How to Build an Approved Vendor List for Electronics Manufacturing

Most approved vendor lists start as a spreadsheet of company names with "approved" in the last column. That works until a buyer orders a power IC from a distributor approved for passives, or an EMS moves your job to a sister factory nobody audited. An AVL that prevents those mistakes records not just who is approved, but for what, at which site, through which channel and until when, and it is wired into purchasing so the system refuses an order that falls outside those limits.

This guide is about designing and running that list. How to vet a single new supplier is covered in the pre-PO due diligence guide; this is what you do with the result.

Separate approved parts from approved sources

Companies use the terms loosely, so write down what yours mean. A workable set:

• AML (approved manufacturer list): the manufacturers and exact part numbers engineering has approved for each internal part number.
• AVL (approved vendor list): the legal entities and sites approved to sell or make a defined scope.
• ASL (approved supplier list): often used as a wider term that also covers service providers such as test labs and logistics.

Keep the first two as distinct records. Engineering approves a part. Quality and procurement approve the sources that may supply it. IPC's Product Data eXchange standards (the IPC-2570 series) treat the BOM, the approved manufacturer list and the approved supplier list as separate pieces of product data for the same reason, and the separation is worth copying even if your "system" is a well-controlled spreadsheet. State in one policy which list is authoritative, so nobody treats an approved manufacturer as an approved place to buy it.

Decide what one AVL row must hold

"Supplier X: approved" is not a usable row. Each record needs:

Scope is where most of the value sits. For a bare-board fabricator, it might name layer count, laminate family, copper weight, surface finish, minimum track and gap, and the IPC performance class. For an EMS, it might cover assembly class, the smallest and largest packages placed, solder processes, conformal coating, test coverage and box build. For a distributor, it is the list of manufacturer lines for which it is authorised, with anything else marked as independent supply.

Tier suppliers by category and risk

One questionnaire for every vendor produces paperwork nobody reads. Write category-specific requirements for, at least:

• original component manufacturers;
• authorised distributors;
• independent distributors and obsolete-part specialists;
• PCB fabricators;
• EMS and box-build providers;
• cable, harness and electromechanical suppliers;
• programming, screening and test laboratories;
• enclosure, tooling and other custom-part makers.

Then give each supplier a risk tier based on product criticality, process complexity, provenance, spend, how easily it could be replaced, and the consequence of a failure. A catalogue distributor supplying prototype resistors may need a desk review. A new EMS building safety-related assemblies may need an audit, a trial build and your customer's agreement.

Agree the evidence each tier needs

For each category and tier, fix the evidence before you look at candidates, so the bar is the same for everyone:

• identity and registration checks, done on the official registers;
• certificates verified with the issuer for site, scope and status (IAF CertSearch shows whether an accredited certificate is active, suspended, withdrawn or expired);
• for assemblers, process evidence such as a listing on IPC's J-STD-001/IPC-A-610 Qualified Manufacturers List, which records the qualified site, classes and expiry date;
• for distributors, the source model: SAE AS6496 governs authorised distribution (SAE lists AS6496A, December 2024, as the current revision, checked October 2026) and AS6081A governs independent distribution, and the controls you expect differ between them;
• an audit, a first-article or a trial build sized to the tier.

Remember what a management-system certificate is. ISO 9001 certification is carried out by independent certification bodies, not by ISO, and it shows a system operating within a stated scope. It does not show that a given site can make your product. ISO published the 2026 edition in September 2026, so expect a mix of 2015 and 2026 certificates during the transition (checked October 2026).

Where the finished product falls under a compulsory Indian scheme, map supplier evidence to your own compliance plan. The BIS Scheme II (registration scheme) pages list covered electronics and IT categories and their Indian Standards; a component maker's test report supports your registration, but the obligation for the finished product stays with the brand owner.

Name the approvers in the policy: quality for the system and the risk, engineering for technical capability, procurement for commercial and continuity factors, and compliance where regulations apply. Nobody should approve outside their area alone.

Use statuses that purchasing can act on

Approval needs a small set of states with clear meanings:

• Provisional: limited orders, up to a stated value, while pilot results and open evidence are gathered.
• Approved: normal orders within the recorded scope.
• Conditional: orders only with stated restrictions, such as 100 per cent incoming inspection or one programme.
• Suspended: no new orders while an investigation or corrective action is open.
• Removed: approval withdrawn; the supplier must requalify from scratch.

Record the approvers, the effective date, the review date and any open conditions against every status change.

Wire the list into purchasing

An AVL that lives only in the quality office does not stop anything. The released BOM maps each internal part to approved manufacturer part numbers. The AVL maps each of those to approved entities and sites. The purchasing system should then enforce:

• Only approved part and supplier combinations can be ordered
• The PO carries the approved site and ship-from address
• Suspended and removed suppliers are blocked automatically
• Buyers get an alert before an approval or certificate expires
• Conditional approvals trigger the right inspection plan at receipt
• Free-text supplier entries cannot bypass the list
• Received lots are traced into the finished product

If you outsource assembly, decide whether your EMS may buy from any distributor on its own list, or only from sources on yours for critical parts. Write the rule into the contract, and require notice before the EMS changes a sub-tier source or moves your job to another site. Approving the EMS is not the same as approving everyone the EMS buys from.

Handle shortages without corrupting the list

Shortages will push someone to buy off-list. Make that a controlled deviation, not a quiet purchase. The deviation record should name the business need, the exact part and lot, the source and its classification, the risk assessment, the inspection and test plan, a quantity limit, the products it may go into, the approvers and an expiry date. Quarantine the material until the conditions are met.

The emergency source does not join the AVL because it delivered once. If you want to keep it, put it through normal qualification. The spot-buying guide covers the inspection side of these purchases.

Keep the list alive

Approvals go stale. Set a review interval by tier, and add event triggers that force an early review: a change of ownership, site, process, certification or authorisation, a serious quality escape, or a financial warning sign. Expired certificates and lapsed reviews should change the status automatically, not wait for someone to notice.

Feed the monthly or quarterly vendor scorecard into these reviews, and watch trends as well as averages: three late deliveries in a row can matter more than a year-to-date figure that still looks green. NIST's manufacturing extension programme cautions against selecting suppliers on unit price alone, and the same applies when deciding who stays on the list.

The mistakes that most often undermine an electronics AVL:

• approving a company everywhere instead of an entity at a site;
• mixing approved parts and approved vendors without rules linking them;
• treating a certificate as proof of product capability;
• one questionnaire for every category;
• no record of authorised versus independent status by line;
• approving after an easy sample that does not represent production;
• statuses that never reach the purchasing system;
• emergency suppliers that become permanent by default.

There is no right number of suppliers per category. Aim for enough qualified sources to protect continuity and keep pricing honest, without more qualification work than your quality team can sustain. For critical single-source parts, a qualified second source is usually worth the effort, as the multi-supplier strategy guide explains.