Dewey Wu General Manager & senior mechanical engineer at EPOC CRAFTER, 15 years in design engineering, quality, and metallurgy. Hands-on across CNC machining, metalwork, sheet metal, and prototyping (subtractive + 3D printing).
CNC supplier evaluation succeeds or fails on four checks: the scope on the QMS certificate, the numbers on a First Article Inspection report, the shop’s response to a pilot order, and the industry-specific paperwork the program requires. Everything else on a capabilities page is context, useful for shortlisting, not for qualifying. This guide walks each check in the order a purchasing engineer runs them, with clause references, tolerance realities, and version boundaries that separate a real evaluation from a marketing tour. The scope covers CNC machining suppliers for general precision parts, automotive programs under IATF 16949, and medical device components under ISO 13485 and the FDA Quality Management System Regulation that took effect 2 February 2026. Where a rule has changed recently or is often misquoted, the boundary is written out so you can quote it back to the supplier.
1. Verify the quality management certificate before the capability sheet
The certificate is worth reading first, not because it proves quality, but because the scope tells you what the quality system covers. A shop can hold ISO 9001:2015 with sheet metal in scope and CNC machining excluded. Read the scope line before the certificate number.
1.1 ISO 9001:2015 with Amendment 1:2024, the baseline every CNC supplier should hold
ISO 9001:2015 sets the QMS floor. Clause 4.3 defines the scope, so ISO 9001 certified without CNC machining in the scope line is not a certified CNC operation. Clause 7.1.5 requires calibration records for every CMM, micrometer, gauge, and thread gauge that accepts product, traceable to national or international standards. Clauses 8.5, 8.7, and 10.2 cover production control, nonconforming outputs, and corrective action.
Amendment 1:2024 added climate change requirements to Clauses 4.1 and 4.2. Any certificate issued before mid-2024 now runs under the amended text, so the supplier’s QMS documentation should reference Amd 1:2024, not 2015 alone.
ISO 9001:2026 remains at pre-publication stage as of the date of this article. A supplier advertising ISO 9001:2026 ready is describing intent, not a certified system. Our ISO 9001:2015 quality system with certificate No. 19826Q01185R001, valid through May 2026, runs under Amendment 1:2024 as the current auditable text.
1.2 IATF 16949:2016 for automotive CNC parts, and what the certificate scope must say
IATF 16949:2016 is the automotive QMS standard, built on ISO 9001:2015 with automotive requirements layered on top. Holding it does not make a shop better at non-automotive CNC work.
Clause 8.5.1.1 requires a Control Plan with defined characteristics, controls, sample sizes, and reaction plans; Annex A is normative. Clause 7.1.5.1.1 requires Measurement System Analysis on measurement systems that accept product, usually Gage R&R on CMMs and any gauge used on a control-planned characteristic. Clauses 8.4.1.2 and 8.4.2.3 cover supplier selection and QMS development.
Process capability sits in Clauses 9.1.1.2 and 9.1.1.3. IATF 16949 does not fix Cpk 1.33 as a universal requirement in its text. That number is a Customer Specific Requirement most OEMs apply, not an IATF universal. The IATF text sets the requirement to demonstrate capability and to define acceptance criteria in agreement with the customer. Read the CSRs before promising a Cpk number in the RFQ.
APQP, PPAP, FMEA, MSA, and SPC are AIAG Core Tools that CSRs make mandatory. Ask which PPAP level the supplier delivers by default, and request a redacted sample package to verify. Our workflow for IATF-aligned CNC parts for automotive programs documents the specific Control Plan and CSR-mapped deliverables the OEM has requested.
1.3 ISO 13485:2016 plus the FDA QMSR that took effect 2 February 2026
ISO 13485:2016 is the QMS standard for medical device organizations. The change to look at first is the FDA Quality Management System Regulation, QMSR, which rewrote 21 CFR Part 820 by incorporating ISO 13485:2016 by reference. QMSR took effect 2 February 2026. A supplier running an ISO 13485:2016 system with CNC machining in scope satisfies the QMSR framework directly. A supplier that held only the legacy QSR has documentation gaps to close, particularly around ISO 14971 risk file structure and Device History Record format.
