Picture a receiving inspector at a Tier 2 aerospace machine shop. A lot of corrosion-resistant fasteners arrives from a distributor the buyer approved two years earlier. The certificate of conformance looks complete, the packaging looks right, and the shipment landed on time after three late deliveries. Under schedule pressure, the lot moves to stock.

Six months later, a customer audit pulls the traceability chain for one of those fasteners. The distributor cannot link the lot to an original manufacturer. By then the parts sit inside assemblies at two customers, and the shop has to find every one of them.

This scenario is illustrative, but the mechanics are real. Aerospace products pass through many hands before they fly, and each hand offers a chance for a nonconforming or counterfeit part to slip in. A certificate that looks right does not prove a part is right. AS9100D recognizes that gap and asks organizations to close it with controls on external providers and a documented approach to counterfeit prevention.

This article explains what AS9100D requires, which supporting standards and laws shape the details, and how to build a risk-based supplier quality program that holds up across several tiers. It also looks at how the same discipline applies in pharmaceutical, medical device, and food manufacturing, because counterfeit and misrepresented material is not an aerospace problem alone.

Why the Aerospace Supply Chain Concentrates Risk

Aerospace products depend on deep, multi-tier supply chains. A prime contractor buys from Tier 1 suppliers, who buy from Tier 2 suppliers, who in turn source raw material, electronic components, and special processes from still others. Each tier adds handling, paperwork, and a possible break in traceability. A failure at the bottom of the chain can reach an aircraft with no visible warning along the way.

Government investigators have documented the scale of the problem in electronics. A Senate Armed Services Committee inquiry, reported in 2012, identified more than 1,800 cases of suspect counterfeit electronic parts in the Department of Defense supply chain between 2009 and 2010. Those cases involved roughly one million parts. The findings fed directly into Section 818 of the National Defense Authorization Act for Fiscal Year 2012, which placed detection and avoidance duties on defense contractors.

The concern also predates electronics. Congress passed the Fastener Quality Act in 1990 after worries about substandard and misrepresented fasteners in the supply base.

Retention adds another layer of difficulty. Customer and regulatory requirements can keep aerospace records alive for decades, and a part’s chain of custody must stay retrievable for as long as the aircraft flies. A supplier program that stores qualification evidence in personal folders or email threads cannot meet that expectation.

Counterfeiting takes several forms. A supplier may remark used parts as new, relabel parts to a higher grade, clone a design without authorization, or sell out-of-specification parts as conforming. Each form defeats a different control, which is why no single inspection step can carry the whole burden.

What AS9100D Requires of External Providers

Clause 8.4: Control of External Providers

AS9100D builds on ISO 9001:2015 and tightens the supplier control requirements. The organization must define criteria for evaluating, selecting, monitoring, and re-evaluating external providers. It must also maintain a register of providers that shows each provider’s approval status, such as approved, conditional, or disapproved, along with the scope of that approval, such as product type or process family.

The standard expects a defined process for changing approval status. It also requires periodic review of provider performance, including product conformity, on-time delivery, and customer-reported problems. The organization stays responsible for the conformity of everything it receives, including product from sources its customer directed it to use.

Flow-Down and Right of Access

Clause 8.4.3 asks the organization to communicate its requirements to external providers. That communication covers applicable technical data, approval requirements for product and processes, competence, key characteristics, and the verification activities the organization plans to perform at the provider’s premises.

It also covers right of access. The organization, its customer, and regulatory authorities must be able to enter the applicable areas of a provider’s facilities and review applicable documented information, at any level of the supply chain. A purchase order that omits those flow-downs leaves the organization unable to inspect the very tiers where risk concentrates.

Clause 8.1.4: Prevention of Counterfeit Parts

AS9100D requires the organization to plan, implement, and control processes that prevent counterfeit or suspect counterfeit parts from entering delivered product. The planning typically addresses these elements:

• Training. Relevant personnel learn how to recognize and prevent counterfeit parts.
• Sourcing methodology. The organization buys directly from original or authorized manufacturers, or from authorized distributors, wherever possible.
• Traceability. The organization requires a chain of traceability back to the original or authorized manufacturer.
• Verification and test. The organization applies methods to detect counterfeit parts.
• Reporting and quarantine. The organization monitors counterfeit reports, quarantines suspect parts, and reports them.
• Obsolete part control. The organization manages obsolescence because discontinued parts attract counterfeiters.

AS9100D leaves the specific methods to the organization. The supporting standards below fill in what those methods look like.

The Standards and Laws Behind the Clauses

Several documents give practical shape to clause 8.1.4. SAE AS5553 sets requirements for avoiding, detecting, mitigating, and disposing of counterfeit electronic parts. SAE AS6081 addresses distributors specifically, and SAE AS6171 defines test methods for suspect counterfeit electronic parts. SAE AS6174 extends the counterfeit prevention approach to materials beyond electronics, such as raw material and hardware.

AS6171 matters because it names the detection techniques. Those include visual inspection under magnification, remarking and resurfacing tests, X-ray fluorescence, radiography, decapsulation, and electrical testing. A shop does not need every technique in-house, but it does need to know which test matches which suspected form of counterfeiting and where to send samples.

