In short
ISO 9001 clause 8.4 requires you to control external providers in proportion to their impact on what you deliver: no form, score or frequency is imposed.
Classifying suppliers by impact and replaceability concentrates serious control on the few critical ones.
Qualification needs written, verifiable criteria; a supplier's certificate is a strong indication, not a guarantee.
You decide the re-evaluation frequency: link it to criticality and add triggers such as serious complaints or repeated nonconformities.
Suppliers that handle your data also fall under ISO/IEC 27001:2022 controls 5.19 to 5.22: extend the same process with security criteria.
A non-conforming supplier becomes your problem in front of the customer and the auditor. If a batch of material arrives out of tolerance, a haulier delivers late or a software provider loses data, the customer does not hold the supplier to account: they hold you to account. That is why supplier evaluation is one of the ISO 9001 requirements an auditor almost always checks, and one where SMEs most often stumble.
The problem is rarely the absence of a supplier list. It is that the list has not been touched for years, the criteria are not written down, nobody can explain why a supplier is "approved", and incoming nonconformities never feed back into the evaluation. In this guide we look at what the standard actually requires, how to classify suppliers by risk, which qualification criteria to use, how often to re-evaluate them and how to keep traceability that stands up at audit. You will also find what ISO/IEC 27001 adds when a supplier handles your data, a concrete example and a final checklist.
What does ISO 9001 require for supplier evaluation?
ISO 9001 requires you to control what comes from outside in proportion to its impact. It does not impose a form, a score or a frequency: it requires criteria that are defined, applied and recorded.
The requirement sits in clause 8.4 of the standard, "Control of externally provided processes, products and services". It has three parts: 8.4.1 (general), 8.4.2 (type and extent of control) and 8.4.3 (information for external providers). This structure is the same as in the 2015 edition, and the official summary of changes introduced with the latest edition of ISO 9001 lists no changes to this clause. If you want to place the requirement within the quality system as a whole, start from our guide to the ISO 9001 quality management system.
Who falls within the scope of external providers
The term "external provider" is broader than "whoever sells you raw materials". In practice three situations fall within scope: those who supply materials, components or services that become part of your product or service; those who deliver something directly to your customer on your behalf; and those who carry out an entire process you have decided to outsource, such as subcontracted machining, a testing laboratory or an after-sales service.
Suppliers that do not touch what you deliver to the customer usually stay outside: stationery, office cleaning, the staff canteen. The criterion is impact, not the size of the spend. A small laboratory that calibrates your measuring instruments can be more critical than a large supplier of generic packaging. Writing down clearly which categories of supplier are inside the system, and why, is the first step to avoid wasting effort on irrelevant ones.
The records to keep
The standard requires you to retain documented information on the evaluation, selection, performance monitoring and re-evaluation of external providers, together with any actions arising from them. This is also confirmed by the official guidance from technical committee ISO/TC 176/SC 2 on the documented information requirements of ISO 9001, which lists these among the records to be retained.
In practice: saying "the supplier is approved" is not enough; you need to be able to show on what basis you decided it, when, who decided and what happened next. An approved supplier list with names and dates but no evidence behind it does not meet the requirement. By contrast, a record for each supplier with criteria, outcome, next re-evaluation date and a link to the nonconformities logged is exactly what the auditor is looking for.
How do you classify suppliers by risk?
Not every supplier deserves the same level of control. Clause 8.4.2 asks you to set the type and extent of controls: the level of attention must grow with the potential effect of the supplier on the quality of what you deliver.
A uniform approach has two flaws. If you apply maximum control to everyone, you waste time on marginal suppliers and the system becomes bureaucratic. If you apply minimum control to everyone, you leave exposed precisely the suppliers that can cause a complaint or a stoppage. Risk-based classification solves both problems and links directly to the way you manage risks and opportunities in the ISO system.
A simple matrix: impact and replaceability
For an SME two questions are enough. First: if this supplier gets it wrong, how much does the customer feel it? Second: if I had to replace them tomorrow, how hard would it be? Combining the answers gives you three criticality classes that are easy to manage.
