What Certifications Should I Look for Before I Approve a China Sheet Metal Supplier?

We have walked dozens of U.S. buyers through supplier approvals in China. The pattern is consistent: buyers get burned not by obviously bad factories, but by factories that look fine on the surface yet carry no audited proof of process discipline.

Before approving a China sheet metal supplier, verify at minimum: ISO 9001:2015 for quality management, ISO 14001:2015 for environmental controls, REACH and RoHS declarations for material compliance, and Mill Test Reports tied to heat numbers for every incoming batch. Additional certifications depend on your end application.

These documents are not paperwork for paperwork's sake. They are your only objective signal of what happens inside a factory you cannot visit every week.

Is ISO 9001 Enough for My Custom Sheet Metal Project?

Our sourcing team reviews supplier quality documents every single day. ISO 9001:2015 ¹ comes up in almost every conversation — but whether it is enough depends entirely on what your parts go into.

ISO 9001:2015 is enough only if your parts are non-critical commercial components. For automotive applications, you need IATF 16949. For aerospace, you need AS9100D. For any product entering regulated markets, you also need material compliance declarations such as REACH and RoHS regardless of ISO status.

What ISO 9001 Actually Covers

ISO 9001:2015 certifies that a factory runs a documented Quality Management System (QMS). That means they have written procedures for process control, equipment calibration, corrective actions, and customer-requirement traceability.

It does not certify the quality of any specific part. It certifies the system used to make parts.

Here is what that distinction means in practice:

When ISO 9001 Is Not Enough

If your parts feed into an automotive assembly line, ISO 9001 alone is insufficient. IATF 16949:2016 ² adds automotive-specific requirements: Advanced Product Quality Planning (APQP), Production Part Approval Process (PPAP) documentation, and Measurement System Analysis (MSA). These enforce a level of dimensional repeatability that ISO 9001 does not address.

For aerospace or defense applications, AS9100D ³ is the required standard. It mandates first-article inspection reports, full material traceability to raw-stock heat numbers, and configuration control. ISO 9001 explicitly excludes these requirements.

Matching Certification to Application

Use this table to identify the minimum certification requirement for your project:

The short answer: ISO 9001 is the baseline, not the ceiling. Know your end application before you set your certification requirements.

What Certifications Help Me Reduce Quality and Compliance Risk When Importing from China?

When we help clients build their approved supplier lists, we always start with risk mapping. The certifications you need are directly tied to the compliance risks your specific supply chain carries.

To reduce quality and compliance risk when importing custom sheet metal from China, require ISO 9001:2015 for process control, ISO 14001:2015 for material and finishing integrity, REACH and RoHS declarations for chemical compliance, Mill Test Reports for material traceability, and social audit certifications such as BSCI or SMETA to validate data reliability from the factory.

ISO 14001 Is a Quality Signal, Not Just an Ethics Document

Many buyers treat ISO 14001:2015 ⁴ (Environmental Management System) as a nice-to-have for corporate social responsibility reporting. That is a mistake.

Factories that hold ISO 14001 must document and control their use of chemicals, surface-treatment processes, and waste disposal. That discipline directly affects your parts.

A supplier that cannot manage its own chemical use is more likely to substitute banned coatings, skip passivation steps, or use non-conforming surface treatments — all of which affect part corrosion resistance and long-term performance.

REACH and RoHS: Non-Negotiable for Regulated Markets

If your parts enter the EU, or are assembled into electronic or consumer products anywhere, REACH ⁵ and RoHS ⁶ compliance is not optional.

• REACH governs hazardous chemical content in the metal itself and any applied coatings.
• RoHS restricts lead, cadmium, mercury, hexavalent chromium, and several brominated compounds.

Do not accept a supplier's self-declaration for either. Request third-party test reports from accredited laboratories: SGS, Bureau Veritas, and Intertek are the recognized names. A self-signed CoC with no lab reference number is worthless at customs.

Mill Test Reports Are the Foundation of Everything

Mill Test Reports (MTRs) ⁷ are not a certification, but they make every other certificate meaningful. An MTR links a specific incoming coil or sheet to its heat number, alloy grade, temper, and mechanical properties — verified at the mill before the metal ever entered the supplier's facility.

Without MTRs, a supplier cannot prove the material they fabricated matches what they quoted. Material substitution — using a cheaper or non-conforming alloy — is otherwise undetectable until you run destructive testing on finished parts.

Social Audits as a Quality Proxy

This connection surprises some buyers: factories that violate labor standards — suppressing injury reports, falsifying working hours — typically apply the same behavior to quality nonconformity reporting. If a factory hides safety problems, it hides defect data too.

BSCI (Business Social Compliance Initiative) ⁸, SA8000, and Sedex/SMETA audits verify factory governance and worker conditions. Their secondary value is as a signal of institutional honesty.

How Can I Verify Whether a Supplier's Certificates Are Valid and Current?

We have seen forged ISO certificates. We have seen expired certificates resubmitted as current. It happens often enough that we treat certificate verification as a required step, not an optional one.

Verify supplier certificates by looking up the certificate number, registered scope, and expiry date directly on the issuing body's online portal. SGS, TÜV Rheinland, Bureau Veritas, DNV, and Intertek all maintain searchable databases. Never rely on a PDF copy alone.