The clauses that carry the weight for CNC supplier work: 7.4.1 requires the medical device organization to establish supplier evaluation and selection criteria (the clause behind every qualification form you fill out). 7.4.2 and 7.4.3 cover purchasing information and verification of purchased product. 7.5.6 covers process validation for processes whose output cannot be verified downstream. 7.5.9 covers identification and traceability, and 7.5.9.2 adds implantable device requirements.
ISO 13485 certified does not authorize implantable device manufacturing. The full path for how ISO 13485:2016 with CNC machining in scope maps to QMSR sits on the medical device parts page, including ISO 14971 risk file position and material traceability defaults.
1.4 How to authenticate a certificate without calling the registrar
A certificate scan is not proof. Certificate holders receive PDFs their staff can forward or edit. Three checks cover most of the risk.
Read the registrar name at the bottom of the certificate, then check that registrar’s public database. Most accredited certification bodies publish a search tool that returns issue date, expiry, and scope by certificate number. This catches stale or wrongly-attributed certificates fastest.
Check the accreditation mark. IAF Member registrars accredit certificates under bodies like ANAB, UKAS, and CNAS. Our certificates carry CNAS C178-M, internationally recognized under the IAF multilateral arrangement. A certificate without an accreditation mark is a self-declaration.
Cross-reference the scope line with the parts you plan to buy. A certificate listing sheet metal fabrication but not CNC machining is not a CNC certificate. A certificate naming design activities but leaving machining off the scope is a design system, not a manufacturing system.
Table 1. Three QMS certificates a CNC supplier evaluation runs into, side by side
| ISO 9001:2015 + Amendment 1:2024 | General precision CNC parts across industries. Baseline QMS. | 4.3 QMS scope; 7.1.5 monitoring and measuring resources with calibration traceability; 8.5 production and service provision; 8.5.2 identification and traceability; 8.7 nonconforming outputs; 10.2 corrective action | ISO 9001:2026 is not a released standard as of the date of this article. A supplier claim of certified to ISO 9001:2026 is intent, not evidence. |
| IATF 16949:2016 | Automotive CNC parts inside Tier 1 and Tier 2 programs. Layers automotive requirements on top of ISO 9001:2015. | 8.5.1.1 Control Plan with Annex A normative; 7.1.5.1.1 Measurement System Analysis; 8.4.1.2 supplier selection; 8.4.2.3 supplier QMS development; 9.1.1.2 and 9.1.1.3 process capability | Cpk 1.33 is not required by the IATF 16949 text. It is a Customer Specific Requirement most OEMs apply, not an IATF universal number. |
| ISO 13485:2016 + FDA QMSR (2 Feb 2026) | Medical device CNC components for Class I, Class II, and select Class III. Carries FDA QMSR relevance in the US market. | 7.4.1 supplier evaluation criteria; 7.4.2 and 7.4.3 purchasing information and verification; 7.5.6 process validation; 7.5.9 identification and traceability with 7.5.9.2 implantable requirements | ISO 13485 certified does not authorize implantable device manufacturing. Implantable work needs additional recordkeeping and customer qualification. |
2. Read the capability numbers, not the capability page
A capability page lists machine models, envelope, and material grades. That is the shortlisting layer. The qualifying layer is a set of measured numbers: FAI report, CMM report, Ra values on the surfaces you care about, and process capability data if the program calls for it. A capability page never carries these numbers. The DFM checkpoints that surface before the drawing is released sit upstream, so a supplier that closes DFM gaps at quote stage shortens the qualification cycle.
2.1 FAI (First Article Inspection) as the fastest tolerance-truth check
A First Article Inspection report tests whether a supplier can hold the tolerances on your drawing, not the ones on the marketing page. FAI covers every drawing characteristic, measured on the first production part off the setup that will run the batch, with the inspection method identified per feature. Two items to read on any FAI report.
Method column. A dimension called out as Ø8 +0.02/0 that lists “vernier caliper” as the inspection method fails the method check. A hole at that tolerance needs a gauge pin, plug gauge, or CMM. Method mismatch signals process maturity more directly than the measured value alone. How tolerance callouts translate onto a First Article Inspection report covers where general tolerances hand off to GD&T and which inspection method belongs on which feature.
