CNC Supplier Audit: 15 Key Questions to Ask

A cnc supplier audit is a risk assessment, not a formality. Procurement managers who skip this step frequently encounter defects only after tooling is locked in or the first production batch has shipped. The objective is to confirm that the supplier can build the part correctly, inspect it accurately, and correct mistakes effectively.

This checklist is designed for professional buyers and engineers evaluating a supplier before awarding a production order. It is grouped by theme. Each question includes a short explanation and red flags to watch for. Use it as a starting point. Adapt it to the part, the material, and the criticality of the feature.

1. Documentation and Traceability

The first area to examine is the supplier’s ability to prove what they did. If a part fails in the field, you will need records that show the material, the machine, the operator, the tooling, and the inspection results. Without this, you cannot trace the failure back to a root cause.

1. Can you provide material certificates for each lot of stock used in this order?
2. Do you maintain full traceability from raw material to finished part?
3. How do you control revision changes to customer drawings?

Red flag: The supplier keeps material certs in a shared drive with no revision control. If they cannot tie a specific part to a specific heat number or mill lot, stop and ask how they handle recall scenarios.

Red flag: Drawing revisions are handled by email attachments. A controlled revision system is non-negotiable for production work.

When you request material certificates for a complex alloy like Inconel or a specific grade of stainless steel, the supplier should be able to link the certificate to the specific heat lot used in that particular run. For example, if you are ordering 500 units of a titanium aerospace bracket, the heat treatment certificate for the raw bar stock must correspond to the specific batch of material that was machined. If the supplier uses a mix of stock from multiple heats, they must segregate the material in the inventory system so that the final part can be traced back to its origin. This is critical for failure analysis. If a fatigue crack appears in the field, the engineer needs to know if the material was from a heat with a known inclusion problem or if it was from a standard commercial grade.

Drawing revision control is equally vital. Imagine a customer sends a revision 2 drawing via email, changing a hole diameter from 10mm to 10.5mm. The supplier’s ERP system should flag the old revision as obsolete. If the shop floor still has the revision 1 print on the machine, the resulting parts will be scrapped. A robust system prevents this. It ensures that when the operator loads the part program, the correct drawing version is referenced. Ask to see how they handle the transition between revisions. Do they re-issue work orders? Do they re-verify the first article? If they simply print the new drawing and start cutting, the system is weak.

2. Inspection and Verification

Machine capability means nothing if the inspection method cannot detect the defect. A supplier with a high-precision mill but no calibrated CMM or no proper gauging program is a liability.

4. What inspection methods do you use for critical dimensions, and how do you verify those methods?
5. How do you handle first-article inspection versus in-process inspection?
6. What is your procedure for handling a part that fails inspection?

Red flag: All dimensions are checked with a caliper or micrometer, even when the feature requires CMM or optical inspection. Ask for the inspection plan. If it is vague, the plan does not exist.

Red flag: Failed parts are returned to the supplier without a documented corrective action. This is a quality system failure.

Inspection plans should be specific. For a machined aluminum housing with a tight tolerance on a mating surface, a CMM is often required to verify the flatness and position. A micrometer can measure depth, but it cannot measure the angle of a chamfered edge or the concentricity of two bores. If the supplier claims to use “appropriate methods” but cannot specify which tool measures which feature, they are guessing. Ask for the inspection plan. It should list each critical dimension, the tool used, the tolerance, and the frequency of checking.

First-article inspection (FAI) is a checkpoint before production begins. For a batch of 10,000 parts, the FAI ensures that the setup is correct. If the first part is good, the next 9,999 are likely good, assuming the process is stable. However, FAI is not a substitute for in-process checks. During a long run, tool wear can shift dimensions. The supplier should have a plan for checking parts every hour or every shift. If they only check the first and last part of the run, there is a high risk of drift in the middle.

