The Fenced-In Factory: Reading Scope and Site on a Chinese CNC Supplier's ISO 9001 Certificate

A certificate on a supplier's wall performs a useful social function. It reassures a visiting buyer, satisfies a procurement checklist and gives a quality manager something to file. It does not, by itself, prove that the machine shop down the road is under the same system, that the CMM has been calibrated this year, or that the alloy used on your parts can be traced back to a named heat. For a UK buyer placing CNC work in China, the certificate is best read as a boundary document: it tells you what the certification body has fenced in, and by omission, what remains outside.

What ISO 9001 actually certifies

ISO 9001 is a quality management system standard. It asks whether an organisation has defined its processes, set objectives, controlled documented information, reviewed performance and addressed nonconformities. It does not prescribe machining tolerances, inspection frequencies or calibration intervals. Those come from the contract, the drawing and the supplier's own technical judgement.

That distinction matters because a certificate can be entirely genuine while saying very little about the capability of a particular CNC cell. A supplier may hold certification for the assembly and sale of electronic enclosures while routing machined components through a separate workshop. The certificate is not wrong; it is simply not about the work you are buying.

Four fields to read before the certificate is filed

The first field is the issuing body. Certification bodies operating in China may be accredited by CNAS, by a European accreditation body, or by an international scheme with local partners. Accreditation is not a guarantee of rigour, but it provides a route to verify that the certificate exists and remains valid. Ask which accreditation the issuer holds and check that the certificate carries the relevant mark.

Second is the certificate number. A number that cannot be found on the issuer's own register is a warning. Third is the expiry date and the surveillance cycle. ISO 9001 certificates are typically issued for three years with annual surveillance audits. A certificate that has passed its expiry date, or one that shows no surveillance activity, should not be relied upon without explanation.

Fourth, and most often overlooked, is the scope statement. This is the sentence that describes the certified activities and, usually, the site address. It may read something like "machining of metal components for industrial equipment" or, less helpfully, "trade and distribution of hardware products." The difference is material. A trading scope does not certify a machine shop. A scope that names a different address from the one on your quotation does not certify the factory making your parts.

The scope statement as a site boundary

When a Chinese supplier sends a certificate, compare the address on the certificate with the address on the quotation, the proforma invoice and the packaging instructions. If the certificate covers a registered office in a city centre while the work is performed at an industrial site in another district, ask for the relationship between the two. It may be a straightforward branch arrangement, or it may indicate that the certified entity is not the manufacturing entity.

The scope should also be read for exclusions. Some suppliers hold certification for machining but exclude design, heat treatment, surface finishing or subcontracted processes. Those exclusions are not necessarily disqualifying, but they shift the burden of control back to you. If heat treatment is outside the scope, the supplier's purchase order to the heat treater and the resulting certificates become part of your quality evidence, not a background detail.

What the certificate cannot tell you about process capability

ISO 9001 does not certify that a supplier can hold a 0.02 mm tolerance on a thin-walled aluminium housing. It does not certify that the CMM is calibrated, that the operators are trained to read your drawing, or that the material certificate relates to the parts in the crate. Those are technical and contractual matters.

A certified system should provide the framework for calibration and traceability, but the evidence sits in records. A calibration schedule, an internal audit report and a nonconformance log are more informative than the certificate alone. A supplier with a well-run system will usually share them without difficulty; a supplier using certification as a sales ornament may not.

An evidence pack to request alongside the certificate

For a Chinese CNC contract, the following documents give a more rounded view than the certificate by itself:

• A current certificate and scope statement, with the site address matching the quotation.
• The calibration schedule for the CMM, height gauge, micrometers and any custom gauges used on your part family.
• The most recent internal audit schedule and a summary of findings, with any major nonconformities and their closure dates.
• The management review minutes or a summary showing that quality performance is reviewed at senior level.
• Two or three recent nonconformance reports, including root cause and corrective action, redacted if necessary.
• The procedure for material traceability, showing how heat numbers and mill certificates are linked to finished parts.
• The procedure for controlling subcontracted processes, with the approval method for any outsourced heat treatment, coating or finishing.
• A sample first article inspection report and material certificate from a comparable job, so that the documentation can be read rather than merely counted.

Verification is a desk exercise, not a site visit

Most of this checking can be done from the UK. Certification bodies increasingly publish registers online, and accreditation bodies offer search tools. A certificate number that appears in the register, against the same legal entity and address, is a reasonable starting point. A scope that includes the words "machining" or "manufacture of metal components" is more relevant than one that speaks only of trade.

The certificate is not useless. It indicates that a management system exists and has been examined by an external body. But it is an index, not a verdict. The scope statement tells you which factory is fenced in. The evidence pack tells you whether the fence is maintained.