The tap is tested. The contractor never was.

More than five hundred people sickened. Taps in Johannesburg suburbs declared unsafe. Councillors lining up microphones to name the cowboy contractors responsible. Not one headline I have read asks the question two decades of supplier audits in automotive and aerospace plants burned into me: who qualified these contractors, who selected them, and who supervised the work while the water went bad. When I hear cowboy contractor, I do not hear a villain. I hear a purchasing system that received exactly the supplier it designed for. The cowboy is what an unqualified supply base looks like from the outside, one newspaper cycle later.

The cheapest bid is a control plan decision

Price-only procurement has a reputation for neutrality it never earned. Awarding on lowest bid is not a passive administrative act. It is an active selection of failure modes. The cheap bid is cheap because something was cut: training, supervision, materials, competent people, the boring paperwork that keeps a water connection sealed. The buyer who specifies nothing but price has written a control plan that assumes none of those cuts will matter. That assumption is the defect.

Flint remains the canonical case, because nobody there was a cowboy either. A sourcing decision was made upstream to save money. Corrosion control was skipped. Lead moved through pipes for months while every responsible party pointed at someone else. The crisis was not caused by a rogue plumber; it was caused by a cost decision with no quality gate attached, and the people who made it were never in the frame.

The lowest bid is not a price – it is a forecast of failure modes, itemised in advance.

In automotive we run the same arithmetic and measure it in PPM instead of patients. I have sat in war rooms where a sub-tier supplier's coating failure traced back, through an A3, to a decision to save two cents a part. Scrap and sorting ran to five figures in €. Purchasing blamed the supplier and re-tendered – to the next lowest bidder. The root-cause analysis stopped at the vendor, because one step further would have indicted a process the buyer owned.

What supplier qualification actually looks like

I built a greenfield quality department for a plant that grew past nine hundred employees, so I know precisely what the shortcut skips. Before the first truck arrived we had a supplier register, vendors classified by risk, capability evidence on file – first articles, process data, operator qualifications – and a defined re-audit cycle for each one. None of that is paperwork for its own sake. When defect costs fell seventy per cent in the years that followed, much of the reduction came from stopping non-conformances at the supplier rather than catching them at receiving. Prevention has an address. It is upstream.

The tool that would have flagged an unqualified water contractor costs two days. A VDA 6.3-style process audit puts an auditor physically in the contractor's operation: who actually closes the hydrant, against what work instruction, with what training record; who decides when a chlorine residual reads low at two in the morning; and what happens to the deviation report afterwards. An IATF 16949 auditor would treat the connection as an outsourced process, which means the utility owns it regardless of whose logo is on the truck. A tender document is not an audit. A certificate proves somebody passed an audit once; it says nothing about the crew that shows up on Tuesday. Qualification is something the customer does – in twenty years I have never seen a supplier accidentally qualify himself.

Testing the tap is detection, not prevention

Sampling at the tap feels like control because it produces numbers. Run the statistics. Intermittent contamination against a periodic sampling regime means the population is your inspection sample; the test tells you, after the fact and with a lag, how many people were exposed. That is a gauge. Gauges sort output. They do not build quality into anything, and end-of-pipe testing on a public utility is detection dressed up as assurance.

Put the QRQC discipline on this event and see where it leads. Go to the place – the actual connection. Look at the actual work. Then trace the deviation back through the contractor to the decision that selected him and left him unsupervised. At Witte Automotive that tracing discipline – QRQC for containment and truth-finding, A3 for the systemic layer – was how we cut failure costs, and it worked because it never stopped at the operator or the vendor. It kept walking until it reached the decision. Applied in Johannesburg, the same discipline would not produce a mugshot of a cowboy. It would produce an organisation chart of a procurement function.

The proof that prevention beats detection is not philosophical, either. The quarter we recorded zero critical customer escalations was built on qualified suppliers, reviewed PFMEAs for outsourced processes and audits before award. A final gauge never saved one. Gauges inform. They do not prevent.

Every plant manager reading about Johannesburg should put the newspaper down and look at the outsourced services inside their own four walls: facilities maintenance, calibration, logistics, cleaning, IT. Behind each one sits either a supplier-quality system or luck. Luck does not survive an audit. The councillors hunting cowboys are running root-cause analysis on the wrong branch of the Ishikawa, and the residents are paying the sample cost. Flint taught this a decade ago and the lesson travelled nowhere. Audit the cowboy before you have to chlorinate your reputation.