{
 "slug": "conformance-receipt",
 "topic_id": "TOPIC-203",
 "cluster": "Defense Industrial Base, CUI & Export-Control Identity",
 "tier": "Tier B",
 "title": "Counterfeit parts and supplier identity: the certificate of conformance problem",
 "summary": "A certificate of conformance is a PDF asserting a lot meets specification. Counterfeiters produce convincing certificates, and verification means contacting a supplier whose identity may itself be impersonated.",
 "lede": "Counterfeit avoidance standards prescribe testing, traceability and approved sourcing. All of it rests on a document that asserts what a lot is, produced by whoever is selling it.",
 "date": "2024-01-05",
 "category": "Compliance",
 "author_id": "margot-reyes",
 "tags": [
  "counterfeit parts",
  "certificate of conformance",
  "supplier quality",
  "DFARS",
  "electronic components",
  "traceability"
 ],
 "image_title": "Conformance Receipt",
 "schema": "Article",
 "key_takeaways": [
  "Conformance documentation was designed for trusted bilateral relationships and did not change when independent distribution and grey-market sourcing broke that assumption.",
  "A verifiable certificate eliminates forged documents and unauthorised signatories. It does not detect a genuine supplier certifying counterfeit stock.",
  "Service life is the design constraint: a part installed in 2026 may be examined in 2056, so verification must not depend on any company's continued existence."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The denominator problem"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "A lot, a certificate and an assumption",
   "caption": "The document is the whole control, and it is the easiest thing to fabricate.",
   "nodes": [
    {
     "label": "Lot received",
     "sub": "with a CoC",
     "note": "looks correct"
    },
    {
     "label": "CoC reviewed",
     "sub": "visually",
     "note": "template forgeable",
     "bad": true
    },
    {
     "label": "Verification = contact supplier",
     "sub": "per lot",
     "note": "not done",
     "bad": true
    },
    {
     "label": "Parts enter the build",
     "sub": "conformance assumed",
     "note": "",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Counterfeit parts discourse suffers from a measurement gap. Detected counterfeits are counted; undetected ones are not, by definition. The FAA has linked suspect unapproved parts to a substantial number of documented incidents, and defense counterfeit reporting captures cases that reached inspection or failure."
  },
  {
   "type": "p",
   "html": "What nobody has is a rate. That matters for this argument because it means the case for verification cannot rest on a frequency claim, and any vendor asserting one should be asked for their denominator."
  },
  {
   "type": "p",
   "html": "The case rests instead on consequence and on cost of investigation, both of which are measurable within a programme."
  },
  {
   "type": "h2",
   "text": "What a certificate of conformance is"
  },
  {
   "type": "p",
   "html": "A statement by a supplier that the delivered items conform to the purchase order requirements and applicable specifications. It typically identifies the part number, lot or date code, quantity, applicable specifications, and carries a signature from the supplier's quality representative."
  },
  {
   "type": "p",
   "html": "It is a PDF. Its authenticity is assessed by receiving inspection staff comparing it against expectations and, occasionally, contacting the supplier."
  },
  {
   "type": "h2",
   "text": "Where the trust model broke"
  },
  {
   "type": "table",
   "head": [
    "Sourcing channel",
    "Original trust basis",
    "Current reality"
   ],
   "rows": [
    [
     "Franchised distributor",
     "Direct manufacturer relationship",
     "Intact; the strongest channel"
    ],
    [
     "Authorised distributor",
     "Contractual authorisation",
     "Generally intact"
    ],
    [
     "Independent distributor",
     "Reputation and audit",
     "Variable; broker chains obscure origin"
    ],
    [
     "Broker / open market",
     "None inherent",
     "Used under allocation pressure; highest risk"
    ],
    [
     "Parted-out or surplus material",
     "Documentation trail",
     "Documentation may be reconstructed"
    ]
   ]
  },
  {
   "type": "p",
   "html": "Allocation shortages push sourcing down this table. That is not a procurement failure — it is the choice between a non-conforming source and a programme stoppage — and it is exactly when verification matters most and is least available."
