between work stations.)
  • Outgoing quality audit.
  • Internal process audits.
  • Preventive actions. (Safety and work center cleanliness.)
  • Continuous Process Improvement (CPI). (Regular meetings including production line workers.)
  • Modification and repair capabilities. (Avoiding the “dog pile” phenomena.)
  • Laboratory for onsite testing. (Functional and parametric.)
  • Statistical Process Control (SPC). (Required for catching yield numbers and failure trends.)
  • Operator training procedures. (Work centers should have employee training certificates on file.)
  • Component substitution controls. (Notifications to your company prior to any substitution.)
  • Machine operating instructions. (Posted near every piece of equipment.)
  • Introducing and implementing design change/revision. (ECO/ECN control.)
  • Product tracking. (Component and material traceability.)
  • Equipment maintenance. (Should have maintenance records for incident history and preventive maintenance.)
  • Calibration. (Test equipment calibration tags should be up to date.)
  • Data collection. (Serial numbering, lot management, and date codes.)
  • Documentation approval. (Check for authority levels and signatures.)
  • Notifying customer of material or process changes. (From their supplier on your products.)
  • Electrostatic discharge (ESD) protection. (Grounded to earth ground, smocks, and wrist straps.)
  • Packaging. (Handling instructions and package assembly drawings.)
  • Storage. (Secure and/or temperature and humidity controlled.)
  • Special processes. (If your company supplied special instructions.)
  • Scrap and rework controls. (Rework integrity for yield improvement and scrap count for materials.)
  • NPI process required. (Training on your company’s product.)
  • Environmental and regulatory compliance documentation. (REACH and RoHS.)
  • Assurance methodologies against receiving or shipping counterfeit materials or products.
  • Availability of all procedures to technicians and operators.

As you have probably noted, this inspection survey requires a very focused and comprehensive effort. Since the CM usually has most or all of the capabilities to purchase, assemble, and test a product, the survey must include all areas of concern as they relate to performance capability and process quality assurance. Often, because of the technical nature of the survey, the component engineer is part of the survey team and is assigned to the task of reviewing the CM’s Documentation Control procedures, ECO/ECN processes, test equipment calibration schedules, ESD precautions and controls, and some aspects of package and assembly handling. Purchasing is often part of the team and is responsible for auditing the company’s purchasing records and part management controls, including inventory and scheduling of material receipts.

The Supplier Quality form is usually sent ahead of the on-site inspection team, so the CM or any other supplier has ample time to review it and make sure the various processes, procedures, and files are in “inspection ready” condition. Often the survey inspection team members will assign a “weight” (for example, 1 to 4) to each criterion, and, at the end of the inspection, they will pass or fail the CM or supplier based upon the weighted average totals.

A simple “pass” or “fail” may be recorded on the form, but a more realistic audit looks at the processes in terms of degrees per 100 percent compliance to the expected quality level. One area of the assembly floor may have adequate ESD measures, while another may not have up-to-date measurement records for the wrist straps. Perhaps the ESD flooring is scratched or damaged and needs repair. You wouldn’t fail the supplier for this, but you might weight them as 3 out of 4 on ESD concerns. This survey is meant to help make your supplier aware of your company’s quality expectations and to help it conform to your company’s documented quality standards.

These surveys, by themselves, won't completely eliminate the “visibility” issue, but by visiting the supplier or CM, meeting the key players, and documenting the performance and logistics expectations, you now have a metric and a method for managing the supplier, no matter how remote the location. If you have follow-up issues before business can begin, you and your supplier have a checklist from which to draw up action items and expected remedy dates. The Supplier Quality Audit record is no guarantee of the supplier’s acceptable performance, but it gets your company on the low side of the risk numbers, instead of shooting in the dark and hoping for the best.

Here’s a keeper. Ask for a company’s Quality Assurance/Control Manual before you even consider doing business with it. If the company says it doesn't have one, politely discontinue the conversation and get out of Dodge. You do not want to do business with a company that does not have auditable controls over its own internal operation. Such a company has no way of monitoring issues of accountability or quality.

