Sub-Tier Supplier Control
Quality & Inspection Standards
PRODUCTS CENTER
Get Custom Quote
PRODUCTS CENTER
Sub-Tier Supplier Control Under GJB9001C
Sub-tier supplier control is a critical requirement under GJB9001C that extends quality management responsibilities beyond the immediate (Tier 1) supplier to encompass all levels of the supply chain. Clause 8.4.1 explicitly requires organizations to "require that external providers apply appropriate controls to their direct and sub-tier external providers, to ensure that the products and services they provide meet requirements."This flow-down requirement ensures that quality, reliability, and compliance are maintained throughout the entire supply chain — not just at the first tier.
For PCB manufacturers, sub-tier supplier control is essential because the quality of finished printed circuit boards depends on materials, components, and services provided at multiple supply chain levels. A nonconformance originating from a sub-tier supplier — such as a laminate manufacturer's raw material supplier or a component distributor's sub-tier source — can compromise the final product. Without systematic sub-tier control, organizations cannot ensure that external providers (and their providers) consistently deliver conforming products and services.
Engineering Summary
- GJB9001C Clause 8.4.1 requires organizations to require external providers to apply appropriate controls to their direct and sub-tier external providers.
- Sub-tier supplier control applies to all levels of the supply chain — not just Tier 1 suppliers.
- Requirements must be flowed down from the organization through Tier 1 suppliers to all sub-tier levels.
- Organizations must ensure that Tier 1 suppliers control their direct and sub-tier external providers to ensure requirements are met throughout the supply chain.
- Risk assessment is mandatory when selecting and evaluating external providers at all tiers — organizations must effectively identify and control risks.
- For PCB manufacturers, sub-tier suppliers include raw material suppliers (laminates, copper foils), component manufacturers, and specialty process providers (plating, testing).
- Customer involvement extends to sub-tier suppliers of interest — organizations shall invite customers to participate in the evaluation and selection of external providers of interest to them.
1. What Auditors Check — A Quick Overview
| Audit Focus | What External Auditors Verify | Expected Evidence |
|---|---|---|
| Flow-Down Requirements | Are quality and regulatory requirements flowed down to sub-tier suppliers? | Purchase order flow-down clauses, supplier agreements, contract requirements |
| Sub-Tier Control | Are Tier 1 suppliers controlling their direct and sub-tier external providers? | Sub-tier supplier evaluation records, audits, performance monitoring |
| Approved Supplier List | Are sub-tier suppliers included in the approved supplier management system? | Approved Supplier List (multi-tier), scope documentation |
| Risk Assessment | Are risks identified and controlled at all supply chain tiers? | Risk assessment records, risk mitigation plans (multi-tier) |
| Customer Involvement | Are customers invited to participate in sub-tier supplier evaluation? | Invitation records, customer participation documentation |
| Performance Monitoring | Is sub-tier supplier performance monitored and reported? | Performance data, re-evaluation records, supplier scorecards |
KEY INSIGHT:
Sub-tier supplier control is a critical audit focus area. Auditors will verify that requirements are flowed down through all supply chain tiers and that Tier 1 suppliers are effectively controlling their sub-tier suppliers to ensure consistency throughout the whole supply chain.
2. Standard Requirements for Sub-Tier Supplier Control
2.1 GJB9001C Clause 8.4.1 — General Requirements
GJB9001C-2017 Clause 8.4.1 establishes the foundational requirement for sub-tier supplier control:
"The organization shall ensure that externally provided processes, products, and services conform to requirements. The organization shall determine the controls to be applied to externally provided processes, products, and services when external providers' products and services will form part of the organization's own products and services."