  },
  {
   "type": "h2",
   "text": "The Conformance Receipt"
  },
  {
   "type": "code",
   "text": "{\n  \"type\": \"manav-stmt/1\",\n  \"action\": \"certificate_of_conformance\",\n  \"render\": [\n    \"Part number: [pn]  Manufacturer: [name]\",\n    \"Lot / date code: [value]  Quantity: [n]\",\n    \"Specifications: [list, revisions]\",\n    \"Test basis: [acceptance testing performed / referenced]\",\n    \"Traceability: [chain as known to the signer]\"\n  ],\n  \"signatory\": \"[named quality representative, credential]\",\n  \"organisation\": \"[supplier, countersignature]\"\n}"
  },
  {
   "type": "p",
   "html": "The traceability field is deliberately phrased as <em>as known to the signer</em>. A distributor cannot attest to what happened before the material reached them, and a certificate implying otherwise is the problem rather than the solution."
  },
  {
   "type": "h2",
   "text": "The limitation, stated prominently"
  },
  {
   "type": "p",
   "html": "A verifiable certificate does not detect counterfeit material. A supplier who genuinely believes their stock is authentic, and signs accordingly, produces a valid receipt for counterfeit parts."
  },
  {
   "type": "p",
   "html": "What it eliminates is a specific and well-documented subset: forged certificates, certificates signed by people without authority, and certificates attributed to organisations that never issued them. Those are a meaningful share of documented cases and they are the share that testing does not catch, because the receiving inspector accepted the paperwork and skipped the test."
  },
  {
   "type": "h2",
   "text": "The fifty-year requirement"
  },
  {
   "type": "p",
   "html": "An electronic component installed in an airframe or a ground system may be examined decades later, after the distributor has been acquired twice and the manufacturer has exited the product line."
  },
  {
   "type": "p",
   "html": "That imposes two design requirements that rule out most schemes: verification must not require contacting anyone, and the verifier must be open source so it can be run in 2056. Neither is a preference; both are records-retention constraints."
  },
  {
   "type": "h2",
   "text": "What to do first"
  },
  {
   "type": "ol",
   "items": [
    "Identify the part families where a counterfeit would be programme-significant. This is a short list.",
    "For those, require conformance receipts from franchised and authorised channels, where compliance is easy and establishes the pattern.",
    "Extend to independent distribution as a purchase order condition, which is where it actually matters.",
    "Retain receipts with the part records, not in a separate quality system that will be migrated away."
   ]
  },
  {
   "type": "h2",
   "text": "Why counterfeit parts survive incoming inspection"
  },
  {
   "type": "table",
   "caption": "What incoming inspection can and cannot see",
   "head": [
    "Check",
    "Catches"
   ],
   "rows": [
    [
     "Visual and dimensional",
     "Crude counterfeits"
    ],
    [
     "Markings and packaging",
     "Careless counterfeits"
    ],
    [
     "Documentation review",
     "Nothing — the document is the counterfeiter's best work"
    ],
    [
     "Destructive or electrical test",
     "Good counterfeits, at a cost per lot nobody pays"
    ],
    [
     "<strong style=\"font-weight:600\">Signature verification</strong>",
     "<strong style=\"font-weight:600\">Fabricated documentation, in milliseconds</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“We buy only from franchised distributors.”</strong> Which is the right primary control and it narrows rather than removes the problem — shortages push buyers to the broker market, and that is where the documentation matters most."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“This needs industry-wide adoption.”</strong> A manufacturer can sign unilaterally. A receiver who can verify does; one who cannot sees an unchanged PDF."
  }
 ],
 "faq": [
  {
   "q": "Does this detect counterfeit parts?",
   "a": "No. It eliminates forged certificates and unauthorised signatories. A supplier certifying counterfeit stock in good faith produces a valid receipt, and only testing catches that."
  },
  {
   "q": "Will independent distributors participate?",
   "a": "Those competing on quality will, because it differentiates them from brokers. Those competing on price and availability will resist, which is itself informative."