Turnaround. The gap between drawing approval and FAI release shows how the supplier programs, sets up, and inspects a first part. On a 5-axis aluminum valve-block program, shop-floor data shows FAI released 2 business days from STEP approval; moving the spool bore to the final precision operation after cross-hole machining and deburring removed the size drift traced to burr removal and tool-pressure variation.
2.2 Ra values, CMM reports, and what in-house metrology covers
The “in-house CMM” claim appears on almost every CNC supplier’s capability page. The question is what the CMM does, not that it exists.
Most general precision drawings default to ISO 2768-1:1989 medium class for linear and angular dimensions. A general tolerance under ISO 2768-1:1989 the shop applies by default covers dimensions without individual callouts; CMM measurement earns its cost on individually-toleranced features, datum-referenced positions, form controls, and profile controls.
Ra values follow the same scrutiny. Ra 0.8 μm on a drawing tells you the roughness target; the CMM does not measure Ra. Roughness needs a contact profilometer or optical equivalent, with the cutoff and evaluation length recorded next to the reading.
Three checks on the metrology setup. Calibration path: every gauge and CMM used to accept product should trace to national standards through a calibration certificate; under ISO 9001:2015 Clause 7.1.5, the certificate should name the calibrating lab and the traceability standard. Environment: precision CMM work sits in a temperature-controlled room, since readings on a bore held to 0.02 mm are affected by 4 to 5 °C swings. Operator and strategy: a CMM report that evaluates every datum as a plane from three points is under-sampled for precision-critical features.
On a 316L stainless-steel fluidic valve-body program, shop-floor data shows Ra 0.4 μm max held on the wetted sealing face, verified with a contact profilometer after final machining and cleaning.
2.3 Process capability: what Cpk really tells you about a CNC line
Cpk describes how the process output distribution fits inside the tolerance limits, using historical variation data. Cpk 1.33 sits inside the tolerance with a comfortable margin; Cpk 1.67 sits well inside; Cpk under 1.00 means part of the distribution falls outside tolerance. Three misreadings show up in supplier evaluations.
Cpk as an IATF universal minimum. As covered in Section 1.2, Cpk 1.33 is a Customer Specific Requirement most OEMs apply, not an IATF universal. A supplier telling you “we hold Cpk 1.33 because IATF requires it” is quoting a CSR.
Cpk on a small sample. Cpk needs a stable process and enough data to describe the distribution. AIAG guidance treats 100 to 125 consecutive parts as a reasonable minimum for the calculation. Cpk claimed on five parts is a preliminary indicator, not a capability number.
Cpk on the wrong feature. Cpk is meaningful on the characteristics called out as critical to quality on the drawing. A supplier reporting Cpk on general tolerance dimensions and staying quiet on the tight features is optimizing the score. Ask for Cpk on the specific characteristics called out, not a program average.
On the aluminum valve-block program, shop-floor data shows Cpk 1.55 on the spool bore, with sample size, measurement method, and temperature documented on the Cpk report itself, not in an appendix.
2.4 Where AS9102 Rev. C applies, and where it does not
AS9102 Rev. C is the SAE aerospace standard for First Article Inspection reporting, defining the Form 1/2/3 structure aerospace customers require. It is aerospace by design; non-aerospace RFQs do not need it, and requiring it adds cost and cycle time without adding assurance.
AS9102 is a report format, not a broader qualification. AS9102-compliant reports are not evidence of AS9100 QMS certification or NADCAP process approval, both of which are separate qualifications.
3. What changes in a second-party on-site audit
Certificate and FAI cover the paperwork and the first-part evidence. The next question is whether the shop runs the way the paperwork claims. That is what a second-party audit answers.
A second-party audit is you or your customer auditing the supplier, distinct from the third-party registrar audit that produced the certificate. Certificates report third-party audit results; they do not replace a second-party visit when the program requires one.
A second-party audit examines the operational reality behind the QMS: Control Plan traceability from the drawing to the shop-floor station, calibration currency on the gauges and CMMs used for the program, NCR and CAPA trail on the last 12 months of similar work, operator qualification records, and how the shop handles a hypothetical drawing change mid-program. Before the visit, how NDA and file access work before an on-site or virtual audit needs settling: what CAD files travel with the auditor, what documentation stays on-site, what leaves the building.
