Vietnam Supplier Qualification Checklist: 5 Documents You Must Request

Supplier qualification is the work you do before placing a production order — not after a quality escape. For Vietnamese manufacturers, the documentation landscape has some specific characteristics that buyers from US and European companies need to understand. This checklist covers the 5 core documents to request, what to look for in each, and the red flags that indicate a factory isn't ready for your requirements.

Note: document review is necessary but not sufficient for supplier qualification. For orders above $20,000 or for regulated applications (medical, automotive, aerospace), a physical audit — or a documented third-party audit — should supplement document review.

Document 1: ISO Certificate with Scope

What to Look For

• Scope statement: The scope must cover your manufacturing process. "Manufacture of precision machined components" is specific. "General manufacturing" is not. If the scope is vague, ask the factory to confirm in writing that your process is within certified scope — and verify with the registrar.
• Facility address: The certificate must list the specific facility address where your parts will be made. A certificate covering a corporate office does not extend to a production facility at a different address.
• Valid dates: Certification cycle is typically 3 years. Check both the issue date and the "valid to" or "expiry" date. Certificates have been renewed late — a 2-week gap in coverage is meaningfully different from a certificate expired for 6 months.
• Registrar: Recognized registrars include BSI, TÜV SÜD, TÜV Rheinland, SGS, Bureau Veritas, DNV, Lloyd's Register, Intertek, and LRQA, among others. Certificates from local Vietnamese certification bodies with no international recognition should be treated differently — not ignored, but verified more carefully.

How to Verify Authenticity

All major registrars maintain public certificate lookup databases. Verification steps:

1. BSI: search at bsigroup.com/en-GB/validate-bsi-issued-certificates/
2. TÜV SÜD: certificatecenter.tuvsud.com
3. SGS: sgs.com/en/certified-client-search
4. Bureau Veritas: veritassmart.com
5. DNV: certificatecenter.dnv.com

Search by the certificate number and/or company name. The result should show: the certificate is active, the company name matches, and the scope/address match what you were sent. Mismatches between the PDF and the registrar database are a meaningful red flag — not necessarily fraud, but worth investigating before proceeding.

Red Flags

• Certificate not verifiable in registrar's public database
• Registrar name is not recognized internationally
• Scope description doesn't match your process
• Certificate expired or within 30 days of expiry without confirmed renewal in progress
• Factory address on certificate doesn't match the production location

Document 2: Business License

What to Look For

The Vietnamese business registration certificate (Giấy chứng nhận đăng ký doanh nghiệp) is issued by the Department of Planning and Investment. It shows:

• Company name and tax code (mã số thuế): These should match exactly across all documents the factory provides. Discrepancies between the business license, ISO certificate, and invoices indicate different legal entities — common with factory groups or subcontractors, but requires clarification.
• Registered business activities: The license lists the business categories the company is registered to operate. Verify that manufacturing is included, not just trading. A trading company can source from manufacturers but cannot produce — know which one you're dealing with.
• Registered address: May differ from factory location (factory may be in an industrial zone while the company is registered at a city office). This is normal — just confirm which address is the production facility.
• Registration date: Indicates how long the company has been operating. A factory registered 18 months ago with no operational history is a different risk profile than one operating for 10 years.

Red Flags

• Company name or tax code doesn't match ISO certificate
• Business activities list only "trading" or "import/export" without manufacturing
• Very recently registered company (under 2 years) with no prior business history
• Reluctance to provide the license — it's a public document

Document 3: Equipment List

What to Look For

A credible equipment list includes: equipment type, manufacturer/brand, model number, quantity, and year of manufacture. What you're evaluating:

• Equipment matches claimed capability: A factory claiming ±0.01mm CNC tolerances should have equipment capable of it — DMG Mori, Mazak, Matsuura, or similar precision machines. A list of 10 generic "CNC machining center" entries with no brands is not verifiable.
• Measurement equipment: Does the quality lab match the production capability? A factory claiming precision machining but listing only manual calipers and no CMM cannot verify the tolerances they're claiming. Look for: Mitutoyo or Zeiss CMM, profilometers, hardness testers, and thread gauges appropriate for the work.
• Capacity vs order size: How many machines of the relevant type, and what shift operation? A factory with 3 CNC machining centers running one shift has a specific weekly capacity — make sure it accommodates your volume requirements without depending on subcontracting (or if they subcontract, that they've disclosed it).
• Equipment age: Manufacturing equipment from 2010 in good maintenance condition is different from 2010 equipment that hasn't been serviced. Year of manufacture is useful but follow up with: are maintenance logs available?

