Controlled shipping is the customer saying, in contractual form: I no longer trust your process, and I will force inspection upon you until I do. In automotive practice it arrives as a formal letter from the customer's supplier quality team, triggered by a defect escape, a line stoppage, or a field complaint traced to your part. Level 1 means you sort and contain at your own facility before shipment. Level 2 means a third party does it for you, at your cost, because Level 1 failed or the risk was judged too high. Some customers add a Level 3 with their own people resident in your plant, though terminology varies between OEMs.
The letter itself is rarely a surprise. What surprises suppliers is how quickly a single escape becomes an instrument with daily reporting, prescribed detection methods and named signatures. Understand the mechanism before arguing with it: containment buys the customer time while you fix the process. It is not the fix, and treating it as one is the most expensive misreading in the whole episode.
Across two decades in automotive and aerospace quality, I have issued and received these letters, and the pattern of failure is consistent. Suppliers under-engineer the inspection, over-invest in surviving the clean-shipment window, and exit without touching the root cause. The defect then returns, usually at a worse escalation level. This article covers the mechanics of each level, the exit criteria most teams misread, and the standard of evidence a defensible exit actually requires.
What controlled shipping actually is
Controlled shipping sits inside the standard automotive escalation ladder: defect escape, 8D demanded, containment required, new business hold if trust collapses further. The CS letter is a mid-rung instrument — the customer still wants your parts, but no longer wants them unverified. It defines the defect, the detection method, the reporting cadence, the duration or exit conditions, and who signs. Deviate from the letter without written agreement and you are in breach regardless of part quality.
Level 1 preserves your operating agency: your people, your station, your records. Level 2 removes it. The third party reports to the customer directly, not through you, and their daily report carries more weight than yours does at that stage. This asymmetry is deliberate. Escalation is not primarily about sorting capacity — it is about the customer replacing your judgement with a paid, independent proxy.
The letter also starts a clock on relationship capital. Every day under containment, your name sits on a watch list that filters sourcing decisions, launch approvals and payment releases. The technical work matters, but the speed and honesty of your response determines whether this episode costs you a programme or just a quarter. Both costs are real; only one appears on the invoice.
Level 1: engineering containment that detects
Level 1 fails most often not because people are careless but because nobody engineered the inspection. A visual check under factory lighting on a moving belt will not find the burr you shipped. Define the defect precisely — location on the part, size threshold, orientation — then choose a method whose detection capability matches it. For a crack on a machined surface, that may be fluorescent penetrant or a structured-light vision station. For a missing clip, a go/no-go fixture with part presence sensing beats a human every time.
Document containment as you would any process under IATF 16949: a work instruction at the point of sort, trained and named operators, a defined sample basis (100 per cent during Level 1, no exceptions), a reject hold area with quarantine labels, and a daily exit audit where a second person rechecks accepted parts. Insist on documented detection validation — seed the sorter with known bad parts and prove they get caught. If you cannot demonstrate detection, you are shipping and hoping, which is precisely what got you into this.
Feed results back daily: parts sorted, defects found by characteristic, detection validation status. Containment data is not administrative noise. It is your live estimate of process fallout and your first clue about where the true process weakness sits. A defect found at 400 ppm in the sort but concentrated in one cavity or one shift points you at the root cause faster than any customer audit will.
Containment that earns exit
- 01Define the defectLocation, size threshold, orientation, boundary samples agreed with the customer
- 02Match the methodDetection capability must match the defect, not the available labour
- 03Validate detectionSeed known-bad parts; prove the sort catches them, documented
- 04Sort 100 per centNamed operators, work instruction at point of sort, quarantine hold area
- 05Report dailyParts sorted, defects by characteristic, fallout trend
- 06Convert to process fixTrace to creating operation; engineer the defect out or detect it in-cycle
Level 2: when the customer stops trusting your people
Escalation to Level 2 happens for a handful of predictable reasons: your Level 1 shipped a defect again, your detection validation was weak or fabricated, you missed a reporting deadline, or the failure mode is safety-related and the customer will not accept supplier self-inspection at all. A third-party sorting house then sets up at your dock or near the customer's plant, billing you for labour, management overhead and often premium logistics. The technical content changes little; the trust content changes entirely.
