The PPAP is on file. The process it approved is gone.

Here is an uncomfortable observation: the boots that fell apart under US Marines during a NATO exercise in the Arctic were almost certainly approved boots. Somewhere sits a qualification file – dimensional results, material certificates, capability studies, appearance approval – and every page says yes. Every quality leader owns a version of that boot: a part that cleared every launch gate and met reality years later, in a customer's hands, in weather nobody retested for. I have run the containment, taken the call and signed the 8D. It was never a launch problem. It was a currency problem – the supplier's process changed while the buyer's approval stayed valid forever.

What the approval actually proves

Not much, and less every day. A production part approval captures one production day: one shift, one set of cavities, one batch of adhesive, one crew that knew it was being watched. It proves the process could conform while someone was looking. It says nothing about the five years after the observers went home. I have signed PPAPs I would not now trust past the first tool refresh. Qualification and sustained conformance are different disciplines, and the gap between them is where field escapes are born.

IATF 16949 tries to close the gap with change-control and customer-notification clauses, but the trigger sits with the party least incentivised to pull it. The clause assumes the supplier will volunteer the change; the supplier's commercial interest runs the other way. Aerospace is more honest about the physics. First article inspection under AS9100 exists because a drawing match last January proves nothing this January, and disciplined organisations re-run the FAI after any change that could touch form, fit or function. Most of the rest of industry treats the approval as a one-time stamp and calls the file evidence for as long as the cabinet holds together.

A qualification file is a photograph of one good day, laminated and mistaken for the process.

Where supplier changes hide

At Witte Automotive I chased a field escape from QRQC into an A3 that ran for weeks: returns clustering on one latch family, coating failing salt spray at a third of specified hours. The trail ended at a subcontractor we had never heard of – surface treatment moved off-site for capacity, chemistry shifted by one line on the data sheet, nothing notified up the chain. The certificate arrived on the same letterhead, which turned out to be the most durable component in the whole chain.

The anatomy repeats. A tier-2 move to a facility the buyer never audited. An equivalent polyurethane – equivalent on paper, not at −30 °C. A re-cut cavity that shifts pack pressure and bond geometry by fractions the control plan never sees. The operator who knew the oven's moods retires, and the parameter sheet does not. Cure times shaved, temperatures nudged, inspection frequency cut – each defensible on its own, the compounding invisible.

The annual audit never catches any of it. It samples the one day the supplier prepared for, out of roughly 250 production days a year. The change chain lives in the other 249, and a VDA 6.3 process audit, however competent, is still a portrait of a guest performance. Unannounced audit windows and serial-based sampling exist for exactly this reason; most supplier programmes use neither.

Requalification triggers that pay for themselves

Building the QA/QC function for SNOP's greenfield plant – 900-plus employees, quality raised from bare concrete – meant designing supplier surveillance from zero, with no inherited binder to defer to. So the triggers went straight into the supplier framework: any tier-2 change, any tooling transfer, a dormant part reactivated, a Cpk slide below 1.33 on a designated characteristic, and a calendar expiry on the approval itself. On top of that, certificate-versus-reality testing. Pull parts quarterly and destroy them against the paperwork: FTIR on polymers, salt spray on coatings, torque–tension on fasteners. A few hundred euros per pull. Field-return analytics ran as the radar, warranty codes clustered by serial range, so an unnotified change announced itself months before a customer did.

The maths is not close. A full requalification runs around €15,000 in testing and audit days. An automotive field campaign opens in six figures before you count sorting, freight and containment. And the cost of a failed Arctic exercise never reaches the purchasing ledger at all. That cadence – catching supplier escapes before they crossed our wall – drove a 70% reduction in defect costs and a quarter with zero critical customer escalations. The €15,000 option is the cheap one.

The Arctic is every plant's parking lot. Somewhere tonight a part that passed every gate is laced into equipment, bolted into a vehicle or flying inside an airframe, meeting conditions it was never retested for – carried by an approval earned on one good day years ago. Approvals have a half-life. Measure yours, and audit as though the file is already lying, because on the day it matters it will be.