ISO 9001 supplier evaluation requirements: auditing Clause 8.4

What the supplier evaluation requirement is, and why it exists

The ISO 9001 supplier evaluation requirements under Subclause 8.4.1 mandate that an organisation must establish and apply criteria to evaluate, select, monitor performance, and re-evaluate external providers based on their ability to provide processes, products, or services in accordance with specified requirements. In addition, organisations must retain documented information of these evaluation activities and any necessary actions arising from them.

This requirement ensures that externally provided inputs do not adversely affect the ability of an organisation to consistently deliver conforming products and services to its customers. Under Clause 8.4, control applies across three distinct operational scenarios: when external products and services are intended for incorporation into the organisation's own offerings, when provided directly to customers on behalf of the organisation, or when a process or part of a process is outsourced.

Subclause 8.4.1 replaces legacy terminology from earlier editions of ISO 9001, shifting from purchased products and suppliers to externally provided processes, products, and services from external providers. Annex A.8 confirms that risk-based thinking governs the type and extent of controls applied, allowing organisations flexibility based on potential product impact. Top management must also review trends in external provider performance during management review under Subclause 9.3.2.

Establishing evaluation criteria and selecting external providers

Quality managers and procurement leads must establish clear, objective criteria before selecting or engaging any external provider. Under Subclause 8.4.1, initial evaluation criteria must assess the provider's capability to deliver conforming outputs before commercial contracts are finalised.

Organisations must follow a structured four-step procedure to manage external provider evaluation and selection:

• Determine the category of external provision under Subclause 8.4.1, identifying whether the provider supplies raw materials for product incorporation, delivers services directly to customers, or executes an outsourced process.
• Establish initial evaluation and selection criteria under Subclause 8.4.1 based on product risk, technical capability, quality management system certification, or historical delivery performance.
• Formally evaluate prospective external providers against the established criteria and retain documented information of the approval decision under Subclause 8.4.1.
• Define and communicate purchasing requirements under Subclause 8.4.3 prior to placement of orders, detailing product specifications, approval methods, competence expectations, and required performance monitoring.

Monitoring performance and applying controls in practice

Once an external provider is approved, Subclause 8.4.1 mandates continuous performance monitoring and periodic re-evaluation. Organisations must evaluate data arising from monitoring under Subclause 9.1.3 to determine whether external providers maintain their ability to fulfill requirements.

Subclause 8.4.2 requires organisations to define both the controls applied to the external provider and those applied to the resulting output. The extent of control must account for the potential impact on customer and regulatory requirements, as well as the proven effectiveness of the provider's internal controls.

Practical audit scenario

Understanding how supplier evaluation requirements function during an internal audit requires examining actual operational workflows.

Example

During an internal audit of a manufacturing plant's purchasing department, an auditor samples procurement files for a critical component supplier under Subclause 8.4.1. The auditor observes that while the vendor appears on the approved supplier list, there are no retained records showing initial evaluation or selection criteria.

Further investigation reveals that the supplier caused two recent production line stoppages due to nonconforming dimensions. Under Subclause 8.4.2, the organisation failed to adjust its receiving verification activities or issue corrective action requests under Subclause 10.2.1. The auditor issues a nonconformity against Subclause 8.4.1 for failing to retain documented information of supplier re-evaluation and follow-up actions.

Before your audit

• Verify that documented evaluation and selection criteria are established for all external provider categories under Subclause 8.4.1.
• Confirm that retained documented information exists for initial supplier evaluations and approval decisions under Subclause 8.4.1.
• Check that purchasing information communicated under Subclause 8.4.3 includes explicit approval criteria and competence requirements.
• Review receiving inspection and verification records under Subclause 8.4.2 to verify that incoming controls match product risk.
• Ensure that supplier performance data is analysed and evaluated under Subclause 9.1.3 for delivery and quality trends.
• Confirm that supplier performance trends are presented as input to top management during management reviews under Subclause 9.3.2.
• Verify that corrective actions taken against poorly performing suppliers are retained under Subclause 8.4.1 and Subclause 10.2.1.

Questions people ask

What are the ISO 9001 supplier evaluation requirements?

The ISO 9001 supplier evaluation requirements under Subclause 8.4.1 require organisations to establish criteria for evaluating, selecting, monitoring performance, and re-evaluating external providers based on their ability to supply conforming products and services. Organisations must retain documented information of these evaluations and any necessary follow-up actions.

Is a formal approved supplier list mandatory under ISO 9001:2015?

No, ISO 9001:2015 does not explicitly require a document named an approved supplier list. However, Subclause 8.4.1 mandates that organisations must retain documented information of evaluation, selection, performance monitoring, and re-evaluation activities.

How often must external providers be re-evaluated under Clause 8.4?

ISO 9001:2015 does not specify a fixed time interval for re-evaluating external providers under Subclause 8.4.1. Organisations may determine re-evaluation frequency based on risk, transaction volume, and performance monitoring data gathered under Subclause 9.1.3.

What information must be communicated to suppliers under Subclause 8.4.3?

Under Subclause 8.4.3, organisations must communicate requirements regarding products or services to be provided, approval criteria for products and processes, personnel competence, interactions, performance monitoring, and any planned verification activities.

Reference documents

• ISO 9001:2015 Quality management systems — Requirements