Your products and services are only as good as the suppliers behind them. Clause 8.4 of ISO 9001 requires you to control externally provided processes, products and services: decide the criteria for choosing suppliers, evaluate them, monitor how they perform and act when they fall short. ISO 14001, 45001 and 27001 add environmental, safety and information security angles.
Which suppliers to control
Focus on suppliers whose products or services affect what you deliver to customers, or your compliance: materials and components, subcontractors, calibration, transport, IT and cloud services, and outsourced processes. Office supplies rarely need more than a light touch.
Setting criteria and approving
- Quality: certification (such as ISO 9001), samples, references, a site visit for critical suppliers.
- Capability and capacity: can they meet your volumes and lead times?
- Compliance: insurance, health and safety, environmental and data protection arrangements.
- Financial stability for suppliers you depend on.
- Record the decision and the evidence, and keep an approved supplier list with the scope each supplier is approved for.
Monitoring performance
Measure what matters: on-time delivery, quality rejects, responsiveness, and any nonconformities raised. Review critical suppliers at least annually and score them against your criteria. Report supplier performance to the management review, which ISO 9001 requires.
When a supplier falls short
- Raise a supplier nonconformity and ask for root cause and corrective action.
- Increase checks on incoming goods until performance recovers.
- Put the supplier on conditional approval, or remove approval, and record why.
Frequently asked questions
Do all suppliers need to be ISO 9001 certified?
No. Certification is one piece of evidence. Many good small suppliers are not certified; evaluate them on samples, history, references and performance instead.
How often should suppliers be re-evaluated?
Critical suppliers at least annually, others less often, and any supplier immediately after a significant problem.
What about subcontractors working on site?
They are suppliers too, but working on your premises brings health and safety duties. See our contractor management guide.
This guide is general information for UK businesses, not legal advice. Check the current regulations and HSE guidance at hse.gov.uk, and take professional advice for your situation.