Electronics Supplier Due Diligence: What to Verify Before the First PO

A clean GST registration, an ISO certificate in the email signature and a quick, polite quotation tell you very little about whether a supplier can deliver genuine, conforming electronic parts on the date you need them. Due diligence before the first purchase order is the work of linking four things: the legal entity you will pay, the source the material really comes from, the controls that protect it on the way, and the exact lot being offered.

How deep you go should follow the risk of the purchase. A sole-source IC, a safety-related power module, a programmed device or a custom cable harness deserves the full sequence below. A catalogue resistor from a well-known authorised distributor can pass a lighter check, but the check should still be written down.

Decide what you are actually approving

Approval is never a blanket yes. Before you collect a single document, write down the scope you are being asked to approve:

• the legal entity and the site that will make, store or ship the goods;
• the manufacturer lines or product families covered;
• the supplier's role for each line: manufacturer, authorised distributor, authorised reseller or independent distributor;
• prototype, production or regulated use, and the application risk;
• any value-added work such as programming, re-reeling or kitting;
• the maximum order value you will allow before a review.

This matters because a distributor authorised for one semiconductor brand can be an independent seller of another, and a warehouse certified for storage is not thereby qualified to programme your microcontrollers. The approval you record later (see the approved vendor list guide) should carry the same scope.

Check the legal entity and the bank account

For an Indian supplier, reconcile the names on the quotation, the proforma, the tax invoice and the bank beneficiary. They should be the same legal entity, or the difference should be explained in writing.

Use the official registers yourself rather than screenshots sent by the vendor:

• GSTIN. The GST Portal's Search Taxpayer function shows, without login, the legal name, trade name, effective date of registration, constitution of business, principal place of business, any cancellation date and return-filing details.
• Company or LLP record. The Ministry of Corporate Affairs master-data service returns the company or LLP details, status and directors or signatories from the CIN, LLPIN or name.
• Udyam number, if the supplier quotes one. It can be checked on the Udyam portal, but registration is on a self-declaration basis, so it confirms an MSME record, not capability.

For an overseas seller, check the equivalent company registry, registered address and export entity. A registration proves that a record exists. It says nothing about stock ownership, process control or authenticity.

Payment-diversion fraud is the cheapest failure to prevent. Confirm any change of bank details by calling a number you found independently, not the one in the email that announced the change. Require two people to approve a new beneficiary, and keep supplier creation, bank-detail entry and payment approval with different people. A sudden request for advance payment to a new account is a stop condition.

Establish the source role for every manufacturer quoted

Ask the supplier to classify itself, line by line, and then test the claim.

Under SAE AS6496, the authorised-distribution standard summarised by ECIA, a distributor must disclose in writing at quotation if it is not authorised for the items quoted. SAE's listing shows the current revision as AS6496A, revised December 2024 (checked October 2026). Independent distributors work to a different standard, AS6081A, which covers reliable-source selection, risk mitigation and control of suspect parts. A partner badge, an association membership or access to someone else's catalogue is not manufacturer authorisation. The guide to verifying an authorised distributor covers the manufacturer-side checks in more detail.

If you must buy outside the authorised channel, say so in the PO and plan quarantine, inspection and testing before the material reaches the line.

Verify certificates with the issuer, not the PDF

Every certificate needs the same five checks: the legal entity and address match the supplier; the standard is the right one for the work; the scope covers the product or process you are buying; the site is included; and the status is current. The registers below are where each one can be checked.

IAF CertSearch shows each accredited certificate as active, suspended, withdrawn or expired, together with its scope, locations and the issuing body. A certificate that cannot be found there is not automatically fake (not every body uploads data), but it moves the burden to the certification body to confirm it.

Two date-sensitive points (checked October 2026). ISO published ISO 9001:2026 in September 2026, so you will see certificates to both the 2015 and 2026 editions during the transition; either can be valid. The IAQG register lists AS9100 Revision D as the current aerospace standard, with a revision in progress. For ESD, ANSI/ESD S20.20-2021 is the current edition, and ESDA notes that IEC 61340-5-1 is technically equivalent. The IPC list shows which classes each site is qualified for and an expiry date, so check both.

No certificate proves that a particular reel is genuine or that a factory can hold your drawing tolerances. Treat it as evidence about a management system within a stated scope. The manufacturing certifications guide explains what each scheme does and does not cover.

