How to audit sub-tier supplier flowdown requirements

Your contract requires your tier one supplier to impose the same terms on its own suppliers. Whether it did is a question almost nobody asks, and the answer is usually partial.

What are sub-tier supplier flowdown requirements?

Sub-tier supplier flowdown requirements are contractual terms a buyer requires its direct supplier to impose on that supplier’s own suppliers, so that obligations reach down the supply chain rather than stopping at tier one. They commonly cover quality system requirements, change notification, counterfeit part prevention, material and process specifications, export control and sanctions compliance, conflict minerals and responsible sourcing, record retention, right of access for audit, and data protection. The clause is standard in most manufacturing agreements and verification is rare, so flowdown coverage in practice is usually incomplete. Auditing it means sampling actual sub-tier agreements and records rather than accepting a tier one attestation, then closing gaps through amendment and by narrowing the flowdown list to what genuinely needs to travel.

Last updated: September 29, 2026 · Reviewed by the Aavenir Manufacturing practice

Key takeaways

  • ✓Flowdown clauses are near-universal in manufacturing contracts and almost never verified below tier one.
  • ✓Attestations from tier one suppliers confirm intent, not coverage, so auditing requires sampling sub-tier agreements.
  • ✓An over-broad flowdown list reduces compliance, because suppliers prioritize what they can negotiate.
  • ✓Record retention and right of access are the flowdowns that make every other flowdown auditable.

Almost every manufacturing supply agreement contains a flowdown clause. It requires the supplier to impose specified obligations on its own suppliers and subcontractors, so that quality requirements, change notification duties, counterfeit part controls, export restrictions and responsible sourcing expectations travel down the chain rather than stopping at the first tier. The clause is cheap to include and widely accepted, which is part of the problem: it is agreed without much discussion and then never tested.

When it is tested, usually after an incident, the picture is consistent. Some flowdowns travelled, typically the ones a tier one supplier was already imposing for its own reasons, such as core quality system requirements. Others travelled partially, appearing in newer sub-tier agreements but not in legacy ones. Several did not travel at all, particularly the more specific or more recent requirements added to the buyer’s terms in the last few years. And nobody at the buyer knew which was which, because the only evidence held was a signed acknowledgment of the buyer’s terms by tier one.

That gap matters most where the obligation is regulatory rather than commercial. A counterfeit part entering at tier three, a sanctioned entity in the material supply chain, an unreported process change at a sub-tier plating vendor: in each case the buyer’s contractual protection depends on a term that had to reach a company it has no direct relationship with. Auditing flowdown is how you find out whether it did, and it depends on the same records discipline as IATF 16949 supplier quality agreements.

What typically needs to flow down

A flowdown audit starts with a decision about scope, because auditing everything is neither possible nor useful. The categories below are the ones where sub-tier coverage genuinely changes the buyer’s position.

  • Quality system and process requirements, certification requirements, special process approvals, inspection and test requirements, and first-article or sample approval duties.
  • Change notification, notice of changes to material, process, tooling, location or sub-tier source, which is worthless if it stops at tier one.
  • Counterfeit and material authenticity controls, authorized distributor requirements, traceability to manufacturer, and test and inspection duties for suspect material.
  • Trade compliance and responsible sourcing, export control classifications, sanctions and denied-party screening, conflict minerals reporting and forced labour due diligence.
  • Records and right of access, retention periods for quality and traceability records, and the buyer’s or regulator’s right to access sub-tier facilities and records.

Record retention and right of access are the enabling pair. Without a retention duty there is nothing to inspect later; without an access right the buyer cannot inspect at all and must rely on whatever tier one chooses to gather. Those two should flow down before any of the others, and they are the ones most often missing from sub-tier agreements, in the same way PPAP commitments drift from the contract that created them.

A longer flowdown list produces less flowdown

Buyers who require thirty clauses to flow down generally achieve worse coverage than buyers who require eight. Tier one suppliers negotiating with their own suppliers prioritize terms they can actually get agreed, and a long list invites blanket incorporation by reference that no sub-tier reads. Narrow the list to what materially changes your position, then audit that list properly.

How to run the audit

A flowdown audit is a sampling exercise, not a questionnaire. These are the design choices that determine whether it produces findings you can act on.

  • Sample agreements, not attestations. Ask for the actual sub-tier purchase terms or agreement extracts covering the flowdown clauses, redacted for price. An attestation that flowdown occurred is not evidence that it did.
  • Select sub-tiers by risk, not by convenience. Prioritize special processes, single-source material, sanctioned-jurisdiction exposure and anything on a counterfeit-risk list. Tier one will offer its best-documented relationships first.
  • Test the change notification path end to end. Pick a recent sub-tier change and trace whether notice reached you within the required window. This single test reveals more than a document review.
  • Check legacy agreements specifically. New sub-tier agreements usually carry current flowdowns; agreements signed before your terms changed usually do not, and those cover much of the existing supply base.
  • Record findings against the contract. Log each gap as a contract-linked finding with an owner and a remediation date, so the next audit starts from the last one rather than from zero.

A five-step roadmap for a flowdown audit programme

Step 1, Define the flowdown list that matters

Reduce your current flowdown requirements to the set where sub-tier coverage changes your legal or quality position. Publish it as a named list referenced by the contract, so it can be revised without amending every agreement.

