CSQP cheat sheet

Cost of poor quality (COPQ) includes appraisal, internal failure, external failure, and prevention costs; external failure costs are typically the largest and least recoverable.

The quality trilogy (Juran) is quality planning, quality control, and quality improvement; each supplier program element should map to one of the three.

1-10-100 rule: prevention costs roughly 1 unit, correction at the process 10 units, field failure 100 units - used to justify supplier prevention investment.

Management review inputs per ISO 9001 clause 9.3 include audit results, nonconformities, supplier performance, and resource adequacy; outputs include improvement and resource decisions.

Kraljic matrix axes are profit impact and supply risk; quadrants are non-critical, leverage, bottleneck, and strategic, and each quadrant implies a distinct supplier management posture.

A supplier quality policy must be documented, communicated, and reviewed; it is a leadership artifact, not a purchasing document.

Quality objectives must be measurable, monitored, and traceable to a responsible owner and timeframe; supplier PPM and on-time-delivery targets are typical examples.

Escalation ladders should define trigger thresholds, decision authority, and time limits before the event, not during it.

Qualification sequence: business/legal screening, financial health, capability and capacity, quality system assessment, sample/PPAP approval, then conditional or full approval.

ISO 9001 certification is a baseline, not evidence of capability for a specific commodity; process audits and part-specific verification remain necessary.

Financial screening indicators include current ratio, quick ratio, debt-to-equity, and dependency on the buying organization's revenue share.

Sampling plans for qualification builds follow ANSI/ASQ Z1.4 (attribute) or Z1.9 (variables); acceptance number c and AQL drive the plan, not a fixed sample size.

A supplier scorecard at selection should weight capability, capacity, quality history, cost, delivery, and risk; weights must be agreed before scoring to prevent post-hoc bias.

Reference checks should ask for defect escape history and corrective action closure time, not satisfaction ratings alone.

Conditional approval must carry an expiry date, defined exit criteria, and a containment plan for parts shipped during the conditional period.

Single-source approval requires documented justification, a risk assessment, and an alternate-source development plan with a target date.

PPM = (defective units / total units received) x 1,000,000; define whether the numerator counts defective units, defect opportunities, or lots before comparing suppliers.

Rolling metrics should use a defined window (commonly 3, 6, or 12 months); a single-month spike and a trend shift require different responses.

OEE = Availability x Performance x Quality; supplier capacity claims should be validated against demonstrated OEE, not nameplate capacity.

On-time delivery must define the tolerance window and whether early delivery counts; OTD% = lines delivered within window / lines scheduled.

Cp = (USL - LSL) / 6 sigma; Cpk = min(USL - mean, mean - LSL) / 3 sigma; Cpk requires a stable, in-control process to be meaningful.

PPAP submission levels 1-5 define what evidence is given to the customer; level 3 (data plus part and appearance approval) is the most common default.

A scorecard should separate quality, delivery, cost, responsiveness, and compliance with explicit weights and a published rating scale.

Metric definitions must be identical on both sides; reconcile measurement system differences before issuing a poor rating.

Supplier development tiers: performance feedback, targeted training, on-site coaching, joint improvement projects, and capability transfer; escalate by tier based on persistence of the gap.

Kaizen events target a bounded process with a defined baseline, target, and 5-day or similar fixed duration; they are not a substitute for systemic capability building.

Root cause analysis must reach the causal system, not the operator; 5 Whys, fishbone, and fault tree are the common tools, verified by reproducing the failure.

Corrective action effectiveness is verified by data after a defined period (commonly 30-90 days or a set number of lots), not by closure of the paperwork.

8D discipline: D1 team, D2 problem description, D3 containment, D4 root cause, D5 corrective action selection, D6 implementation and validation, D7 prevention, D8 recognition.

Poka-yoke at the supplier process is preferred over inspection because inspection is a detection control with a known escape rate.