The handling of failed parts is a strong indicator of culture. If a part fails inspection, the supplier should quarantine it immediately. They should not just rework it and move on. They need to stop the process, investigate why it failed, and determine if other parts are affected. If a part is scrapped, the supplier should document the reason. Was it a setup error? Tool breakage? Material defect? This data is valuable for future prevention.

Inspection Item	Typical Method	Red Flag
Critical dimensions	CMM or precision gages	Calipers only, no calibrated gages
Surface finish	Comparator or profilometer	Visual inspection only
First article	Full drawing review	Spot check only
Material verification	Spectro or certs	No verification at all
Post-inspection	Statistical sampling	No sampling plan

Surface finish is often an overlooked area. A part may meet all dimensional tolerances but fail on surface finish requirements. For example, a pump impeller may require a specific Ra value to prevent cavitation. If the supplier relies on visual inspection to verify surface finish, they are not measuring the requirement. A profilometer provides objective data. Ask them to show you the profilometer readings for a recent part. Do they have a graph? If they just say “it looks smooth,” the inspection is subjective.

3. Equipment and Process Control

This section focuses on whether the machines, tools, and processes are under control. A machine that is out of calibration or using worn tooling will produce parts that drift over time.

7. What is your calibration schedule for machines and measuring equipment?
8. How do you manage tooling, and how do you verify tool wear?
9. What process controls do you use for critical features?

Red flag: Calibration certificates are expired or missing. Ask for the last calibration date and the next due date. If they cannot answer, the calibration program is not running.

Red flag: Tool wear is managed by “experience” rather than by measurement or tool life tracking. For high-volume runs, this is a significant risk.

Calibration is the baseline of trust. If a machine’s axes are not calibrated, every part it produces is wrong. Ask for the calibration schedule. For a CNC mill, this often involves checking axis positioning errors, backslash, and thermal growth. The certificate should show the date of the last check and the next due date. If a certificate is expired, the machine is out of control. Even if the parts still look okay, the tolerances are not being met.

Tooling management is another critical area. In high-volume production, tool wear is inevitable. If the supplier relies on an operator’s “feel” to know when to change a tool, the process is unstable. One operator might change a tool at 50% wear, while another might wait until 90%. This inconsistency leads to part-to-part variation. A controlled process uses tool life tracking. The machine counts the number of parts cut with each tool. When the count reaches the limit, the tool is changed automatically or flagged for replacement. Ask to see how they manage tooling for a critical feature, such as a fine-pitch thread. Do they have a standard tool life for that specific material and cut?

Process controls for critical features should be defined. For example, if a part requires a specific hole position relative to a datum, the supplier should have a method to verify this position frequently. They might use a pin gauge to check the position every hour. This is a process control. It is not just an inspection; it is a check that the process is staying within limits.

4. Labor and Training

A process is only as good as the people running it. Trained operators catch problems early. Untrained operators find them late, if they find them at all.

10. How are operators trained, and how is their competence verified?
11. What is your training program for new processes or new materials?
12. How do you handle operator turnover?

Red flag: Operators have no documented training records. Ask to see the training matrix. If it is a single line in a binder, the system is not real.

Red flag: The same operator handles all machines, all shifts, and all processes. This creates a single point of failure.

Training records should be specific. It is not enough to say “operators are trained.” The supplier should have a training matrix that lists each operator, the machines they are qualified to run, the processes they have been trained on, and the date of certification. For example, an operator running a 5-axis mill should be trained in coordinate system setup, tool offset programming, and collision avoidance. If they are not certified in these areas, they should not be allowed to run the machine.

New processes and materials require specific training. If the supplier introduces a new material like PEEK or a new process like EDM, the operators need to be trained on the specific challenges of that material. For instance, PEEK is difficult to machine due to its elasticity and heat sensitivity. Operators need to know the correct feed rates and coolant settings. If they do not have a training program for new materials, they will likely have high scrap rates and poor surface finishes.

