.png)
Supplier subcontracting should be visible and controlled before production, not discovered from a different factory stamp, inconsistent finish or failed inspection. Map which process will occur at which site, classify the consequence of failure, require the evidence appropriate to that process, flow the controlled requirements down, and record approval before affected work moves.
A blanket ban is not the only control. A supplier may propose outsourcing plating, heat treatment, printing, packaging, testing or overflow production. The importer still needs to know what is outsourced, decide what requires prior approval, and preserve traceability from the released requirement to the delivered lot.
Define the outsourced work before choosing a control
Use “outsourced process” here for work performed by another legal entity or unapproved site that can affect the ordered product or its evidence. It may include a complete manufacturing step, a special finish, assembly, packing, inspection, testing or production transferred during a capacity shortage.
Do not automatically treat every purchased input as the same problem. A catalogue fastener, a buyer-specified critical component and an unapproved second factory carry different consequences. The importer first needs a clear process boundary, then a control proportional to the failure risk.
The China factory audit checklist assesses capability at a named supplier or site. Subcontracting control begins when some work sits outside that assessed boundary.
Map every process, site and responsible party
Ask the primary supplier to map the proposed route from incoming material to packed goods. For each step, record who performs it, where it occurs, what requirement controls it and what evidence returns.
| Product or process step | Performing entity and site | Controlled requirement | Evidence returned | Approval state |
|---|---|---|---|---|
| Material or component | Named source where material identity is material | Grade, specification and approved substitution rule | Certificate, lot link or incoming check as applicable | Approved, conditional or hold |
| Manufacturing operation | Primary or sub-tier factory | Drawing, method and critical characteristics | Traveller, production record or inspection result | Approved, conditional or hold |
| Finish or treatment | Named process provider | Process specification and acceptance criteria | Process record or certificate where required | Approved, conditional or hold |
| Inspection or test | Named internal or external function | Method, sample and decision rule | Traceable report | Approved, conditional or hold |
| Packing and labelling | Named packing site | Released packaging and mark file | Pack-out evidence and final check | Approved, conditional or hold |
The exact record depends on the product and process. This table is a control map, not a universal document list.
An ISO 9001 Auditing Practices Group educational paper on external providers asks whether outsourced processes are considered and relevant controls are in place. It also warns that an approved-provider list or a certificate alone may not establish effective supply-chain control. The paper is audit guidance, not an endorsed ISO/IAF requirement; the control levels below are OPL's operational framework.
Classify the consequence, not the supplier label
Classify each outsourced step by what could happen if it fails or changes without notice. Use workflow labels rather than pretending they are regulatory categories.
| Control level | Typical operational signal | Minimum decision | Automatic escalation |
|---|---|---|---|
| Routine control | Low-consequence step with measurable output and reliable incoming verification | Disclose provider or site, flow current requirement, verify output | Repeated failure, unexplained site change or lost traceability |
| Heightened approval | Step affects fit, function, appearance, durability, identity or shipment evidence | Prior named approval plus process-specific evidence and verification plan | New provider, changed method, failed evidence or material nonconformance |
| Specialist hold | Safety, regulated conformity, mandatory testing, dangerous goods or specialised process validation may be affected | Qualified technical, regulatory or legal review before work | Missing specialist acceptance or unresolved product scope |
The risk is not determined by whether the sub-tier is large, certified or familiar to the primary supplier. It follows the product requirement, failure consequence, ability to detect failure and the strength of traceability.
Set the approval rule before work moves
Write the rule into the purchasing and supplier-control system before the supplier needs extra capacity. At an operational level, require the primary supplier to:
- disclose the process, site and provider before affected work begins;
- explain why outsourcing is proposed and whether it is temporary or ongoing;
- provide the evidence required for the assigned control level;
- flow the current requirements and change restrictions to the sub-tier;
- preserve lot and process traceability; and
- obtain written approval for a material provider, site or method change.
Whether those terms are enforceable, and which remedy follows a breach, is a legal and contractual question. This article does not supply contract wording. Its role is to define the operational decision and evidence the importer needs a contract or PO to support.
ISO's supply-chain guide identifies clear purchasing information, specific approvals and monitoring or inspections as relevant supplier controls. It does not require every supplier to hold ISO 9001 certification, and it distinguishes quality-management-system conformity from product or service conformity. A certificate should not replace process-specific evidence.
