Technical and quality supplier qualification: PPAP, certificates, 8D and audits

What is technical and quality supplier qualification?

Commercial qualification answers whether you can buy from a supplier: legal entity, tax, sanctions, insurance, bank details. Technical and quality qualification answers whether the supplier can make your part to specification, every time. In a manufacturer that means four things: a certified quality system that covers the site and process, an approved production part (PPAP or first article), capable processes on the characteristics that matter, and a working loop for non-conformities and corrective actions.

ISO 9001 clause 8.4 asks you to set criteria for evaluating, selecting, monitoring and re-evaluating external providers based on their ability to supply conforming product. IATF 16949, AS9100 and ISO 13485 add sector rules on top. The commercial side is covered in the supplier qualification guide for manufacturers; this guide covers the quality side.

How do you check ISO 9001, IATF 16949, AS9100 and ISO 13485 certificates?

A certificate PDF proves little on its own. Check four things on each one: that the certification body is accredited (or, for IATF 16949, recognised by IATF), that the scope covers the product and process you buy, that the site on the certificate is the site that makes your part, and that it is in date. Then confirm it in the public register.

Where do APQP and PPAP fit?

APQP (Advanced Product Quality Planning) is the AIAG framework for developing a new part with a supplier, in five phases: plan and define the program; product design and development; process design and development; product and process validation; and feedback, assessment and corrective action. PPAP is the evidence package at the end of the validation phase: it shows that the production process, run at rate with production tooling, makes parts that meet every requirement. IATF 16949 clause 8.3.4.4 requires a product and manufacturing process approval process; in automotive that is PPAP or the customer's equivalent, such as VDA 2 for German OEMs.

What are the 18 PPAP elements?

The AIAG PPAP manual lists 18 elements. Not every submission needs all of them; the submission level and the customer decide which are sent and which are kept at the supplier.

What are the PPAP submission levels?

The level says what the supplier sends and what it keeps available for review. At every level the supplier holds the full set of records.

How do you review a PPAP package against the drawing?

The review is a comparison: every report against the drawing, the specification and your customer-specific requirements. Much of the effort goes on finding the values, not on judging them.

1. Check the package is complete for the level requested

   List what the level and your customer-specific requirements call for and check each element is there, legible and for this part. A missing MSA or a PFMEA copied from a sister part are typical reasons a PPAP comes back.

2. Check identity and revision on every document

   Part number, drawing revision and engineering change level must match across the PSW, the dimensional report, the control plan and the test reports. A report against revision B in a revision C submission is a rejection, however good the numbers are.

3. Compare each dimensional result with the drawing

   Every characteristic on the drawing should appear in the dimensional results, ballooned, with nominal, tolerance and measured value. Check the reported nominal and tolerance against the drawing, not just the pass or fail column.

4. Check capability against your requirement

   For special characteristics, compare Ppk or Cpk with the value your customer-specific requirements set, or with the AIAG default if you have none. Check the study used enough parts and a measurement system that passed MSA.

5. Check material and test reports against the specification

   Material grade, chemistry and mechanical properties against the drawing's material callout; test methods and lab scope against the specification. Material certificates should carry heat or lot numbers you can trace to the parts submitted.

6. Check consistency between PFMEA, control plan and flow diagram

   Every process step in the flow diagram should appear in the PFMEA, and every high-risk failure mode should have a control in the control plan with a reaction plan.

7. The quality engineer decides

   Approve, approve on an interim basis with a deviation and an action plan, or reject. The decision, the reason and the documents go on the supplier's record.

This is what a value-by-value check looks like. Illustrative example with sample data, not a customer record.

What about first article inspection and material certificates?

Outside automotive, the same evidence often comes as a first article inspection report. In aerospace, AS9102 defines it in three forms: part number accountability, product accountability (materials, special processes, functional tests) and characteristic accountability (every design characteristic with its result). A first article is repeated after a change in design, process, site or tooling.

Material certificates and lab results are checked against the drawing and the material specification: grade, chemistry, mechanical properties, heat treatment condition, and the type of inspection document required, such as an EN 10204 3.1 certificate. The heat or lot number on the certificate should trace to the parts delivered, and the lab that issued the results should be accredited for the method used.

How do you manage non-conformities and 8D reports?

When a supplier ships non-conforming parts, you open a non-conformity, contain the stock and ask for a corrective action, usually as an 8D report. The 8D only works if each step is checked, not just received:

• D0: plan the response and decide whether an 8D is needed.
• D1: form the team with the people who know the process.
• D2: describe the problem: what, where, when, how many, how detected.
• D3: contain it: stock at your site, in transit and at the supplier is sorted or quarantined.
• D4: find and verify the root cause, both why it occurred and why it was not detected.
• D5: choose permanent corrective actions and verify they work.
• D6: implement them and validate the result over time.
• D7: prevent recurrence: update the PFMEA, the control plan and the work instructions, and apply the fix to similar parts and processes.
• D8: close the 8D and recognise the team.

The common failure is an 8D that stops at D3 or names a root cause like "operator error" with no verification. Track each open 8D by date, check that D4 explains both occurrence and escape, and check at D7 that the PFMEA and control plan were actually updated. Open and late 8Ds belong in the supplier's quality score.

How do you prepare supplier audits and follow up the action plan?

Before an on-site process or system audit, the auditor needs the supplier's file in one place: certificates and scope, the last audit report and its open findings, PPAP status by part, open non-conformities and 8Ds, and delivery and rejection history. After the audit, each finding becomes an action with an owner, a due date and the evidence that closes it. Findings stay open until the evidence is reviewed, not until the supplier says they are done.

Re-qualification runs on the same record: certificates re-checked before expiry, PPAP resubmitted on changes, audits scheduled by risk. How the quality record combines with financial, sanctions and ESG data is covered in the guide to supplier risk monitoring.

What does Traza do in quality qualification, and who signs off?

Traza is a source-to-pay suite run by AI agents. It runs as your suite and system of record, or on top of the SAP, Ariba, Coupa or Oracle you keep. In supplier qualification, Nora covers the quality side as well as the commercial one:

• Certificates: reads ISO 9001, IATF 16949, AS9100 and ISO 13485 certificates for certification body, accreditation, scope, site and expiry, and asks the supplier for the renewal before it lapses.
• PPAP: emails the supplier the list of elements for the level you request, follows up on what is missing, checks the package is complete and compares each report with the drawing value by value: part number, revision, tolerances, material and capability indices against your requirement.
• First article and material certificates: reads the report and the certificates against the drawing and the material specification, including heat or lot traceability.
• Non-conformities and 8Ds: keeps each 8D open by discipline, chases the supplier by email for overdue steps and checks that the root cause and the PFMEA and control plan updates are there before closure.
• Audits: prepares the supplier's file for the auditor, reads the audit report and tracks every finding and action to closure with its evidence.

Suppliers work by email, with no portal and no account. Your quality engineer gets one review in Microsoft Teams or Slack with what passed, what is out of tolerance or missing, and the source of each value. The checkpoints stay with people: the quality engineer reviews the flags and signs off the PSW; your auditor visits the site; the certification body issues the certificate; the lab runs the tests. Traza reads their output, keeps it on the supplier's record and writes the approval to your ERP only after the engineer signs.

To see the PPAP check on one of your own parts, book a call.

Frequently asked questions

This article is for information and is not legal advice. Practices and references are for the United States; check what applies to your contracts and your state.