Your supplier portal is green. Their control plan is fiction.

You spent millions on a platform that tracks every shipment in real time. Every ASN, every carrier handover — visible, timestamped, green. Your supplier qualification model, meanwhile, still runs on an annual audit where the supplier hands you a binder and you tick boxes in a hotel conference room for six hours. The binder is beautiful. The control plan inside it bears a passing resemblance to what happens on the shop floor at 02:00 on a Wednesday.

Nobody at the procurement conference wants to discuss this gap. Bain Capital just acquired SupplyOn — one of the largest digital supply chain networks in European complex manufacturing — for a reason. The transaction layer of the aerospace supply chain is digitising fast. SeAH Aerospace just closed a new aluminium alloy supply deal with Airbus, and they are exactly the kind of new entrant the qualification system is least equipped to handle. New material. New process. New supplier. Same periodic snapshot audit that was already obsolete before the platform existed.

What the portal sees and what it doesn't

Supplier portals are transactional infrastructure. Shipment left. Shipment arrived. Invoice cleared. Some — SupplyOn among them — go deeper: document exchange, deviation requests, 8D workflows. Useful. But none of that tells you whether the supplier's process is capable.

Here is what the portal cannot tell you. Whether the operator on the anodising line followed the control plan or the version they actually use — the one scribbled on the wall behind the tank. Whether the heat treatment furnace drifted 8°C last Tuesday and nobody logged it, because the thermocouple was due for calibration in two weeks and the shift lead did not want to stop production. Whether the FAI was done on the first part of a 4,000-piece batch, or the first part the inspector liked the look of.

I see this weekly. At Airbus, the routing verification KPIs we implemented exposed process drift that the existing reporting had normalised for months. The portal was green. The parts conformed on paper. Walk the actual routing against the documented one, though, and you found operations performed out of sequence, inspection points skipped on "trusted" suppliers, setup parameters that had migrated quietly from the PFMEA baseline. We cut internal lead time by 97% tracking those deviations — not by adding dashboards, but by making the gap between documented and actual process visible.

New alloys, new suppliers, same old qualification

The SeAH deal is instructive. Aluminium alloys for aerospace are not a commodity purchase. A new alloy grade means new processing parameters, new failure modes, new capability curves that nobody has established yet. The qualification model most primes use — PPAP-equivalent documentation under EN 9100, an initial process audit, then periodic surveillance — was designed for stable supply of mature products. It breaks down when a supplier's process in month three looks nothing like their process in month eighteen.

I have run supplier quality across multi-site AS9100 and EN 9100 environments. The pattern is consistent. A supplier passes the initial audit with a strong score. Twelve months later, the same process has accumulated quiet drift: tooling wear untracked, setup sheets "optimised" by operators, SPC charts maintained for the customer file but never consulted for decisions. The audit comes around again. The binder is updated. The score holds. Nothing about the underlying process capability has been verified in the interim.

This is not supplier failure. It is model failure. Periodic audits measure compliance at a moment. They do not measure capability over time. When you introduce new alloys, new suppliers, or new processes into a supply chain that is simultaneously being digitised and expanded, the gap between what you think you know and what is happening widens exactly when you cannot afford it.

Process authority is not a dashboard metric

The cybersecurity headlines tell a parallel story. Coca-Cola halting US production after ransomware. OT attacks on manufacturing climbing globally. Plants connect to external networks faster than they govern that access, and third-party governance lags behind connectivity. The same dynamic plays out in supplier quality: we connect data systems faster than engineering understanding. A portal that exchanges documents in real time is worthless if nobody on either side has read the process behind those documents in six months.

If your supplier qualification stops at the document they sent you, you are auditing a story, not a process.

I cut EASA audit findings by 50% in a single cycle — not by adding checkboxes or buying better software, but by understanding what audit systems systematically miss. The misses are predictable. They live in the gap between documented and executed process, in the assumptions that calcify between audits, in the drift that a snapshot will never catch. The platforms being acquired and integrated right now are detection infrastructure. They tell you faster when something has gone wrong. Prevention still requires boots on the supplier floor, a PFMEA you can defend at 03:00, and the engineering authority to look a supplier in the eye and tell them their beautifully documented process is fiction.