HDI PCB Supplier Audit: Define the Scope and Who Pays Before You Book the Trip

The audit everyone agreed to, and nobody defined

The decision to audit an HDI supplier is usually easy. Someone on the team says the boards are going into a product where a latent via failure is expensive, the supplier is new or the build is moving to a new site, and everyone agrees an audit is warranted. The supplier agrees too. A date gets picked. Flights get booked.

Then the questions start arriving in the wrong order. Who goes, and does the supplier expect a quality engineer or a procurement lead? Are we auditing the plant that laminates, or the plant that drills, or both, because they turn out to be different buildings. Is laser drilling in-house here. Is the sequential lamination press theirs. Who is paying for this trip. If we find something, who pays to fix it, and do we come back to check, and does that second trip cost us again. How long is the result good for. If they move a process line in four months, does any of this still apply.

None of those are hard questions. Every one of them is cheap to answer in writing before the trip and expensive to answer after it. The pattern that causes the trouble is treating the audit as an event rather than as an arrangement: a thing that happens on a date, as opposed to a thing with a defined boundary, a named cost owner, a stated shelf life, and a rule for when it must happen again.

On HDI specifically the stakes of a loose scope are higher than on a conventional multilayer, and for a structural reason. HDI value is concentrated in a small number of process steps whose output you cannot inspect from the outside of a finished board. Microvia formation, the plating that fills or caps those vias, the registration discipline that keeps sequential layers aligned, and the lamination cycles that stack them are all buried by the time the board ships. A finished HDI board looks like a finished HDI board. If the audit scope happened not to include the step that actually controls the risk you were worried about, you did not confirm anything. You bought a photograph of a clean factory floor.

What this article answers

This is a purchasing and supplier-qualification document, not an auditing manual. It covers five things:

1. How granular a scope line has to be before it is executable by whoever actually runs the audit, and why process-step granularity is the working level on HDI.
2. Which subcontracted steps must be named individually in the scope, and what happens when the scope says "the supplier's process" and part of that process belongs to somebody else.
3. What on-site, documentation-only and third-party audits each can and cannot confirm, so the mode matches the question instead of the budget.
4. Who owns four distinct cost buckets — travel and auditor time, corrective action, re-audit, and the ongoing cost of maintaining evidence — each of which quietly defaults to one party when unassigned.
5. How long the conclusion is valid and which categories of change should trigger a mandatory re-audit regardless of the calendar.

Then where to write it so it binds, because an audit scope agreed over email and never carried into a document has no standing when the result is contested.

An audit is a contract arrangement, not an event

The most useful reframing available here costs nothing: stop describing the audit by its date and start describing it by its four parameters.

An audit has a scope boundary. There is a set of processes, documents, records and locations inside it, and everything else is outside it. The boundary is the single most consequential thing in the arrangement, because a conclusion only covers what was inside it. "We audited the supplier" is not a finding. "We audited these named steps at this named site against these criteria" is.

An audit has a cost owner, and in practice several, because the costs arrive in different forms at different times. The trip is one cost. Fixing what the trip found is another. Verifying the fix is a third. Keeping the evidence current so the next audit is cheaper is a fourth. These do not all belong to the same party and they are rarely discussed as separate items.

An audit has a validity period. A conclusion reached about a factory on a Tuesday describes that factory on that Tuesday. Everyone knows this and almost nobody writes down how long they intend to rely on it. The absence of a stated period does not mean the conclusion lasts forever; it means the conclusion's expiry will be decided retroactively during an argument.

An audit has re-audit triggers. Some changes invalidate a conclusion before its period expires. A moved production line, a new subcontractor for a step that was in scope, a change in the equipment used for a step you specifically went to look at — each of these can make a valid conclusion stale instantly. If the triggers are not enumerated, the supplier has no obligation to tell you the trigger occurred, and you will usually find out from a defect.

Write those four parameters down and most of the downstream disputes disappear, because the disputes were never about auditing practice. They were about which party assumed what, in the absence of anyone having said.

Scope granularity: the level at which a scope line becomes executable

Audit scopes fail in a predictable way. They are written at the level the commercial conversation happened at, which is the level of the company, and they need to be executed at the level of a process step.