Red Flags

• No brand names or model numbers — just equipment categories
• No measurement equipment listed beyond calipers
• Equipment list doesn't match what you saw on a factory visit or video tour
• Claimed capacity seems implausibly large for the machines listed

Document 4: Customer Audit Report

What to Look For

A customer audit report is a third-party validation of the factory's quality system — from an existing customer who has already done the evaluation you're considering. Not all factories have these, but factories that supply to quality-demanding buyers (automotive OEMs, medical device manufacturers, aerospace primes) typically have customer audit history.

Ask for audit summary findings (not necessarily the full report) from a customer audit conducted within the past 24 months. What you're looking for:

• Auditing organization: A Tier 1 automotive supplier or OEM quality team, a medical device manufacturer, or a third-party body like SGS or Bureau Veritas. The more demanding the auditing organization, the more meaningful the result.
• Findings and response: Were there non-conformances? How were they responded to? An audit with zero findings and a certificate of approval is good. An audit with 3 minor findings and documented corrective actions that were verified as closed is actually a stronger signal than zero findings — it means the system handles issues systematically.
• Audit scope: Does it cover your manufacturing process? An audit of their assembly area doesn't validate their machining capability.

Red Flags

• No customer audit history at all (for factories claiming to serve quality-demanding industries)
• Audit is more than 3 years old with no follow-up
• Major non-conformances with no documented resolution
• Audit conducted by an internal team rather than independent body or customer quality team

Document 5: Sample Inspection Report with CMM Data

What to Look For

Request a sample inspection report from a recent order — ideally for a part with similar complexity to yours, with customer name redacted. A credible inspection report includes:

• Part identification: Part number, revision, date, lot number, order quantity, sample size.
• Measurement data: Actual measured values for each dimension, not just pass/fail. A report showing "tolerance ±0.05mm, actual 0.03mm" is informative. A report showing only checkmarks or "OK" per feature is not measurement data — it's a visual inspection form.
• CMM data for precision features: If tolerances are tighter than ±0.1mm, the dimensions should be measured by CMM (Mitutoyo Crysta, Zeiss Contura, or similar), not calipers. CMM reports typically include a header with machine serial number, probe calibration date, and measured point cloud data alongside nominal values.
• Inspector identification: Inspector name or ID and date of inspection.
• Result summary: Accept/reject decision with any discrepancies noted.

What a Good vs Bad Corrective Action Record Looks Like

Ask for 1–2 corrective action records (closed CARs) from the past 12 months. Here's the difference:

Red Flags

• Inspection reports show only pass/fail checkmarks with no measured values
• No CMM data for dimensions claimed to be at ±0.02mm or tighter
• Corrective action records consist of "operator retrained" with no process change
• No corrective action records available at all ("we don't have quality problems")
• Reports are clearly templates filled in after the fact rather than real production records

When to Escalate to a Physical Audit

Document review should escalate to a physical audit (in-person or documented third-party) in these situations:

• Order value exceeds $20,000 (first order with a new supplier)
• Regulated application: medical device, automotive safety-critical, aerospace
• Any red flag in the document review that wasn't explained satisfactorily
• Tight tolerances (±0.02mm or tighter) on more than 20% of features
• Complex tooling (multi-cavity mold, die with side actions, multi-setup CNC fixture)
• Supplier is claiming a certification scope that seems broad for their apparent size

Third-party audit options in Vietnam: SGS, Bureau Veritas, Intertek, and Asia Inspection all have Vietnam offices. Cost: $300–$600 per man-day for standard factory audits. For regulated applications, a customer-conducted audit is preferable when feasible.

Key Takeaways

• The 5 essential qualification documents: ISO cert (with scope), business license, equipment list, customer audit report, sample inspection report with CMM data.
• Always verify ISO certificates directly via the registrar's public lookup — not just the PDF.
• Scope and facility address on the certificate must match the actual production location.
• Equipment list should include brand names and models — generic descriptions are not verifiable.
• Good corrective action records have specific root causes, specific process changes, and verification data — not just "operator retrained."
• Physical audits are necessary for orders over $20K, regulated applications, or any unresolved document red flags.