Improvement projects should state a measurable baseline and target (PPM, Cpk, lead time) before work starts; otherwise benefit cannot be verified.

Training transfer requires on-the-job application and follow-up; attendance-based training metrics do not demonstrate capability change.

Risk score = likelihood x impact; both scales must be defined numerically and applied consistently across the supply base.

FMEA: RPN = Severity x Occurrence x Detection; action priority should also consider severity alone, since a high-severity item cannot be offset by low RPN.

Business continuity assessment should cover single points of failure: sole-source tooling, single-site production, single utility, and key-person dependency.

Sub-tier visibility is a risk control; require the supplier to disclose critical sub-suppliers and their locations for regulated or high-risk commodities.

Geographic concentration, currency exposure, labor stability, and regulatory change are external risk factors that sit outside the supplier's own quality system.

Risk mitigation hierarchy: avoid, reduce, transfer (inventory buffer, dual source, insurance), and accept with documented rationale.

Counterfeit and obsolescence risk controls include authorized-distributor sourcing, traceability to lot, and last-time-buy planning.

Risk register entries need an owner, a review cadence, a trigger threshold, and a residual risk rating after mitigation.

ISO 9001:2015 clause structure: 4 context, 5 leadership, 6 planning, 7 support, 8 operation, 9 performance evaluation, 10 improvement.

Audit types: first-party (internal), second-party (supplier/customer), third-party (certification body); only third-party leads to a certificate.

Nonconformity classification: major (system breakdown or product risk), minor (isolated lapse), observation (improvement opportunity); classification drives response time.

Objective evidence must be recorded as what was seen, where, and when; conclusions without evidence are not audit findings.

Audit sampling must cover shifts, lines, and records across the audit period; sampling only one shift is a common finding.

ISO 19011 governs audit program management and auditor competence; auditor independence is required for the area being audited.

Process audit uses a turtle diagram: inputs, outputs, resources, methods, personnel, and performance measures for one process.

Certification surveillance audits occur annually with recertification typically every three years; a certificate does not replace supplier-specific verification.

MSA: gauge R&R below 10% is generally acceptable, 10-30% conditional depending on application, above 30% requires measurement system improvement.

SPC: control limits are computed from process data (typically mean plus or minus 3 sigma), not from specification limits; never plot spec limits as control limits.

Control chart choice: X-bar/R for subgrouped variables, individuals chart for single measurements, p or np for attribute defectives, c or u for defect counts.

Process capability requires a stable process first; a Cpk calculated on an out-of-control process is not a valid predictor.

Minitab, QDA, and similar tools calculate capability indices; the analyst must still verify normality or use non-normal capability methods.

Pareto analysis orders causes by frequency or cost; the 80/20 rule is a heuristic, not a guaranteed distribution.

FMEA should be updated when a design or process change occurs, and detection ratings must reflect actual controls, not intended ones.

Acceptance sampling risks: producer's risk (alpha, rejecting good lots) and consumer's risk (beta, accepting bad lots); both depend on sample size and acceptance number.

BATNA is the best alternative to a negotiated agreement; a supplier's BATNA strength determines its willingness to concede on price or terms.

ZOPA is the zone of possible agreement between each side's reservation point; no overlap means no deal, regardless of persuasion technique.

Integrative negotiation expands the pie via tradeables (volume, payment terms, lead time, exclusivity); distributive negotiation divides a fixed pie.

Supplier communication plans should define the contact matrix, escalation path, meeting cadence, and data exchange format.

Conflict modes (Thomas-Kilmann): competing, collaborating, compromising, avoiding, accommodating; collaborating requires both high assertiveness and high cooperativeness.

Cultural dimensions (Hofstede) such as power distance and uncertainty avoidance affect how directly a supplier will report problems.

Relationship classification should distinguish transactional, preferred, strategic, and partnership tiers with different governance and information-sharing levels.

Meeting records and decisions should be written and acknowledged; verbal agreements on quality requirements are not auditable evidence.