Commercial Off-The-Shelf (COTS) components are now built into almost every modern manufacturing, aerospace, defence, telecommunications, automotive and industrial engineering product. Using COTS components cuts development time, lowers cost and speeds up delivery, which is exactly why organisations reach for them by default. But COTS procurement is not the risk-free shortcut it is often assumed to be.

Buying a commercially available part does not remove technical or quality risk; it usually just moves it out of sight. Once an organisation buys a COTS item, it typically loses direct control over the design, the manufacturing process, the inspection regime and the lifecycle of that component. Without the right controls, a simple purchased part can quietly become the source of production disruption, nonconforming product, obsolescence headaches and unhappy customers.

This article sets out what COTS components are and the seven hidden risks that need controlling:

  • Limited design control.
  • Limited visibility of the supplier’s processes.
  • Thin inspection and verification data.
  • Counterfeit parts.
  • Obsolescence.
  • Weak traceability.
  • Uncontrolled configuration change.

What are COTS components in manufacturing?

COTS components are standard products that manufacturers buy from external suppliers rather than designing and producing themselves. Electronic components, power supplies, bearings and fasteners, network hardware, sensors, connectors and cable assemblies, software modules, industrial control equipment and mechanical hardware are all typical examples. They exist as catalogue items with predefined specifications and standard configurations, which is precisely their appeal: lower development cost, shorter development cycles, better availability, less tooling investment, access to proven technology and simpler procurement.

The trade-off is dependency. Using COTS components creates a reliance on external manufacturers and supply chains that a business cannot fully control, and that dependency is where most of the risk originates.

Why COTS components carry hidden risk

Procurement and engineering teams naturally focus on cost and lead time when choosing a supplier. Those factors matter, but they are only part of the picture. Organisations rarely have full visibility of the manufacturing methods, inspection processes, process capability, material sourcing, change history, sub-tier supplier controls, obsolescence planning or counterfeit prevention behind a COTS part. That lack of visibility is what turns a straightforward purchase into an operational and quality risk.

Risk 1: limited design control

Buying COTS means giving up influence over product design, material selection, process validation, firmware updates, software architecture and internal test methods. The supplier owns the intellectual property and controls the roadmap, and can change materials, manufacturing location, sub-tier suppliers, firmware revisions, functional characteristics or packaging without asking first, unless a contract says otherwise. For regulated industries such as aerospace and defence, that is a serious exposure, and one worth addressing in every supplier agreement before it becomes a problem.

Risk 2: limited visibility, and the procurement controls that address it

Effective management of COTS components starts with procurement governance. Treating a COTS purchase as a low-risk catalogue transaction is the single biggest mistake teams make. The fix is a risk-based supplier approval process applied consistently, not just to the parts that look critical.

Supplier approval and qualification

Before placing an order, quality and supply chain functions should assess a supplier’s certifications, manufacturing capability, financial stability, export control compliance, counterfeit prevention measures, traceability capability, obsolescence management and change notification processes. Relevant certifications typically include ISO 9001, AS9100, ISO 14001, ISO 27001 and the IPC standards for electronics.

Approval should not stop at onboarding, either. Ongoing performance monitoring against indicators such as on-time delivery, parts-per-million defect rates, corrective action closure, escapes and returns, lead time and conformity trends is what catches drift before it becomes a failure.

Risk 3: thin inspection and verification data

One of the biggest limitations when sourcing COTS components is the inspection data you actually receive. Most suppliers provide a certificate of conformance, limited dimensional data, a basic test report and a commercial datasheet. That is rarely enough evidence to verify full product conformity on its own.

Why incoming inspection alone is not enough

Traditional incoming inspection cannot reliably catch latent defects, firmware issues, counterfeit components, material substitution, internal process failures or reliability weaknesses. For complex assemblies and electronics, destructive testing or full validation is often impractical or prohibitively expensive.