  },
  {
   "q": "How does this interact with counterfeit avoidance standards?",
   "a": "It supports traceability and documentation requirements. It does not replace testing, inspection or approved-source requirements."
  },
  {
   "q": "Why does the verifier need to be open source?",
   "a": "Because the part outlives the software. A proprietary verifier is a dependency on a company that may not exist when verification is needed."
  },
  {
   "q": "Why doesn't incoming inspection catch counterfeits?",
   "a": "Visual and documentation checks catch crude ones. The documentation is the counterfeiter's strongest work, and destructive testing is not run per lot."
  },
  {
   "q": "Can a manufacturer adopt this alone?",
   "a": "Yes. Signing is unilateral; receivers who can verify do, and others see an unchanged PDF."
  },
  {
   "q": "Where does the risk concentrate?",
   "a": "The broker market, used during shortages, where documentation carries the most weight and is least testable."
  }
 ],
 "sources": [
  {
   "t": "Counterfeit avoidance standards for aerospace and defense electronic components."
  },
  {
   "t": "CMMC program — DoD CIO",
   "u": "https://dodcio.defense.gov/CMMC/"
  },
  {
   "t": "Federal Aviation Administration regulations and policies",
   "u": "https://www.faa.gov/regulations_policies"
  },
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  },
  {
   "t": "GIDEP — Government-Industry Data Exchange Program",
   "u": "https://www.gidep.org/"
  },
  {
   "t": "NIST SP 800-171 Rev. 3 — Protecting CUI",
   "u": "https://csrc.nist.gov/pubs/sp/800/171/r3/final"
  }
 ],
 "related": [
  {
   "slug": "release-certificate-receipt",
   "title": "625 stolen engine parts and a paper tag",
   "category": "Vertical"
  },
  {
   "slug": "release-approval-receipt",
   "title": "Engineering release and configuration control",
   "category": "Compliance"
  },
  {
   "slug": "coverage-receipt",
   "title": "Premium diversion",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Conformance%20Receipt/1500_900/blog.jpg",
 "wordcount": 880,
 "url": "/blog/conformance-receipt.html",
 "reading_time": "4 min read",
 "seo_title": "Counterfeit parts and the certificate of conformance",
 "meta_description": "A certificate of conformance is a PDF asserting a lot meets specification. Counterfeiters produce convincing ones and verification means phoning.",
 "hub": {
  "slug": "topics/dib-identity",
  "title": "Defense industrial base identity"
 },
 "answer": "That someone produced a PDF asserting a lot meets specification. Counterfeiters produce convincing ones, and verification means contacting the supplier — which nobody does per lot. The certificate is the control, and it is the least testable artefact in the supply chain.",
 "answer_q": "What does a certificate of conformance actually prove?",
 "glossary": [
  {
   "term": "Certificate of conformance",
   "def": "A supplier's statement that a lot meets the stated specification."
  },
  {
   "term": "Franchised distributor",
   "def": "An authorised distributor with a direct relationship to the manufacturer, and the lowest-risk purchase channel."
  },
  {
   "term": "Broker market",
   "def": "The open market for parts outside authorised channels, used during shortages and where counterfeits concentrate."
  }
 ],
 "checklist": {
  "title": "Making conformance testable",
  "id": "testable",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Sign the certificate contents.",
    "text": "Part, lot, specification, test results, the named signatory."
   },
   {
    "name": "Publish the key at a stable location.",
    "text": "Retained for the life of the parts, not the contract."
   },
   {
    "name": "Verify on receipt, automatically.",
    "text": "Milliseconds, no phone call, every lot."
   },
   {
    "name": "Flag unsigned certificates for the broker market.",
    "text": "Where the risk concentrates."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav binds the authorising individual to the exact record being released or approved, and produces a receipt a prime, a government customer or an auditor can verify without access to your systems.",
  "href": "../docs.html",
  "label": "See approval receipts"
 }
}