The organization shall:
- Base criteria for evaluation, selection, performance monitoring, and re-evaluation on the external provider's ability to provide processes, products, and services in accordance with requirements
- Retain documented information of these activities and any necessary actions arising from evaluations
- Compile an Approved Supplier List based on evaluation results, which serves as the basis for selecting external providers and for procurement
- Follow approval procedures when selecting external providers outside the Approved Supplier List
- Require external providers to apply appropriate controls to their direct and sub-tier external providers, to ensure that the products and services they provide meet requirements
- Invite customers to participate in the evaluation and selection of external providers of interest to them
- Ensure effective identification and control of risks when selecting and evaluating external providers
2.2 Clause 8.4.2 — Control Types and Extent
Clause 8.4.2 requires organizations to ensure that externally provided processes, products, and services do not adversely affect the organization's ability to consistently deliver conforming products and services. For sub-tier supplier control, this means:
- Ensuring that externally provided processes remain within the control of the organization's quality management system
- Defining the controls to be applied to external providers and their outputs
- Considering the potential impact of externally provided processes, products, and services on the organization's ability to meet customer and regulatory requirements
- Considering the effectiveness of controls applied by external providers
- Determining necessary verification or other activities to ensure requirements are met
- Defining verification requirements, methods, and acceptance criteria, and implementing verification with retained records
2.3 Clause 8.4.3 — Information for External Providers
Clause 8.4.3 requires organizations to communicate to external providers the following requirements that must be flowed down to sub-tier suppliers:
- The processes, products, and services to be provided
- Approval requirements for: products and services; methods, processes, and equipment; and release of products and services
- Capability requirements, including required personnel qualifications
- Interaction between external providers and the organization
- Controls and monitoring of external provider performance used by the organization
- Verification or validation activities that the organization or its customers intend to perform at the external provider's site
- Functional and performance requirements, quality assurance requirements, and support requirements
- Requirement to report technical quality issues and resolution results
- Requirement to notify the organization of technical state changes, production line or process changes, or equipment changes
- Requirements for control of documented information that external providers produce and maintain
2.4 The Sub-Tier Control Mandate
The core mandate for sub-tier supplier control is explicit in GJB9001C:
"The organization should require external suppliers to implement appropriate control over their direct and secondary external suppliers, in order to ensure that the products and services provided by them meet the requirements.。"
This requirement means that the organization's quality management system must extend its influence beyond Tier 1 suppliers. Tier 1 suppliers must be required and enabled to control their direct and sub-tier suppliers using appropriate methods — including evaluation, selection, performance monitoring, and re-evaluation — to ensure that requirements are met throughout the supply chain.
3. Flow-Down Requirements — Cascading Quality Through the Supply Chain
Flow-down is the mechanism by which quality, regulatory, and customer requirements are transmitted from the organization through Tier 1 suppliers to all sub-tier levels. Effective flow-down ensures consistency throughout the supply chain.
3.1 What Must Be Flowed Down
| Requirement Category | Examples |
|---|---|
| Quality Requirements | GJB9001C compliance, IPC standards (IPC-A-600, IPC-6012), GJB 362B, quality management system requirements |
| Technical Specifications | Material specifications (Dk, Df, Tg, CTE), dimensional tolerances, impedance requirements, surface finish requirements |
| Regulatory Requirements | RoHS/REACH compliance, export control requirements, ITAR/EAR compliance, counterfeit prevention (AS5553/AS6174) |
| Customer-Specific Requirements | Customer-specified materials, special process approvals, First Article Inspection (FAI) per GJB 908, unique marking requirements |
| Change Management | PCN (Product Change Notification) requirements, technical state change notification, process change approval |
| Documentation and Records | Certificate of Conformance requirements, material certifications, test reports, traceability records, inspection records |
3.2 Flow-Down Methods
- Purchase Order Flow-Down Clauses: Include specific quality and regulatory requirements in purchase orders and contracts
- Supplier Quality Requirements Documents: Provide comprehensive quality requirements manuals to all suppliers
- Contractual Flow-Down: Require suppliers to flow down all applicable requirements to their sub-tier suppliers
- Approved Supplier List Integration: Require suppliers to use customer-approved sub-tier supplier lists when applicable
- Prior Written Consent: Require suppliers to obtain prior written consent before subcontracting work to sub-tier suppliers
- Audit and Verification: Verify that flow-down requirements are implemented through supplier audits and performance monitoring
3.3 Sub-Tier Approval Requirements
Organizations must establish requirements for sub-tier supplier approval:
- Tier 1 suppliers shall provide evidence that audits are performed for their sub-tier suppliers
- Tier 1 suppliers shall inform the organization of the list of sub-tier suppliers delivering products/services with critical items and key characteristics
- Subcontracting work requires prior written consent from the organization
- Changes in sub-tier suppliers and changes in location of manufacture must be communicated in advance
- Sub-tier suppliers must meet applicable quality system requirements (e.g., ISO 9001, AS9100, GJB9001C)
4. Sub-Tier Supplier Control Process — The Eight Steps
The sub-tier supplier control process ensures that requirements are effectively flowed down and implemented throughout the supply chain.