Table 2. Audit types a purchasing engineer chooses between
| Third-party certification audit (by registrar) | Multi-day, annual | QMS conformance to the standard scope | Already done. Read the certificate and audit summary. | Whether the shop runs this way on your specific program |
| Second-party on-site audit (by buyer) | 1 to 3 days | Control Plan traceability, calibration currency, NCR trail, operator qualification, drawing-change handling, shop-floor conditions | High-value or high-risk programs, first-time supplier on regulated work, medical or automotive PPAP-driven programs | Long-term stability when the audit is a one-off |
| Second-party virtual audit (video walk-through) | Half-day to 1 day | Shop-floor visual, quality documentation snapshot, live Q&A with the quality lead | Shortlisting stage, geographic distance, follow-up on a specific finding | Machine calibration status, gauge calibration certificate details |
| Second-party desktop review (documentation only) | 4 to 8 hours | QMS manual, procedures, sample FAI, sample CMM report, sample NCR, calibration certificate list | Low-risk parts, non-regulated work, supplement to a registrar audit | Anything about how the shop runs the operations described |
Which audit type fits the program is a program-risk decision, not a procurement policy. A Class II medical device housing needs an on-site visit. A prototype aluminum bracket runs on the desktop review.
4. The pilot order is the audit that scales
An FAI answers whether the shop can hold your drawing on the first part. A pilot order answers whether the shop holds it across a release, batch after batch, at the delivery date the RFQ committed to. Pilot orders sit outside the QMS certificate and outside the audit report; they are the qualification data your program will use once the supplier is on the AVL.
Pilot size depends on program risk. Non-regulated precision parts move well on a 20 to 50 piece pilot when the FAI is clean, since the pilot answers repeatability and delivery discipline, not process validation. Regulated parts (medical, automotive PPAP-driven) sit on a larger pilot, closer to the first release quantity, because the pilot data feeds the process capability calculation and the PPAP package.
Drawing defects belong upstream at the geometry decisions that catch DFM gaps at quote stage; the pilot catches process-execution risk: material variance, fixture rigidity, deburr consistency, packaging protection, and paperwork discipline.
4.1 KPIs to track on the pilot and after
A useful pilot delivers four numbers that transfer directly onto the supplier scorecard once the program goes into production. Table 3 below gives the calculation, source, and preferred thresholds. The insights to watch alongside those numbers:
FAI turnaround. A supplier releasing FAI in 2 to 3 business days has programming, setup, and inspection running as a routine. Ten business days on a well-toleranced part means the constraint is workflow, not machining.
On-time delivery. A pilot that ships one day late is a slip. A supplier that treats a one-day slip as on-time will treat a five-day slip the same way when the program moves into production.
First-pass yield. Rework yield hides in “yield after rework” numbers; ask for the first-pass number and the rework routing separately.
RMA and NCR count. Zero NCR is a paperwork signal, not a quality signal: a shop running at scale has real NCRs, and a clean NCR trail with root-cause and CAPA closure is stronger evidence of quality culture than a zero count.
4.2 The supplier scorecard that survives contact with production
Most supplier scorecards carry either too many KPIs to read or too few to signal anything once the program is in production. Table 3 lays out the smallest set that keeps signal through a program.