Critical suppliers have a high impact on the product or service and are hard to replace: a supplier of made-to-drawing components, a subcontractor carrying out heat treatment, the provider of the management software you run on. Important suppliers have a medium impact or available alternatives: standard materials with precise specifications, transport, maintenance. Ordinary suppliers have a low impact and are easy to replace. For each class, define in advance what evidence is needed to qualify, which indicators you monitor and how often you re-evaluate. That way the rule is written once and applied consistently to everyone.
An example: a 40-person machine shop
Picture a machine shop that makes components to customer drawings. It has around thirty active suppliers. Among them, the steel bar supplier, the galvanising subcontractor and the laboratory that calibrates the gauges are critical suppliers: a mistake on their part becomes a non-conforming part shipped to the customer. The haulier and the tooling supplier are important. Stationery, cleaning and the workwear supplier remain ordinary, and for some of these the shop may even decide they are outside the scope of the quality system.
The result is that serious control focuses on about ten suppliers, not thirty. For critical ones the shop requests material certificates for every batch, checks first samples and re-evaluates every year. For important ones it relies on delivery indicators and logged nonconformities. For ordinary ones a simple initial evaluation is enough. It is a system that one person can run in a few hours a month.
How do you qualify a new supplier: criteria and evidence
Qualifying means deciding beforehand, on the basis of written criteria, whether a supplier can meet your requirements. Qualification should happen before the first significant order, not after the first problem.
Criteria should be few, verifiable and consistent with the criticality class. A common mistake is to copy a very long questionnaire and send it to everyone: suppliers answer loosely and you file paper nobody reads. A short grid, with criteria you can actually check, works better.
The most useful criteria for an SME
For most SMEs five families of criteria work. Technical capability: can the supplier do what you need, with the required tolerances, materials or skills? Production and logistics capacity: can they handle your volumes and lead times? Quality system: do they hold a valid ISO 9001 certificate or, failing that, documented process controls? Legal compliance: do they have the authorisations, qualifications or declarations required in their sector? Soundness: experience, references, stability of the relationship.
A supplier's certification is a strong indication, not a guarantee. Always check that the certificate is valid, that its scope really covers the product or service you buy and that it was issued by an accredited body. A certificate whose scope differs from what you buy is of little value as evidence of qualification.
Questionnaire, samples, site visit: when they are needed
Qualification tools should be chosen according to class. For ordinary suppliers a document-based evaluation or a history of successful supplies may be enough. For important ones a short questionnaire works, accompanied by certificates and technical data sheets. For critical ones it pays to add a field test: an approved sample, a first batch inspected one hundred per cent or a visit to the supplier.
The visit, also called a second-party audit, is the most time-consuming tool but also the most effective. It lets you see how the supplier controls its processes, handles nonconformities and deals with your requirements. It is not needed for everyone: keep it for critical suppliers, for new suppliers on delicate work, or when indicators flag a recurring problem.
How do you monitor suppliers over time?
The initial qualification is not enough. The standard also requires you to monitor performance and re-evaluate suppliers: a supplier that was excellent two years ago may have changed ownership, staff or processes.
Monitoring works when it relies on data you already collect. Every late delivery, every nonconformity at goods-in and every customer complaint traceable to a supplier is useful information. The problem is that it often sits in different places: delivery notes in the warehouse, nonconformities in a quality file, complaints in the sales team's inbox. An effective system links them to the supplier record.
Practical indicators to measure performance
A few indicators, always calculated the same way, are worth more than a complicated dashboard. These are the most widely used in SMEs, with the question each one answers.
Indicator | What it measures | Where you find the data |
|---|---|---|
On-time delivery | How many deliveries arrive within the agreed time | Orders and delivery notes |
Acceptance conformity | How many batches pass goods-in inspection | Goods-in inspection records |
Attributed nonconformities | How many internal problems originate from a supplier | Nonconformity log |
Linked complaints | How many customer complaints trace back to a supplier | Complaints log |
Responsiveness | How quickly the supplier replies and closes the actions requested | Communications and corrective actions |
For each indicator set an alert threshold, not an abstract target. If the acceptance conformity of a critical supplier falls below the threshold, a corrective action request or tighter inspection is triggered. That way the indicator is not just a number to report at management review, but a signal that produces an action.