Company-level scope reads like "audit Supplier X." It is not executable. An auditor arriving with that instruction will audit whatever the host chooses to show, which is the part of the operation the host is proudest of. This is not deception on anyone's part; it is the natural result of an unspecified request.

Site-level scope reads like "audit Supplier X's Plant 2." Better, and it catches one of the common HDI surprises, which is that the entity you are contracting with operates more than one facility and your boards may not be built where you think. But it still does not tell the auditor what to look at inside the building.

Product-family-level scope reads like "audit Supplier X's HDI line." This feels specific and usually is not, because "the HDI line" is rarely a single physical line. It is a routing through shared equipment, some of which also runs conventional work, and the question of whether your build uses the same drill as the standard multilayer work is exactly the kind of thing the phrase obscures.

Process-step-level scope is the working level. It reads as an enumerated list of the steps you intend to confirm, each named in the supplier's own process terminology, each with the question you want answered about it. On HDI the list that matters tends to concentrate in a few places: the formation of the small vias, whatever plating process fills or closes them, the registration and alignment discipline between sequentially built layers, the lamination cycles, and the electrical test coverage that would or would not catch a buried defect. Add the steps specific to your build — a particular surface finish, a cavity, a mixed-dielectric stack — because those are frequently the steps that are subcontracted.

Underneath the process steps, three categories belong in scope that are not process steps at all and are the ones most often omitted:

Document systems. Not "do they have procedures" but specifically: how does a change to your build's process reach the floor, how is the revision of your fabrication data controlled, and how would the operator running your job know which revision is current. A supplier with excellent processes and a weak document path will build your previous revision correctly.

Retention records. What is kept, for how long, and retrievable by whom. The practical test is not whether records exist but whether a record for a specific job from some months ago can be produced while you are standing there. Record systems that work only prospectively are common and are worth knowing about before you rely on traceability in a dispute.

Retained samples and coupons. Whether anything physical is kept from a build, under what identification, and whether you can get it. This is the difference between being able to investigate a field failure and being able to discuss one.

A scope at this granularity is longer to write and it is the only version that produces a conclusion you can point at later. The test to apply before you send it: if the auditor on the day reads this line, do they know what to ask for and what would constitute a satisfactory answer. If not, the line is a topic, not a scope item.

Subcontracted steps are where undefined scope does its damage

Nearly every HDI supplier subcontracts something. This is normal, it is often the correct engineering decision, and it is not a problem in itself. It becomes a problem when the audit scope is written as though the supplier performs every step, because then the scope silently excludes the steps performed elsewhere, and those are disproportionately the steps you were worried about.

The mechanism is simple. You write a scope covering the HDI process. The auditor audits what the supplier does. The supplier subcontracts one step. That step is outside the audit, nobody said so, and the conclusion is reported as covering the HDI process. Everyone has acted in good faith and the result is a confirmation that does not cover the risk.

The categories where this shows up most on HDI work:

Small-via formation. Whether the vias are formed on the supplier's own equipment or at a partner is a question with a factual answer that is frequently not asked. If it is subcontracted, the control of that step, the records for it, and the recourse if it goes wrong all live with a company you have no contract with.

Specialised plating. The process that fills or closes small vias is sometimes a separate operation at a separate location. Plating subcontracting is also the case where retention records are hardest to obtain afterwards, because the records are held by the party furthest from your contract.

Lamination for unusual stacks. A supplier equipped for standard cycles may send a sequential or mixed-material stack elsewhere. Your build may be the exception that leaves the building.

Surface finishes. Very commonly subcontracted, often to a party chosen per-job by availability rather than fixed, which means the answer can be accurate on the day of the audit and different on the day of your build.

Electrical test. Sometimes outsourced, sometimes partially. Relevant because test coverage is the only step in the list that would catch a buried defect from an earlier step, so if it is outside scope your audit has confirmed none of the backstop.

Depanelisation and specialised mechanical work. Lower risk individually, but the same scope logic applies.

