20 May, 2026 | Category: Aerospace Quality, AS9100, Supplier Quality Assurance
Commercial Off-The-Shelf (COTS) components are now built into almost every modern manufacturing, aerospace, defence, telecommunications, automotive and industrial engineering product. Using COTS components in manufacturing cuts development time, lowers cost and speeds up delivery, which is exactly why organisations reach for them by default. But COTS procurement isn’t the risk-free shortcut it’s often assumed to be.
Buying a commercially available part doesn’t remove technical or quality risk, it usually just moves it out of sight. Once an organisation purchases a COTS item, it typically loses direct control over the design, the manufacturing process, the inspection regime and the lifecycle of that component. Without the right controls in place, a simple purchased part can quietly become the source of production disruption, product nonconformance, obsolescence headaches and unhappy customers. This article sets out what COTS components actually are, and the quality, procurement, traceability and configuration management controls that keep them from becoming a liability.
What Are COTS Components in Manufacturing?
Commercial Off-The-Shelf (COTS) components are standard products that manufacturers buy in from external suppliers rather than designing and producing themselves. Electronic components, power supplies, bearings and fasteners, network hardware, sensors, connectors and cable assemblies, software modules, industrial control equipment and mechanical hardware are all typical examples. They exist as catalogue items with predefined specifications and standard configurations, which is precisely their appeal: lower development costs, shorter development cycles, better availability, less tooling investment, access to proven technology and simpler procurement all round.
The trade-off is dependency. Using COTS components in manufacturing creates a reliance on external manufacturers and supply chains that a business can’t fully control, and that dependency is where most of the risk in this article originates.
Why COTS Components in Manufacturing Carry Hidden Risk
Procurement and engineering teams naturally focus on cost and lead time when choosing a supplier. Those factors matter, but they only capture part of the picture. Organisations rarely gain full visibility of the manufacturing methods, inspection processes, process capability, material sourcing, change history, sub-tier supplier controls, obsolescence planning or counterfeit prevention measures behind a COTS part, and that lack of visibility is what turns a straightforward purchase into an operational and quality risk.
Limited Design Control
Buying COTS means giving up influence over product design, material selection, process validation, firmware updates, software architecture and internal testing methods. The supplier owns the intellectual property and controls the roadmap, and can change materials, manufacturing location, sub-tier suppliers, firmware revisions, functional characteristics or packaging without asking first, unless a contract says otherwise. For regulated industries such as aerospace and defence, that’s a serious exposure, and one worth clarifying in every supplier agreement before it becomes a problem.
Procurement Controls for COTS Components in Manufacturing
Effective management of COTS components in manufacturing starts with procurement governance. Treating a COTS purchase as a low-risk catalogue transaction is the single biggest mistake teams make; the fix is a risk-based supplier approval process applied consistently, not just for the parts that look critical.
Supplier Approval and Qualification
Before placing an order, quality and supply chain functions should assess a supplier’s certifications, manufacturing capability, financial stability, export control compliance, counterfeit prevention measures, traceability capability, obsolescence management and change notification processes. Relevant certifications typically include ISO 9001, AS9100, ISO 14001, ISO 27001 and the IPC standards for electronics. Approval shouldn’t stop at onboarding, either, ongoing performance monitoring against indicators such as on-time delivery, parts-per-million defect rates, corrective action closure, escapes and returns, lead time and conformity trends is what actually catches drift before it becomes a failure.
The Challenge of Inspection and Verification
One of the biggest limitations when sourcing COTS components in manufacturing is the inspection data you actually get. Most suppliers hand over a certificate of conformance, limited dimensional data, a basic test report and a commercial datasheet, rarely enough evidence to verify full product conformity on its own.
Why Incoming Inspection Alone Isn’t Enough
Traditional incoming inspection can’t reliably catch latent defects, firmware issues, counterfeit components, material substitution, internal process failures or reliability weaknesses. For complex assemblies and electronics, destructive testing or full validation is often impractical or prohibitively expensive. The answer is layered assurance rather than a single inspection gate: approved supplier lists, source inspection, first article inspection, risk-based sampling, functional testing, environmental stress screening, batch verification and enhanced receiving inspection for the highest-risk items. The higher the criticality of the component, the more of these layers should apply.
