What the clause requires
Clause 8.4 covers everything that comes from outside: purchased materials and components, contracted services and outsourced processes. The organization has to determine criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers, based on their ability to provide processes, products and services in accordance with the requirements, and it has to retain documented information on those activities and on any action arising from them. In other words, the supplier file has to show not only who was approved, but on what basis and what happened next.
The type and extent of control are proportional to the impact on the ability to consistently meet requirements. A provider of a critical raw material may need incoming inspection of every batch, a certificate of analysis and a periodic audit at its premises; a provider of office supplies may need nothing at all. Outsourced processes remain fully within the quality management system and under the control of the organization, which has to define what verification or other activity it will apply to make sure the outsourced process delivers what was agreed.
The organization also has to communicate its requirements to the external provider: the processes, products and services to be provided; the approval of products, methods, processes and equipment; the competence required of the people involved, including any qualification; the interactions with the quality management system; the control and monitoring of performance that the organization will apply; and the verification or validation activities that the organization or its own customer intends to perform at the premises of the external provider. A vague purchase order such as steel plate, 100 pieces, is one of the most common failures in this clause.
What the auditor asks to see
- Criteria for evaluation, selection, monitoring and re-evaluation of external providers, written down and applied
- Record of the evaluation of each relevant provider and of the actions arising from it
- Approved supplier list that purchasing actually uses when placing orders
- Control proportional to the impact, such as incoming inspection, certificates of analysis or supplier audits
- Purchase orders carrying the specification and the requirements communicated to the provider
Where companies most often get it wrong
- Buying from a provider who was never evaluated against any criterion
- Evaluation carried out once, at certification time, and never repeated
- Provider with poor performance kept on the approved list with no action taken
- Outsourced process with no defined control and no verification at all
- Purchase order issued with no technical specification and no acceptance requirement
Example of a nonconformity
- Requirement
- ISO 9001, 8.4.1: retain documented information of the evaluation and re-evaluation of external providers and of any actions arising from those activities.
- Evidence
- The heat treatment provider, an outsourced process, had 5 batches returned between January and June 2026; the last recorded evaluation dates from 2024 and there is no record of any action taken about current performance.
- Finding
- The performance of the external provider is neither monitored nor re-evaluated.
How to comply using PrismaBiz
Ready-made templates for this clause
Frequently asked questions
Does every supplier have to be evaluated?
Only those providing processes, products or services that affect conformity of what the organization delivers. Providers with no impact on quality can be left out, as long as the criterion for that decision is defined and consistent.
How often should providers be re-evaluated?
The standard does not set a frequency. Annual or half-yearly re-evaluation is common, plus an immediate review whenever something relevant happens, such as a rejected batch or a serious delay.
Does an ISO 9001 certified supplier still need evaluation?
Certification does not remove the obligation, but it can be one of the criteria that reduces the extent of control applied. The organization remains responsible for monitoring actual performance.