No—a quality-management-system certificate is a starting point, not a product approval. It can support confidence that an organization has defined processes, but it does not prove that a proposed material source, manufacturing route, subcontractor, first production run or delivered lot meets your special-alloy fastener requirements.
A useful qualification decision separates four questions: Can the organization manage quality? Can the proposed route make this part? Has a representative production configuration been verified? Does the actual order carry the required release evidence? Treating those questions as one checkbox is how buyers approve a supplier on paper and discover the real gaps after production begins.
What the ISO certificate tells you—and what it does not
ISO 9001:2026 specifies requirements for establishing, maintaining and improving a quality management system [1]. In September 2026 it replaced the 2015 edition, with transition arrangements applying to existing certifications. A buyer should therefore review the certificate’s standard edition and transition status rather than assuming that a 2015 certificate became meaningless overnight.
Check the certified legal entity, address or site, activities and product scope, certification body, issue and expiry dates, certificate status and exclusions or boundaries. Then compare that scope with the facility and processes proposed for your order. A certificate for distribution or general machining at one site does not automatically cover heat treatment, special processes or work performed by another facility.
Certification also does not approve a specific alloy, drawing, finished-product standard, inspection plan or subcontract route. Those belong in technical qualification and order control.
Use four qualification gates, not one approval box
| Gate | Decision | Evidence to review | Approval boundary |
|---|---|---|---|
| 1. Organization and QMS | Can the organization control requirements, external providers, measurement, nonconformance and records? | Questionnaire, relevant certification, audit findings, responsibilities and record controls. | Approves the organizational baseline, not a product or process. |
| 2. Proposed technical route | Can the planned material source, forming or machining, heat treatment, thread process, finish and inspection route meet this order? | Process flow, source list, quality plan, capability evidence and subcontract controls. | Applies only to the reviewed route and controlled changes. |
| 3. First production verification | Does a representative production configuration meet the defined design record? | FAI or initial-sample record, characteristic list, drawing revision and discrepancy closure. | Applies to the verified configuration; it is not blanket approval of future changes. |
| 4. Order and lot release | Do the delivered items and records comply with the actual PO? | Material, process, dimensional, thread, test, traceability and release package. | Applies to the stated lot, coverage and acceptance basis. |
Match qualification depth to purchasing risk
ISO 19011:2026 provides guidance for audit programs and conducting management-system audits, including evidence- and risk-based approaches [2]. It does not make an onsite audit mandatory for every order. The qualification route should reflect the consequence of failure, design maturity, material and process complexity, external-provider dependence, past performance, replaceability and customer or regulatory requirements.
| Purchasing situation | Proportionate starting controls | Possible additional controls |
|---|---|---|
| Established, replaceable item with stable requirements | Scope review, questionnaire, certificate verification, sample documents and order controls. | Targeted remote review if evidence or performance is unclear. |
| Drawing-based alloy fastener with heat treatment or subcontract processes | Technical route review, approved sources, quality plan, first article or initial sample, traceability and change notification. | Remote or onsite process audit, witness point or independent test where risk justifies it. |
| Customer-critical or regulated application | Customer-defined approval route, source restrictions, formal quality clauses, FAI, hold points and complete release package. | Customer or third-party audit and continuing surveillance according to the governing program. |
Qualify the route, including sub-tier suppliers
For a special-alloy fastener, the technical route may include raw-material production or stocking, cutting, forging or machining, thread rolling or cutting, heat treatment, surface treatment, cleaning, marking, inspection, testing and packing. The organization quoting the order may not perform every step.
Request a route that identifies which operations are internal and which are outsourced, who controls each external provider, how specifications and revisions flow down, how incoming and returned work is identified, and what records remain linked to the manufacturing lot. A capability brochure is not a process flow, and a list of equipment is not evidence that the equipment, people and method are qualified for the requested part.
ISO 10005 gives guidance for establishing and applying quality plans to a specific product, project or contract [3]. A practical order quality plan can identify operations, characteristics, responsibilities, inspection stages, witness or hold points, records and release authority without turning the RFQ into a generic audit checklist.
FAI verifies a controlled production configuration
A first article inspection should connect the design record to a representative production result. SAE AS9102C establishes requirements for performing and documenting FAI when that aerospace standard is contractually invoked [4]. Outside aerospace, buyers may use an initial-sample or pre-production approval process, but the purpose and deliverables still need to be defined.
State the drawing and revision, part number, material and process configuration, characteristic list, actual or attribute results, nonconformities and approval status. Define what triggers a full or partial repeat: design revision, material or source change, process or tooling change, facility transfer, interruption, corrective action or another customer-defined event.
A photograph, sales sample or one-off prototype is not automatically an FAI. A passed FAI also does not prove that every later lot conforms; routine production still requires the agreed process controls and lot-release evidence.
Traceability and change control must share one baseline
The controlled baseline may include drawing revision, purchase specification, approved material and source, manufacturing site, process flow, external providers, special-process parameters, inspection method, packaging and marking. A ‘no changes’ clause is weak if it does not identify this baseline and the changes that require notification or approval.
Traceability should link purchase line, part and revision, raw-material heat or batch, manufacturing lot, heat-treatment or subcontract lot, inspection and test records, concessions or rework, and final packaging. The MTC, PMI and inspection-evidence guide explains what each record proves inside that chain.
Set notification timing, required comparison or validation evidence and approval authority. Emergency source changes and equivalent-material proposals need the same discipline; a commercial need does not make an engineering substitution self-approving.
NCR, disposition and corrective action are different controls
A nonconformance report records the failed requirement, affected product and quantity, containment, investigation status, proposed disposition and authorization. Disposition may include rework, repair, use-as-is under an approved concession, return or scrap. State who can approve each path and what reinspection or updated evidence is required.
Corrective action addresses why the nonconformance occurred and how recurrence will be prevented. An 8D is one possible structured method, but it should not be requested automatically for every minor issue. Severity, recurrence, escape risk and customer rules should determine whether a simple correction, root-cause analysis or full formal response is appropriate.
Keep affected-lot identification, containment, disposition, reinspection and updated certificate or report references connected. Closing an NCR administratively is not the same as demonstrating that the delivered lot now meets the purchase requirements.
Qualification continues after the first approval
Initial approval can become stale. Monitor the indicators relevant to the purchase: escapes, repeat nonconformities, concession frequency, documentation errors, traceability breaks, response and corrective-action effectiveness, delivery reliability, unauthorized changes and audit closure. Use trends and severity, not a single score detached from context.
Define re-evaluation triggers such as long inactivity, ownership or site change, certificate status change, major process transfer, significant nonconformance, repeated late corrective actions or expansion into a new material or process scope. ISO 10012:2026 can support review of measurement-process controls where inspection reliability is central [5].
Nine clauses to include before requesting a quotation
- Product, drawing number, revision and applicable purchase specifications.
- Material specification, product form, condition and any approved-source restrictions.
- Proposed internal and subcontract manufacturing route.
- Required supplier approval route: document review, remote review, onsite audit or customer approval.
- FAI or initial-sample scope, format, approval authority and repeat triggers.
- Heat, manufacturing-lot, process-lot and packaging traceability.
- Changes that require notification or written approval.
- NCR, concession, reinspection and corrective-action requirements.
- Final inspection, test, third-party and document-release package to be priced.
For drawing-based special-alloy fasteners, send these clauses with the drawing or BOM through the BYBOLT RFQ form. BYBOLT works with material and manufacturing partners; the proposed route, inspection, documentation, issuing parties, sampling, cost and schedule are reviewed for the specific enquiry rather than implied by a generic supplier approval.