CNC Turned Parts

CNC turned parts carry compliance weight — the IATF scope decides what the paperwork actually covers. This page covers the IATF 16949 scope, the documentation to request, and the legal entity behind it.

What are CNC turned parts?

CNC turned parts are rotational parts produced on CNC lathes — shafts, pins, bushings and threaded bodies, held to ±0.002 mm on diameters. Turned parts for regulated buyers carry paperwork: IATF 16949 scope, material certificates, first-article reports.

A certification is a third-party audit you inherit without paying for it. When a supplier holds ISO 9001, IATF 16949, and ISO 14001, an independent registrar has already checked that the quality system, the process control, and the environmental management are documented and running, not just claimed. That is compliance verified by someone whose job is to be skeptical, before you spend a dollar of your own due-diligence budget.

For you, the certificates are the cheapest pre-audit available. They do not replace your own checks, but they shrink the unknown from "does this shop run a system at all" to "does this shop run the system I specifically need."

The inheritance runs in both directions. A certificate stays valid because the registrar returns on a surveillance schedule and re-checks — it is not a one-time snapshot from years ago. That recurring audit is the part you do not have to pay for: the registrar has already watched the shop handle non-conformances, corrective actions, and management review. What you inherit is an ongoing audit trail, not a single framed certificate. Your own work then narrows to the gap the registrar cannot see for you — whether the supplier's specific process fits your specific part.

There is also a limit, and knowing it keeps your file honest. A certificate verifies that a system exists and runs; it does not verify that your particular part will come out right every time. That is what first-article inspection, PPAP, and your own incoming checks are for. The certificate is the foundation, not the ceiling — it removes the worst unknowns so the remaining checks stay small, targeted, and affordable.

What does the IATF 16949 scope actually cover?

IATF 16949:2016 is the automotive quality-management standard, and its scope here is stated precisely: the manufacture of CNC metal machining parts, excluding product design under Clause 8.3. The exclusion is not a weakness — it is a boundary, clearly drawn, so you know that design responsibility stays on your side while manufacturing process control stays on the supplier's side.

Honest scope note: this is a build-to-print manufacturer. If your program needs the supplier to own design responsibility, that must be scoped separately up front, and a supplier that says so plainly is one whose compliance you can map to your own requirements.

Design responsibility is a legal and commercial line, not a technical detail. When the scope excludes product design, the supplier's obligation ends at manufacturing your print to specification; it does not extend to choosing tolerances, selecting the alloy for the load, or signing off the design. That line matters the moment something fails in the field, because it determines who carries the liability. Knowing it up front lets you write the contract, the PPAP, and the warranty around the correct owner — before there is a dispute to resolve.

It also changes what you can delegate. With a build-to-print supplier you keep full control of the drawing and the design risk, and you delegate the manufacturing risk. That split is clean, and a clean split is what a compliance file is for.

What compliance documentation can a buyer request?

Compliance is proven by documents, not by assurances. A serious supplier can produce, on request: material certificates with incoming XRF verification, CMM inspection reports, SPC control charts on key characteristics, and — for automotive programs — APQP/PPAP evidence including a process flow chart, a control plan with critical characteristics and inspection frequency, a PFMEA with RPN and corrective actions, and environmental control procedures.

Each document is a link in the chain that connects your part back to its raw material, its process, and its inspection. A compliance file that contains all of them is the difference between "trust us" and "here is the record."

The documents are not interchangeable, and requesting the right set saves you a review cycle. Material certificates and XRF records answer whether the lot is the alloy you specified. CMM reports answer whether the dimensions sit inside tolerance. SPC charts answer whether the process is stable or the part passed by luck. APQP/PPAP answers whether the process was planned and risk-assessed before production, with a control plan on the characteristics that matter. If you ask for a quality certificate, you get a logo; if you ask for these four, you get the record.

What is the factory's legal registration, and why does it matter?

Behind every compliance file is a legal entity, and a verifiable one is the foundation of due diligence. The legal name is Dongguan Zhuohang Ltd, registration number 91441900MA4UWT6X39, founded in 2005. A registration number you can check confirms you are dealing with a real, incorporated manufacturer — not a brand shell or a forwarding address — and it is the first entry in any serious compliance review.

