KEY TAKEAWAYS

✓
Verify certifications directly — don’t rely on a CM’s self-reported claims. Request current certificates with expiry dates.

✓
Quality systems matter more than equipment lists. A shop with outdated certs and no documented corrective action process is a liability.

✓
DFM feedback during quoting is a strong signal of a CM’s technical depth — treat silence as a red flag.

✓
ITAR registration is a legal requirement for defense-related parts, not an optional differentiator. Confirm it before sharing any controlled technical data.

✓
First Article Inspection (FAI) and CMM reporting should be standard, not upsells. Know what inspection documentation you’ll receive before committing.

The first filter in any CM evaluation is certification status. ISO 9001 establishes a baseline quality management system. AS9100 layers on aerospace and defense-specific requirements including risk management, configuration control, and first article inspection. If your parts touch a regulated supply chain, these aren’t nice-to-haves — they’re table stakes.
Don’t take a CM’s word for it. Request the actual certificate, confirm the issuing registrar, and cross-check the expiry date. Many registrars publish searchable databases. A lapsed or narrowly scoped cert is a disqualifier. Scope matters too — some shops hold ISO 9001 for their office processes but not their production floor.
For defense and aerospace work, also confirm ITAR registration with the U.S. State Department’s Directorate of Defense Trade Controls (DDTC). ITAR isn’t a certification — it’s a federal registration requirement. Sharing controlled technical data with an unregistered manufacturer isn’t just a contract problem; it’s a federal violation. Verify before you transmit any drawings.

WARNING: A certificate printout from a CM’s website is not verification. Always request the current certificate directly and confirm the registrar. Scope limitations can mean a cert doesn’t cover the actual manufacturing processes you need.

Certifications establish intent. The actual quality management system (QMS) tells you whether that intent is operational. Ask for the CM’s quality manual or a process overview. You’re looking for evidence of documented procedures, not just high-level policy statements. Specifically, probe for corrective and preventive action (CAPA) processes — how does the shop respond when something goes wrong?
Inspection capability is equally critical. Ask what metrology equipment is on the floor: CMMs, surface plates, optical comparators, bore gauges. More importantly, ask whether inspection is performed by a dedicated QC team or by the machinist who made the part. Operator self-inspection is acceptable for in-process checks, but final inspection should involve an independent QC step for any precision or safety-critical work.

• Does the CM maintain calibration records for all measurement equipment?
• What is their nonconformance rate, and do they track it?
• Can they provide a sample inspection report or CMM output?
• Do they perform First Article Inspection (FAI) to AS9102 standards?

A CM that can’t answer these questions fluently — or gets defensive — is telling you something important about their quality culture.

INSIGHT: CMM inspection included as a standard deliverable (not an add-on) is a meaningful differentiator. It means you get objective dimensional data, not just a machinist’s judgment call on whether a part is in spec.

Every CM has a sweet spot — the combination of materials, tolerances, geometries, and volumes where they produce the best outcomes. Your job is to determine whether your program falls within theirs. Start with a capability statement or equipment list. CNC machining shops will typically specify axis count, maximum envelope, and spindle configurations. Sheet metal shops will list press brake tonnage, laser bed size, and forming capabilities. But raw equipment specs only tell part of the story.
Tolerances are the real test. Ask specifically: what is their standard tolerance, and what is their demonstrated capability on tight features? A shop that lists ±0.005 inch as achievable but has no statistical process control (SPC) data to back it up is guessing. For critical dimensions, request Cpk data or evidence of process validation.
Also evaluate their material experience. Machining 6061 aluminum is fundamentally different from machining Inconel 718 or titanium Ti-6Al-4V. If your application involves hard metals, exotic alloys, or tight surface finish requirements, ask for references or sample parts from analogous programs. Don’t accept ‘we can do that’ without substantiation.

Design for Manufacturability (DFM) review is one of the most underused qualification signals available during the pre-award phase. A technically competent CM — or managed sourcing partner — will flag issues in your design that drive cost or risk quality outcomes. A shop that just quotes what’s on the drawing without comment is either missing those issues or choosing not to mention them. Neither is good.
What does useful DFM feedback look like? It might include flagging an unnecessarily tight tolerance on a non-functional surface, recommending a radius change to eliminate a specialty tool, identifying a thin-wall section likely to deflect during machining, or noting that a threaded insert would be more reliable than a tapped hole in that material. These observations demonstrate real process knowledge.
When you submit an RFQ, pay attention to the quality and specificity of the response. Did they ask clarifying questions? Did they note any design concerns? A 24-hour quote with embedded DFM notes signals a partner with technical depth, not just transactional quoting bandwidth. If the only feedback you get is a price, you’re working with an order-taker, not an engineering partner.