Test the controls by tracing a past order

Procedures are easy to send. Records are harder to fake. During a site visit or a live video walk-through, pick one completed order and ask the supplier to show, in sequence: the purchase from its upstream source, goods receipt, the package or reel ID, lot and date code data, incoming inspection, storage location, the certificate of conformance it issued, the shipment and any return. Note how long retrieval takes and whether the records agree with each other.

While you are there, look at the practical controls that matter for electronic parts:

• ESD-protected areas, grounding and the last ESD audit result
• Moisture-sensitive device storage, bag sealing and floor-life records
• Physical segregation of authorised, independent, returned and quarantined stock
• Control of relabelling and preservation of original manufacturer labels
• Calibration status of test and inspection equipment
• Non-conformance handling, corrective action and effectiveness checks
• Access control and audit trails on the stock and order systems

For a manufacturer or contract assembler, add the process view: the equipment and fixtures that control your critical characteristics, operator training, preventive maintenance logs and spare capacity. NIST's manufacturing extension programme suggests asking what a capacity figure really means, noting that a supplier running below about 60 per cent may have other business problems and one above about 80 per cent may struggle to absorb your order.

If the supplier will receive firmware, programming keys, CAD data or remote access to your systems, include information security. NIST's due-diligence quick-start guide (SP 1326, July 2026) organises the assessment around ownership and control, provenance, resilience, foundational cyber practices and supply-chain tiers. It is written for technology suppliers, but the five headings work as prompts for any supplier that touches your data.

Check the offer itself

An approved supplier can still quote unsuitable material. For each line, confirm:

• manufacturer and the complete orderable part number;
• quantity physically on hand versus quantity being sourced;
• who owns the stock and where it sits;
• original factory packaging and seal condition;
• date code, lot code and country of origin, and whether lots are mixed;
• moisture-sensitivity level, bag seal date and storage history;
• the certificate of conformance and traceability documents that will ship;
• lifecycle status and quote validity.

For higher-risk stock, ask for current photographs of the actual labels and reconcile them with the paperwork. One photo or one good sample does not approve a supplier's whole inventory. The MOQ, lead-time and date-code checks article goes further into reading the offer itself.

Put the conditions into the order

What you verified should become an obligation. The RFQ, quality agreement and PO should state:

• the approved manufacturer and exact part number, with no substitution or change of source without written approval;
• disclosure of source status for each line;
• original packaging, ESD and moisture-sensitive handling;
• lot and date-code segregation, traceability and the documents to be supplied;
• your right to audit and to see records;
• notice of product or process changes and discontinuance;
• hold and notification when non-conforming material is found;
• returns, warranty, containment and cost recovery;
• preservation of suspect or counterfeit parts rather than return to stock.

Read the supplier's own terms for non-cancellable, non-returnable clauses and warranty limits, and resolve conflicts before you pay. Avoid "or equivalent" on a PO unless engineering has approved the equivalent.

Run a pilot order before broad approval

Choose a quantity large enough to exercise normal packing, paperwork and delivery, and small enough that a failure is contained. Then:

1. Confirm the lot and documents before dispatch.
2. Quarantine the goods on arrival.
3. Reconcile seller, shipper, labels, part number, quantity and documents.
4. Inspect packaging, ESD and moisture protection and physical condition.
5. Apply the agreed sampling or test plan.
6. Record how the supplier responds to any discrepancy.
7. Link the received lot to the pilot build and its yield records.

Judge the pilot on delivery against the acknowledged date, incoming acceptance, document accuracy, assembly yield and the supplier's behaviour when something goes wrong. Those results become the first entries in the vendor scorecard.

Record the decision with its limits

Give the supplier a status and a scope rather than a tick: approved, conditional, prototype-only, inactive or blocked. Write down the conditions, such as "authorised lines only" or "lot testing required", the approver and a review date. Set triggers for an early review: a change of ownership, site, bank, certification, authorisation or process, a quality escape, or a financial warning sign.

Stop and escalate if any of these appear during the process:

• the quotation, invoice and bank names differ without a documented reason;
• authorisation cannot be confirmed by the manufacturer;
• the stock owner or location is not disclosed;
• a certificate's site or scope does not match the work;
• the supplier refuses traceability, inspection or a factory walk-through;
• substitutions are proposed after the order is placed;
• urgent advance payment is requested after a bank change.

If you are still building the shortlist, the component distributors directory is one place to start, and independent testing and certification providers can help when a part needs lab verification. Either way, the checks above remain the buyer's job.