Step-by-Step: How to Verify a Certificate

The process is straightforward. What matters is doing it systematically.

Step 1 — Get the certificate document. Ask the supplier for a copy showing the certificate number, issuing body name, registered scope, issue date, and expiry date.

Step 2 — Identify the issuing body. Common certification bodies operating in China include SGS, TÜV Rheinland, TÜV SÜD, Bureau Veritas, DNV, Intertek, and LRQA.

Step 3 — Go to the issuing body's lookup portal directly. Do not use a link the supplier sends you. Go to the certifier's official website yourself. The SGS Certified Client Directory ⁹, for example, allows lookup by certificate number, company name, and country.

Step 4 — Search by certificate number. Confirm the following match the document the supplier gave you:

Step 5 — Check scope carefully. A factory may hold ISO 9001 for its welding operations but not its sheet metal fabrication. The scope statement on the certificate specifies exactly what activities are covered.

Red Flags to Watch For

• Certificate PDF has no issuing body logo or signature
• Certificate number returns no result on the issuing body's portal
• Registered scope is vague or lists only trading activity, not manufacturing
• Expiry date has passed
• Registered address does not match the factory address the supplier provided

ISO 45001 as an Additional Verification Proxy

ISO 45001 ¹⁰ (Occupational Health and Safety) is often overlooked. Factories that maintain documented hazard controls, equipment maintenance schedules, and incident reporting tend to apply the same systematic documentation culture to production quality. Poor safety records and poor process-control records tend to appear together.

It is not a replacement for direct quality certification verification. But if a factory holds ISO 45001 from a credible third-party auditor and it checks out on the portal, that is a meaningful positive signal.

Which Certifications Matter More for U.S. Buyers of Custom Metal Parts?

U.S. buyers face a specific combination of requirements: domestic customer quality expectations, import compliance, and increasing pressure from tariff-driven supply chain diversification into Vietnam and Southeast Asia. The certification priorities for a U.S. importer are not identical to those for a European buyer.

For U.S. buyers of custom metal parts from China or Vietnam, the highest-priority certifications are ISO 9001:2015, IATF 16949 or AS9100D for regulated industries, and current MTRs for every shipment. REACH and RoHS matter if parts enter electronic or consumer product assemblies. Certificate of Conformance per shipment lot creates the legal record needed for customs disputes and downstream warranty claims.

Why Certificate of Conformance per Shipment Lot Matters

A Certificate of Conformance (CoC) is not a factory-level certification. It is a shipment-level document. It ties a specific purchase order to the material specification, dimensional standard, and finish requirement that were contracted.

For U.S. buyers, a properly issued CoC serves two critical functions:

1. It gives you grounds to reject non-conforming goods at customs before they enter your warehouse.
2. It creates the legal and traceability record you need to support any warranty or liability claim downstream.

A CoC that does not reference a specific PO number, material spec, and inspection standard is not useful. Ask for this format explicitly in your purchase order terms.

Vietnam Suppliers: Same Standards Apply

As more U.S. buyers shift volume to Vietnam to avoid China tariffs, a common question arises: do Vietnamese suppliers meet the same certification standards?

The answer: the standards are identical. ISO 9001, ISO 14001, IATF 16949, and REACH/RoHS requirements do not change based on country of manufacture. The verification process — checking certificates on issuing body portals — is the same.

What does change is the density of certified suppliers. China has a larger pool of ISO-certified sheet metal fabricators than Vietnam currently does. In our Vietnam branch office, we see this firsthand: the qualified supplier pool is smaller, making supplier qualification and factory auditing even more important.

Priority Ranking for U.S. Buyers

The Practical Step: Build It Into Your PO Terms

The most effective approach is not to chase certifications after a problem occurs. Build your requirements into your purchase order template. Specify which certificates must be on file before production starts, which documents must accompany each shipment, and what happens if they are missing.

That creates a contractual obligation — not just a preference — and gives you clear grounds to act if a supplier fails to comply.

Conclusion

Approving a China sheet metal supplier without verifying certifications is a preventable risk. Start with ISO 9001, match additional standards to your application, verify every certificate directly on the issuing body's portal, and build CoC requirements into your PO terms before the first order ships.

Footnotes

1. ISO's official page for ISO 9001:2015 quality management system requirements and certification scope. ↩︎

2. AIAG's authoritative resource on IATF 16949:2016 automotive quality management system requirements. ↩︎

3. NQA's guide to AS9100D certification requirements for aerospace and defense manufacturers. ↩︎

4. ISO's official standard page for ISO 14001 environmental management systems, now updated to 2026. ↩︎

5. European Commission's official overview of the REACH regulation governing chemical substances in manufacturing. ↩︎

6. Nemko's comprehensive guide to the EU RoHS Directive and restricted hazardous substance compliance. ↩︎

7. Merit Brass guide explaining how to read a Mill Test Report and verify heat number traceability. ↩︎

8. amfori's official page on the BSCI audit program for social compliance in global supply chains. ↩︎

9. SGS's online Certified Client Directory for verifying management system certificate numbers and scope. ↩︎

10. ISO's official standard page for ISO 45001:2018 occupational health and safety management systems. ↩︎