Find, compare, and connect with verified US manufacturers.
dsdomesticsuppliers
All posts
Sourcing10 min read

Supplier Audit Checklist for Machine Shops and Fabricators

A one-day, eight-section audit for a machining or fabrication supplier, scored on evidence you chose rather than answers you were given. Includes the scoring scheme, what each section is actually testing, and the findings that should stop an order outright.

Introduction

A supplier audit goes wrong in one of two directions. Either it is a tour, where somebody walks you past the machines and you come away impressed and no better informed, or it is a 140-line questionnaire that takes two days, generates a binder nobody reads, and still misses that the operator was running an obsolete drawing revision.

The checklist below is built to avoid both. Eight sections, one day on site, scored on evidence rather than on assurances. It assumes a machining or fabrication supplier in the 10 to 200 employee range, which is where most of the US supply base sits and where a formal audit is most likely to find something.

The governing principle is simple: an audit scores what you saw, not what you were told. If a shop describes a process and cannot produce a record of it operating, that is not a pass with a note. It is a gap.

The Eight Sections

Checklist figure titled "A supplier audit that fits one day on site", subtitled that it is eight sections scored on evidence seen rather than answers given. The eight ticked items read: quality system, covering certificate, scope, current internal audit and management review; document control, that the operator is holding the current revision of the drawing; calibration, covering gauge list, due dates, traceability, and what happens when one is late; material control, covering incoming receipt, mill test reports, segregation, and traceability to the part; process control, covering setup approval, first-piece sign-off, in-process checks and work instructions; nonconformance and corrective action, covering the open log, containment, root cause and verified closure; subcontractor control, covering the approved list, what is flowed down, and incoming checks on returns; and delivery and capacity, covering on-time measurement, backlog and single points of failure

1. Quality system

Ask for the certificate, then read the scope statement on it rather than the standard it names. ISO 9001 at this site, for these activities, is a different claim from ISO 9001 at the parent company. Check the expiry and check the certificate against the registrar's or accreditation body's register, not against the PDF on the wall.

Then ask for two things that are far more revealing than the certificate: the most recent internal audit report and the most recent management review minutes. A certified shop that cannot produce a current internal audit has a certificate and not a system. The internal audit also tells you what the shop already knows is wrong, which saves you finding it.

2. Document control

This is the highest-yield section in the whole audit and it takes ten minutes.

Walk to a machine that is running. Note the part number and the drawing revision in the operator's hand. Then go to the system of record and confirm that is the current revision. Do it twice, at two machines, on jobs you picked.

Obsolete drawings on the floor is one of the most common real findings in small-shop audits, and the mechanism is almost always the same: a revision came in by email, the office updated the file, and the paper copy at the machine never got pulled. Nothing in a questionnaire catches it.

3. Calibration

Ask for the gauge list with due dates. Look for anything overdue. Then pick two gauges physically near the inspection bench and trace them to the list, which catches the gauge that is in use and not on the list at all.

The question that matters most here is what happens when a gauge is found out of tolerance at calibration. A shop with a real system will describe assessing the parts measured with that gauge since its last good calibration, and will have a record of having done it. A shop without one will say they recalibrate it. The difference is whether a bad gauge triggers a look backwards at product already shipped.

4. Material control

Follow one part backwards. Pick a finished or in-process part, and ask them to show you the heat or lot number it came from, the receiving record for that material, and the mill test report.

What you are testing is whether traceability survives the shop floor. Plenty of shops receive certified material correctly and then cut it into pieces that can no longer be tied to the certificate. Also look at how non-conforming and unidentified material is segregated: a controlled, labelled location is good, a shelf near the back door is a finding.

5. Process control

Ask to see the setup approval and first-piece sign-off for a job currently running, and the in-process check frequency. Then check whether the recorded checks actually happened at the stated frequency, or whether six hours of entries were filled in at once at the end of a shift.

Work instructions matter in proportion to how much of the process lives in one person's head. A shop where the same operator has run the same family of parts for fifteen years may genuinely not need detailed instructions, and that is also a single point of failure worth recording under section eight.

6. Nonconformance and corrective action

Ask for the nonconformance log, open and closed, for the last twelve months.

