My shop works with materials/vessels for Power, Oil/Gas, Chemical plants, all kinds of groups with particular quality needs.
In general, you will meet everybody's assurance requirements if:
Step 1) Make sure the supplier is trusted in the industry. Has a good history, client base, certified (ISO, API, etc)...but even that won't prevent the main problem: PEOPLE LYING...
Take Kobe Steel for example:
Link
"Kobe Steel admits data fraud went on nearly five decades, CEO to quit"
Very respectable company...until everybody found out they lied on almost all their product. People trusted them for years...you would get a certified CMTR from the mill, all the chemistry, mechanical tests, etc...it looked good on paper...until everybody found out they completely made it up.
Step 2) From a trusted source, continue to verify the CMTR's meet the specs.
Step 3) If you still don't trust it, perform your own analysis. You could use XRF/OES as a qualitative check (for us this is a standard for our dock to make sure the material matches the CMTR) as a cheaper/easier way...but it's only a verification, not actual chem report. Most customers require PMI to make sure the material matches the CMTR..but they trust the CMTR.
-chicopee is right: in general: nobody wants to be taken to court for fraud/liability issues. You are USUALLY good with the CMTR as being accurate. Most customers have a "NO CHINA" requirement or sometimes "No India, China, or former Eastern Soviet Block" requirement. This is because they *feel* less trusting of many suppliers from those countries have that 'care factor'.
-EdStainless also has a good point. ISO/API often have requirements for supplier validation: site visits, audits, etc. You might want to look at this as well.