A registration number is checkable the same way a certificate number is, and it answers a different question. The certificate tells you what the shop can do; the registration tells you who is legally responsible for doing it. If the two do not match — the certificate held by one entity and the invoice raised by another — you have found a compliance gap before any parts ship. Matching the legal name, the registration number, and the certificate holder is the least expensive check that catches a shell company.

How does material verification fit into compliance?

Material compliance is the part of due diligence most buyers skip, and it is where the quietest failures live. Every incoming lot is checked by XRF spectrometer against its mill certificate before it reaches a machine, so a substituted alloy is caught at the door. The mill certificate plus the XRF check together form the material traceability that regulated buyers — and any buyer who wants the alloy they specified — require. This is the same discipline IATF 16949 audits look for, running on every job, not just automotive ones.

The XRF check is not a chemistry lab, and it is not pretending to be one. It reads the elemental spectrum of the surface and flags a lot whose reading does not match the mill certificate — a quick, non-destructive gate that catches substitution before machining starts. For alloys where full composition or mechanical properties matter, the mill certificate carries the heat number and the tested values. Together the two documents form the traceability pair: the certificate states what the lot claims to be, and the XRF states what it actually is.

What does a complete compliance due-diligence checklist look like?

A complete check runs in a fixed order, and each step removes one unknown. First, the certificate numbers — verified with the registrar. Second, the scopes — read for exclusions like Clause 8.3. Third, the legal entity — name and registration number. Fourth, the documentation — material certs, CMM reports, SPC charts, and APQP/PPAP where required. Fifth, the floor — a live walk to confirm the system runs in practice, not just on paper.

The order matters more than the items, because each step is only meaningful if the one before it holds. A scope without a verified number is just text; documentation without a real legal entity behind it is just paper; a floor walk without records to compare is just a tour. Run the steps in sequence and a failure shows up early and cheaply, instead of late and expensively.

What questions expose a compliance file's gaps fastest?

A few pointed questions get past the brochure faster than a checklist read top to bottom. The point is not to catch a supplier in a lie; it is to see whether the answers come from a live system or a template.

• Send the certificate number, the registrar, and the current validity dates — for all three standards.
• State the scope exclusions in writing, and name who owns design responsibility.
• Show the material verification record for the most recent lot, not a blank form.
• Walk the inspection room live and show the calibration log on the CMMs.
• Confirm the legal entity on the invoice matches the one on the certificate.

A supplier that answers all five in one message is running a system. A supplier that answers none of them is running a website.

How do you weigh a certificate against a site visit?

The two checks answer different questions, and a complete file uses both. The certificate is the registrar's word that a system exists; the site visit is your own eyes that it runs on the floor. Neither replaces the other.

Check	What it confirms	What it cannot see
Certificate, verified with registrar	A documented, audited system in scope	Your specific part, this week
Documentation review	Records exist for real jobs	Whether records are live or staged
Site visit or live video walk	The system runs on the floor	Long-term stability over months

Layered in that order, the three checks cost little and remove the unknowns in sequence. Skip the certificate and you pay for an audit you could have inherited; skip the floor and you take the paper's word for the practice.

What does a compliant first order look like?

An MOQ of 1 piece turns the compliance file into something you can test rather than something you have to take on faith. Order a single first article, and the material certificate, the CMM report, and the SPC chart should arrive with it. If the documentation lands complete and matches the part, you have verified the system on your own print at minimal cost. If it lands late, incomplete, or not at all, you have learned something about the supplier that no certificate would have shown. The single part is the least costly audit you will run.

The first article is also where the compliance file meets reality. A certificate can look complete on paper and still produce a part that does not match your print, because the print is the one input the registrar never saw. Running a single part through the supplier's own inspection and comparing the report to your own measurement closes that loop. When the two reports agree, you have not just a compliant supplier — you have a supplier whose compliance extends to your part, which is the only compliance that counts for you.

Why is a third-party audit worth more than a self-declaration?