How often to re-evaluate suppliers
The standard does not set a frequency for re-evaluation. It is up to you to define it, and the most defensible choice is to link it to the criticality class: for example yearly for critical suppliers, every two years for important ones, less often or event-driven for ordinary ones.
Alongside the fixed schedule you need triggers for extraordinary re-evaluation: a serious complaint, a repeated nonconformity, a change of ownership or production site, the expiry or suspension of the supplier's certification. Write them into the procedure, so nobody has to decide each time whether it is "worth" reopening the evaluation. A re-evaluation can end in three ways: confirmation, confirmation with conditions (more goods-in checks, an improvement plan) or suspension.
What do you need to communicate to suppliers?
A supplier cannot meet requirements it does not know. Clause 8.4.3 is precisely about the information to pass on to external providers, and many nonconformities start here, not from poor execution.
In concrete terms, before placing a supply you must make sure the supplier knows what it has to deliver, to which specifications, which checks or approvals are planned, which competences are needed by whoever does the work and how you will verify the result. If you intend to carry out checks at their premises, or your customer will, this too must be communicated in advance.
The natural vehicle is the purchase order, accompanied by drawings, specifications or general terms of supply. The typical mistake is an order showing only code, quantity and price, while the specifications live in an email from three months earlier. When the wrong batch arrives, nobody can prove which drawing revision had been sent. Linking the order to the correct document revision removes most of these disputes.
Suppliers and information security: what ISO/IEC 27001 adds
If a supplier handles your data or manages your systems, service quality is not enough: information security matters too. ISO/IEC 27001:2022 devotes four specific controls to this topic in Annex A.
The controls are 5.19 (information security in supplier relationships), 5.20 (addressing information security within supplier agreements), 5.21 (managing information security in the ICT supply chain) and 5.22 (monitoring, review and change management of supplier services). Implementation guidance for these controls is in ISO/IEC 27002:2022, which uses the same numbering.
How to combine quality and security in a single evaluation
For a company certified to ISO 9001 that is working towards ISO/IEC 27001, the most efficient solution is a single evaluation process with additional criteria for suppliers that handle information. The cloud ERP provider, the payroll firm, IT support and the backup service go into the same supplier register as materials suppliers, but with an extra section.
In that section you assess how the supplier protects information, which security clauses you have included in the contract, how it notifies you of an incident and what happens to the data at the end of the relationship. Monitoring follows the same logic as quality: you periodically review the service, manage the supplier's changes and record the outcome. If you want to go deeper into the standard, you will find the full picture in our complete guide to ISO 27001.
How do you demonstrate traceability to the auditor?
Traceability is what turns an evaluation into evidence. The auditor is not satisfied with the approved supplier list: they pick a supplier, often starting from an order or a nonconformity, and reconstruct the story.
The typical questions are predictable. Why is this supplier considered critical? On what evidence was it qualified? When was the last re-evaluation and with what outcome? Were the nonconformities of recent months taken into account? Did the purchase order contain the right requirements? If every answer means searching three different folders, the risk of a finding is high even if the work had, in fact, been done.
A supplier record that stands up at audit
An effective supplier record contains a few elements, always up to date: company details and product category, criticality class with its rationale, qualification criteria and evidence, certifications with expiry dates, performance indicators for the period, linked nonconformities and corrective actions, outcome and date of the last re-evaluation, date of the next one. With this structure you can answer the auditor in a few minutes and without reconstructing things from memory.
Typical mistakes that lead to findings
The most frequent mistakes recur in almost every company. An outdated supplier list, with active suppliers never evaluated or former suppliers still approved. Supplier certificates that have expired and were never requested again. Evaluation criteria written in the procedure but different from those actually used. Goods-in nonconformities logged but never fed into the evaluation of the supplier. Re-evaluations all done on the same day, just before the audit, with the same score for everyone. Each of these signals tells the auditor that the process exists on paper but does not drive decisions.
One place for evidence and deadlines
Keeping records, certificates, indicators and nonconformities together is the hardest part of the process. With Complaion, supplier evaluation becomes an ongoing process, not an activity to catch up on before the audit. The dedicated Lead Auditor who follows your company helps you define the criticality classes, qualification criteria and re-evaluation frequency best suited to your sector and size.