Table 3. Supplier scorecard KPIs a CNC program can hold across production
| On-time delivery % | Releases shipped by committed date / total releases | PO and dock receipt | 95%+ for preferred supplier status; 98% for regulated programs | Capacity constraint, upstream material variance, QMS handling of drawing changes |
| First-pass yield | Pieces released at final inspection with no rework / pieces started | Final QA inspection records | 97%+ on precision CNC parts; 99% on regulated critical characteristics | Process drift, tool wear management, operator variance, drawing gaps |
| FAI turnaround | Business days from drawing and STEP approval to released FAI | Program change log, FAI release date | 3 to 5 business days on standard tolerance parts; 5 to 7 for tight tolerance or first-run | Programming queue, setup discipline, inspection queue, drawing clarity |
| RMA rate | Parts returned by customer / parts shipped over rolling 12 months | Customer complaint log and RMA record | Under 0.5% for precision CNC parts | Undetected drift, packaging protection, inspection gap on a specific characteristic |
| NCR closure time | Business days from NCR raised to CAPA verified effective | QMS NCR log | 30 to 45 business days on process NCRs; shorter on documentation NCRs | CAPA depth, root-cause analysis maturity, cross-function handoff |
| Cpk on drawing-critical characteristics | AIAG calculation over 100 to 125 consecutive parts | CMM data on critical dimensions | Per Customer Specific Requirement (commonly 1.33 or 1.67); IATF text does not fix a universal value | Process not centered, spread too wide for the tolerance, wrong process for the tolerance |
Once the pilot data lands inside these ranges, the transition into low-volume production runs on the same fixturing, setup, and inspection routine. See how the pilot lot transitions into low-volume production without re-qualifying the shop for the trigger conditions (design lock, tolerance stability, order regularity) that sit outside the qualification workflow.
5. Red flags that separate reliable CNC suppliers from risky ones
Red flags show up on paperwork or in the way the shop answers questions.
The certificate scope excludes the part type. An ISO 9001 or ISO 13485 certificate that names sheet metal, injection molding, or assembly and leaves CNC machining off the scope is not evidence of a CNC quality system. Shops sometimes present the certificate anyway.
The FAI method column is missing or wrong. An FAI that lists “measured” as the method for every dimension is not an FAI. Method mismatch on tight tolerances (vernier caliper on Ø8 +0.02/0) tells you the inspection routine does not match the drawing.
Cpk is quoted without sample size, method, or feature. “Our Cpk is 1.67” without which characteristic, on how many parts, measured how, at what temperature, is a marketing number.
Calibration certificates are absent or list unaccredited labs. A CMM used to accept product needs a calibration certificate that traces to a national standard, from an accredited lab. A calibration sticker on the machine with no certificate behind it is a housekeeping mark, not a QMS record.
The NCR log is empty. A shop running at production scale has NCRs. A clean NCR trail with root cause, CAPA, and closure evidence is a stronger quality signal than a zero-NCR claim.
The quality lead is unavailable during the audit or pilot. Program decisions during a pilot (drawing revision, first-article deviation, packaging change) need the quality lead on the call within one business day. A shop where the quality lead is booked into other audits or does not exist as a role for CNC work is a program-management risk.
The certificate holder name and the invoicing entity do not match. Certificates are issued to a legal entity at an address. A supplier where the certificate legal entity, the invoicing entity, and the shipping address do not resolve to the same operation may be brokering the work to a shop the certificate does not cover.
Any single flag has explanations. A cluster of three or more calls for a second look at whether the shop that ships the parts is the shop the certificate describes.
6. Industry-specific rules the general framework does not cover
Automotive, medical, and consumer electronics programs each add requirements the base ISO 9001 QMS does not carry.
6.1 Automotive CNC parts: PPAP package, IMDS, and the Control Plan at the machine
Automotive CNC work runs on the AIAG Core Tools, not on the ISO 9001 audit report. A PPAP Level 3 submission carries 18 elements, including the Control Plan, MSA studies, dimensional results (the automotive FAI equivalent), initial process studies, and a Part Submission Warrant. The pilot has to feed the initial process study, so a 5-piece pilot is not PPAP-capable.
IMDS (the International Material Data System) captures material composition down to substance level for every part shipped to an OEM. The IMDS entry needs the material grade, temper, coating, and any substances flagged under REACH or the OEM’s declarable substance list.
A Control Plan in the quality office does not run production. A Control Plan posted at the machine, with characteristics, control methods, sample sizes, and reaction plans at the station, does. Ask to see the shop-floor copy during the audit.
A supplier can run automotive programs under ISO 9001:2015 plus customer-specific APQP, PPAP, MSA, and special-characteristic requirements, without holding site-level IATF 16949 certification. Whether that model fits your program depends on the OEM’s supplier requirements manual. On the 5-axis aluminum valve-block program, shop-floor data shows the automotive customer accepted the ISO 9001 + CSR path, with Cpk 1.55 on the Ø12.000 +0.018/0 mm spool bore over 125 consecutive pieces, 99.6% on-time delivery across 12 releases, and 98.9% first-pass yield.
