KEY TAKEAWAYS

✓
ISO 9001:2015 certifies a quality management system, not part quality directly — audits assess process discipline, not dimensional output.

✓
Always verify certification scope: a shop certified for ‘general machining’ may not cover your specific process or material.

✓
Clause 8.4 places explicit supplier control obligations on certified manufacturers — ask how they manage their own supply chain.

✓
Certificate expiration and surveillance audit status matter as much as the initial certification date.

✓
ISO 9001 is a baseline. For aerospace and defense work, AS9100 Rev D adds mandatory risk management, FOD controls, and first article requirements that ISO alone does not cover.

ISO 9001:2015 certifies that an organization has implemented and maintains a Quality Management System (QMS) conforming to the standard’s requirements — it does not certify that any individual part meets a drawing or specification. This distinction is critical. A registrar audits documented processes, risk-based thinking, corrective action records, and management review cycles. They are not measuring parts on a CMM or validating surface finishes. The certificate means the system exists, is followed, and has been audited by a third-party body accredited under IAF Multilateral Recognition Arrangements (MLA). The 2015 revision was a significant structural update from the 2008 version. It introduced a high-level structure (Annex SL) that aligns all ISO management system standards, and it embedded risk-based thinking throughout every clause rather than treating preventive action as a separate requirement. Suppliers still on the 2008 version had until September 2018 to transition — any active certificate should now read ISO 9001:2015. If a supplier presents a 2008 certificate, that is a red flag worth investigating.

IMPORTANT: An ISO 9001 certificate has a 3-year validity cycle with mandatory surveillance audits typically at 12 and 24 months. Always request a current certificate with the issuing registrar’s name and confirm scope language covers your process.

ISO 9001:2015 is built on seven Quality Management Principles defined by ISO/TC 176. Understanding these gives you a framework for evaluating supplier maturity beyond checkbox compliance. The principles are:

• Customer focus — sustained attention to customer requirements and enhancement of satisfaction.
• Leadership — top management must demonstrate active commitment, not delegate quality to a single QA manager.
• Engagement of people — quality performance depends on competent, empowered personnel at every level.
• Process approach — activities are managed as interrelated processes with defined inputs, outputs, and controls.
• Improvement — organizations must continually improve QMS performance, not just maintain it.
• Evidence-based decision making — decisions driven by data analysis, not intuition or anecdote.
• Relationship management — managing supplier and partner relationships as strategic assets.

When you audit a supplier yourself or review their corrective action history, map what you find against these principles. A shop with excellent process documentation but zero data-driven decisions in their NCR (nonconformance report) records is not fully living the standard — they are paper-compliant.

Not all clauses carry equal weight for a manufacturing buyer. Focus your supplier qualification questions on these high-impact areas. Clause 7.1.5 — Monitoring and Measuring Resources: Does the supplier maintain a calibrated measurement system? Ask for calibration records on CMM equipment, micrometers, and gauges. Calibration intervals, traceability to NIST standards, and out-of-tolerance response procedures are all auditable. Clause 8.3 — Design and Development: If the supplier performs any design, this clause governs it. For pure contract manufacturers working from customer-supplied drawings, scope may explicitly exclude this clause — that is acceptable and common. Clause 8.4 — Control of Externally Provided Processes, Products, and Services: This is often where supplier quality programs break down. Clause 8.4 requires the certified organization to verify that outsourced processes still meet requirements. If your machined part goes out for heat treat, plating, or welding, the primary supplier must have controls over those sub-suppliers — not just a list of approved vendors. Clause 8.5.1 — Control of Production and Service Provision: Covers traveler documents, work instructions, and process parameters. Ask to see a sample shop traveler and verify it references your revision-level drawing.

PRO TIP: Ask for a supplier’s Approved Supplier List (ASL) and their procedure for qualifying new sub-suppliers. A weak Clause 8.4 program is one of the most common paths to undetected nonconformances reaching your dock.

Supplier-provided certificate copies are a starting point, not a finish line. Certificates can lapse, have their scope modified, or in rare cases be fraudulent. The correct verification path is through the registrar’s public database or directly contacting the registrar. Major accredited registrars — BSI, Bureau Veritas, DNV, Intertek, NSF-ISR — maintain searchable certificate lookup tools on their websites. When you search, confirm four things:

• Certificate status is active, not suspended or withdrawn.
• The scope description matches the processes you are sourcing (e.g., ‘CNC machining of aluminum and steel components’ versus a generic ‘manufacturing’ scope).
• The site address on the certificate matches the facility you are actually placing orders with — multi-site certificates require careful review.
• The registrar itself is accredited by an IAF MLA member body such as ANAB (US), UKAS (UK), or DAkkS (Germany).

Accreditation of the registrar matters. An ISO certificate issued by a non-accredited body carries no internationally recognized standing and will not satisfy most aerospace, defense, or automotive customer flow-down requirements.