A self-declaration is the supplier grading its own homework; a certificate is a third party that has no incentive to pass it. The registrar's job is to be skeptical, and its signature is only as good as its independence. That independence is the point: it is why a certified claim costs more than a typed sentence, and why you can lean on it without leaning on the supplier's own word. When you read a certificate number, you are not reading a promise; you are reading a finding from someone paid to check.

There is a practical limit to that trust too. A registrar audits a sample of the system on a schedule; it does not live on the floor. So the third-party finding covers the system, and your own checks cover the parts. Both are needed, and a compliance file that mixes them is the one you can defend.

How do you build a compliance file you can hand to a regulator?

A file you can hand over is one that a third party can read without you there to explain it. It opens with the legal entity — name, registration number, address. It carries the three certificate numbers and their scopes. It holds the material and inspection records for the parts in question, the SPC charts on key characteristics, and the APQP/PPAP package where the program calls for it. Each page is dated, and each claim on the page is traceable to a record behind it. That is the difference between a compliance file and a folder of logos: the first can be audited, the second can only be admired.

What do you do when a certificate fails verification?

A failed verification is information, not a dead end, and it is exactly the information the logo was designed to hide. If the number does not resolve, or resolves to a different legal entity, or the scope does not cover your part, you stop and ask for the correct, current document. If the corrected document still does not match, you have your answer: the compliance claim was not what it appeared to be. Walking away from that finding is cheaper than discovering it on a rejected shipment, and far cheaper than discovering it in a field failure.

How do you read a certificate scope line word by word?

A scope line is three fields, and each one can hide an over-claim. The activity field says what was audited — machining of metal parts, not the whole business. The site field says where — a single address, not a network of anonymous workshops. The exclusion field says what is not covered — product design under Clause 8.3, here. If you read only the activity field, you are reading one third of the line; the exclusions are where a scope either earns trust or loses it.

Scope field	What it states	What to check
Activity	Which process was audited	Does it name every process you are buying?
Site	The physical location audited	Does it match the address on the invoice?
Exclusions	What the audit did not cover	Is there a stated exclusion you missed?

Read the line twice. The first pass confirms the process you need is named. The second pass hunts for what is missing — a finishing process, a heat-treat step, a design activity. The exclusions are where the scope stops, and a scope is only honest if the stopping point is printed rather than left for you to assume.

What does a surveillance audit actually check?

A certificate is not a one-time snapshot from years ago. The registrar returns on a surveillance schedule and re-samples the system, and what it re-checks is the record of the system working between visits. Three things carry the most weight: the internal audit results, the management review, and the handling of non-conformances and corrective actions. A supplier that can show these on request has a live system; a supplier that shows only the framed certificate has a system that stopped being checked the day the photo was taken.

The surveillance visit is why a certificate you inherit is worth more than a certificate you merely read. The registrar has already watched the supplier find problems, write corrective actions, and close them — the expensive part of a quality system, and the part a fake file can never reconstruct. Your own due diligence then narrows to the one thing the registrar cannot see: whether the supplier's specific process fits your specific part.

How does compliance due diligence change by industry?

The base certificates answer the same question in every industry — does a documented, audited system exist. What changes is the additional evidence each industry stacks on top. Automotive buyers add PPAP and process capability. Medical buyers push harder on material traceability and change control. Robotics and automation buyers care about tight tolerances and repeatability over long runs. Semiconductor equipment buyers care about material purity and cleanliness. The base file is the same; the second layer is the part you must specify yourself, because no supplier can guess your industry's specific requirement.

Industry	Extra evidence to request	Why it matters
Automotive	PPAP, process capability (Cpk)	Proves the process, not just the part
Medical	Full material traceability, change control	A substituted lot can become a recall
Robotics / automation	Capability over long runs, repeatability	Parts must stay in tolerance across thousands
Semiconductor equipment	Material purity, cleanliness records	Contamination is a yield killer

State your industry's second layer up front. A supplier that has never seen a PPAP package will not produce one from habit; a supplier that has will hand it over in a day. Asking for the right second layer at the quote stage is how you learn whether the supplier has actually served your industry, rather than whether it is willing to. For medical turning, the second layer is spelled out in the guide to medical CNC turned parts materials, documentation, and tolerance expectations — the record set a device maker's file needs, feature by feature. For aerospace turning, where the part rotates and the geometry evidence must follow the axis, the expectations are worked out in the guide to aerospace CNC turned parts materials, documentation, and tolerance expectations — roundness and runout to the datum axis, forging or bar lot traceability, and the surface-integrity record.