The answer is layered assurance rather than a single inspection gate: approved supplier lists, source inspection, first article inspection, risk-based sampling, functional testing, environmental stress screening, batch verification and enhanced receiving inspection for the highest-risk items. The more critical the component, the more of these layers should apply.

Risk 4: counterfeit parts

Global supply chain instability has pushed counterfeit risk sharply higher across electronic and industrial component markets. When lead times stretch, organisations are tempted to buy through brokers or non-authorised distributors, and that is where counterfeit parts, refurbished components sold as new, relabelled products, nonconforming materials and unapproved revisions creep in.

High-reliability industries should buy through authorised distribution channels wherever possible. Defence suppliers in particular should be familiar with Def Stan 05-135, published by UK Defence Standardization, which sets out the arrangements a supplier needs to keep counterfeit materiel out of the MOD supply chain.

Risk 5: obsolescence

COTS lifecycle management is the other side of the same coin. Suppliers can discontinue a product with minimal notice, forcing redesign, requalification, production delays, customer impact and configuration disruption all at once.

Effective obsolescence management means lifecycle monitoring, last-time-buy planning, alternative part qualification, approved substitution processes and, where the risk justifies it, strategic stockholding. It should be built into programme risk management from the outset rather than bolted on after a discontinuation notice arrives.

Risk 6: weak traceability

Traceability is one of the most important controls for COTS components. Without it, organisations struggle to contain quality escapes, run recalls, investigate failures, support warranty claims, meet regulatory obligations or demonstrate compliance.

What traceability should cover

Effective traceability links purchase orders, supplier batches, lot and serial numbers, manufacturing dates, inspection and assembly records, and customer deliveries. In aerospace and defence, that chain often has to extend down to individual component level. Electronics manufacturing usually also needs full batch genealogy, date code control, RoHS and REACH declarations, material compliance records and component authenticity verification. Digital traceability systems are increasingly what makes end-to-end visibility realistic at that level of detail.

Risk 7: uncontrolled configuration change

Configuration management is the control most often under-resourced when integrating COTS components, and it is usually the one that causes the most damage when a supplier makes an uncontrolled change.

Why configuration control matters

A seemingly minor supplier modification can affect fit and form, electrical compatibility, software integration, thermal performance, reliability or safety certification. Without proper configuration control, mixed configurations end up in production before anyone notices.

Essential configuration management controls

Formal controls should cover approved part numbers, revision status, firmware versions, software baselines, approved alternates, engineering change approval, supplier change notifications and product lifecycle status. Supplier agreements should require notification of material changes, process changes, factory relocation, design revisions, sub-tier supplier changes and end-of-life announcements, with engineering, procurement and quality assessing the impact of each before it is implemented.

Building a robust COTS assurance strategy

The organisations that get this right treat COTS governance as a strategic quality activity, not a purchasing exercise. That means collaboration across procurement, engineering, quality assurance, supply chain, manufacturing and programme management, built around a risk-based framework that matches component criticality to the right level of assurance.

Best-practice COTS control measures

In practice, that means approved supplier frameworks, risk-based procurement controls, supplier performance scorecards, incoming inspection strategies, counterfeit prevention plans, product traceability systems, formal configuration management, obsolescence planning, supplier change notification processes and periodic supplier audits, all working together rather than in isolation. None of it removes the commercial advantage of buying COTS; it just makes sure that advantage does not come with an unmanaged risk attached.

Final thoughts

COTS components offer genuine commercial and operational benefits, but no organisation should assume a commercially available part is automatically low risk. Limited design authority, reduced visibility of manufacturing controls and thin inspection data add up to quality and supply chain challenges that need structured management, not an afterthought. Businesses that build in strong procurement governance, supplier assurance, traceability and configuration management are far better placed to manage risk, stay compliant and protect product integrity.

For more on controlling external providers, see our article on supply chain quality in AS9100.

How Hillscom can help

If you are building AS9100-aligned controls for COTS components into your quality system, Hillscom works with UK aerospace and defence and manufacturing businesses on exactly this. Find out more on our AS9100 page, or get in touch.