Contract Review in Small Manufacturing: Documenting What You Already Do

I was walking a client through ISO 9001's requirements for reviewing customer requirements - Clause 8.2 - and asked how he currently handles incoming orders. He paused. "I mean, I look at the print. I figure out what material I need, how many parts I can get per bar, what my cycle time is, and I shoot back a quote via email. If they send a PO, I check it matches what I quoted."

That's contract review. He was already doing it. He just didn't have a name for it, and he didn't have records that would satisfy an auditor.

This is one of the most common gaps I see in small machine shops pursuing ISO 9001 Certification. The actual review of customer requirements happens - sometimes it's thorough, sometimes it's a gut check - but there's no documented trail. The knowledge lives in the owner's head, in a pen-and-pad calculation, or in an email thread that nobody would think to save as a Quality Record.

What ISO 9001 Actually Requires

Clause 8.2 covers the determination and review of requirements for products and services. In plain language, it asks three things:

• Do you understand what the customer wants? This includes stated requirements (what's on the print or PO), implied requirements (industry norms the customer expects but didn't spell out), and any statutory or regulatory requirements that apply.
• Can you actually deliver it? Before committing to a job, have you confirmed you can meet the specs, tolerances, material requirements, delivery timeline, and any special processing?
• Do you have records of that review? The standard explicitly requires retaining documented information on the results of the review and on any new requirements for the products and services.

Most small manufacturers nail the first two points instinctively. The owner or estimator looks at the print, checks tolerances, figures out if they have the right equipment and materials, and quotes accordingly. Where it falls apart is the third point - the records.

The Pen-and-Pad Problem

I asked that same client how he does his quoting. His answer: "I live with a pen and pad. I look at the max length of material, figure out waste, check my cut-off tool width, calculate parts per bar, call suppliers for material pricing, and work out my hourly rate." All on paper. All in his head. No template, no form, no standardized document.

The calculation is sound. He knows exactly what he's doing. But if an auditor asks to see evidence of Contract Review for a specific job, there's nothing to point to except maybe an email where he quoted a price. The actual review - the part where he confirmed he could meet the tolerances, that he had supplier access for the right material grade, that his equipment could handle the geometry - all of that happened in a conversation with himself and a notepad.

This doesn't mean you need to overhaul how you work. It means you need to capture what you're already doing in a way that leaves a trail.

What the Review Should Capture

For a small machine shop, a Contract Review record doesn't need to be complicated. At minimum, it should document:

• What the customer asked for - Part number, drawing revision, quantity, material spec, tolerances, finish requirements, delivery date
• Any referenced standards or regulations - If the print calls out ASME Y14.5 or a specific material standard, note it. This is part of understanding the full set of requirements.
• Specific customer instructions - Packaging preferences, post-processing requirements (anodizing, chem film, heat treat), shipping method, labeling
• Confirmation you can meet the requirements - Do you have the equipment, materials access, and capability? Even a simple checkbox or sign-off works.
• Who reviewed it and when - A name or initials and a date. That's your evidence of review.

A simple quote form or order review checklist that captures these elements turns an informal process into an auditable one without adding much time to what you're already doing.

Handling Changes Mid-Job

Clause 8.2 also addresses changes to requirements - and this is where small shops often have strong instincts but weak documentation.

I was talking with a client who described a situation where he was mid-production and the customer called to say they needed a design change - an additional feature added to the part. His response was exactly right: stop production, wait for the updated drawing, make a sample batch of the new revision, send it to the customer for approval, and require a new purchase order referencing the updated revision before continuing full production.

That's textbook change management. He handles drawing revisions by archiving the old revision in a clearly labeled folder, creating a new file with the updated revision designation, and only producing from the current revision. If a customer sends a PO referencing Rev A, he pulls the Rev A file. If they later send Rev B, he archives Rev A and works from Rev B.

The practice is solid. What's often missing is a record that the change was reviewed and accepted - that someone confirmed the organization can still meet the new requirements and that relevant documents were updated. A quick note on the Job Traveler or a documented email exchange covers this.

The Email as a Quality Record

Here's something worth noting: for many small manufacturers, email is already the de facto Quality Record for contract review. The quote email to the customer captures what you understood the requirements to be and what you're committing to deliver. The customer's reply or PO confirms alignment.

One client I work with has a policy that any verbal agreement gets followed up in email - specifically because he's been burned in the past by customers claiming engineering didn't approve a change that was verbally agreed to. "Everything in writing" is his rule, and it's a good one.

If you're using email to communicate quotes, requirements, and changes, you're halfway to meeting 8.2's documentation needs. The gap is usually that these emails aren't organized or retrievable as job-specific records. They're buried in an inbox rather than linked to a job folder or order file.

A practical fix: save the relevant email chain to the job folder alongside the print, PO, and any other documentation. That way, when an auditor asks to see evidence of Contract Review for a specific order, you can pull the folder and show the full picture.

When the PO Doesn't Match the Quote

The standard requires that any differences between previously expressed requirements (your quote) and those in the contract or order (the PO) be resolved before acceptance. This sounds formal, but it's practical risk management.

In a small shop, the owner is usually the one receiving both the quote request and the PO, so discrepancies get caught naturally. But as you grow and someone else starts handling order intake, this becomes a real vulnerability. The person processing the PO may not have been part of the quoting conversation.

This is exactly the scenario the standard is trying to prevent: producing parts based on requirements that don't match what you agreed to. Having a step - even an informal one - where the PO is checked against the quote before production starts can save you from producing the wrong quantity, the wrong revision, or at the wrong price.

Practical Takeaways

If you're a small manufacturer working toward ISO 9001, here's how to get Contract Review right without overcomplicating it:

• Create a simple quote or order review form. It doesn't need to be elaborate. A one-page document that captures customer requirements, referenced standards, your confirmation of capability, and a sign-off is enough.
• Save relevant emails to job folders. If email is your primary communication channel, treat those emails as Quality Records. Archive them where they're retrievable by job or customer.
• Document drawing revision changes. When a customer sends a new revision, record that the change was reviewed, the old version was archived, and production will proceed from the updated drawing.
• Check the PO against the quote before starting. Even if it's just you, build the habit of verifying alignment. As you bring on staff, this step becomes critical.
• Keep everything in writing. Verbal agreements are fine for getting started, but follow up with written confirmation. You'll thank yourself when there's a dispute about what was agreed to.

The goal isn't to slow down your process. It's to capture what you're already doing so you can prove it when someone asks.

If you're working through ISO 9001 requirements and want help figuring out what documentation you actually need versus what's overkill, we offer a free initial consultation to help you sort it out.