Operator turnover is a constant risk in manufacturing. If an operator quits, the supplier needs a plan. Do they have cross-trained staff? If only one operator knows how to run a specific machine, and that person leaves, production stops. A strong supplier has a backup plan. They cross-train operators so that at least two people can run each critical machine. Ask them to show you their cross-training matrix. If it is sparse, the risk of downtime is high.

5. Corrective Action and Continuous Improvement

Every supplier will make mistakes. The question is how they handle them. A supplier with a weak corrective action process will repeat the same errors. A supplier with a strong process will use failures as input for improvement.

13. What is your procedure for handling customer complaints?
14. How do you track corrective actions to closure?
15. Do you conduct internal audits, and what do you do when you find nonconformance?

Red flag: Corrective actions are “closed” without a root cause analysis. Ask for the 8D or equivalent report. If they do not have one, they are not analyzing the problem.

Red flag: The same nonconformance appears in multiple audits. This indicates the corrective action did not work, or it was not implemented.

Corrective action is about fixing the system, not just the part. When a defect occurs, the supplier should not just rework the part. They need to find the root cause. Is it a machine issue? A tooling issue? A material issue? A human error? Once the root cause is found, they implement a fix. For example, if a hole is out of position due to a loose vise, the fix is not just to tighten the vise. The fix is to implement a torque check procedure for the vise bolts and to train operators on the importance of torque.

Tracking corrective actions to closure is essential. A corrective action is not closed until the fix is verified. The supplier should check the parts after the fix is implemented to ensure the defect has not returned. If they close the action without verification, the problem will likely reappear.

Internal audits are a way to check the quality system. The supplier should audit themselves. They check if the machines are calibrated, if the operators are trained, and if the inspection records are complete. When they find a nonconformance during an internal audit, they should treat it like a customer complaint. They should correct it and prevent recurrence. If the same issue appears in multiple internal audits, the corrective action is not working.

6. Practical Audit Approach

A cnc supplier audit is not a one-day event. It is a process. Plan for at least two visits. The first is a desk review. You examine documentation, calibration records, and quality plans. The second is a floor walk. You observe machines, talk to operators, and verify that the paperwork matches reality.

Bring a sample of the part you intend to order. Ask the supplier to produce a first article. Walk through the entire process with them. Watch how they handle a dimension that is slightly out of tolerance. Do they stop? Do they measure again? Do they call a supervisor? Do they document the result?

These small moments reveal more than any form. A supplier that treats quality as a system will respond with precision. A supplier that treats quality as an afterthought will respond with excuses.

During the floor walk, observe the work area. Is it clean? Are the parts organized? Are the tools in their designated places? A messy work area often indicates a lack of control. If parts are lying on the floor or tools are scattered, the risk of damage and confusion is high.

Talk to the operators. Ask them what they are doing. Ask them how they know the part is good. If they say “I check it with the caliper,” ask which dimensions they check. If they cannot answer, they are not following a plan. If they say “I follow the work instruction,” ask to see the work instruction. If the work instruction is vague or missing, the process is not defined.

Watch how they handle a problem. If a dimension is slightly out of tolerance, the operator should stop. They should measure it again. If it is still out of tolerance, they should follow the procedure. This might involve notifying a supervisor, quarantining the part, and starting a corrective action. If the operator just reworks the part and moves on, they are not following the system. This is a red flag. It indicates that quality is not a priority.

7. Red Flag Summary

Use this summary when scoring your audit results. It is not a pass/fail list. It is a risk assessment. Assign a weight to each item based on the criticality of the part and the complexity of the process.

• Documentation gaps: High risk for traceability, low risk for simple parts.
• Inspection method mismatch: High risk for critical features, low risk for non-critical dimensions.
• Calibration lapses: High risk for precision work, low risk for roughing.
• Training gaps: Medium risk for simple parts, high risk for complex multi-process parts.
• Corrective action weakness: High risk for any part, especially in high-volume production.

A cnc supplier audit is a tool. Use it to make a decision. The goal is not to find faults. The goal is to understand the risk. If the risk is acceptable, proceed. If it is not, renegotiate, require corrective actions, or find another supplier.