Counterfeit and Obsolescence Risks
Global supply chain instability has pushed counterfeit risk sharply higher across electronic and industrial component markets. When lead times stretch, organisations are tempted to buy through brokers or non-authorised distributors, and that’s where counterfeit parts, refurbished components sold as new, relabelled products, non-conforming materials and unapproved revisions creep in. High-reliability industries should route procurement through authorised distribution channels wherever possible. Defence suppliers in particular should be familiar with UK Defence Standardization‘s Def Stan 05-135, which sets out the arrangements a supplier needs in place to keep counterfeit materiel out of the MOD supply chain.
Obsolescence Management
COTS lifecycle management is the other side of the same coin. Suppliers can discontinue a product with minimal notice, forcing redesign, requalification, production delays, customer impact and configuration disruption all at once. Effective obsolescence management means lifecycle monitoring, last-time-buy planning, alternative part qualification, approved substitution processes and, where the risk justifies it, strategic stockholding, built into programme risk management from the outset rather than bolted on after a discontinuation notice arrives.
Product Traceability Requirements
Traceability is one of the most critical controls for managing COTS components in manufacturing. Without it, organisations struggle to contain quality escapes, run recalls, investigate failures, support warranty claims, meet regulatory obligations or demonstrate compliance.
What Traceability Should Cover
Effective traceability links purchase orders, supplier batches, lot and serial numbers, manufacturing dates, inspection and assembly records, and customer deliveries. For regulated sectors such as aerospace and defence, that chain often has to extend down to individual component level, and electronic manufacturing usually needs full batch genealogy, date code control, RoHS/REACH declarations, material compliance records and component authenticity verification on top. Digital traceability systems are increasingly what makes end-to-end visibility realistic at that level of detail.
Configuration Management and Change Control
Configuration management is the control most often under-resourced when integrating COTS components in manufacturing, and it’s usually the one that causes the most damage when a supplier makes an uncontrolled change.
Why Configuration Control Matters
A seemingly minor supplier modification can affect fit and form, electrical compatibility, software integration, thermal performance, reliability or safety certification. Without proper configuration control, mixed configurations end up in production before anyone notices.
Essential Configuration Management Controls
Formal controls should cover approved part numbers, revision status, firmware versions, software baselines, approved alternates, engineering change approval, supplier change notifications and product lifecycle status. Supplier agreements should also mandate notification for material changes, process changes, factory relocation, design revisions, sub-tier supplier changes and end-of-life announcements, with engineering, procurement and quality working together to assess the impact of each one before it’s implemented.
Building a Robust COTS Assurance Strategy
The organisations that get this right treat COTS governance as a strategic quality activity, not a purchasing exercise. That means collaboration across procurement, engineering, quality assurance, supply chain, manufacturing and programme management, built around a risk-based framework that matches component criticality to the right level of assurance control.
Best-Practice COTS Control Measures
In practice, that looks like approved supplier frameworks, risk-based procurement controls, supplier performance scorecards, incoming inspection strategies, counterfeit prevention plans, product traceability systems, formal configuration management, obsolescence planning, supplier change notification processes and periodic supplier audits, working together rather than in isolation. None of it removes the commercial advantage of buying COTS, it just makes sure that advantage doesn’t come with an unmanaged risk attached.
Final Thoughts
COTS components in manufacturing offer genuine commercial and operational benefits, but no organisation should assume a commercially available part is automatically low risk. Limited design authority, reduced visibility of manufacturing controls and thinner inspection data all add up to quality and supply chain challenges that need structured management, not an afterthought. Businesses that build in strong procurement governance, supplier assurance, traceability and configuration management put themselves in a far stronger position to manage risk, stay compliant and protect product integrity. As supply chains keep getting more global and more complex, that’s not going to matter less.
If you’re building AS9100-aligned controls for COTS components into your quality system, our AS9100 aerospace consultants work with UK manufacturers on exactly this.