How do regional compliance expectations differ?

Compliance documents travel with the parts, and different markets ask for different paperwork. European buyers routinely ask for material substance declarations and finished-product marking evidence. North American buyers lean on material certificates and lot-level traceability. Japanese buyers tend to push on dimensional accuracy and PPAP-style submission. Australian buyers want import documentation and evidence of a real manufacturer behind the brand. The differences are in emphasis, not in the underlying system, which is why the same three certificates and the same material and inspection records serve all four, once you know which document each market wants on top.

Keep the differences in emphasis, not in law. This page states what buyers commonly request in each market; it does not enumerate tariffs or regulation clauses, because those change and they belong to the finished product rather than the machined part. What does not change is the foundation: a verifiable certificate, a traceable material record, and an inspection report that matches the lot.

What standard engineering references should a compliance file lean on?

A compliance file is stronger when it rests on references a third party can look up. Three come up most often for machined parts: the general-tolerance standard ISO 2768, the surface-roughness scale measured in Ra, and the DFM rules that decide whether a part can be machined economically. None of these is factory-specific; each is a public standard an auditor or a customer can check independently.

ISO 2768 gives default tolerances for features without a specific callout, in three classes: f (fine), m (medium), and c (coarse). A drawing that says "ISO 2768-m" tells the shop how much the un-dimensioned features are allowed to vary, which closes a whole category of quote-time ambiguity. Surface roughness is stated in Ra micrometres — 0.8 µm for a fine machined finish, 1.6 µm for general machining, 3.2 µm for a lightly machined surface. DFM rules are the practical limits — minimum wall thickness, maximum hole depth versus diameter, minimum internal corner radius — that decide whether a feature costs a standard setup or a special one.

These references are the vocabulary the rest of the file is written in. A supplier that uses them precisely, and a buyer that understands them, can read each other's drawings and quotes without a translator.

How do you read a tolerance and surface-finish callout?

A tolerance callout is either specific or inherited. A specific callout states the number — ±0.002 mm (turning) / ±0.003 mm (milling) here for milling and turning, ±0.002 mm for grinding. An inherited callout points to a general standard — ISO 2768-m, for example — and lets un-dimensioned features fall where the standard says. The two are different promises, and a compliance file should make clear which applies to which feature.

Nominal size (mm)	ISO 2768-f	ISO 2768-m	ISO 2768-c
over 6 up to 30	±0.1	±0.2	±0.5
over 30 up to 120	±0.15	±0.3	±0.8
over 120 up to 400	±0.2	±0.5	±1.2

Tolerance also has a cost ladder, and it is worth reading before you over-specify. A general tolerance is the baseline — standard setup, standard measurement. A ±0.05 mm callout costs a little more. A ±0.002 mm (turning) / ±0.003 mm (milling) callout costs a tighter process and CMM verification. A ±0.002 mm grinding callout costs the most, because it adds a process and a surface-finish instrument. Each step up the ladder is a step you should be able to justify, not a default you inherit from a habit of writing tight numbers.

Surface finish is stated the same way, in Ra micrometres. 0.8 µm is a fine machined surface for sealing and bearing faces; 1.6 µm is general machining; 3.2 µm is a lightly machined or rough surface. A quote that names the Ra on the critical faces is a quote that has been thought through; a quote that omits it is leaving a finishing decision to be discovered later, at the cost of a rework cycle.

For the bands behind those numbers — which features earn a tight callout, which finishes are realistic on a turned surface, and when a part crosses from turning into grinding — see What Tolerances and Surface Finishes Are Realistic on CNC Turned Parts.

What material grades should you expect to see documented?

The material line on a quote should name a grade, not a family. "Aluminum" is a family; 6061-T6 or 7075-T6 is a grade with known properties. "Stainless" is a family; 304 or 316 is a grade with known corrosion resistance. The grade is what the mill certificate documents, and it is the only form of the claim you can trace.