What to do about it is not to prohibit subcontracting, which would be unrealistic and would cost you good suppliers. It is three things, all of which are writing rather than travel:

Require declaration before the audit. Ask the supplier, in writing, to list which steps of your build are performed by others and where. Doing this before the scope is finalised is the single highest-value action in this entire article, because it converts an unknown into a line item. A supplier who will not answer this has told you something useful.

Decide per step whether it enters scope. Not all of them need to. A subcontracted step whose output is fully verifiable afterwards is lower priority than one whose output is buried. Make the decision explicitly rather than by omission.

State what in-scope means for a step you do not control. There are workable options: the supplier's own audit of their subcontractor with records made available to you, a documentation review of the subcontractor, your right to attend, or a third-party report. Each is weaker than auditing it yourself and each is much stronger than silence. What matters is that the arrangement is named, because it determines who you talk to when the step fails.

One related point worth stating plainly: the question of which steps are in-house versus subcontracted is a separate inquiry from how those steps enter an audit scope and get paid for. Knowing the split is upstream work. This article assumes you have it and addresses what you then do with it.

What each audit mode can and cannot confirm

Audit mode is usually chosen by budget and calendar, then the conclusion is relied on as though mode were irrelevant. The three modes answer genuinely different questions and the useful discipline is to pick the mode after deciding what you need confirmed.

On-site audit. What it can confirm: that the equipment exists and is where they said it is, that the operation runs the way the procedure describes, how material and work-in-progress actually move, what the floor does when something goes wrong, and whether a named record can be retrieved while you wait. The last of those is the item with the best return and the one most often skipped in favour of a tour.

What it cannot confirm: consistency over time. You saw one shift on one day building whatever was running. It also cannot confirm anything about your specific build if your build was not in production during the visit, which is the common case and is worth asking about when scheduling. And it confirms nothing about subcontracted steps happening somewhere else, however thorough the visit.

Documentation-only audit. What it can confirm: that a control system exists on paper, that the document and revision structure is coherent, that records of the type you need are generated and retained, and that historical records for a named job can be produced. That last one is genuinely strong evidence and is available without travel. A supplier who can pull the complete record set for a job you name has demonstrated something a factory tour cannot.

What it cannot confirm: that the floor follows the documents. The gap between a documented process and a practised one is the entire reason site visits exist. Documentation-only is appropriate for confirming record systems and traceability, and insufficient for confirming practice.

Third-party audit. What it can confirm: whatever was in the third party's scope, which is the critical qualifier and the one most often lost. A third-party report is strong evidence about the thing it examined, and silent about everything else. It is also usually cheaper and faster than your own visit, and sometimes available already completed.

What it cannot confirm: your specific build's process path, unless your build happened to be in that scope, which it generally was not. Before relying on a third-party report, read its scope section and compare it against your own scope list. If you cannot obtain the scope section, you cannot use the report as evidence of anything in particular.

The practical combination most teams land on, in rough order of value per unit of effort: a documentation review including retrieval of records for a named historical job, then a targeted on-site visit scoped to the few process steps whose output is buried, with any available third-party reports read for their scope rather than their conclusion. Choosing the mode to match the question is cheaper than choosing the most expensive mode and hoping it covers everything.

Cost ownership: four buckets that default to whoever forgot to ask

"Who pays for the audit" is treated as one question with one answer. It is four questions, they arrive at different times, and each has a different default when unassigned.

Bucket 1 — the audit itself. Travel, auditor time, and the supplier's time hosting. Market practice varies and there is no universal right answer; what matters is that it is stated. Common arrangements: the buyer bears their own costs as a cost of qualification, the buyer bears costs but they are credited against initial orders, or costs are shared where the audit also serves the supplier's own qualification needs. Unstated, the default is that each party absorbs its own, which is usually fine and occasionally produces a surprise invoice for host time. Thirty seconds of writing removes the ambiguity.

Bucket 2 — corrective action. What it costs the supplier to fix what you found. Normally the supplier's, and it is worth saying so, with one exception that causes most of the real disputes: findings that are not non-conformances against any agreed requirement, but rather things you would prefer were different. If you ask for a change that was never a requirement, that is a change request with a price, not a corrective action. Distinguishing the two in advance — findings against agreed requirements versus buyer-requested improvements — prevents an argument at exactly the moment you want the relationship to be cooperative.

