PCB Assembly Sourcing Channels: Which BOM Lines Need a Declared Source

The moment a part is placed, one question becomes unanswerable

A reel arrives. The parts go into a feeder. The machine places them, the oven reflows them, and the board moves on. From that point forward, there is one question about those components that nobody on your side can answer from the hardware itself: where did they come from?

Not "what are they" — that is readable. The marking is on the package, the value is measurable, the footprint is visible, electrical test will tell you whether the circuit works. Provenance is different. It is not a physical property of the part. It is a property of the transaction that delivered the part, and transactions leave records, not residue. A component bought direct and a component bought through four intermediaries can be the same component, and on a finished board they are indistinguishable without destructive analysis.

This is why sourcing channel belongs in the contract rather than in the inspection plan. Incoming inspection can confirm identity and condition. It cannot reconstruct a chain of custody that was never recorded. The only mechanism that answers "where from" is a document that was created before placement, and documents only exist if somebody required them.

Most PCBA contracts miss this, and they miss it in a specific and repeatable way. The material clauses are usually thorough: who purchases, who funds, who absorbs a shortage, who owns leftover stock, how overage is settled. All of that is about money and risk. None of it is about route. A contract can be completely explicit that the assembler buys the parts and completely silent on which channels the assembler may buy them through — which means every channel is permitted, including the ones you would have refused.

Why "guarantee the parts are genuine" does nothing

The most common attempt to close this gap is a line in the purchase order requiring the supplier to guarantee authenticity. It feels like a strong clause. It is close to unenforceable, for three reasons that are worth separating.

It specifies an outcome, not a behaviour. The supplier agrees to a result. They do not agree to any particular purchasing conduct, so nothing about their actual process has to change. You have bought a promise instead of a procedure.

It has no test. To enforce the clause you have to prove the negative, after the fact, on parts that are already soldered to assembled boards. The cost of that proof usually exceeds the value of the parts, which is precisely why the clause is rarely invoked even when both sides suspect something.

It contains no scope. It applies equally to a passive resistor and to the one programmable device your product cannot function without. A clause that treats every line identically gives the supplier no signal about where to spend effort — so effort gets spread evenly, which means it gets spread thin.

The alternative is not a stronger promise. It is a narrower, more specific requirement: name the lines that matter, state the channel tier permitted on each, state the evidence that must accompany delivery, and state who may approve a departure. That is four short fields, and unlike the authenticity clause, each one is checkable on arrival rather than litigable after failure.

Four tests for which BOM lines need a declared channel

Declaring a channel for every line is not the goal. On a long BOM it would be ignored, and ignored requirements are worse than absent ones because they create the appearance of control. The useful question is not "is this part important?" — every part on the BOM is important, or it would not be there. The useful question is "would the channel change anything about this part or about who is responsible for it?" Four tests separate the lines where the answer is yes.

Test 1 — Does the part have state? Some components leave the factory in a condition that can be altered by subsequent handling and storage, and the alteration is not visible. Moisture-sensitive packages, parts with a defined floor life once a dry pack is opened, parts whose solderability degrades with age, parts with a stored configuration. For these, the handling history matters as much as the identity, and handling history is channel-dependent: a route with more intermediaries has more opportunities for an unrecorded excursion. A part with no state — a basic passive in a sealed reel — is far less sensitive to route.

Test 2 — Is the behaviour that matters absent from the BOM line? This is the test that catches the expensive cases. A BOM line typically carries manufacturer part number, description, package, quantity. If the attribute your design depends on is implied by the part number and guaranteed by the manufacturer's own distribution, the line is relatively safe. If the attribute depends on which production variant, which date range, which specification revision shipped under that part number, then two parts with identical BOM lines are not necessarily interchangeable, and the route determines which variant you get.

Test 3 — Would a failure of this part be attributable? If the part fails in the field, can the failure be traced back to a specific delivery, and from that delivery back to a specific purchase? If yes, the channel requirement supports a real remedy. If the part is placed in large quantity across many assemblies with no lot segregation, a channel clause with no lot traceability requirement is decorative — the clause and the traceability requirement have to travel together or neither works.

Test 4 — Is the part scarce, or recently scarce? Scarcity is what pushes purchasing into unfamiliar routes. A part that is readily available through its normal route will almost always come through it, with or without a clause. A part that is allocated, end-of-life, long-lead or recently constrained is exactly the part where somebody, under schedule pressure, will find stock somewhere else and treat the find as good news. Scarcity is the strongest single predictor of channel drift, and it is knowable at RFQ time.

Lines that pass two or more of these tests belong on a short restricted list. In practice that list is short — it is not the BOM, it is a subset of it — and its shortness is what makes it enforceable.