| Step | Activity | PCB Sub-Tier Example |
|---|---|---|
| 1 | Map the Supply Chain — Identify all tiers of the supply chain. Determine which sub-tier suppliers provide critical materials, components, or services that affect product quality. | Identify supply chain: Organization → PCB Fabrication Supplier (Tier 1) → Laminate Supplier (Tier 2) → Resin/Glass Supplier (Tier 3); and Component Distributor (Tier 1) → Component Manufacturer (Tier 2) → Wafer Foundry (Tier 3). |
| 2 | Define Flow-Down Requirements — Identify all quality, regulatory, and customer requirements that must be flowed down to sub-tier suppliers. | Define flow-down requirements: GJB9001C compliance, GJB 362B material requirements, IPC-6012 Class 3, counterfeit prevention (AS5553), material certifications, and traceability requirements. |
| 3 | Communicate Requirements to Tier 1 — Communicate all flow-down requirements to Tier 1 suppliers through contracts, purchase orders, and quality agreements. Include requirements for sub-tier control. | Communicate requirements to PCB fabrication supplier; include flow-down clauses in purchase order; require supplier to flow down GJB9001C, IPC, and counterfeit prevention requirements to their sub-tier suppliers. |
| 4 | Require Sub-Tier Approval — Require Tier 1 suppliers to obtain approval before using sub-tier suppliers. Define approval criteria and process. | Require PCB fabrication supplier to obtain approval before changing laminate supplier; require sub-tier supplier evaluation and qualification; maintain sub-tier supplier list. |
| 5 | Conduct Risk Assessment — Identify and control risks at all supply chain tiers. Assess single-source dependency, geopolitical risks, counterfeit risk, and technology maturity. | Assess risks: single-source laminate supplier (high risk); geopolitical risks for raw material sourcing; counterfeit risk for obsolete components; sub-tier capacity constraints. |
| 6 | Monitor Sub-Tier Performance — Monitor sub-tier supplier performance through Tier 1 supplier reporting, audits, and quality data. Require Tier 1 suppliers to report sub-tier quality issues. | Monitor laminate supplier performance through PCB fabrication supplier's incoming inspection data; review sub-tier supplier audit reports; track sub-tier nonconformance trends. |
| 7 | Verify Flow-Down Implementation — Verify that flow-down requirements are effectively implemented throughout the supply chain. Conduct audits of Tier 1 and sub-tier suppliers as needed. | Conduct on-site audit of PCB fabrication supplier; verify flow-down to laminate supplier; review sub-tier supplier evaluation records and performance data. |
| 8 | Continuous Improvement — Use sub-tier performance data for continuous improvement. Update flow-down requirements based on lessons learned and emerging risks. | Review sub-tier supplier performance trends; update flow-down requirements; implement corrective actions for sub-tier nonconformances; share lessons learned across supply chain. |
CRITICAL RULE:
Organizations must require external providers to apply appropriate controls to their direct and sub-tier external providers. This requirement extends to all levels of the supply chain — organizations cannot delegate responsibility for sub-tier supplier quality.