Build a process-specific approval pack
The pack should answer whether the proposed route can produce and prove conformity to the released requirement.
| Approval question | Evidence to request where relevant | Acceptance owner | Hold trigger |
|---|---|---|---|
| Who performs the work? | Legal entity, site, contact and relationship to primary supplier | Procurement | Unnamed or changing provider |
| Can the provider perform this process? | Relevant equipment, capability, personnel or prior-output evidence | Technical or quality owner | Capability not linked to the ordered process |
| What requirement will it receive? | Current specification, drawing, method, sample or work instruction | Product owner | Obsolete or incomplete revision |
| How will output be checked? | Inspection or test plan, acceptance criteria and responsible person | Quality owner | No agreed verification method |
| How will lots remain traceable? | Lot, batch, traveller or record linkage | Operations or quality | Output cannot be linked to provider and process |
| What happens when something changes? | Notification route, approval authority and affected-lot hold rule | Procurement and product owner | Change can proceed without review |
For a technical process, a qualified reviewer may need to inspect capability, method qualification, competence, calibration or test evidence. Do not convert those specialist decisions into a generic procurement tick.
Flow the controlled requirements to the sub-tier
The primary supplier should remain the importer's operational point of accountability unless the importer deliberately changes the commercial model. That means the primary supplier must show how the current requirements reach the sub-tier and how evidence returns.
Flow down only what the sub-tier needs, but do not omit controls that affect its work:
- exact specification or approved work instruction revision;
- critical characteristics and acceptance method;
- approved material, component, site or process restrictions;
- traceability and record requirements;
- nonconformance notification and hold authority;
- change-notification and reapproval triggers; and
- any product-specific legal or regulatory requirement confirmed by the qualified owner.
The product specification sheet owns the controlled product requirement. The quality-control plan owns the checks. Subcontracting control ensures the relevant parts of both survive the handoff.
Verify operation, not just paperwork
Match verification to the risk and what can be observed. Options include a remote evidence review, process-specific questionnaire, sample from the proposed route, first-output review, on-site assessment, independent inspection or a traceability exercise. None is automatically sufficient for every product.
If the outsourced route changes how the first intended-production output is made, consider whether the first article inspection process should be repeated or extended. That decision belongs to the technical and quality owners. Do not assume a golden sample made on the primary site's earlier route proves the sub-tier route.
Check three things after approval:
- the actual provider and site match the approval;
- the production evidence links to the delivered lot; and
- the verification result addresses the controlled requirement.
A clean certificate with no product, lot, method or provider linkage may be administratively complete and operationally weak.
Control substitutions and site changes
An approved provider is not permission to substitute any provider. Define the events that reopen the decision, such as:
- new sub-tier or manufacturing site;
- material, component, method, equipment or tooling change;
- temporary overflow transfer;
- process interruption followed by restart;
- certificate, qualification or approval expiry where relevant; or
- repeated defect, traceability break or missed notification.
Route product-affecting changes through the product change-control process. Record the proposed change, reason, affected orders and lots, evidence required, approvers, validation result and effective date. Hold affected production until the required decision is recorded.
For an Australian Trusted Trader applicant or participant, the 2025 ATT Rule includes risk-based supply-chain security criteria and reasonable measures concerning other people in the international supply chain. Its Explanatory Statement gives examples such as business-partner screening, breach notification and incorporating security and trade-compliance requirements into third-party terms. That framework is specific to ATT. It is used here as an Australian example, not as a universal rule for every importer.
Respond when unapproved subcontracting is found
Do not jump from discovery to acceptance because the goods look correct. Preserve evidence and separate three decisions.
Contain
Pause affected production, shipment or stock release as appropriate to the product and available authority. Identify open orders, work in progress, shipped lots and received inventory that may share the unapproved route.
Establish traceability
Ask for the actual provider, site, process dates, lots, inputs and records. Compare them with the approved specification and route. If the supplier cannot establish the affected population, record that limitation rather than inventing precision.
Decide disposition
The relevant product, quality and compliance owners decide what evidence, inspection, testing, rework or rejection is required. Safety, regulatory and specialist technical questions remain on hold for qualified review. Then use the supplier corrective-action process to address why disclosure or control failed; do not treat retrospective approval as corrective action.
Monitor the primary supplier after approval
Add subcontracting controls to ongoing performance review:
- disclosure made before work moved;
- approved route used;
- evidence complete and linked to the lot;
- changes notified on time;
- sub-tier defects and escapes; and
- corrective actions verified.
Feed those outcomes into the supplier performance scorecard. One approved outsourced process should not raise or lower the entire supplier score without defined evidence. Track the process and trend.
Keep specialist decisions on hold
Do not use this framework to approve a safety-critical process, mandatory test, regulated product, dangerous-goods activity or specialised validation without the necessary qualified reviewer. Also hold when the importer cannot determine whether a provider or site change affects an existing approval, certificate, registration or legal obligation.
The safe output is then a precise resume point: affected process, missing evidence, required specialist and production or lot boundary on hold.
Make the subcontracting path visible before release
The control succeeds when the importer can trace the ordered requirement through the primary supplier, outsourced process, returned evidence and delivered lot. It fails when approval attaches only to a company name while the work moves invisibly.
Map the route, assign the consequence, approve the evidence and reopen the decision when the route changes. If a material step remains undisclosed or unsupported, preserve completed work and hold the affected release.