Channel tiers, and the ceiling on what each one can prove

Channels differ in one way that matters for a contract: how much of the route they can document. Not how trustworthy they feel, not how much they charge — how much of the path from original production to your assembly line they can put on paper. Each tier has a ceiling. Asking for evidence above the ceiling produces either a refusal or a document that asserts more than the supplier actually knows, and the second outcome is worse than the first.

Tier 1 — Direct from the manufacturer or its authorised distribution. The route is a single documented hop. The seller's own records connect your delivery to production. This tier can support traceability to a production lot, can pass through manufacturer-issued documentation, and can usually tell you the storage condition of the stock it shipped. Ceiling: high. It is the only tier where the chain is complete by construction rather than by assembly of third-party claims.

Tier 2 — A named stocking intermediary with its own documented receiving. The route has more than one hop, but every hop was recorded by a party that keeps records. The intermediary can show what it received, from whom, and what it did to the stock while holding it. This tier can usually support identity and receiving documentation; it can sometimes support lot-level traceability, depending on whether the stock was segregated or commingled. Ceiling: medium — and the binding constraint is commingling, not honesty. If stock from several receipts was merged into one bin, no subsequent document can un-merge it.

Tier 3 — Open-market purchase with testing substituted for provenance. The route cannot be documented end to end; it is reconstructed partially or not at all. What this tier offers instead is inspection and test applied after acquisition. That is a genuine control and it is not worthless, but it is a different kind of assurance: it samples the population for detectable defects rather than establishing where the population came from. Ceiling: low on provenance, variable on condition. The honest way to describe this tier is that it substitutes evidence of state for evidence of origin.

Tier 4 — Buyer-supplied (consigned) material. The route is documented by you, and the ceiling is whatever your own records support. This tier is worth naming explicitly because it inverts the responsibility: if you supply the part, the assembler cannot be asked to vouch for its origin, and any failure attribution clause written as though they could will not survive the first dispute.

Two consequences follow from the ceiling idea, and both are easy to get wrong.

First, the tier has to be chosen per line, not per contract. A blanket "Tier 1 only" on a long BOM is a quotation problem disguised as a quality requirement: it either gets quoted at a price nobody accepts, or it gets agreed to and then quietly not followed on the lines where Tier 1 stock does not exist. A blanket "any tier" leaves your restricted lines unprotected. The declaration is only workable as a per-line field.

Second, a lower tier is not automatically unacceptable. There are situations — a discontinued part, an urgent repair build, a legacy product — where Tier 3 is the only route that exists. The failure mode is not using Tier 3. The failure mode is using Tier 3 without knowing it, on a line where you would have chosen differently, and finding out after the boards are built. A channel declaration does not forbid routes. It makes the route a decision somebody made on the record, with the trade-off visible at the time.

What to require from each tier, and what each document does not prove

"Send documentation" is as weak as "guarantee authenticity" and for the same reason: it names no artefact. Below is what is actually requestable at each tier, paired with the limit of each document. The limits are the important column — a document believed to prove more than it proves is a liability, because it ends the inquiry early.

Certificate of conformance from the seller. Available at every tier. It states that what was shipped matches what was ordered. It does not establish origin — it is the seller's assertion about their own fulfilment, and it is equally issuable by a seller who bought the stock yesterday from a party they cannot name.

Manufacturer-issued documentation passed through unaltered. Realistically available at Tier 1, sometimes Tier 2. This is stronger because the issuer is the original producer. Its limit is coverage: it describes the production it refers to, not the handling that happened afterwards. A genuine manufacturer document travelling with mishandled stock is still a genuine document.

Lot or date-code identification tied to your specific delivery. Available at Tier 1, conditionally at Tier 2, rarely at Tier 3. This is the artefact that makes later failure attribution possible at all. Its limit is granularity — identification at the level of a large commingled batch gives you a population too broad to act on, so the requirement has to specify the level, not just ask for "lot traceability".

Receiving and handling records from the intermediary. The Tier 2 artefact. Shows what the holder received and how it was stored. Its limit is the hop before them: it documents custody from their dock onward and is silent on everything upstream.

Inspection or test reports on the acquired stock. The Tier 3 substitute. Its limit is the sampling plan and the detection scope — it reports on what was examined, for the characteristics that were examined. A report with neither sampling plan nor stated scope is an assertion with a letterhead.

Packaging and handling condition evidence. Relevant wherever Test 1 applied — sealed packaging intact, desiccant and indicator present, the records that start the clock on floor life. Its limit is that it is point-in-time: it describes the condition at one moment, which is why it has to be captured at your receiving rather than inferred later.

Written as a contract field, the requirement reads: *for each restricted line, the permitted tier, the named artefacts required with delivery, and the identification level those artefacts must reach.* Three values per line. Nothing in that list requires a new process from a supplier operating at the declared tier — which is the test of whether a requirement is reasonable: a supplier who is already doing it should be able to comply by attaching documents they already hold.