5. PCB Sub-Tier Supplier Control Scenarios — Practical Examples
5.1 Laminate Supply Chain — Multi-Tier Control
| Item | Description |
|---|---|
| Supply Chain Structure | Organization → PCB Fabrication Supplier (Tier 1) → Laminate Supplier (Tier 2) → Resin/Glass/Copper Supplier (Tier 3) |
| Flow-Down Requirements | Organization flows GJB9001C, GJB 362B, and material specifications to PCB Fabrication Supplier. PCB Fabrication Supplier flows material requirements to Laminate Supplier. Laminate Supplier flows raw material specifications to Resin/Glass/Copper Suppliers. |
| Sub-Tier Controls | PCB Fabrication Supplier evaluates and approves Laminate Supplier; Laminate Supplier controls Resin/Glass/Copper Suppliers; Organization audits PCB Fabrication Supplier's sub-tier controls; material certifications and traceability maintained at all tiers. |
| Risk Management | Single-source risk at Tier 2 (laminate) mitigated by qualifying alternative laminate suppliers; Tier 3 raw material supply chain monitored for geopolitical risks. |
| Documentation | Sub-tier supplier evaluation records, material certifications at all tiers, traceability documentation, audit reports, Approved Supplier List (multi-tier). |
5.2 Component Supply Chain — Counterfeit Risk Management
| Item | Description |
|---|---|
| Supply Chain Structure | Organization → PCBA Supplier (Tier 1) → Component Distributor (Tier 2) → Component Manufacturer (Tier 3) → Wafer Foundry (Tier 4) |
| Flow-Down Requirements | Organization flows counterfeit prevention requirements (AS5553/AS6174) to PCBA Supplier; PCBA Supplier requires Component Distributor to source only from authorized channels; Component Manufacturer controls Wafer Foundry quality. |
| Sub-Tier Controls | PCBA Supplier maintains Approved Supplier List for component sources; Component Distributor provides Certificate of Conformance and traceability; counterfeit detection at multiple tiers. |
| Risk Management | Counterfeit risk at Tier 2 and Tier 3; obsolete component risk; single-source dependency at Tier 4; geopolitical risks for semiconductor sourcing. |
| Documentation | Authorized distributor verification, Certificate of Conformance, counterfeit prevention program records, traceability documentation at all tiers. |
5.3 Sub-Tier Supplier Audit Requirements
Organizations must establish audit requirements for sub-tier suppliers:
- Tier 1 suppliers shall provide evidence that audits are performed for their sub-tier suppliers when delivering products/services with critical items and key characteristics
- The organization shall verify that Tier 1 suppliers periodically review sub-tier supplier control of non-conforming material
- Sub-tier suppliers shall be audited against applicable quality standards (ISO 9001, AS9100, GJB9001C)
- Audit results shall be documented and used for sub-tier supplier performance evaluation
6. Key Control Points in PCB Sub-Tier Supplier Control
6.1 Supply Chain Mapping and Visibility
- Map all tiers of the supply chain — identify Tier 1, Tier 2, Tier 3, and beyond suppliers
- Identify which sub-tier suppliers provide critical materials, components, or services that affect product quality
- Maintain visibility into sub-tier supplier ownership, control, and location
- For defense programs, supply chain accountability extends past direct vendors and sub-tier suppliers to the fabrication source of every component
6.2 Flow-Down Verification
- Verify that flow-down requirements are effectively communicated to and implemented by all supply chain tiers
- Require Tier 1 suppliers to provide evidence of flow-down to sub-tier suppliers
- Include flow-down requirements in purchase orders, contracts, and quality agreements
- Conduct audits to verify flow-down implementation
6.3 Sub-Tier Supplier Approval
- Require Tier 1 suppliers to obtain prior written consent before using sub-tier suppliers
- Define approval criteria for sub-tier suppliers based on their ability to meet requirements
- Maintain a list of approved sub-tier suppliers for critical items
- Require suppliers to flow down controls listed in agreements to their direct and sub-tier suppliers
6.4 Risk Management at All Tiers
- Identify and control risks at all supply chain tiers — not just Tier 1
- Assess single-source dependency, geopolitical risks, counterfeit risk, and technology maturity at each tier
- For defense programs, trace the country of origin of parts embedded deep within sub-assemblies
- Implement risk mitigation measures for high-risk sub-tier suppliers
6.5 Performance Monitoring and Reporting
- Monitor sub-tier supplier performance through Tier 1 supplier reporting and quality data
