Subcontracting Risk: How to Discover Where Your Product Will Really Be Made

A supplier can send a valid business license, a current ISO 9001 certificate, and a social-audit summary that all name its own factory, and still route your order to a different site that none of those documents covers. Subcontracting is common and lawful; what puts the order at risk is subcontracting you never see. The buyer's job is to find the site that will really make the product before approving the supplier.

Subcontracting is an arrangement in which a supplier has another company perform part or all of the work for an order. The other company is the subcontractor, and the buyer usually deals only with the supplier. Subcontracting itself is not the risk. Undisclosed subcontracting is, because it can leave the buyer approving one entity or site while a different site makes the order.

What Subcontracting Risk Actually Means for a Buyer

Subcontracting risk is not the fact that a supplier uses another company; it is the risk that the buyer approves one entity or site while a different, undisclosed site makes the order, so quality, compliance, certificate coverage, and origin evidence attach to the wrong place. Treat the producing site, not the supplier name, as the thing you approve, and hold release until the site and the documents agree.

• Best for: buyers and supplier quality or compliance managers who hold a supplier's license, certificate, and audit summary and need to know where the order will be made.
• What subcontracting is: a normal arrangement in which another company performs part of the work for an order.
• What it leaves open: the producing site, the process and capacity behind the order, any undisclosed subcontractor, and the site-scoped documents.
• How to use it: run the producing site through a five-gate chain, then record the result as an approval with a disclosure and change condition.
• Main risk: treating a supplier-level certificate as proof of the site that makes the order.

What Subcontracting Is — and Why It Is Not the Risk Itself

Subcontracting is an arrangement in which a supplier has another company perform part or all of the work for an order, and it is a normal way to add capacity or reach a specialised process, so the arrangement itself is not the risk; the missing disclosure is. The buyer's real question is not whether the supplier subcontracts, but whether the production site that will make the order has been named, whether the certificate scope on file covers that site, and whether any disclosure of a subcontractor has been agreed in advance. Answer those three and the practice becomes a manageable input.

The practice is well defined rather than a grey area. A subcontractor is a person or business that undertakes to perform part or all of the obligations of another's contract, and a subcontract assigns part of an existing contract to another company, which is why a supplier can legitimately hand part of your order to a partner plant. To judge where an order is really made, the China manufacturing and product guide sets out how China's manufacturing and product-development stages fit together.

Why Chinese Suppliers Subcontract Production

Suppliers subcontract to cover capacity peaks, to reach a specialised process or finish they do not run in-house, and to smooth demand across a season, so a buyer should expect some subcontracting and plan a disclosure step for it. A single plant rarely covers every step of a product, and a supplier that wins a large order near a holiday may place part of it with a partner rather than turn it down when the in-house line is already booked for 6 weeks. None of that is a warning sign by itself; it is a reason to agree in advance how any change of site will be disclosed.

Quality systems already assume that external providers exist. An ISO 9001 certificate is limited by a particular scope and displays the addresses to which the certificate refers, and the ISO 9000 principles treat an organization and its external providers as interdependent. Read that carefully: the certificate is tied to a scope and to named addresses, so it describes the site it lists rather than a licence to move your order to any plant the supplier chooses.

What a Supplier's Own Documents Cannot Prove About Production

A supplier's own documents cannot prove that the registered entity runs the site that makes the order, that a certificate or audit covers that site, or that no undisclosed subcontractor is involved, because those documents answer a supplier-level question rather than your site-level question. The licence confirms an entity, the certificate confirms a scope and an address, and the audit confirms a worksite that was visited, so each stops short of the question you are actually asking.

The gap is not unique to any one supplier. The U.S. International Trade Administration reports that significant trade barriers for U.S. companies persist, including non-transparent regulatory processes and selective enforcement of laws. That is a general statement about the market, not about a specific factory, but it explains why a buyer should verify production directly rather than assume it.

For a supplier you already use, those open questions become a follow-up problem. NewBuyingAgent's existing-factory management service uses local China follow-up and quality-control capability to keep production, change, and release evidence attached to the entity you verified, so a supplier-level document check and the day-to-day reality do not drift apart.