Defense work adds regulatory force. DFARS clause 252.246-7007 requires covered contractors to maintain a counterfeit electronic part detection and avoidance system, and DFARS 252.246-7008 restricts the sources from which they may buy electronic parts. Covered contractors flow those duties down to subcontractors that supply electronic parts. Defense contractors also report suspect counterfeit parts through the Government-Industry Data Exchange Program, known as GIDEP.

On the civil side, FAA Advisory Circular 21-29 guides the detection and reporting of suspected unapproved parts, and the FAA runs a program to track them. Two other aerospace standards complete the picture. AS9102 defines first article inspection, with forms that account for the part, the product, and each characteristic. Nadcap accreditation covers special processes such as heat treating, welding, nondestructive testing, and chemical processing.

Building a Risk-Based Supplier Program

Classify Suppliers and Parts

Not every supplier deserves the same oversight. Start by classifying external providers and the parts they supply. Five factors drive most of the decision:

• Part criticality. Flight-safety parts and parts with key characteristics warrant the closest control.
• Source type. An original manufacturer carries less risk than a broker or an unauthorized distributor.
• Process complexity. Special processes and complex assemblies need process-level oversight.
• Supplier history. Late deliveries, escapes, and repeat corrective actions raise the tier.
• Customer requirements. Customer-directed sources and prime flow-downs set minimum controls.

Document the classification logic. An auditor wants to see why a supplier landed in a given tier, not merely the tier itself.

Qualify With Evidence

Qualification replaces assumptions with documented proof. A thorough package includes qualification records, certificates and accreditations, a risk assessment, and a site audit report for higher tiers. For process suppliers, it also includes capability evidence and, where required, Nadcap accreditation. For product suppliers, it should include a first article inspection under AS9102 before production quantities ship.

Aerospace qualification often takes months, and that is appropriate given the safety stakes. The eLeaP overview of AS9100 and the aerospace supply chain describes how deep that verification runs, from process capability studies to source inspection programs that continue after approval.

Control Special Processes and Use Source Inspection

Special processes, where later inspection cannot fully verify the output, need a different kind of control. Heat treating, welding, plating, and nondestructive testing all fall in this group. Inspecting the finished part cannot always reveal a flawed process, so the organization has to control the process itself. Require Nadcap accreditation where the customer or contract calls for it, review process certifications and personnel qualifications, and confirm that the provider’s records tie each lot to the equipment and parameters used.

For safety-critical parts, source inspection adds a second layer. A representative verifies product at the supplier’s site before shipment, which catches a nonconformance while correction is still cheap. Define in the purchase order when source inspection applies and what the inspector will examine, so the supplier schedules for it instead of treating it as an interruption.

Verify What Arrives

A certificate of conformance records what a supplier claims. Incoming inspection tests whether the claim holds. Scale the inspection to risk. A low-risk commodity item may need only a documentation check and a dimensional sample. A critical raw material lot may need independent chemistry or hardness verification. Electronic components bought from anything other than an original or authorized source should face the full set of AS6171 techniques that match the suspected risk.

Quarantine procedures matter as much as the tests. A suspect lot must be physically segregated and clearly identified so it cannot reach production while an investigation runs.

Manage Obsolescence Before It Manages You

Obsolescence drives more counterfeit exposure than most teams admit. When a manufacturer discontinues a component, the authorized channel dries up, and buyers turn to brokers. Build an obsolescence management process before that moment arrives. Monitor product change and end-of-life notices from original manufacturers, review the bill of materials for single-source and aging parts, and plan lifetime buys or redesigns while authorized stock still exists.

When a broker purchase becomes unavoidable, treat it as a high-risk event. Require full traceability documentation where it exists, apply the strongest test regime, obtain customer approval where the contract requires it, and record the decision with its rationale. That written trail protects the organization if questions arise later.

Monitor and Requalify

Approval is not permanent. Track on-time delivery, quality performance, responsiveness, and corrective action history for each provider. Define in advance what triggers a status change, a for-cause audit, or a return to qualification. Trigger events include a counterfeit alert, a customer complaint traced to the supplier, a change in ownership or location, and a loss of certification.

Supplier audits should follow the same risk logic as internal audits. High-tier suppliers receive on-site audits on a defined cycle, while low-tier suppliers may rely on questionnaires and certificate review between periodic audits.

Respond to a Suspect Part

Even a strong program will occasionally catch a suspect part, and the response deserves a written procedure before anyone needs it. A workable sequence has six steps:

• Quarantine. Segregate the affected lot and every lot that shares its source, and tag the material so no one moves it by mistake.
• Escalate. Notify quality leadership and the person responsible for customer and regulatory notification.
• Test. Send samples to a qualified laboratory using the methods that match the suspected form of counterfeiting.
• Trace forward. Identify every assembly, work order, and customer shipment that received material from the same source.
• Report. Notify as the contract and the law require, including the customer and, for defense work, GIDEP.
• Correct. Document the root cause and open a corrective action that covers both the failed control and the sourcing decision that let the part in.

