Supplier risk is not a single quality score. It is the probability that a source will fail you in one of several distinct ways — late delivery, silent substitution, a certificate that does not cover the process you need, a plant that cannot actually run your volume, or simply an owner who closes the doors with your tooling inside. Each failure mode has a different tell, and each one can be checked before you commit. The point of a risk assessment is not to find a perfect supplier, because none exist. It is to know in advance which failure mode you have accepted, and to price and plan for it.
This guide is written for the buyer or sourcing engineer qualifying a new PCB or PCBA source. It is deliberately different from general supply-chain resilience planning — that broader topic, covering lead-time buffers, geographic diversification and tariff engineering, is treated in PCB supply chain risk management. Here the scope is narrower and more immediate: how to score a specific candidate supplier before placing the first order. For the deeper audit once you are already engaged, see supplier audit.
At Huaxing PCBA we are on the other side of this assessment every week, and we build our own readiness around the same eight dimensions below, under IATF 16949 and ISO 9001 across 8 SMT lines. A supplier who can answer all eight clearly, with evidence rather than adjectives, is a supplier worth the effort. One who deflects more than two is not.
Why the Assessment Must Precede the Order
Once a product is running, switching suppliers is expensive — new tooling, new first-article approval, new reliability testing, new documentation, and the schedule risk of the transition itself. That cost is what locks buyers into a bad source. The assessment is therefore worth doing thoroughly before the first order, when the switching cost is still zero. After the second order, every problem you discover has to be weighed against the cost of moving, and most buyers choose to absorb the problem instead. That is how bad suppliers accumulate.
The commercial reality is that qualification effort is front-loaded and cheap, while remediation effort is back-loaded and expensive. A two-week qualification that stops you onboarding the wrong source saves months. The eight dimensions below take a buyer perhaps a day of work, most of it reading documents the supplier can supply immediately.
Key Takeaway: Do the risk assessment before the first purchase order, not after. Before the order your switching cost is zero and you can walk away; after it, every discovered problem competes against the cost of requalifying, and the problem usually wins.
The Eight Dimensions of Supplier Risk
Score each dimension on a simple three-point scale — verified, claimed, or absent — and weight by how much the failure would cost you. The dimensions are ordered by how often they cause real failures, not by how easy they are to check.
Certification scope — does the certificate cover your process?
The most common trap in PCB sourcing is a supplier who holds a valid certificate for a scope that does not include the process you are buying. An ISO 9001 certificate for bare-board fabrication does not cover assembly. An IATF 16949 certificate at one site does not cover a sister plant. A UL mark on the laminate does not certify the finished assembly. Ask for the certificate with its scope statement and issuing body, and check that the process you need is named. A certificate without a scope statement is decorative. See PCB certifications and compliance and, for the automotive-specific case, AS9100 supplier certification.
Process capability — can the plant actually hold your tolerances?
Not every fabricator can hold every spec. Minimum line width, minimum annular ring, layer count, controlled impedance, via-in-pad fill and fine-pitch assembly all have real capability floors. Ask for the process capability document and compare it against your design's actual requirements — not the requirements you wish you had. A supplier who quotes a 0.075 mm line width is not necessarily able to yield it. Ask what their demonstrated capability is, and on how many production lots. See IPC-2221 design rules and fabricator capability.
Capacity and loading — do you fit, or fill a gap?
A supplier with spare capacity is a supplier who will prioritise you; a supplier running at 105% will push your order behind their favourites when a large customer pulls a schedule forward. Ask for their current utilisation and their largest customer as a share of throughput. If one customer is more than a third of their volume, you are structurally subordinate to that customer's schedule. See reading line utilisation numbers for how to interpret the figures they give you.
Component sourcing and traceability — can they prove what is on the board?
Counterfeit and out-of-spec components enter through the grey market, and a supplier who buys from brokers cannot always tell you where your parts came from. Ask how they source, whether they buy authorised or open-market, and what traceability they retain. Ask to see a sample of their incoming-inspection records. A supplier who can produce lot-level traceability from authorised distribution is worth a premium over one who cannot. See counterfeit component verification and supplier PPAP.
Quality system maturity — documented process or tribal knowledge?
A mature quality system produces evidence as a matter of routine: control plans, PFMEA, inspection records, corrective-action logs, calibration schedules. An immature one relies on a few experienced people who remember how things are done. The tell is in the documents you can request. Ask for a control plan, an FMEA, a calibration schedule, and a recent 8D report. If they can produce all four without being coached, the system is real. See control plan and PFMEA and 8D report and CAPA.
Financial and ownership stability — will they still exist next year?
Financial failure is the risk buyers assess least and regret most, because it takes tooling, inventory and in-flight orders down with it. You cannot audit a supplier's books directly, but you can read the signals: how long they have operated, whether ownership changed recently, whether key staff turn over, whether they can be reached at a registered address, and whether they are willing to hold tooling in escrow. For the tooling side of this, see tooling and design-file ownership.
Documentation and IP protection — what happens to your files?
Your Gerber, BOM and design files are the most valuable thing you send a supplier, and the risk is not only that they leak but that you lose control of them on exit. Confirm that a signed NDA is in place before any file transfer, understand who inside the supplier can access the data, and establish in writing that design files and tooling are your property and transferable. See supplier NDA and IP protection.