- Require Tier 1 suppliers to report sub-tier quality issues and resolution results
- Use performance data for sub-tier supplier re-evaluation
- Track GIDEP alerts for sub-tier supplier performance
6.6 Change Management at All Tiers
- Require Tier 1 suppliers to notify the organization of changes in sub-tier suppliers
- Require notification of changes in location of manufacture
- Require notification of technical state changes, production line or process changes, or equipment changes at all tiers
- Implement PCN (Product Change Notification) requirements for sub-tier changes
7. Sub-Tier Supplier Control Audit Checklist — Key Areas to Verify
| Audit Area | Verification Points |
|---|---|
| Flow-Down Requirements | Are quality, regulatory, and customer requirements flowed down to all sub-tier suppliers? Are flow-down clauses included in purchase orders and contracts? |
| Sub-Tier Approval | Does Tier 1 have an approved sub-tier supplier list? Are sub-tier suppliers evaluated and approved before use? Is prior written consent obtained? |
| Supply Chain Mapping | Is the complete supply chain mapped? Are critical sub-tier suppliers identified? Is there visibility into sub-tier ownership and location? |
| Risk Management | Are risks identified and controlled at all supply chain tiers? Are risk mitigation measures implemented? |
| Performance Monitoring | Is sub-tier supplier performance monitored? Are quality issues reported and resolved? Are GIDEP alerts tracked? |
| Change Management | Are sub-tier supplier changes communicated and approved? Are location of manufacture changes communicated? |
| Documented Information | Are sub-tier evaluation, approval, monitoring, and audit records maintained? Are flow-down requirements documented? |
| Customer Involvement | Are customers invited to participate in sub-tier supplier evaluation and selection of interest? |
8. Audit Preparation Checklist for PCB Manufacturers
| # | Check Item | Clause | Status | Notes |
|---|---|---|---|---|
| Flow-Down Requirements | ||||
| 1 | Flow-down requirements are documented and communicated to Tier 1 suppliers | 8.4.3 | ☐ | |
| 2 | Purchase orders include flow-down clauses for quality and regulatory requirements | 8.4.3 | ☐ | |
| Sub-Tier Control | ||||
| 3 | Tier 1 suppliers are required to control their direct and sub-tier external providers | 8.4.1 | ☐ | |
| 4 | Sub-tier supplier approval process is established and documented | 8.4.1 | ☐ | |
| 5 | Prior written consent is required for sub-tier subcontracting | 8.4.1 | ☐ | |
| Supply Chain Mapping | ||||
| 6 | Supply chain is mapped to identify all tiers of suppliers | 8.4.1 | ☐ | |
| 7 | Critical sub-tier suppliers are identified and monitored | 8.4.1 | ☐ | |
| Risk Management | ||||
| 8 | Risk assessment is conducted for all supply chain tiers | 8.4.1 | ☐ | |
| 9 | Risk mitigation measures are implemented for high-risk sub-tier suppliers | 8.1 | ☐ | |
| Performance Monitoring | ||||
| 10 | Sub-tier supplier performance is monitored through Tier 1 reporting | 8.4.1 | ☐ | |
| 11 | Sub-tier quality issues are reported and resolved | 8.4.3 | ☐ | |
| Change Management | ||||
| 12 | Sub-tier supplier changes are communicated and approved | 8.4.3 | ☐ | |
| 13 | Location of manufacture changes are communicated | 8.4.3 | ☐ | |
| Documented Information | ||||
| 14 | Sub-tier evaluation, approval, and monitoring records are retained | 8.4.1 | ☐ | |
| 15 | Flow-down requirements are documented and maintained | 8.4.3 | ☐ | |
9. Common Audit Findings and How to Avoid Them
| Finding | Why It Happens | How to Avoid |
|---|---|---|
| "No flow-down of requirements to sub-tier suppliers" | Requirements not documented or communicated beyond Tier 1 | Document flow-down requirements; include in contracts and purchase orders; verify implementation |
| "Tier 1 suppliers not controlling sub-tier suppliers" | Sub-tier control requirements not established or enforced | Require Tier 1 suppliers to apply appropriate controls to direct and sub-tier external providers |
| "No sub-tier supplier approval process" | Sub-tier suppliers used without evaluation or approval | Establish sub-tier supplier approval process; require prior written consent |
| "No supply chain mapping" | Supply chain not mapped beyond Tier 1 | Map all supply chain tiers; identify critical sub-tier suppliers |
| "No risk assessment at sub-tier levels" | Risks only assessed at Tier 1 level | Conduct risk assessment at all supply chain tiers |
| "Sub-tier changes not communicated" | Sub-tier supplier changes made without notification | Require notification of sub-tier supplier changes and location of manufacture changes |
10. Frequently Asked Questions
What is a sub-tier supplier under GJB9001C?
