Engineering Services — Buyer's & Make-vs-Buy Guide

Keep in-house what is core, differentiating, IP-sensitive, or iterating fast. Outsource what is non-core, capital-intensive to build, needed at a volume you can't justify staffing for, or already met by a certified specialist. Concretely, buy when (a) the capability isn't your competitive edge, (b) demand is volatile or below the break-even for dedicated capital, (c) you need a specialized process or added capacity faster than you can build it, or (d) a certified partner already clears the regulatory bar. Make when the work is your differentiator, changes constantly, or exposes core IP.

Make-vs-buy is a total-cost and strategic-risk decision, not a unit-price comparison. In-house buys control, IP containment, and fast iteration, but ties up capital and fixed overhead. Outsourcing converts fixed cost to variable, buys specialized capability and certifications you'd otherwise fund yourself, and scales with demand — at the cost of control, lead-time dependency, and coordination overhead. The break-even moves with volume: low or uncertain volume favors buy; high, stable, IP-critical volume can favor make.

The classic error is deciding on quoted unit price alone and ignoring total cost of ownership — tooling, qualification, logistics, quality oversight, travel, inventory, and the cost of a supplier miss. The reverse error is insourcing a non-core process for the feeling of control and then carrying idle capacity and overhead you can't fill.

Require the certification that matches your regulatory context, not a generic badge. General / industrial → ISO 9001 (the 2015 edition, with ISO 9001:2026 now rolling out on a three-year transition to ~2029). Aerospace & defense → AS9100 (Rev D), built on ISO 9001. Medical devices → ISO 13485:2016. Automotive production → IATF 16949:2016. For US defense work also confirm ITAR registration and the applicable cybersecurity requirements (NIST SP 800-171 / CMMC).

These standards are not interchangeable. AS9100, ISO 13485, and IATF 16949 each extend ISO 9001 with sector-specific requirements — configuration management and counterfeit-part controls for aerospace; design controls, risk management (ISO 14971), and traceability for medical; and PPAP/APQP production-approval discipline for automotive. A shop with general ISO 9001 can be excellent and still lack the documented process a regulated product legally requires. "ISO certified" alone tells you a quality system exists, not that it fits your product.

Accepting a generic quality badge for a regulated product; or over-specifying — demanding AS9100 for a non-critical commercial part and paying an aerospace premium for no benefit. Certificates are site- and scope-specific and they expire: verify the certificate is current and that its scope covers the exact site and process doing your work.

Score partners on five axes before price: (1) capability & capacity fit — do they routinely deliver your process, material, tolerance, and volume, with headroom; (2) quality system — the right certification plus willingness to sign a quality agreement and share first-article/inspection data; (3) financial stability & continuity — so they survive the program and aren't one lost order from insolvency; (4) communication & responsiveness — a named contact, clear escalation, and realistic time-zone/language handling for offshore; (5) IP protection — NDA, controlled data handling, and written clarity on who owns tooling and designs. Then compare price on equal specs.

Most sourcing failures trace to picking on price and headline capability, then discovering the gaps — quality escapes, slipped lead times, communication breakdowns — after tooling is cut and money is committed. Scoring the five axes surfaces those risks while they are still cheap to avoid. Ask for references in your industry, a plant visit or virtual tour, and a small qualification run before committing volume.

A low quote that quietly omits scope you assumed was included; a partner whose certification is genuine but whose real capacity for your part is thin; offshore savings erased by freight, duties, lead time, travel, and rework. An under-specified RFQ is the root of most of these — see the next entry.

Parts or deliverables that pass the supplier's checks but fail yours — wrong finish, missing tolerance callouts, untested edge cases, "we built exactly what the drawing said." Cost and schedule then blow up in rework and re-quotes.

An RFQ that omits critical-to-quality characteristics, tolerances, materials, finish, and test/acceptance criteria; assuming the supplier will infer intent; and no quality agreement defining inspection, first-article approval, and change control.

1) Specify critical-to-quality characteristics, tolerances, materials, finish, and acceptance criteria explicitly, and cite the governing standard. 2) Put a quality agreement in place (inspection plan, first-article or PPAP, nonconformance handling, change control). 3) Require a first-article / qualification run before production. 4) Fix in writing who owns tooling, fixtures, and IP. 5) Lock a change-control process so no silent material or process substitutions slip through.

A program stalls when one supplier hits a fire, a labor action, a quality hold, or insolvency — and no qualified alternate exists. Or projected offshore savings evaporate in freight, duties, quality travel, lead-time inventory, and rework.

Sole-sourcing a critical part for the lowest unit price; comparing unit price instead of landed total cost; no second source qualified; and underestimating the coordination cost of distance, time zones, and IP exposure.

1) Qualify a second source for critical parts, or at least document a tested switch plan. 2) Compare landed total cost of ownership — freight, duties, inventory, quality oversight, and travel — not unit price. 3) Weight supply-chain resilience and geographic risk, not cost alone. 4) Protect IP both contractually and technically when sourcing offshore. 5) Hold safety stock or dual-source the genuine single-points-of-failure.