The platform gathers the evidence in one place: supplier certificates, evaluations, linked nonconformities and corrective actions, reference documents. The deadline tracker keeps the validity of certificates and the dates of re-evaluations under control, so deadlines do not depend on one person's memory. When the audit comes, the information is already organised and linked together.
What should you do when a supplier fails to meet requirements?
When a supplier gets it wrong, the first thing is to contain the problem: quarantine the material, check whether other batches are affected, decide whether to rework, return or accept under concession. Only then do you move on to the causes.
The nonconformity must be logged and linked to the supplier record. If the error is significant or recurring, ask the supplier for corrective action: root cause analysis, actions decided, timescales and verification of effectiveness. It is the same method you use for internal nonconformities, described in our guide to corrective action and root cause analysis.
The supplier's response in turn becomes part of the evaluation. A supplier that responds quickly, finds the real cause and does not repeat the error can remain approved, perhaps with tighter goods-in checks for a period. A supplier that ignores requests or repeats the same errors should be downgraded or suspended. Remember, though, that as long as the supplier remains in your chain, the responsibility towards the customer stays with you: that is why a downgrade must translate into concrete controls, not just a lower score.
How Complaion helps you qualify and monitor suppliers
Managing suppliers well means protecting the quality you deliver to your customers, even when part of the work is done by others. Complaion supports more than 1,000 clients with a model that combines expertise and tools: a dedicated Lead Auditor who follows your company and proposes the path best suited to your needs, and a platform that gathers evidence, manages documents, keeps the deadline tracker and prepares the audit.
Whether you are setting up the process for your first certification or want to put a supplier list that has not been touched for years back in order, you can start from our dedicated ISO 9001 certification service. To understand how to apply it to your business, talk to a Lead Auditor or request a quote built around your company from the pricing page.
Frequently asked questions on ISO 9001 supplier evaluation
Does ISO 9001 require you to evaluate all suppliers?
No, not all in the same way. The standard concerns providers of processes, products and services that affect what you deliver to customers. The level of control should be proportionate to the impact of each supplier. Suppliers that do not touch the product or service can stay outside the scope, as long as the choice is justified and consistent.
Do you need an approved supplier list?
The standard does not use the term "approved supplier list" and does not impose a specific format. It does, however, require you to retain documented information on the evaluation, selection, monitoring and re-evaluation of suppliers and on the resulting actions. A list with criticality, outcome and dates, linked to the evidence, is the simplest way to meet the requirement and to answer the auditor.
How often should suppliers be re-evaluated?
ISO 9001 does not set a frequency: you define it. The soundest choice is to link it to criticality, for example yearly for critical suppliers and less often for the others. Alongside the ordinary schedule, it is worth planning extraordinary re-evaluations after serious complaints, repeated nonconformities or major changes at the supplier.
If a supplier is ISO 9001 certified, can I skip evaluating it?
No. The supplier's certification is a good indication, but it does not replace your own evaluation. You need to check that the certificate is valid, that its scope covers what you buy and that actual performance is consistent. A certified supplier can still deliver late or out of specification, so performance monitoring remains necessary.
Which criteria should you use to qualify a new supplier?
The most useful criteria for an SME are technical capability, production and logistics capacity, quality system, legal compliance and overall reliability. They should be chosen according to the supplier's criticality and must be verifiable. For critical suppliers it pays to add a concrete test, such as a sample or a site visit.
What happens if a critical supplier has a nonconformity?
First you contain the problem by quarantining the material and checking other batches. Then you log the nonconformity, link it to the supplier record and, if the error is significant, request corrective action with root cause analysis. The outcome weighs on the re-evaluation: the supplier may remain approved with tighter controls or be suspended.
What changes for IT suppliers with ISO/IEC 27001?
Under ISO/IEC 27001:2022, suppliers that handle your information must also be managed from a security standpoint. Annex A devotes controls 5.19 to 5.22 to suppliers: supplier relationships, agreements, the ICT supply chain and monitoring of services. If you already have an ISO 9001 process, you can extend it with security criteria rather than creating a new one.
