PCBA Contract Manufacturing: What Should You Verify First?

Table of Contents

1. Before You Send Files: What Must the NDA and Data Path Protect?

2. Before Award: Does the Certificate Cover the Quoted Site?

3. Before Production: Who Owns Revision Control and Alternate-Part Approval?

4. Before Shipment: What Should the Record Prove?

5. Conclusion

6. FAQs

A PCBA contract manufacturing project can involve sourcing, assembly, inspection, testing, and production records. But some problems begin before the first board reaches the line. A buyer may send Gerber files, the BOM, schematics, and test files before confirming who can access them, which manufacturing site the relevant certification actually covers, or who has authority to approve a substitute.

Those questions are easy to mix together. An NDA, a quality certificate, and an approved BOM do not serve the same purpose. In practice, the review should follow the project through four points: file release, contract award, production release, and shipment release. At each stage, the buyer needs something that can be checked—not just a general statement that the supplier is reliable.

Before You Send Files: What Must the NDA and Data Path Protect?

The first gate is the release package. It includes more than a Gerber file. The buyer may also expose an assembly BOM, approved manufacturer part numbers, test scripts, fixture drawings, revision history, quantity forecasts, and pricing. A confidentiality clause that names only “design information” may leave later revisions or production data outside the intended scope.

The Clause Set That Should Match the Project

The agreement should identify each artifact, whether derivative files are covered, how long confidentiality lasts, and what happens when the project ends. If the buyer permits a subcontractor to receive production data, the clause should name that subcontractor or define how approval is obtained.

A mutual NDA is often appropriate when both sides exchange commercially sensitive information, but mutual form does not remove the buyer's need to confirm the actual data path. The manufacturer should be able to explain who receives the release, where it is stored, who can copy it, and how access is withdrawn when a project closes.

Who Can Access, Copy, or Retain the Release

Ask for the practical access model, not only the legal wording. Can external contractors view the BOM? Are test scripts stored with the production lot? Are files retained after final shipment, and if so, under what review and deletion process? These answers help determine whether the NDA and the supplier’s access controls reflect the real workflow.

The same release review should identify which revision is approved. A supplier that receives several BOM versions without a controlled release may work from the wrong file even if the confidentiality terms are sound. Version control and confidentiality therefore belong in the same first gate.

NDA requirements and enforceability vary by jurisdiction. Qualified legal counsel should review the agreement and its interpretation before files are exchanged. The operational checks below can then be applied to the approved legal terms.

Which Revision Becomes the Controlled Release

The released manufacturing package should use a controlled identifier that buyer can trace. A folder name or email subject can change without changing the controlled revision. The release should identify the Gerber, BOM, assembly drawing, test specification, and any approved fixture data that belong together.

The revision also needs an owner. One person or system should release the package, and later changes should create a new controlled version. That prevents a supplier from receiving an updated BOM in a separate message while continuing to build from an earlier assembly drawing.

Before Award: Does the Certificate Cover the Quoted Site?

Certification is the second gate. The buyer should identify the legal entity, manufacturing site, process scope, and product scope connected to the quotation. ISO 9001 provides a general quality-management framework. IATF 16949 may apply to automotive production and service-part manufacturing programs, and ISO 13485 is relevant to medical-device manufacturing. IPC-A-610 defines visual acceptance requirements for electronic assemblies and operates at a different level from a company quality-management-system certification.

What the Certificate Scope Covers

The current certificate should be reviewed with its scope statement and certification body. A buyer needs to know which legal entity holds it, which plant operates under it, and which processes the scope includes. A manufacturer may operate several sites, or it may rely on a subcontractor for a special process. The qualification applies only within the scope and locations identified by the supporting evidence.

In an electronic contract manufacturing program, check the legal entity, manufacturing site, product or process scope, certificate status, and issuing body. The product or market can also change the relevant standard. A general quality system may support a commercial control board while an automotive or medical program expects additional controls.

What Production Records Must Support It

Process evidence shows how the management system is implemented in the actual production route. Request the records that connect the system to this project: IQC controls, first-article approval, in-process inspection records, functional test results, and corrective-action procedures. The quality-control system becomes relevant when those controls can be tied to the board, process route, and acceptance criteria being quoted.

The records should answer practical questions. How is an incoming lot identified? Who approves the first article? Which inspection method applies to a hidden joint? What happens when a test result falls outside the approved limit? These questions turn a certificate review into production evidence.

When a Certificate No Longer Answers the Question

A certificate stops carrying the full answer when the quote moves to a different site, a new subcontractor, or a process outside the audited scope. The buyer then needs the additional qualification or control evidence for that location and process. A supplier can explain how the exception is covered and who remains accountable.