Bucket 3 — re-audit and verification. The cost of confirming the fix. This is the bucket most often left unassigned and the one that most often turns into a second unplanned trip. Decide two things: whether verification requires a visit at all, since much of it can usually be done with evidence rather than travel, and who pays if it does. A reasonable and common pattern is that verification of supplier-caused non-conformances is at the supplier's cost, while verification of buyer-requested changes is not. The point is less which rule you pick than that you pick one before anyone is annoyed.

Bucket 4 — maintaining the evidence. The ongoing cost to the supplier of producing records, retaining samples, and notifying you of changes in the form you asked for. This bucket is almost never discussed and it is where audit requirements quietly become a price component. A supplier asked to maintain unusual record-keeping for your account will either price it, or agree and let it decay, and the second is more common and worse. If your requirements go beyond what the supplier does as standard, say so during quoting and let it be priced rather than discovering during the next audit that it stopped happening.

Two framing points on cost. First, the trip is usually the smallest of the four and absorbs almost all of the discussion, because it is the one with an invoice attached. Second, the largest real cost in a badly arranged audit is none of these: it is the schedule cost of discovering a problem late because the scope missed it. That cost cannot be assigned to anyone, which is the argument for spending the effort on scope definition rather than on cost negotiation.

Validity period and the changes that force a re-audit

An audit result has a shelf life whether or not anyone states one. Stating it has two benefits: you know when to plan the next one, and the supplier knows when their conclusion stops being an asset they can point to.

Set the period by risk rather than by habit. A supplier building a product where a buried via failure surfaces in the field warrants a shorter interval than one building a low-consequence board. A supplier with a stable process history warrants a longer one than a new relationship. A supplier who notifies changes reliably warrants a longer one than a supplier from whom you learn about changes through defects. There is no correct number and this article will not invent one; what matters is that the number exists in writing and that both parties know it.

More important than the period is the trigger list, because the changes that invalidate a conclusion do not wait for the calendar. Enumerate these, and attach an obligation to notify:

Relocation of any in-scope process step, between buildings or between lines within a building. This is the trigger with the highest hit rate and the lowest notification rate, because from the supplier's side it is routine capacity management.

A new or changed subcontractor for an in-scope step. Your audit concluded something about a specific party performing that step. A different party is a different conclusion. This is also where the pre-audit subcontractor declaration pays off a second time: without it you have no baseline against which a change can even be identified.

Replacement or significant modification of equipment used in an in-scope step. Particularly relevant for the small-via formation and plating steps, where the equipment and the process window are closely coupled.

A change in the material set or stack-up construction for your build, including substitutions the supplier considers equivalent. Equivalence is a judgement, and the right to review it is worth retaining.

Significant turnover in the roles that control the in-scope steps. Softer than the others and still real, because much of what an audit confirms is practice, and practice lives in people.

Any confirmed quality escape traced to an in-scope step. The audit concluded the step was controlled. An escape is evidence about that conclusion, not merely about the lot.

Change of ownership or management of the supplier or of a named subcontractor. Not automatically a problem, and reliably a reason to re-confirm rather than assume continuity.

Two mechanics make the trigger list work. First, the obligation must be to notify in advance where practicable, not after the fact, because a notification that arrives with the defective lot has no value. Second, state what happens when a trigger fires: full re-audit, targeted re-audit of the affected step, or documentation review. Graduated responses are more realistic than treating every trigger as a full re-audit, and a graduated response that is written down will actually be used.

Which document carries it, and what each one can enforce

An audit arrangement agreed in a thread of emails is an understanding, not a requirement. The arrangement has to land in documents, and the documents have different enforcement weight.

The RFQ is where the audit requirement should first appear, and its function is pricing rather than enforcement. Stating at RFQ stage that qualification includes an audit of named steps, that subcontracted steps must be declared, and that specified records must be retained and made available lets the supplier price all of it. A supplier who learns about your record-retention requirements after winning the order will either absorb them badly or renegotiate. Neither is as good as having quoted them.

