> If you have to verify the details of the work you outsource
Yes, they have to verify. Verification is necessary whether or not the component is sourced through a supplier or in-house. Verification happens after the sourcing step. And yes, you are criminally liable in the supplier case if your supplier commits fraud and you knew about it, as is the implication here.