Step 2, Build the sub-tier map for critical items

For your highest-risk parts and materials, identify the actual sub-tier suppliers with tier one’s cooperation. You cannot audit flowdown to suppliers you cannot name, and most buyers cannot name theirs below tier one.

Step 3, Request and review sample sub-tier terms

Ask for redacted extracts of sub-tier agreements covering the flowdown list, across a risk-weighted sample including legacy agreements. Review against the list clause by clause rather than in aggregate.

Step 4, Run one end-to-end change notification test

Select a sub-tier change that occurred in the last year and trace the notification chain with dates. Document where it broke, because the break point tells you whether the problem is contractual or operational.

Step 5, Close gaps through amendment and re-audit

Log each gap with an owner and a date, require remediation at tier one’s next sub-tier renewal where possible, and re-sample the same population on a defined cycle to measure whether coverage improved.

Track flowdown obligations and audit findings together

Aavenir holds the flowdown list against every supplier agreement and tracks audit findings as owned, dated obligations.

Book a demo

Why the audit changes negotiation, not just compliance

The obvious output of a flowdown audit is a gap list. The more useful output is a realistic view of what flowdown your supply base can actually deliver, which changes how you write the clause next time. Buyers who have audited tend to narrow their flowdown list, make the retention and access rights unconditional, add a specific obligation on tier one to evidence flowdown annually rather than merely to impose it, and accept that some requirements need to be handled by direct qualification of the sub-tier rather than by contract chain. That is a better contractual position than a long unverified list, and it is arrived at only by finding out what the current list achieved. Buyers running contract lifecycle management for manufacturing tend to hold the flowdown list centrally so a revision reaches every agreement by reference.

Flowdown audit reference

The table sets out what to sample for each flowdown category and the finding that usually emerges. Requirements are industry-specific and regulated sectors such as aerospace, automotive and medical devices carry additional standards.

Flowdown categoryWhat to sampleTypical findingRemediation
Quality system requirementsSub-tier terms plus certification evidenceCertification required but currency unverifiedAdd expiry tracking to tier one duty
Change notificationOne traced change with datesNotice given to tier one, not passed onSpecify pass-through window contractually
Counterfeit preventionAuthorized source and traceability clausesAbsent in legacy sub-tier agreementsAmend at next sub-tier renewal, interim attestation
Trade compliance screeningScreening obligation and re-screening cadenceOne-time screening only, no re-screening dutyAdd periodic re-screening requirement
Records and right of accessRetention period and access clauseRetention present, access right missingMake access right an unconditional flowdown

Flowdown clauses are one of the clearest examples of a contractual protection that exists on paper and not in fact. The clause is standard, the acknowledgment is filed, and the actual coverage below tier one is unknown and partial. Auditing it is unglamorous sampling work, and it produces two things worth having: a gap list you can remediate, and a realistic flowdown list for the next round of agreements. Buyers in regulated or safety-critical sectors generally find the first audit uncomfortable and the second one much less so.

For related guidance, see Scrap and yield loss allocation clauses, a controls sheet, Price adjustment clauses in direct material contracts and IATF 16949 evidence your contract system should hold.

FAQ

Sub-tier flowdown, answered

Is a flowdown clause enforceable against a sub-tier supplier? +
Generally not directly, because the buyer has no contract with the sub-tier. The clause is enforceable against the tier one supplier, which is obliged to impose the terms and, depending on drafting, to evidence that it did. That is why an unconditional right of access to sub-tier records and facilities matters so much: it gives the buyer a practical remedy that does not depend on privity with the sub-tier.
How many sub-tier agreements should a flowdown audit sample? +
Enough to cover your risk concentrations rather than a fixed percentage. In practice that usually means all sub-tiers performing special processes or supplying single-source critical material, plus a risk-weighted sample of the remainder, deliberately including agreements signed before your current terms took effect. Legacy agreements are where gaps cluster.
What is the difference between flowdown and pass-through? +
Flowdown is the obligation to impose terms downward. Pass-through usually refers to the obligation to transmit something specific upward or onward, most often a notification. Change notification needs both: the sub-tier must be obliged to notify tier one, and tier one must be obliged to pass that notice to you within a stated window. Many contracts require the first and omit the second.
Should we audit flowdown or qualify sub-tier suppliers directly? +
Both, for different populations. Direct qualification is appropriate for a small number of genuinely critical sub-tiers, typically special processes and single-source material, and it gives you a direct relationship and direct rights. Flowdown auditing is the scalable control for the wider base. Choosing one exclusively either overloads your qualification capacity or leaves critical sub-tiers unverified.
How often should a flowdown audit run? +
Annually for critical categories and on a longer cycle for the remainder, with re-sampling of the same population so coverage change is measurable. A one-off audit produces a snapshot; a repeated audit on a stable sample produces a trend, which is what tells you whether remediation is actually working.
Does IATF 16949 or AS9100 require flowdown verification? +
Both standards require organizations to ensure that applicable requirements reach external providers and, in the automotive case, to develop supplier quality management system capability, which in practice means more than inserting a clause. Auditors increasingly ask how the organization knows flowdown occurred. Certification requirements vary by standard version and sector, so confirm the applicable clause text for your certification scope.

Find out what actually flowed down

Aavenir keeps the flowdown list against every supplier agreement, tracks tier one evidence duties and manages audit findings to closure.

  • ✓Flowdown list versioned and referenced rather than embedded
  • ✓Audit findings tracked as contract-linked obligations
  • ✓Standalone or native on ServiceNow