A log with nothing in it is not a good sign; it means nonconformances are handled without being recorded. You want to see entries, containment actions, root cause that goes past "operator error," and closure that was verified by someone other than the person who caused it.

Pick one closed corrective action and test it. Ask what changed, then go and look at whether the change is in place. A corrective action that closed on a promise to re-train, with no evidence of re-training, is a finding in itself and tells you how the rest of the log should be read.

7. Subcontractor control

Ask for the approved supplier list and how a supplier gets onto it. Then take the outside process your part needs, usually heat treat or plating, and ask what requirements are flowed down on the purchase order and what is checked when the parts come back.

The common gap is flow-down. A customer requirement on material or process arrives at the shop, and the shop's purchase order to its plater carries none of it. The parts come back, get inspected dimensionally, and the process requirement was never communicated to anyone who could meet it.

8. Delivery and capacity

Ask how on-time delivery is measured and against which date, what the current backlog is in weeks, and what their utilisation is running at. Then ask the question that is really about risk: which single machine, person, or supplier, if it stopped tomorrow, would stop your part.

Most small shops have an honest answer to that and have never been asked. The answer belongs in your file whether or not it is a finding.

Scoring It

An audit that produces a percentage and no decision rule is theatre. Score each section on evidence, then let the scores drive a predetermined action.

Labelled schematic titled "Scoring an audit so the number means something", subtitled that you score the evidence and then let the score decide the action. Six rows. Score 4, evidence sampled: objective evidence shown and two records pulled at random held up, with the note that full marks require you to have chosen the sample and a binder they opened for you is a 3. Score 3, evidence shown: a documented process exists and the record they produced matched it, noted as the normal score for a competent shop and not to be treated as a finding. Score 2, process but no record: they described a process and nothing on the floor demonstrated it, noted as an observation requiring the record by email within ten working days. Score 1, gap: no process, or a record that contradicted the process, noted as a finding needing a corrective action with a date before any production order. Score 0, stop: a requirement is absent and the shop does not accept that it applies, noted as not a scoring problem, with instructions not to place the order and not to schedule a re-audit yet. And a final deciding row: any zero fails the audit outright whatever the total, because averaging a zero away is how an audit becomes paperwork, so gate on the minimum rather than the mean

Two features of this scheme are doing the work.

The first is that a 4 requires you to have chosen the sample. The difference between a shop that can produce the record you asked for and a shop that can produce the record it prepared for you is the entire difference between a system and a performance. Ask for a specific job by part number and date, picked from a list you were handed rather than nominated by your host.

The second is that any zero fails the audit regardless of the average. A shop can score 3s across seven sections and have no corrective action process at all, and the mean will look respectable. Averaging a zero away is how audits become paperwork. Gate on the minimum.

A reasonable rule for a commercial buyer: no zeros, no more than two 1s, and a written corrective action with a date for every 1 before a production order is released. For a first article or prototype order you can be looser. For a sole-sourced production part, you should not be.

What a One-Day Audit Does Not Cover

Honesty about scope matters, because an audit report has a way of being read later as a general endorsement.

One day does not assess financial stability. A shop can run a clean floor and be sixty days from insolvency, and the audit will not see it. That is a credit question, answered through trade references, payment behaviour and in significant cases financial statements.

It does not assess cybersecurity to any depth. If you are flowing down defence requirements, CMMC and NIST SP 800-171 are their own assessment with their own evidence, and a half hour in a quality audit does not touch them.

It does not establish capability for a part the shop has not made. The audit tells you whether the shop controls its processes. Whether it can hold your particular callout is a first article question, and the audit and the first article answer different things.

And it is a snapshot. The operator holding the right revision today is evidence about today. Re-audit on a cycle tied to how much you are buying and how much a failure would cost, and re-audit sooner after any change of ownership, any plant move, or any escape.

Conclusion

Eight sections, one day, scored on evidence you selected rather than answers you were offered. Walk to a running machine and check the drawing revision. Follow one part back to its mill test report. Pull one closed corrective action and verify the change is actually in place. Ask what single thing stopping tomorrow would stop your part. Then score it, fail it on any zero regardless of the average, and get a dated corrective action for every gap before the production order goes out.

Share