A Registered Entity Is Not Necessarily the Producer

A registered entity can be a trading company, an agency, or a holding company that arranges production at another site, so the registration record alone cannot establish that the entity operates the site that will make the order. Its business scope may list manufacturing while the work is placed with a plant that the buyer never sees, because the registry records what the entity is registered to carry out, not what it operates.

What separates a producer from an arranger is where the work happens, not what a document says the entity may do. A buyer asking the production question wants the site address, the process, and the capacity for the order quantity. A short walk-through with the process steps visible and an equipment list answer a question the registration record cannot; when those are missing, the producing site is still unknown.

Certificates and Audits Cover the Site They Name

A management-system certificate is limited by the scope and the addresses it names, and a social audit covers the worksite an auditor visits, so neither proves a second site that has not been disclosed or approved. The common misreading is treating a valid certificate as if it covered the supplier in general, when it covers the site and activities printed on it. Read every certificate against the site that will make your order, and check that the address matches.

Social audits are site-level by design. SMETA is a social audit used to assess labour, health and safety, environmental, and business-ethics conditions at a supplier site, and the audit is conducted by an auditor visiting a supply chain worksite in person. That makes it strong evidence for the site the auditor entered and no evidence for a partner plant that was never visited, so site-level work is still outstanding when the producing site is not on the audit.

Build the Evidence Chain That Finds the Real Producer

A defensible finding adds four checks around the supplier's identity: confirm the producing site, evidence the process and capacity for the order, require disclosure and approval of any subcontractor, and tie the site-scoped documents and origin evidence to that site. Together with the identity check, these five gates turn a supplier declaration into a repeatable site finding. Release only when all five agree; otherwise hold.

Five-step site chain from confirming the producer entity through confirming the production site, evidencing process and capacity, approving disclosed subcontractors, and tying site-scoped documents to the order

Read the table as a release rule: if the producer entity, the production site, the process and capacity evidence, the disclosed subcontractors, and the site-scoped documents do not all agree, the order stays on hold.

The pressure to know the whole chain is rising. The Responsible Sourcing Tool, a U.S. government-backed resource, warns that forced labor can be hidden in a global supply chain and says that preventing and addressing the risk requires a due diligence management system that assesses, addresses, and monitors supply chain risk. A system of that kind needs the producing site named, because a risk you cannot locate is a risk you cannot monitor.

Where you are sourcing a new product rather than checking an existing supplier, those gates can be built into the supply brief. NewBuyingAgent's product-supply service uses local China factory access and product-development/quality-control capability to pre-vet the supplier and keep the site, process, and disclosure evidence attached to the order.

Ask for the Production Site, Not Just the Supplier Name

You should require the producing site to be named and evidenced with its address, process, equipment, and capacity for the order quantity, so the site that will make the order is confirmed rather than assumed from the supplier's identity. A name on a certificate is not a site; a site has a physical location you can visit and machines that either can or cannot make your product. Ask for that, and the supplier's own documents become a starting point instead of the answer.

The evidence set is small and specific. Ask for the site address and its registration, a short walk-through that shows the process steps, the equipment used for your product, and the capacity the site can commit to your order quantity and delivery date. Then compare it with the certificate and the audit. If the site that will make the order is a different address from the one those documents name, you have found the gap before production rather than after shipment, and you still have 30 days before the first delivery to fix it.

Disclose and Approve Subcontractors Before the Order

You should require any subcontractor to be disclosed in writing and approved before production starts, so your compliance and origin evidence stays attached to the site that produces rather than to the supplier that sold. A verbal reassurance that a partner plant is fine does not survive a shipment that is stopped, a defect claim, or a compliance question, because at that point the buyer needs a record, not a memory. Make disclosure a condition of the order, not a favour.

Regulators are moving in the same direction. The EU corporate sustainability due diligence directive requires in-scope companies to identify and address impacts in their own operations, those of their subsidiaries, and in their chains of activities, with application phased in through 2028 and 2029. The lesson holds whether or not the rule applies to you: a site inside your chain of activities is inside your responsibility, so it should be named and approved before the order runs.

Worked Example: A Certificate That Covered the Wrong Site

Test the supplier's documents against the site that will make the order before releasing a deposit, and hold or move the order when the producing site is not the site the documents cover. A supplier that fails the site test should be re-verified or replaced, not approved on the strength of a valid certificate.