6.2 Medical device CNC components: traceability, ISO 14971, and the QMSR gap
Medical CNC work runs on FDA QMSR and ISO 13485:2016 requirements, with the OEM’s supplier quality agreement layered on top. Three items sit above the general framework.
Material traceability follows heat and lot from incoming receipt to final release, with the MTR tied to each part shipment. A supplier that ships stainless or titanium without a per-lot MTR cannot support the Device History Record the OEM has to keep. On the 316L fluidic valve-body program, shop-floor data shows 316L UNS S31603 per ASTM A276 solution-annealed bar, with heat and lot identity retained through final release, and passivation to ASTM A967 documented on the FAI package.
ISO 14971 risk file position sits with the OEM as the medical device manufacturer. The CNC supplier’s contribution is process risk documentation (PFMEA) and evidence that special processes (passivation, controlled cleaning, machining validation where output cannot be verified downstream) run under controlled conditions.
The QMSR gap (mechanism covered in Section 1.3). Ask for the gap assessment memo on the RFQ. On the valve-body program, shop-floor data shows 3 business days from drawing approval to released FAI (including CMM report, material traceability, surface-roughness record, and passivation documentation), 99.3% on-time delivery across 6 releases, 99.2% first-pass yield, and zero customer RMAs across 1,080 shipped pieces. The ISO 13485:2016 scope on that certificate covered contract manufacture of precision machined components for non-implantable medical devices; sterilization and sterile packaging sat outside the cited scope.
6.3 Consumer electronics and general precision parts: where standard scope is enough
Consumer electronics and non-regulated precision parts run under ISO 9001:2015 with Amendment 1:2024 as the baseline QMS. The inspection routine and cosmetic acceptance criteria change; the certificate stack does not.
Two additions sit on top of the base FAI plus CMM package. Coating thickness verification when parts ship with anodize, plating, or paint: Type II anodize film thickness runs 8 to 25 μm on most process specs, Type III (hard anodize) runs 25 to 50 μm, logged per lot on a coating gauge and included in the release paperwork. Cosmetic acceptance against a signed master sample, since a drawing does not describe visible finish acceptance: every batch runs against the same master, and any deviation triggers a signed engineering review before release.
On a consumer electronics launch for a compact sensing and connectivity module, shop-floor data shows Al 6061-T6 unibody enclosures with A-surface flatness held to 0.05 mm across 160 mm and heat-spreader contact-pad flatness held to 0.03 mm, finished in Type II black anodize with 12 to 18 μm coating thickness logged per lot against the master sample. The program ran 750 pilot pieces followed by a 3,500-piece launch, with 100% on-time delivery across 5 releases and 99.5% first-pass yield after final cosmetic and anodize inspection.
7. Where EPOC CRAFTER fits on this workflow
The workflow above is the one our qualification records run under. ISO 9001:2015 with Amendment 1:2024 covers precision CNC machining and inspection of metal components. ISO 13485:2016 covers contract manufacture of precision machined components for non-implantable medical devices, including machining, inspection, traceability, and controlled cleaning; sterilization and sterile packaging sit outside the cited scope. Automotive programs run under the ISO 9001 QMS plus customer-specific APQP, PPAP, Control Plan, MSA, and special-characteristic requirements, without a site claim to IATF 16949 certification.
The shop-floor data cited above sits on real production releases, documented in the case library of delivered CNC programs. Our end-to-end manufacturing that keeps CNC, finishing, and assembly under one roof is why the same documentation set moves through the shop without a vendor handoff at each step.
Send the STEP file, the drawing revision, and the industry the part ships into. The scope on the certificate, the FAI turnaround, and the KPI data will come back mapped to your program, not to a capability page.
Related Resources
ISO 2768 General Tolerances. How the default class flows onto every CNC drawing and where individual tolerances need to override it.
Quality & Certifications. Full scope of ISO 9001:2015 with Amendment 1:2024, CNAS C178-M accreditation, and certificate authentication path.
Case Library. Quality events and inspection reports on delivered CNC programs across industries.
Ready to Quote Your CNC Prototype?
Upload your STEP file and get a DFM review + quote within 12 hours.
No tooling cost. Minimum 1 part.