Communication and responsiveness — how do they behave under a problem?
The cheapest risk signal to measure is also one of the most predictive: how the supplier responds when something is difficult. Send a technically detailed question and observe the reply. Do you get an engineer's answer or a sales deflection? Do they push back on a spec they cannot hold, or accept everything and disappoint later? A supplier who says no clearly and early is safer than one who says yes to everything. Test this before you commit, because it does not improve with volume. See quote comparison for how to read the answers you get back.
Scoring the Dimensions Into a Go / No-Go
Once each dimension is scored as verified, claimed or absent, weight it by the cost of that failure to your specific product, then set a threshold. A consumer accessory can tolerate an absent score on dimension six; a medical or automotive product cannot tolerate an absent score on dimension one. The weighting is product-specific, which is why a generic supplier scorecard copied from the internet is close to useless.
A workable structure:
| Dimension | Verified = 2 | Claimed = 1 | Absent = 0 |
|---|---|---|---|
| Certification scope | Scoped certificate names your process | Certificate exists, scope unclear | No certificate for the process |
| Process capability | Demonstrated capability doc, lot history | Verbal capability claim | Cannot state capability limits |
| Capacity / loading | Spare capacity, diversified base | At capacity, unclear bookings | Overloaded or single-customer |
| Component traceability | Lot-level, authorised distribution | Broker sourcing, partial records | No traceability records |
| Quality maturity | Control plan, FMEA, 8D all produced | Some documents, ad hoc | Tribal knowledge only |
| Financial stability | Long tenure, stable ownership, escrow OK | Recent, opaque, escrow refused | Will not discuss |
| IP protection | NDA signed, access controlled, transfer terms set | NDA only | No NDA before file transfer |
| Responsiveness | Engineer answers, pushes back on spec | Sales answers, vague | Non-responsive to technical questions |
Score a candidate, then apply a rule: any zero on a dimension your product treats as critical is a stop, regardless of the total. A supplier who scores sixteens across the board but zero on certification scope is a supplier who cannot legally ship your automotive product, and the total hides that. The stop rule keeps a strong average from papering over the one failure you cannot accept.
Red Flags That Should End the Qualification Early
Some signals are strong enough on their own to end a qualification without completing the full assessment. Recognising them saves the cost of an assessment you do not need to finish.
Unwillingness to provide a certificate scope. If a supplier sends a certificate image but will not state what the certificate covers, the scope is probably narrower than the conversation implies. This is the single most common form of supplier exaggeration, and it is disqualifying for regulated products.
Pricing far below the market with no explanation. Legitimate cost advantages come from scale, automation, geography or vertical integration, and a supplier should be able to explain theirs. A price a third below the field with no story behind it is usually paid for elsewhere — in material substitution, in unchecked component sourcing, or in a quote that will not hold. See PCB cost factors for the legitimate drivers.
Refusal to allow a factory visit or a third-party audit. Even for buyers who will never visit, the willingness to be audited is a signal in itself. A supplier who resists third-party inspection has something the inspection would find.
Pressure to commit volume before a first article. A supplier who wants a firm annual commitment before proving they can build one good board has the risk backwards. Prove the first article, then discuss volume. See first article inspection.
Procurement tip: Ask three suppliers the same technical question and compare how they answer, not just whether they answer. The one who returns a specific, bounded reply — including the spec they cannot hold — is telling you what the other two are hiding. Responsiveness under a hard question is the cheapest predictive signal in supplier assessment.
Turning the Assessment Into an Ongoing Control
A risk assessment that ends at qualification is a one-off, and suppliers change: ownership shifts, key engineers leave, a large customer arrives and absorbs capacity, a certificate lapses. Convert the eight dimensions into a light annual review rather than a one-time gate. Re-score on the same scale once a year, and immediately if any of the change signals appear. The value is in the trend — a supplier drifting from mostly-verified to mostly-claimed is a supplier preparing to fail you, usually a quarter or two before it happens.
Tie the review to your incoming quality data, so the subjective scores are anchored to objective results. If dimension two (process capability) was scored verified but your incoming defect rate is climbing, one of the two is wrong. Let the data override the assessment, not the other way around. See AQL sampling and outgoing quality control for the receiving-side measures that anchor the review.
Summary: Know Which Failure Mode You Have Accepted
No supplier is risk-free, and chasing a perfect score wastes effort on suppliers no better than the ones you already have. The purpose of the assessment is to make the accepted risk explicit: to know which of the eight failure modes you have taken on, to price it, and to plan around it before the first order rather than after the tenth. Score the eight dimensions, apply the stop rule for anything critical, and re-score annually. That discipline is what separates a sourcing programme from a series of purchases.
At Huaxing PCBA we are assessed on these dimensions constantly, so we keep the evidence ready: scoped IATF 16949 and ISO 9001 certificates, process capability documents, control plans and PFMEA on request, and tooling and design-file terms you can hold us to. Send your Gerber and BOM and we will return a quote with the qualification documents you need inside 24 hours, or talk to our engineering team about qualifying a new source for a critical product.