The purchase order carries the commercial terms, and a PO can reference an audit arrangement but is a poor place to define one. Its value here is the reference: a PO that points to a named, revision-controlled qualification arrangement makes that arrangement part of the order.

The quality agreement, or whatever the equivalent document is called in your organisation, is where the arrangement actually belongs. This is the document that can hold the scope list, the subcontractor declaration and the obligation to update it, the audit mode, the four cost buckets, the validity period, the trigger list with notification obligations, the graduated response, and the records and retained-sample requirements. It is the only one of these documents designed to carry obligations that persist across orders, which is exactly what an audit arrangement is.

The fabrication drawing and data package carry build requirements, not supplier-qualification arrangements. Keep audit terms out of them. Mixing the two makes both harder to revise.

The audit report itself is evidence, and its usefulness depends on one thing people routinely omit: the report must restate its own scope. A report that records findings without recording what was and was not examined cannot be used later to establish what was confirmed. Write the scope list into the report, including the explicit list of things excluded. The exclusions section is the part your successor will need most.

A short practical note on sequencing. The subcontractor declaration should be requested before the scope is finalised, the scope should be agreed before the mode is chosen, the mode should be agreed before the cost buckets are negotiated, and all four should be in the quality agreement before anyone travels. Audits that go wrong usually ran that sequence backwards, starting from a date.

Where this sits relative to the adjacent supplier questions

Supplier qualification is several distinct decisions that get compressed into one word, and separating them keeps each document doing one job.

Building a shortlist happens before any of this. That is a question of which suppliers have the evidence available to be worth considering at all, and it is answered from documents and claims rather than from audits. Assessing a supplier's capability evidence is likewise upstream: it asks what they can demonstrate, not how you will go and confirm it. Determining which process steps are performed in-house versus subcontracted is the factual input this article depends on and does not duplicate — that inquiry establishes the split, while this one addresses how the split enters an audit scope, who pays for examining it, and what invalidates the result.

Prequalification scope and expiry for a different board type is the same class of question applied to different physics. Heavy copper risk concentrates in different steps than HDI risk does, so the scope list and the trigger list come out different even though the structure is the same.

This article addresses one thing: for a supplier you have already decided to audit, what the scope covers, what it costs, who pays, how long it stands, and what makes it stand down. If several of these documents are missing in your process, the scope list and the subcontractor declaration are the two to write first, because they are the only ones whose absence can make an entire completed audit worthless.

Before you book the audit

Six items, all of them writing rather than travel, and all of them cheaper now than later:

1. Request a written subcontractor declaration for your build before finalising scope. Highest value action here by a wide margin. Everything else in this list gets better once you have it.
2. Write the scope at process-step granularity, including document systems, retention records and retained samples, and include an explicit exclusions list.
3. Choose the audit mode per question, not per budget. Documentation review for record systems and traceability; on-site for the steps whose output is buried.
4. Assign all four cost buckets in writing, and distinguish non-conformances against agreed requirements from buyer-requested improvements before you need the distinction.
5. State the validity period and the trigger list, each trigger with a notification obligation and a graduated response.
6. Put all of it in the quality agreement at a controlled revision, reference it from the PO, and make sure the audit report restates its own scope and exclusions.

To discuss an HDI build and what a supplier should be able to evidence about the buried steps, start from the HDI PCB product page. For what to ask a supplier to confirm in writing during qualification, capabilities outlines the areas worth getting on paper, and contact is the route for arranging a documentation review before anyone commits to travel. If you are sending a build out for pricing with audit and record-retention requirements attached, include them with the quote request so they are quoted rather than renegotiated.

FAQ

What should an HDI PCB supplier audit scope actually list?

Named process steps in the supplier's own terminology, not a company or a product family. On HDI the list concentrates on the steps whose output is buried in the finished board: small-via formation, the plating that fills or closes them, registration and alignment between sequentially built layers, lamination cycles, and the electrical test coverage that would catch a defect from an earlier step. Add the steps specific to your build. Then add three things that are not process steps: the document and revision control path that reaches the floor, what records are retained and who can retrieve them, and whether anything physical is kept from a build. Finish with an explicit exclusions list, which is the part that makes the conclusion usable later.

Who pays for a PCB supplier audit?