WARNING: A certificate from a non-IAF-accredited registrar is not the same as an accredited ISO 9001 certificate. If you cannot find the registrar in the IAF database, treat the certification as unverified.

ISO 9001 is the foundation. AS9100 Rev D is the aerospace and defense sector-specific extension — it includes every ISO 9001:2015 requirement and adds approximately 100 additional or enhanced requirements tailored to aviation, space, and defense supply chains. The additions that matter most to buyers include: First Article Inspection (FAI) requirements aligned with AS9102, Foreign Object Damage/Debris (FOD) prevention programs, Key Characteristics (KC) identification and flow-down, configuration management, counterfeit parts prevention, and explicit risk management obligations tied to safety-of-flight hardware. If you are sourcing parts for FAA-regulated aircraft, military platforms, or space hardware, ISO 9001 alone is insufficient — AS9100 is the expected baseline. Nimble’s certified partner network carries both AS9100 and ISO 9001 registration, which means the quality infrastructure behind your quote already satisfies aerospace customer flow-down requirements without requiring you to qualify individual shops. For commercial-industrial applications with no regulated end-use, ISO 9001 is typically sufficient — but understand what you are accepting when you drop from AS9100 to ISO-only sourcing.

A quality management system is only as credible as its nonconformance and corrective action process. Under ISO 9001:2015 Clause 10.2, certified organizations are required to react to nonconformances, take action to control and correct them, evaluate root cause, and implement corrective actions that prevent recurrence. The standard also requires retaining documented information as evidence. When evaluating a supplier’s quality maturity, ask for a sanitized sample corrective action report. What you want to see: a structured root cause methodology (5-Why, Ishikawa/fishbone, or fault tree), containment actions documented before root cause is complete, effectiveness verification with a defined review date, and evidence the fix was deployed — not just written. What you do not want to see: every NCR closed as ‘operator error’ with retraining as the sole corrective action. That pattern indicates a reactive culture, not a process-driven one. For high-mix, low-volume contract manufacturing — CNC machined parts, sheet metal assemblies, injection-molded components — the corrective action loop is where you distinguish suppliers who prevent escapes from those who simply react to customer complaints.

RULE OF THUMB: A corrective action report that closes in under 48 hours for a complex nonconformance is almost always superficial. Real root cause analysis on a process failure takes time. Fast closure can be a sign of a check-the-box QMS.

Certification should be one filter in a multi-layer qualification process — not the only one. Here is how to use it effectively in a sourcing workflow. RFQ stage: Require current certificate documentation as a go/no-go gate. Define acceptable registrars and scope language in your supplier qualification requirements. Do not accept self-declarations of conformance as a substitute. Supplier qualification: Combine certificate verification with a supplier questionnaire targeting Clauses 7.1.5, 8.4, and 8.5. For critical or flight hardware, conduct an on-site or remote audit before first purchase order. Ongoing monitoring: Set a calendar reminder to re-verify certificate status annually. Incorporate QMS status into your supplier scorecard alongside OTD, PPM defect rates, and responsiveness metrics. Flow-down requirements: When your own customers impose quality flow-downs on your organization, map those requirements to your supplier’s QMS clauses. Ensure your purchase orders reference applicable standards, drawing revisions, and special process approvals explicitly — verbal agreements are not auditable evidence. Nimble’s sourcing process includes documented quality flow-downs on every purchase order issued into the partner network, with CMM inspection reports available as standard deliverables — not an upcharge.

Before placing a critical order with any ISO 9001-certified supplier, work through this evaluation checklist:

• Certificate active? Verified directly through registrar database, not from supplier-provided PDF alone.
• Scope covers your process? Confirm machining, fabrication, molding, or applicable process is explicitly within scope.
• Registrar is IAF-accredited? Verify on the IAF database or the registrar’s own ANAB/UKAS listing.
• Surveillance audits current? Ask for the last surveillance audit date and whether any major nonconformances were raised.
• Calibration system in place? Request evidence of NIST-traceable calibration for key measurement equipment.
• Sub-supplier controls documented? Review Clause 8.4 procedure and Approved Supplier List.
• Corrective action system active? Request a sample CAPA with root cause methodology visible.
• First article capability? Confirm whether FAI per AS9102 or internal first article is standard or optional.

This checklist applies whether you are sourcing five prototype parts or a 5,000-piece production run. The risk profile scales — your diligence should too.

FOR AEROSPACE AND DEFENSE BUYERS: ISO 9001 certification alone will not satisfy AS9100 flow-down requirements from Boeing, Lockheed, Raytheon, or similar primes. Verify AS9100 Rev D registration specifically, and confirm OASIS database listing for aerospace supply chain work.

READY TO SOURCE?

Table of Contents

Related Services

Get a Quote in 24h

Upload your drawing and get a detailed quote with free DFM review.