Grade	Typical use	Note for documentation
6061-T6 aluminum	General structural, machined parts	Common, weldable, anodizes well
7075-T6 aluminum	High-strength structural parts	Strength near steel, higher cost
5052 aluminum	Sheet, corrosion-prone parts	Formability over machinability
304 stainless	General corrosion resistance	Austenitic, non-magnetic
316 stainless	Marine / chemical exposure	Added molybdenum resists pitting
4140 alloy steel	Shafts, high-stress parts	Heat-treatable, good fatigue strength

The grade matters because two grades in the same family can be a world apart in cost and behavior — 7075-T6 is far stronger and pricier than 6061-T6, and 316 outlasts 304 in salt spray. When a quote says "aluminum" and your print says 7075-T6, you have a material risk waiting to surface at inspection. Name the grade, request the mill certificate with the heat number, and check the XRF reading against it — the three steps close the material question before the first chip.

When does certificate-based due diligence fail?

Certificate-based due diligence fails when you stop at the certificate. The failures below are all versions of the same mistake: treating a system-level fact as if it were a part-level guarantee.

• The certificate is current, but the scope does not name the process you are buying.
• The material cert is real, but it has no heat number that ties to your lot.
• The documents are complete, but they describe a different revision of the drawing.
• The supplier is certified, but the work runs through an unnamed subcontractor.

A certificate removes the worst unknowns; it does not remove all of them. The remaining unknowns are specific to your part and your drawing, and no registrar has seen either. That is why the file ends with a first article on your own print, not with the certificate. The certificate is the gate; the first article is the proof.

What signals a supplier is hiding compliance cost?

Compliance has a cost — the time to write records, the instruments to measure, the audits to pass. A supplier that is hiding that cost hides it in small signals you can read before you commit. Charging extra to release documents that should ship with the parts is one. Saying the records are "available on request" but never producing them before payment is another. Refusing to name the subcontractor who does the finishing is a third. Each signal is the supplier telling you that record-keeping is an expense it would rather avoid, and an expense avoided in the paperwork is an expense avoided in the part.

The quietest signal is the lot number. Ask for a document lot that matches the shipped lot, and a supplier with a real traceability system answers instantly. A supplier that cannot match the two is showing you that its documents and its parts live in different systems, which means the documents describe something other than what is in the box.

How do Incoterms fit into the compliance paperwork?

Incoterms decide where responsibility transfers between seller and buyer, and that boundary also decides which documents change hands at which point. Under EXW you collect at the factory gate and takes the documents there; under FOB the seller loads to the port and the paperwork follows the shipment; under DDP the seller carries responsibility to your door, including the paperwork that clears customs. The terms do not change what compliance evidence exists — the certificates and the records are the same — but they change who holds the originals and when.

For a compliance buyer, the practical point is simple: know your term, and know which party carries the records through the handoff. A file that arrives with the parts under DAP is the seller's obligation; a file you must chase under EXW is yours. Write the documentation requirement into the same agreement that names the Incoterm, so the paperwork travels with the risk.

How do you read a mill certificate line by line?

A mill certificate is the material's birth record, and the three fields that matter are the grade, the heat number, and the tested values. The grade is the alloy designation — 6061-T6, 304, 4140. The heat number identifies the specific melt the material came from, and it is the thread that ties your part back to a furnace. The tested values are the measured chemistry and, for structural grades, the mechanical properties. A certificate with all three is a traceability document; a certificate with only the grade is a name tag.

The heat number is the field buyers under-read and auditors over-read. Two bars of 6061-T6 from different heats can be chemically close but not identical, and when a part fails the question is always "which heat." A certificate without a heat number cannot answer it, which means the traceability ends at the warehouse door rather than the furnace.

What belongs in a legal-entity check beyond the registration number?

The registration number is the entry, not the whole check. A complete entity check adds three fields: the registered address, the legal form, and the signatory on the invoice. The address should match where the work happens. The legal form tells you what kind of liability sits behind the name — a limited company, not a trading alias. The signatory should be someone the entity can bind, not a first name in an email. Together they answer the question the number alone cannot: who exactly is accountable if something goes wrong.