Separate it into four buckets, because they arrive at different times and default differently when unassigned. The audit itself (travel, auditor time, host time) is commonly each party absorbing its own, sometimes credited against initial orders. Corrective action for findings against agreed requirements is normally the supplier's. Re-audit and verification is the bucket most often forgotten and most often becomes an unplanned second trip. The ongoing cost of maintaining records and notifications is almost never discussed and is where audit requirements quietly become a price component. State all four; which rule you choose matters less than having chosen.

Do subcontracted process steps need to be in the audit scope?

The steps whose output you cannot verify afterwards do. The failure mode is not deliberate: you write a scope covering the supplier's process, the auditor audits what the supplier performs, one step belongs to someone else, nobody said so, and the conclusion gets reported as covering the whole process. Request a written declaration of which steps are performed elsewhere before you finalise scope, decide per step whether it enters, and name what in-scope means for a step you do not control — supplier audit of their subcontractor with records available to you, documentation review, your right to attend, or a third-party report. Any of those beats silence.

Is a documentation-only audit worth doing instead of a site visit?

For some questions it is the better instrument, not merely the cheaper one. Asking a supplier to produce the complete record set for a specific job you name from some months ago tests the record system, the retention policy and the retrieval path in one request, without travel, and a supplier who can do it has demonstrated something a factory tour cannot. What documentation cannot confirm is that the floor follows the documents, which is the whole reason site visits exist. The efficient combination is a documentation review first, then a targeted visit scoped to the few steps whose output is buried.

How long is an HDI supplier audit result valid?

Set the period by risk and write it down; this article will not supply a number, because the right one depends on the consequence of a buried failure in your product, the stability of the supplier's process history, and how reliably they notify changes. The period matters less than the trigger list, since the changes that invalidate a conclusion do not wait for the calendar. Without a stated period the conclusion does not last forever — its expiry simply gets decided retroactively, during an argument.

What changes should force a re-audit before the validity period expires?

Relocation of an in-scope step between buildings or lines, which is the highest-frequency trigger and the lowest-notification one because it is routine capacity management from the supplier's side. A new or changed subcontractor for an in-scope step. Replacement or significant modification of equipment used in an in-scope step. A change in material set or stack-up for your build, including substitutions considered equivalent. Significant turnover in the roles controlling in-scope steps. Any confirmed escape traced to an in-scope step. Change of ownership or management. Attach a notification obligation in advance where practicable, and define a graduated response so not every trigger means a full re-audit.

Can we rely on a third-party audit report for an HDI supplier?

Only for what was in its scope, which is the qualifier that gets lost. Read the report's scope section and compare it line by line with your own scope list before relying on it. A third-party report is strong evidence about what it examined and silent about everything else, and it generally did not examine your specific build's process path. If the scope section cannot be obtained, the report cannot be used as evidence of anything in particular.

Where should audit terms be written so they are enforceable?

The quality agreement, at a controlled revision, referenced from the purchase order. That is the only document among the usual set designed to carry obligations persisting across orders, which is what an audit arrangement is. State the requirement in the RFQ as well, but for a different reason: so the supplier can price the record retention, notification and hosting obligations instead of discovering them after winning. Keep audit terms off the fabrication drawing, which carries build requirements. And make the audit report restate its own scope and exclusions, or it will not establish what was confirmed.

What is the difference between a finding and a change request?

A finding is a non-conformance against a requirement both parties had already agreed to. A change request is something you would prefer were different but never specified. The cost treatment differs — corrective action for findings is normally the supplier's, while buyer-requested changes are priced — and conflating them produces an argument at precisely the moment you want the relationship cooperative. Draw the distinction in writing before the audit, when it is abstract and easy to agree.

We already audited a supplier with no written scope. What should we do now?

Reconstruct the scope retroactively and write it down with an honest exclusions list, including the steps you now believe were subcontracted and therefore not covered. That converts a vague reassurance into a known-coverage record, which is more useful than it sounds. Then request the subcontractor declaration you did not get, and decide whether the gap justifies a targeted documentation review rather than a second trip. Most of the value of the next audit comes from having written the scope for it, not from the travel.

---