A sub-tier supplier is any external provider below Tier 1 in the supply chain. This includes Tier 2 (suppliers to Tier 1), Tier 3, and beyond. GJB9001C requires organizations to ensure that Tier 1 suppliers apply appropriate controls to their direct and sub-tier external providers.
What does GJB9001C require for sub-tier supplier control?
Clause 8.4.1 requires organizations to "require that external providers apply appropriate controls to their direct and sub-tier external providers, to ensure that the products and services they provide meet requirements."
What is flow-down in supply chain management?
Flow-down is the process of transmitting quality, regulatory, and customer requirements from the organization through Tier 1 suppliers to all sub-tier levels. It ensures consistency and compliance throughout the supply chain.
What requirements must be flowed down to sub-tier suppliers?
Quality requirements (GJB9001C, IPC standards), technical specifications (materials, tolerances), regulatory requirements (RoHS, export controls), customer-specific requirements, change management (PCN), and documentation requirements (certifications, traceability) must be flowed down.
How should sub-tier suppliers be approved?
Sub-tier suppliers should be evaluated and approved based on their ability to meet requirements. Tier 1 suppliers should obtain prior written consent before using sub-tier suppliers. Sub-tier supplier lists should be maintained for critical items.
What documented information must be retained for sub-tier supplier control?
Organizations must retain: sub-tier evaluation records, approval records, performance monitoring records, flow-down requirement documentation, audit records, and change notification records.
Is customer involvement required for sub-tier supplier evaluation?
Yes. Organizations shall invite customers to participate in the evaluation and selection of external providers of interest to them — which may include sub-tier suppliers.
What happens if a sub-tier supplier change is not communicated?
Uncommunicated sub-tier supplier changes can lead to nonconforming products, loss of traceability, and compliance issues. Organizations must require notification of sub-tier supplier changes and location of manufacture changes.
Related Standards & Topics
PCB and PCBA Manufacturing for Military and Aerospace Programs
UltroNiu Electronics Group provides PCB and PCBA manufacturing services with GJB9001C-compliant sub-tier supplier control and supply chain management. Contact our engineering team for program-specific multi-tier supply chain quality requirements.
Request Engineering ReviewReferences: GJB9001C-2017 Clauses 8.4, 8.4.1, 8.4.2, 8.4.3 (Central Military Commission Equipment Development Department). Sub-tier supplier control requirements sourced from GJB9001C-2017 Clause 8.4.1. Flow-down requirements sourced from aerospace and defense industry practice (AS9100D, AS5553). Sub-tier supplier audit requirements sourced from industry best practices for multi-tier supply chain management. PCB-specific sub-tier control practices based on industry best practices for military and aerospace PCB manufacturing. Courtesy of UltroNiu Engineering Knowledge Center.
Get Custom Quote
PRODUCTS CENTER
World-class PCB & PCBA manufacturer focused on high-frequency and high-reliability boards for defense, aerospace, automotive and industrial electronics.
You can unsubscribe at any time with a single click.
Copyright © 2025 UltroNiu Electronics Group All Rights reserved.