This is also where a quote may reveal a different legal entity. The commercial brand, the contracting entity, and the manufacturing plant can be separate parts of the same project. The buyer should connect them in writing before award instead of resolving the difference after the first shipment.

How to Compare Evidence Before Award

Before awarding the contract, ask every candidate the same five questions:

Use the same evidence questions with each PCBA contract manufacturer. Ask for the document, record, or named responsibility behind each answer. A specific answer about IQC, first-article approval, and lot traceability gives the buyer something to verify. A general quality statement does not carry the same decision value.

Before Production: Who Owns Revision Control and Alternate-Part Approval?

Production should begin after the design revision, BOM revision, process route, test limits, and fixture revision are locked. This gate connects commercial sourcing with engineering control. A supplier may identify a shortage or propose an alternative, and the buyer still needs a controlled decision path.

How to Lock the BOM and Process Route

The released BOM should identify, as applicable, the manufacturer part number, package, quantity, reference designator, and any approved sourcing restriction. The process route should name the assembly methods, special processes, inspection points, and test steps that apply to this board. Any exception should be visible in the quotation or production plan.

The lock should also identify the fixture and test revision. A production build that uses a different carrier, fixture, or test script can produce a different result even when the BOM stays unchanged.

Who Approves an Alternate or ECO

An alternate proposal should identify the affected part, reason, assessed risk, supporting validation evidence, and proposed effective date or lot. The buyer should name the approval authority and require a record of the decision. An email discussion can inform the decision; the released change control should still show who approved it and which revision became effective.

PCBasic supports BOM import, component sourcing, IQC incoming inspection, and first-article systems. Review the electronic component sourcing workflow when the quote includes purchasing, and confirm how an approved alternate becomes part of the released build.

Where Incoming Traceability Begins

At the manufacturing site, incoming-material traceability starts when components are received. The incoming inspection record should identify the lot, part, supplier or sourcing channel, inspection result, and disposition. The approved alternate list should connect to that record, and the production record should show which material moved to the line.

For a high-mix or repeat-production program, this connection becomes more valuable over time. A buyer can compare a new lot with the approved revision and identify when a component, fixture, or process changed. MES and production records can support that review when the required identifiers are defined before production.

Before Shipment: What Should the Record Prove?

The final gate is release evidence. A shipment should connect the approved revision, production lot, test conditions, and change history. The exact record set depends on the board and project plan.

What First Article and In-Process Records Should Show

The first-article record should show that the initial build conforms to the released revision and the approved process requirements. In-process evidence can include SPI results, AOI results, X-ray inspection for agreed hidden joints, and process checks. Each record should identify the board revision, lot, inspection stage, and disposition.

The buyer should know which measurements are recorded and which results require action. A pass label without the inspection condition provides limited value when the next lot changes.

What Functional Test Evidence Should Include

Functional-test evidence should identify the fixture, input conditions, power limits, software version, test points, pass/fail thresholds, and the required disposition for a failed test. The test should reflect the product functions and operating conditions that the buyer intends to verify before release.

For a turnkey PCBA project, the manufacturer may control the internal process while the buyer controls acceptance. The record should show that the agreed conditions were used and that any nonconforming result was identified, controlled, and dispositioned according to the agreed procedure.

How the Lot, Revision, and Change Log Connect

The final package should connect the incoming-material record, production lot, approved revision, test result, and shipment. A change log or controlled deviation record should explain any difference from the released plan. MES and production records can support this traceability when the buyer defines the required identifiers before production.

A generic statement that the factory has traceability provides little assurance. The useful answer names the specific record and shows how it links the shipment to the approved build.

Conclusion

A sound PCBA contract manufacturing review moves through four gates: file control, certification scope, lock the revision and substitution path, and define the shipment record. Each one should leave a clear record that can be checked later. Once those answers are in place, contact PCBasic about the build so the quotation reflects the actual inputs, controls, and acceptance criteria.

FAQs

Q1: Can an NDA replace a supplier quality review?

A1: No. An NDA limits disclosure, but the buyer still needs to verify the production site, process scope, BOM controls, test evidence, and change approval.

Q2: What should be checked when reviewing a PCBA contract manufacturer's certification?

A2: Check the legal entity, site, process and product scope, current status, and the production evidence that connects the management system to the quoted build.

Q3: When should the approved alternate list be finalized?

A3: Before production. The list should identify who may approve a substitute, what evidence is required, and how the approved part connects to the production lot.