Your job at Level 2 is to support the third party honestly. Give them boundary samples, real work instructions, access to your containment records, and a point of contact who answers within the hour. Withhold anything and they will note it in their daily report to the customer — a report that outranks yours at this stage. Cooperation is not generosity; it is the only channel through which your information still reaches the decision-maker unfiltered.
Watch their process as well. Sorting houses vary enormously in competence, and I have seen them miss the very defect they were hired to catch because the boundary samples were ambiguous. Audit their station yourself, weekly, with the same seeded-part method you applied to your own. A defect escaping Level 2 containment is the fastest route I know to new business hold, because it demonstrates that neither you nor an independent proxy can detect the problem.
Exit criteria: the part everyone gets wrong
Customers frame exit as a period of clean shipments plus evidence of corrective action. Read the letter carefully, because the specifics decide your plan: how many consecutive defect-free deliveries, whether requalification lots are required, whether the customer audits your line before release, how the third-party contract winds down. Some require capability demonstration on the problem characteristic; others accept verification runs. The underlying logic is identical — the customer wants evidence that the defect can no longer be produced undetected, not that you inspected harder for eight weeks.
The repeated mistake is treating the clean-shipment window as the goal. Suppliers staff containment heavily, ride out the period, and exit. Three months later the defect returns because the root cause was never addressed below the surface: the worn fixture, the uncontrolled torque tool, the batch-to-batch variation in incoming resin. Exit must be driven by process evidence — validated corrective actions, error-proofing installed and challenged, capability studies showing the characteristic centred and stable, and a defined reaction plan if it drifts.
Build the exit file from day one. Every detection validation, every engineering change, every run-at-rate result, dated and signed. When the customer's supplier quality engineer asks for justification, you hand over a package rather than assembling one under pressure. The difference between those two modes of delivery is often the difference between a routine release and an extended containment with an audit attached.
Inspection can never be the end state; any exit that leaves the process dependent on human vigilance is a deferred re-entry at Level 2.
The relationship damage nobody prices
Beyond sorting labour, expedited freight and line-stop charges, controlled shipping corrodes the relationship in ways that never appear on an invoice. Engineers at the customer stop calling your engineers informally and start putting everything in writing. That shift from partnership to policing is slow to reverse, and it taxes you in lost opportunities you will never even hear about — the quote not sent, the launch not awarded.
Internally, the damage is just as real. Containment consumes your best inspectors and engineers, who are then unavailable for the new programme that needs them. Purchasing colleagues start asking whether dual sourcing should be considered. I have watched suppliers spiral from one CS2 into a second on a different part number because all improvement capacity was consumed by firefighting the first. Containment capacity is stolen from prevention, which manufactures the next containment.
Manage this by over-communicating. Give the customer a single accountable leader, a weekly status that is honest about setbacks, and visible executive attention. Customers forgive failure; they do not forgive surprises or evasion. The suppliers who recover fastest are the ones whose quality leaders called the customer before the customer called them — every time, without exception.
Two exits from the same letter
Window as goal
- Staff the sort heavily and ride out the period
- Exit on consecutive clean deliveries
- Root cause untouched: worn fixture, uncontrolled tool
- Same defect returns within a quarter, escalated
Capability as goal
- Containment data traced to the creating operation
- Engineering change or embedded detection with proven catch rate
- Characteristic shown centred and stable under known noise
- Exit backed by process evidence, not sorter performance
The exit must land on capability
Containment buys time; capability repays it. The corrective action must move the defect from "detected at sort" to "cannot be produced", or at minimum "detected at the station that made it, automatically, within the cycle". Every escaped characteristic gets traced back through the process to the operation that creates it. That operation then gets either an engineering change — better fixture location, redesigned nest, corrected process parameter window, modified tooling geometry — or an embedded detection with proven effectiveness, tested with known-bad masters on every shift.
In-process detection beats end-of-line detection, and prevention beats both. When you present the exit package, lead with the process change and the proof it holds under variation: run the process across the known noise factors and show the characteristic stays within limits. Where capability applies, demonstrate it on the escaped characteristic with the same Cpk 1.33 minimum you would defend at a PPAP submission, not a special-case threshold invented for the occasion.
Ask one question of yourself before the customer asks it of you: if we removed all containment tomorrow, what evidence says the defect rate is effectively zero? If the honest answer is "our sorters are good", you are not ready to exit. I have signed off on both kinds of exit in my career — the ones backed by capability and the ones backed by luck. Only the first kind stays closed.