CNC Supplier Audit Checklist: Evidence Before Capability Claims

Set the audit objective and scope

Define why the supplier is being assessed, which legal entity and physical site are in scope, which part families or processes matter, and what evidence is required. ISO 19011 describes management-system auditing as a systematic, independent, documented, evidence-based process and emphasizes risk-based planning.

A generic factory tour is not enough. Build the audit around the risks of the intended work: material identity, critical tolerances, special processes, regulatory documentation, capacity, and supply continuity.

Follow a representative production route

Select a comparable part or critical feature and trace it through contract review, process planning, material receipt, programming, setup approval, machining, in-process checks, final inspection, release, and record retention. Compare written procedures with actual records and observed practice.

Review whether the machine, fixture, cutting strategy, measurement system, and personnel competence are suitable for the requirement. For tight or safety-related characteristics, ask how measurement capability and uncertainty are addressed.

Verify external processes and traceability

Heat treatment, coating, plating, testing, and other special processes may be subcontracted. Identify each external provider, how it is approved, what purchase requirements are flowed down, and how certificates and lot identity return to the finished part record.

Trace material from certificate and receiving record to work order, in-process identification, finished lot, and shipping documents. Sampling one complete trail is more informative than collecting isolated certificates.

Review control when something changes or fails

Examine nonconformance segregation, disposition authority, corrective action, customer notification, engineering change control, program revision control, and prevention of unintended use. Ask for a recent example with sensitive commercial information removed.

Close with evidence and actions

Classify findings by risk, identify the evidence reviewed, assign owners and due dates, and define what must be verified before production approval. Certification may support the assessment, but it does not replace verification of the actual site and process scope.