Forward tracing separates mature programs from weak ones. A team that can list every affected assembly within hours limits the damage, while a team that cannot must treat everything from that source as suspect.

Where Supplier Programs Break Down

Supplier programs that fail an audit or a customer investigation usually share a few weaknesses:

• The approved supplier list lives in a spreadsheet. Status, scope, certificate expiry dates, and audit history drift apart, and nobody notices an expired approval until an auditor does.
• Certificates substitute for verification. The organization accepts a certificate of conformance without ever testing a sample against it.
• Schedule pressure overrides sourcing rules. A buyer turns to a broker for an obsolete or long-lead part and skips the traceability requirement.
• Flow-down stops at Tier 1. The purchase order carries quality clauses, but the Tier 1 supplier never passes them to its own sources.
• Obsolescence goes unmanaged. Teams discover a discontinued part when a line is already down, and the only available source is a broker.
• Receiving staff lack counterfeit training. Inspectors know the dimensional checks but not what a remarked or resurfaced part looks like.
• Suspect parts return to stock. Without formal quarantine and disposition, a questionable part can drift back into inventory.
• Reporting happens late or never. Nobody owns the decision to notify the customer or report through GIDEP.

Every one of these failures is a process failure, not a people failure. Clear ownership, defined triggers, and records that show the decision path prevent most of them.

Counterfeiting Beyond Aerospace

A well-built supplier verification program travels across verticals, because misrepresented material appears everywhere regulated products depend on purchased inputs.

In pharmaceutical manufacturing, 21 CFR 211.84 lets a manufacturer accept a supplier’s report of analysis in place of testing only after it establishes the reliability of that supplier’s results through appropriate validation at appropriate intervals. The manufacturer must still run at least one specific identity test on each component lot. That structure mirrors the aerospace principle: a certificate counts only after the organization has shown that it can trust it. The 2008 heparin contamination, in which an adulterated raw material reached patients in the United States, showed how costly the gap can be.

Medical device manufacturers meet the same logic in ISO 13485 clause 7.4, which asks that supplier evaluation and monitoring be proportionate to the risk the purchased product poses to the device. That language gives a risk-based tier model a direct regulatory anchor.

Food manufacturers face a parallel expectation under the FDA’s Preventive Controls for Human Food rule. Hazard analysis must consider economically motivated adulteration when it is known or reasonably foreseeable and affects food safety. A supplier that substitutes a cheaper ingredient represents the food-industry version of a remarked part.

Each vertical uses different vocabulary, yet the controls look alike: approved sources, verified traceability, risk-proportionate testing, and documented decisions.

Running Supplier Quality in One System

Connected data makes supplier control practical. When qualification records, audits, certificates, incoming inspection results, and corrective actions live in separate files, nobody sees the pattern that points to a problem. A repeat late-delivery issue, an expiring certificate, and a rejected lot can all concern the same supplier, and a spreadsheet will not link them.

A structured supplier module addresses that gap. The eLeaP aerospace QMS page describes support for approved supplier list management, quality agreement documentation, incoming inspection records, supplier audit scheduling and findings, and performance trending. It also describes training that deploys automatically to internal teams when a supplier audit exposes a gap in receiving, inspection, or qualification procedures. That link between supplier findings and internal competence closes a loop most paper systems leave open.

The supplier lifecycle itself, from qualification through monitoring and corrective action, appears in the eLeaP article on supplier quality management and compliance risk. For guidance on what to document at qualification, see the eLeaP quality site’s piece on how to improve supplier quality management. Qualification records, site audit reports, risk assessments, and certificates of compliance form the core set.

Software cannot decide which parts deserve scrutiny. It can enforce the decision once the team makes it, and it can show an auditor the full record in minutes.

Measuring Supplier Program Performance

Track a short list of measures and bring them to management review:

• Approved supplier list accuracy. What share of suppliers have current approval status, valid certificates, and a completed audit within the planned cycle?
• Incoming quality performance. What percentage of lots are accepted, and how many rejections trace to the same suppliers?
• Supplier corrective action timeliness. How long do supplier corrective action requests stay open, and how many pass an effectiveness check?
• Flow-down coverage. Do purchase orders carry the required clauses for each tier?
• Counterfeit prevention activity. How many staff completed counterfeit awareness training, and how many suspect parts were quarantined, tested, and dispositioned?

Review these measures alongside your internal audit results. Patterns that cross both data sets often point to the process that deserves attention next.

The Underlying Test

Every control in this article answers one question: can the organization prove where each part came from and that it is what the paperwork says? The underlying test is practical. Pick a part number in a delivered assembly, then trace it back through every tier to the original manufacturer or the verified source, and show the test, inspection, and approval records along the way.

If the team can produce that chain quickly and completely, the supplier program works. If the trail breaks at a distributor, a certificate, or a spreadsheet, the break marks exactly where counterfeit or nonconforming product could enter. Build the program so that the chain holds at every tier, and AS9100D’s clauses become a description of how the organization already operates.