9 comments on “Reducing Risk Through Supplier Quality Audits

    March 16, 2012

    Every so often one gets a wee nugget and your comment on “Quality Assurance/Control Manual” is exactly that.  I will use this in future.

  2. dalexander
    March 16, 2012


    I am glad you saw the gold in the ore of the article. There is some major time and effort saving in that wee nugget.

  3. _hm
    March 18, 2012

    @Douglas: Thanks for highly informative article. However, sometimes, project get so accelerated, that many process falls apart. This is due to pressure for time to market and many other similar reasons. All party concerend knows, quality suffers, however, they are ready to take calculated risk. I wish some process are more standardized and automated so that it is integral part and much transperant to design / manufacturing engineer. Is this possible?


  4. stochastic excursion
    March 19, 2012

    Nothing says that companies are bound to follow these practices, only that failing to do it leads to exposure to (sometimes needless) risk.  It's all dependent on how much exposure a company can tolerate before the costs of implementing these controls are worthwhile.  I'm sure actually determining the risk is nothing trivial.

    Curious about “dog pile”.  Something tells me that is an article in itself!


  5. dalexander
    March 19, 2012


    “Dogpile” refers to the boards or articles that did not pass inspection of functional testing and require troubleshooting to fix. If the dogpile gets too high and there are no technicians analysing the common failure modes, a problem in parts or manufacturing may go unheeded, increasing the size of the dogplie and reducing the overall yield. Also, many boards could be restored and returned to production after being successfully evaluated and repaired.

  6. dalexander
    March 19, 2012


    You are right about processes going by the wayside when a company gets things going too fast. It is important to remain flexible because every procedure can always be reviewed for not just functionality, but also practicality. If a company decides to bypass a procedure, someone should be extra watchful when it comes to waste and problems. Then, when things slow down again, there should be a meeting about the problems encountered. See my article on the Post Mortem Review Meeting. It will be posted this week.

  7. mike_at_DCA
    April 11, 2012

    Doug, this is “spot on”. Unfortunately so many “manufacturers” do not do any audits at all of their suppliers, or just do cursory walk-arounds of, for instance, a potential CM, that they fail to assess the risks involved. This invariably leads – as you well know – to avoidable problems like unexpected part obsolescence, quality problems, inability to ship to volume, and worse. With the toy industry it led all the way to government regulation disallowing lead in paint on toys along with an opressive testing requirement.

    I would add two more issues to the list of auditable items. First (and this is not really “supplier quality”, but is often of critical importance), does the company have a product roadmap and what is it? If they don't and you don't need one then great. But if they don't, and you have a plan for follow-on generations of products, and their part is of critical importance, you need to ensure that you're in agreement on future direction.

    The second is an assessment of whether and how they select and/or manage the substances incorporated into the products they're manufacturing and selling to you. The impact of RoHS, REACH, and other active substance restriction regimes means manufacturers that select substances must have an effective process to identify substances and assess their risks (e.g. of being placed on a list like the candidate SVHC list, or of becoming restricted).

    Keep up the good work!

  8. dalexander
    April 11, 2012

    That is the voice of experience talking. I really appreciate your forward looking perspective. I agree that a company roadmap is important if the CM is going to be worthy of multi-year business potential. I have Environmental compliance on the checklist, but did not consider how the CM is set up to handle any SVHC awareness that comes to light through services such as DCA's. Thanks for the heads-up.

  9. mike_at_DCA
    April 11, 2012

    Thanks Douglas. I was actually thinking more about the suppliers of components, technologies, and materials than I was about the CM. CMs need to be audited to your list of processes as part of qualification to be sure (and maybe/maybe not for the two items I mentioned below – depends on what they do for you)! But so do suppliers – whether you buy parts from them or just specify them – of at very least criticial parts.

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.