Illustrative Example: A Certificate That Covered the Wrong Site

In this illustrative example, a consumer-goods buyer is preparing a first production order and choosing among 3 shortlisted Chinese suppliers and 2 candidate production sites. The plan is 30,000 units for a first production run, with a USD 75,000 deposit requested against a proforma invoice. The selected supplier holds a valid business license, an ISO 9001 certificate, and a recent social-audit summary, all naming the supplier's own address, so the buyer treats the site check as passed.

Two things do not line up. The certificate and the audit summary both name the supplier's own address and process scope, but the production schedule the supplier sends names a second site the supplier calls a partner plant. That second site is not named on the certificate, the audit, or the proforma invoice, and the supplier has not confirmed it in writing, so the buyer's documents are all true and all about the wrong address.

A certificate and an audit attach to the entity and the site they name, so the buyer cannot read them as evidence for a second site that has not been disclosed or approved. The decision is to hold the deposit and the approval while allowing reversible preparation such as specification and packaging review to continue, because none of that work commits money to an unverified site.

The corrective action is to require the second site to be named in writing with its own registration, certificate scope, and audit or inspection evidence, then to approve it as a disclosed subcontractor or require the order to move back to the named site before release. This illustrative example invents no measured result and no verified site visit, and a closed check is not a guarantee about later orders; the buyer's own verification and controls govern the real scope.

Put the Finding Into an Approval and a Change Rule

Record the producing site, the process and capacity evidence, the disclosed subcontractors, and the site-scoped documents in one approval with an owner, a date, and a change-notification condition, so the finding stays current when the supplier moves production, and re-verify the site at least every 12 months or after any change. Written this way, the site becomes one line in a decision record instead of a question that has to be re-argued from memory. The change condition is what keeps a valid approval from going stale after the supplier shifts the order to a different plant.

The document scope belongs in that record too. The U.S. International Trade Administration notes that Chinese import documents vary by product and that the General Administration of Customs requires certain facilities to register before shipping. Naming the applicable facility registration and documents in the approval keeps them attached to the producing site instead of surfacing at the port, when it is too late to change where the order was made.

For a supplier entering China sourcing, prepare the supplier name and registered entity, the product and specification, the order quantity and value, the site the supplier says will make the order, any subcontractor it names, the destination, and the delivery timing. NewBuyingAgent can use its local China factory access, on-site inspection, and product-development/quality-control capability to verify the producing site, follow the order through existing-factory management, and return a China-side site-verification result aligned with those approval conditions. With the details ready, send your supplier and order details to NewBuyingAgent.

Frequently Asked Questions

Is subcontracting in China illegal or dishonest?

No; subcontracting is a normal arrangement in which another company performs part of the work, so the practice is not the risk, and undisclosed subcontracting is. A supplier may place part of an order with a partner plant for capacity, a specialised process, or a seasonal peak. What matters is whether the producing site is named and approved before the order runs, because that keeps quality, compliance, and origin evidence attached to the right place.

Does an ISO 9001 certificate prove the site that makes my order?

No; a certificate is limited by the scope and the addresses it names, so it proves the site it lists rather than a second site that makes the order. Read the address on the certificate and compare it with the site the supplier says will produce your order. If they differ, the certificate still has value for the site it covers but is not evidence for the partner plant, and a site-level check remains.

What evidence shows where a product is really made?

Ask for the producing site's address and registration, process and equipment evidence, capacity for the order quantity, the site's own certificate or audit scope, and shipping documents that name the site. A short walk-through that shows the process steps is more useful than another document from the selling entity, because it lets the buyer name the site and match it against the documents before the deposit moves.

What should a buyer do if the supplier will not name the subcontractor?

Hold the deposit and the approval; an unnamed producing site leaves the buyer without quality, compliance, or origin evidence for the site that makes the order. A refusal to name a partner plant is not proof of a problem, but it removes the buyer's ability to verify, so pause the release rather than proceed on an assurance. The order can resume once the site is disclosed and approved, or move back to the named site.

How does undisclosed subcontracting affect compliance and origin?

It breaks the link between the documents the buyer holds and the site that produces, so compliance and origin evidence can be attached to a site that did not make the order. Facility registration, certificates, and origin documents are site-specific, so a document naming the supplier's own address says nothing about a partner plant. Disclosing and approving the producing site before production keeps that evidence usable if a customs, compliance, or defect question arrives later.