Run the check before the first payment, not after the first dispute. A registration number that resolves to a different name or address than the one on the invoice is the earliest and cheapest warning of a shell in the chain.

How do you verify a calibration log is real?

A calibration log is the quiet half of every measurement claim, and it has two tells when it is fake. A real log has a schedule and a history — instruments are due on dates, and past calibrations are recorded with results, not just dates. A fake log lists instruments and nothing else, or shows every instrument "calibrated" with no third-party name, no certificate number, and no as-found versus as-left values. The third-party calibration certificate is the part you ask for: it should name the lab, the standard it was checked against, and the results.

Calibration is the property that makes a CMM report believable. An instrument out of calibration produces numbers that look precise and are wrong, and a log that is current and third-party is the difference between measurement and theater.

How do you read a CMM report line by line?

A CMM report is readable in a minute if you know the four fields: the drawing revision, the characteristic, the nominal versus the actual, and the pass line. The drawing revision matters because a report for revision B proves nothing about revision C. The characteristic is the dimension or tolerance being checked. The nominal-versus-actual is the measurement itself, and it should vary slightly from nominal, because a real measurement always does. The pass line is the tolerance boundary the actual must sit inside.

A report where every actual equals the nominal exactly is a template, not a measurement — no instrument is that clean. A report with values that drift a few microns around nominal is a record of a real part. Ask for the report on your own drawing, at your own revision, and the difference between the two is obvious the moment you read it.

What do you do between first article and volume?

The first article proves the process can make your part once. The gap between one part and a thousand is process stability, and it is closed with three steps. Lock the drawing revision and the control plan before volume starts, so the part you qualified is the part you are buying. Agree the inspection points and the sampling plan, so the volume run is checked the same way the first article was. Keep the SPC charts running on the critical characteristics, so a drift shows up as a trend before it shows up as a reject.

The three steps turn a one-off proof into a repeatable purchase. Skip them and you are buying a thousand first articles, each one a fresh roll of the dice.

Guides

Buyer-side guides to the same facility — how to screen a supplier online in thirty minutes, the tolerance and finish bands worth specifying, the cost model, the lead-time schedule, the quality evidence, and the service map behind the certificate file.

• Aerospace CNC Turned Parts: Materials, Documentation, and Tolerance Expectations on Rotational Geometry — the rotational-geometry evidence chain for shafts, bushings, sleeves, and spools: where roundness error comes from, the axis behind every runout and concentricity callout, the forging or bar lot chain behind the material, and the surface-integrity record.
• Medical CNC Turned Parts: Materials, Documentation, and the Tolerance Expectations You Can Measure — the two-column acceptance sheet for medical turning: which material facts a tool can verify and which only a record can prove, which tolerances deserve measurement, and the documents that tie the numbers to the batch.
• China CNC Turned Parts Sourcing: What to Verify Before You Pay — the checks that settle a turning order before the money moves: measurements you can run at your own bench, batch statistics that catch drift, and the trial-then-scale order that keeps every payment matched to evidence.
• Aluminum vs Stainless for CNC Turned Parts: A Decision Table for Rotating Duty — a rotating-duty decision table that runs the failure modes of shafts, threads, sealing stems, and fittings against each metal family, with the lathe, finish, and verification implications written out.
• CNC Turned Parts vs Alternatives: Which Material–Process Pair Wins Your Part? — your route comparison across multi-spindle and Swiss turning, MIM, investment casting, cold heading and forging, and metal additive, paired with the material families each route can run.
• How to Choose a CNC Turned Parts Supplier Online: A 30-Minute Screen — a timed five-lane screen that shortlists the suppliers worth your drawing before you send it.
• CNC Turned Parts Lead Times: What Drives Them and How to Plan — the four clocks behind a turning delivery date and how to turn a quote into a dated chain you can verify.
• CNC Turned Parts: What Tolerances and Surface Finishes Are Realistic? — the practical bands per feature and material, and when a callout turns a turning job into a grinding one.
• How Much Do CNC Turned Parts Cost in 2026? — your cost model where every quote line maps to evidence you can verify.

Frequently Asked Questions