RULE OF THUMB: If a CM quotes your part with no questions and no DFM comments, either your design is flawless — or they didn’t look closely enough. The former is rare. Treat silence as a yellow flag.

For aerospace, defense, and medical applications, material traceability isn’t optional. You need to be able to trace every lot of material from the mill certificate through to the finished part. Ask the CM how they manage incoming material: Are certs reviewed against the specification at receiving? Are materials segregated and labeled with lot numbers? What prevents a mixing event on the shop floor?
Counterfeit material prevention is a growing concern, particularly for aluminum, titanium, and electronic components. The better shops will reference their compliance with AS5553 (counterfeit electronic parts) or AS6174 (counterfeit materiel) and have documented supplier qualification procedures for their own raw material vendors. Ask directly: do you purchase from authorized distributors or brokers? Do you require mill certs for every heat lot?
Also clarify ownership of traceability data. In the event of a quality escape or field failure, can the CM reconstruct the full manufacturing record for a given serial number — including operator, machine, tooling, material lot, and inspection results? This is standard practice in a mature QMS and a legitimate expectation for any regulated supply chain.

WARNING: ‘We’ve never had a material issue’ is not a traceability program. Ask for the documented procedure. If one doesn’t exist in writing, assume the controls don’t exist either.

Technical capability and quality systems qualify a CM. Execution capability determines whether they can actually support your program. Lead time quoting should be realistic and defensible — ask how quoted lead times are derived. Is there available capacity on the machines your parts require, or is the CM assuming they’ll add a shift or subcontract operations? Both can be acceptable, but you should know which it is.
Probe for schedule performance history. On-time delivery (OTD) rate is a standard KPI in any mature QMS. Ask for their OTD rate over the past 12 months. A rate below 90% warrants explanation. Also ask how they handle capacity conflicts when multiple programs compete for the same machines. Priority management is a real operational challenge, and a CM without a transparent process for it will eventually deprioritize something — ideally not your parts.
Responsiveness during the quoting phase is a proxy for responsiveness during production. If it takes a week to get a quote, expect similar friction when you need an urgent ECO implemented or a delivery date expedited. Nimble’s certified partner network is built around 24-hour quotes precisely because engineering cycles don’t run on a CM’s administrative schedule.

A CM that fails mid-program is a program-ending event. Financial stability assessment doesn’t require a full audit, but it does require some due diligence. For a new supplier relationship, it’s reasonable to request a Dun and Bradstreet (D&B) report, trade references from current customers, or evidence of existing long-term customer relationships. A CM with stable, multi-year program commitments from known OEMs is demonstrably lower risk than a shop that can’t name its top three customers.
Also evaluate their insurance posture. At minimum, a CM should carry general liability and product liability insurance. For aerospace and defense work, errors and omissions (E&O) coverage is also relevant. Request certificates of insurance and verify the coverage limits are appropriate for the value of the work you’re awarding.
Beyond financials, assess single-point-of-failure risks. Does the CM rely on one or two key employees for critical process knowledge? Are there backup machines if a primary CNC goes down? A managed sourcing model, where work is routed across a certified partner network rather than locked to a single facility, naturally distributes these risks and provides continuity when individual shops hit capacity or operational constraints.

INSIGHT: Concentration risk cuts both ways. A CM that relies on you for more than 30-40% of their revenue may prioritize your work — or may lack the financial resilience to survive a program pause on your end. Balance is healthier for both parties.

Verbal assurances don’t survive personnel turnover or legal disputes. Formalize the qualification process with documented outputs you can reference throughout the relationship. At minimum, your supplier qualification record should include: the CM’s current certifications with expiry dates, a completed supplier questionnaire covering quality system, capacity, and traceability, a review of their approved supplier list (ASL) for critical subcontractors, and the results of any on-site audit or remote assessment.
For new CMs on critical programs, a First Article Inspection (FAI) is non-negotiable. The FAI should cover dimensional inspection against the drawing, material certification review, surface finish verification, and functional testing if applicable. Document the results formally and keep them on file. Some programs will require you to submit FAI packages to your own customer — make sure the CM’s inspection output is formatted to meet that requirement.

• Maintain a living vendor qualification record, updated at each cert renewal
• Define re-qualification triggers: quality escapes, ownership changes, facility moves
• Establish escalation paths for nonconformances before they occur, not after
• Align on purchase order terms that reference applicable quality clauses

Qualification is not a one-time event. Build in periodic re-evaluation — annual at minimum — to confirm the CM’s capabilities and compliance status remain current.

RULE OF THUMB: If your supplier qualification record fits on one page, it isn’t detailed enough. A legitimate QSR for an aerospace or defense supplier should include certification copies, audit findings, FAI results, and approved scope of work — not just a name and address.

READY TO SOURCE?

Table of Contents

Related Services

Get a Quote in 24h

Upload your drawing and get a detailed quote with free DFM review.