Channel substitution: the timing is the whole clause

A channel declaration that cannot be departed from will be departed from anyway, informally, the first time the declared route has no stock. So the substitution path is not a weakening of the clause — it is the part of the clause that gets used, and its only real variable is *when* you find out.

There are three moments at which a channel change can surface, and they are not equally priced.

Before purchase. The supplier knows the declared route cannot be served and says so before committing money. At this point every option is still open: wait, redesign, accept a lower tier with added testing, split the build, change the part. Nothing has been spent. This is the only moment where the decision is genuinely yours.

After purchase, before placement. Stock is in hand and was bought through an undeclared route. The options have narrowed to accept, test further, or return — and returning now has a cost attached that somebody has to absorb. The decision is still possible, but it is no longer free.

After placement. The parts are on boards. There is no longer a decision about the parts; there is only a decision about the assemblies. This is the moment the clause was written to prevent, and it is also the moment at which most buyers first learn a substitution happened.

Which means the operative requirement is not "ask permission before substituting" — it is "notify before purchase commitment, not before shipment". Those two phrasings read almost identically in a contract and differ by the entire cost of the build.

A notification that arrives in time but arrives empty is only marginally better than no notification. For the buyer to answer the same day — and same-day answers are what keep a build on schedule — the notice has to carry enough to decide on:

• the affected line, and the quantity affected
• the declared tier, and the tier actually available
• why the declared route cannot serve it
• what evidence the available route can produce, stated against its ceiling
• what additional inspection or test is proposed to compensate
• the decision deadline, and what happens by default if the deadline passes

That last item is the one most often left out, and leaving it out is how an unanswered notice silently becomes an approval. Every substitution clause needs a stated default, because silence will otherwise be read as consent by whichever party benefits from reading it that way.

Who approves, and the difference between notification and authority

Three roles get conflated in practice, and separating them is most of the work:

Who may raise a substitution — usually the supplier, sometimes buyer-side purchasing. This is a wide permission and should be. Raising is not deciding, and a process that discourages raising just moves substitutions off the record.

Who may approve a substitution — must be a single named buyer-side role. Not "the buyer", which is an organisation and cannot sign. The common failure is approval by whoever is closest to the schedule pressure, which structurally produces approval. If approval authority sits with the person accountable for delivery date, the clause has no teeth, because they are being asked to choose between two of their own objectives.

Who may veto a substitution — on lines that passed Test 2 or Test 3, the design or quality authority needs an independent veto that purchasing cannot override. This is the only mechanism that keeps a technically-driven restriction from being renegotiated as a commercial one at the worst possible moment.

And the approval has to land somewhere durable. A decision given over a call is not usable at acceptance; a decision recorded against the specific line, quantity and delivery is. The acceptance question months later is not "did somebody agree?" — it is "which document says so, and does it cover this delivery?"

Where these clauses have to live to be enforceable

The same four fields have different force depending on where they are written, and writing them in the wrong place is a common way to do all the work and get none of the protection.

In the RFQ — this is where the declaration has to appear first, and the reason is pricing rather than compliance. A restricted-channel line costs differently from an unrestricted one. If the restriction appears only after award, you have either an unpriced requirement that will be contested, or a change order. Declaring at RFQ also makes the quotes comparable: without it, a supplier quoting an unrestricted route and a supplier quoting Tier 1 are offering different things at prices you are about to compare as though they were the same thing.

As BOM columns — this is where the per-line values belong, because this is the document that reaches the people who actually purchase. A requirement in a contract annex that is not reflected in the working BOM will not be seen by the buyer executing the order. Two columns — permitted tier, required evidence — put the requirement where the decision is made.

In the purchase order — the PO is what binds commercially. It needs the incorporation by reference, the substitution notification timing, the named approval role and the default on silence. Anything that will be argued about in money terms has to appear here.

In the quality agreement — artefact formats, identification levels, retention periods, and what receiving does when an artefact is missing. This is also where "what happens if the documents do not arrive with the shipment" belongs, and it is worth stating, because the realistic failure is not forged documentation. It is documentation that simply never shows up, on a delivery that is otherwise fine, under schedule pressure that makes nobody want to stop the line over paperwork.

At incoming receiving — the declaration has to be a check somebody performs, with a defined outcome when it fails. A requirement with no receiving step is a requirement that gets discovered to have been unmet during a failure investigation, which is the one moment it can no longer help.

What the gap costs, and where the cost appears

The cost of omitting this section almost never appears as a sourcing problem. It appears somewhere else, wearing a different name, which is why the gap survives so many contract reviews.

At receiving, as an argument about paperwork. Parts are fine, documents are thin, the line needs to run. Without a declared artefact list there is no basis to hold the delivery, so it is released — and the release is the point at which traceability was lost, though nobody records it that way.

In production, as an unexplained process variation. A reel behaves slightly differently. Placement or soldering yield shifts on one line and not others. Without lot segregation tied to a delivery, the shift is attributed to the process, because the process is the only variable anybody can see.

In the field, as a failure with no attributable population. Returns come back. The common factor is a component, but the affected build cannot be bounded, because the parts were commingled across assemblies. The containment action becomes "all units", and the difference between a bounded recall and an unbounded one is usually larger than the entire material cost of the BOM.

In the next qualification, as a question you cannot answer. A customer or an auditor asks how you control component sourcing. The answer is a sentence about guaranteeing authenticity, with no per-line declaration, no artefact list and no approval record behind it. The gap is not that the control was weak. It is that there is no document to show.

How this article relates to the adjacent PCB168 guides

This is a narrow article by design, and it sits between several that cover the neighbouring questions. Reading it as a replacement for any of them will leave gaps.

Alternate part approval — whether a *different* part is acceptable — is the subject of turnkey PCBA BOM risk and alternate part approval. This article is about the same part arriving by a different route, which is a question that survives even after alternates are fully controlled.

When a part goes end-of-life and a substitution clock starts, the timing and default-path clauses are in component EOL and the substitute approval clock. That article governs the decision window; this one governs what the replacement's route must document.

For EMC-relevant components, where equivalence cannot be read off the BOM line at all, see PCBA EMC/EMI component sourcing approval scope. That is Test 2 applied in depth to one component family.

Who funds material and who absorbs a shortage is material ownership when parts run short — the money-and-clock question that most contracts do answer. And the delivery-side counterpart, what documentation has to arrive with finished goods, is the shipment document package and lot traceability. Channel evidence collected at purchase and shipment documentation issued at delivery are two ends of the same chain; requiring one without the other leaves the chain open at one end.

What to settle before the purchase order

• The restricted list: which lines passed two or more of the four tests, named individually rather than described by category.
• The permitted tier per restricted line, with at least one line's tier deliberately set lower than the maximum so the list reflects real decisions rather than a default.
• The required artefacts per tier, named as documents, with the identification level each must reach.
• The notification trigger, written as before purchase commitment rather than before shipment.
• The named approval role, the independent veto on technically-restricted lines, and the default outcome if the notification window closes unanswered.
• The receiving check and its failure action — what receiving does with a delivery whose artefacts are incomplete, decided now rather than at the dock.
• Where each of the above is written: RFQ, BOM columns, PO, quality agreement. A requirement that exists in only one of these four is a requirement that someone in the chain will never see.

For assembly scope and the engagement models these clauses attach to, see the PCB assembly service page. To put a restricted-channel BOM out for pricing, the quote page is the entry point, and capabilities covers the process scope the declaration sits inside.

FAQ

Is a sourcing channel declaration only relevant for turnkey assembly?

It is most relevant there, because turnkey is where the assembler purchases and therefore chooses the route. But it is not exclusive to turnkey. In a partial-consignment arrangement the declaration tells you which lines you retained and which were delegated, and on consigned lines it records that the origin obligation sits with you — which matters later, when a failure has to be attributed to one side or the other.

We buy the same part numbers every build. Do we need this once, or every time?

Declare once as part of the BOM, and let it persist with the BOM revision. What has to repeat is the notification obligation: a route that was available last build may not be available this one. Scarcity is the variable that changes between reorders, and it is the variable that moves parts into unfamiliar channels.

Our supplier says a channel restriction will raise the price. Is that a reason to drop it?

It is a reason to apply it to fewer lines, not to drop it. A restriction has a real cost, and a restriction applied to an entire BOM will be priced accordingly or quietly ignored. Applied to the short list that passes two or more of the four tests, the priced difference is bounded — and it is the comparison you wanted in the first place, because without the declaration the cheaper quote may simply be a different sourcing route offered at face value.

If a certificate of conformance does not prove origin, why ask for one at all?

Because it establishes what the seller asserted, in writing, at the time of shipment. That has value in a dispute even though it is not provenance. The error is not requesting it — the error is treating it as the end of the chain of evidence rather than one documented link in it.

Can incoming inspection substitute for a channel declaration?

Only partially, and only for the things inspection can see. Inspection can confirm identity, check packaging and condition, and detect some classes of defect. It cannot reconstruct custody that was never recorded, and it cannot tell you whether a part spent an unrecorded period outside its specified storage condition. For parts that passed Test 1, condition is exactly the variable at stake, which is why these parts need both a declaration and a receiving check — not one instead of the other.

Who should hold approval authority for a channel substitution?

A named buyer-side role that is not accountable for the delivery date, with an independent technical veto on lines that were restricted for technical reasons. If the same person owns both the schedule and the approval, the approval decision will follow the schedule, and the restriction will exist on paper only.