ISO 9001 clause 8.4, external providers: what supplier control has to show, and why the approved supplier list is where most audits find it
Written from the auditor's side of the table. Clause numbers are pointers; the wording is ours, not the standard's. Last checked against the published ISO 9001:2026 text: October 12, 2026.
Every plant has an approved supplier list. Very few can show how a supplier got onto it, what would get one off it, or when it was last looked at. Clause 8.4 asks for those three things and for a fourth that most systems skip: a decision about how much control each supplier needs, based on what happens if they fail. This page walks the clause, the evidence, and a method that runs on data instead of the last bad experience.
What clause 8.4 requires
| Sub-clause | In plain words |
|---|---|
| 8.4.1 General | Make sure what you buy in, and what others do on your behalf, conforms. The clause applies in three cases: things that go into your own product, things a provider delivers straight to your customer in your name, and processes you have handed to someone else. Set criteria and use them for evaluating, selecting, monitoring and re-evaluating providers, judged on whether they can deliver what you require. Keep records of those activities and of any actions that came out of them. |
| 8.4.2 Type and extent of control | Outsourced processes sit inside your system's control; handing a process out does not hand out responsibility for it. Decide the controls you will apply to the provider and the controls you will apply to what they deliver. Size those controls by the potential impact on your ability to meet customer and regulatory requirements, and by how effective the provider's own controls are. Decide what verification or other activity is needed to be sure the requirement is met. |
| 8.4.3 Information for external providers | Check your requirements are adequate before you send them. Then communicate, as appropriate: what is to be provided; how products, services, methods, processes, equipment and releases get approved; the competence and qualifications required; how the provider is expected to deal with you and, where it applies, with your customers and other interested parties; how you will control and monitor their performance; and any verification you or your customer intend to carry out at their premises or elsewhere. |
The clause is a loop, not a list. Evaluate, select, monitor, re-evaluate. An approved supplier list is the output of the first two steps. Most findings come from the second two: nobody monitored, and nobody re-evaluated.
What changed in 2026
Wording, mostly. The outsourced-process sentence was rewritten from "remain within" to a plain present tense, which reads as a standing obligation rather than a leftover one. The information clause gained a new item: how the provider interacts with you and, where it applies, your customers and other interested parties. Verification can now be stated as taking place at the provider's premises or another location. The record requirements use the edition's available-as-evidence phrasing, and external provider performance stays an input to management review. The full clause list is on the what changed page.
What an auditor asks for
- The criteria. Written, and applied. How does a supplier get approved, what is measured while they are approved, and what gets them re-evaluated or removed.
- Three suppliers, walked through the loop. A critical one, a routine one, and one added recently. Evaluation record, approval, performance data, re-evaluation date.
- The type-and-extent decision. Why the heat treater gets a certificate on every lot and an audit every two years while the packaging supplier gets a receiving check. If every supplier is controlled the same way, 8.4.2 c) has not been applied.
- Outsourced processes. Which processes are performed by others, and what control your system exercises over them. Calibration, plating, testing and transport are the usual ones nobody thought of as outsourced processes.
- What the provider was told. Purchase order terms, drawings, specifications, quality requirements, the flow-down of your customer's requirements, and the new interaction expectation.
- Performance data that reaches decisions. On-time and quality figures per supplier, the corrective action requests raised, and what happened when a supplier stayed poor.
The findings that come up most
- The list with no criteria. Suppliers approved because they were already there when the system was written.
- No re-evaluation. Approval dates from the certification year; nothing since.
- Same control for everyone. No type-and-extent decision; the critical supplier and the stationery supplier on the same page of the procedure.
- Outsourced processes not identified. Calibration and plating treated as purchases, not as processes inside the system.
- Corrective action requests to suppliers that never close, and poor ratings that never change anything.
- Customer requirements not flowed down. The drawing note on the customer's print never reaches the sub-tier.
Every one of those findings traces back to the same gap: performance was never logged, so nothing could be rated, escalated or re-evaluated. The $5+ Supplier Scorecard is the log, the monthly rating and the SCAR register in one workbook, with escalation computed when a poor rating meets an open request; the Supplier Quality Pack adds the evaluation with a quality override, the approved supplier list with expiry dates, and the re-evaluation that answers the auditor's second question before it is asked.
How to run supplier control on data
- Evaluate with a quality override. Score price, delivery and capability, but let a quality failure fail the evaluation on its own. A supplier cannot score its way past a quality problem.
- Put an expiry date on every approval. Re-evaluation then happens on a date, not after a problem.
- Log performance as it happens, receipt by receipt: on-time measured against the original promised date, not the revised one; rejects with the issue type beside them so a pattern shows before the count does.
- Score it monthly on a weighting you have written down, and let the scorecard escalate on its own: a poor rating meeting an open corrective action request is the trigger for a call, a visit, or a second source.
- Decide type and extent once per supplier and write the decision down: certificate, receiving inspection, source inspection, audit, or trust with monitoring. Review it at re-evaluation.
- Feed the results to management review as the external provider performance input, and take the worst supplier to the top of the risk register if they are single-source.
The tool for this clause: the $5+ Supplier Scorecard, a performance log, a 60/40 rating and a SCAR register, with ESCALATE computed when a poor rating meets an open SCAR. The Supplier Quality Pack adds evaluation with the quality override, the approved supplier list with expiry flags, re-evaluation and the dashboard.
Not sure where your system stands on the 2026 edition?
The free readout asks thirteen questions and gives you your readiness, your timeline to the deadline, and your first three actions. Nothing you enter leaves your browser unless you ask for the optional AI reading.
Run the free readoutSee every toolQuestions
Does ISO 9001 require an approved supplier list?
Not by name. Clause 8.4.1 requires criteria for evaluating, selecting, monitoring and re-evaluating external providers, and records of those activities. A list of approved providers with the evaluation behind each entry is the usual way to evidence it.
How often must suppliers be re-evaluated under ISO 9001?
The clause does not set a period. It requires re-evaluation against your criteria, so you decide the interval and record it. Annual for critical suppliers and at a longer interval for routine ones is common, with an early re-evaluation triggered by poor performance.
What counts as an outsourced process in ISO 9001?
Any process, or part of one, that an external provider performs and that your system depends on: calibration, heat treatment, plating, testing, transport, contract machining, software hosting. Clause 8.4.2 keeps such processes inside your quality management system's control.
What information must be sent to suppliers?
Clause 8.4.3 lists it: what is to be provided; how products, services, methods, processes, equipment and releases are approved; required competence; how the provider is to interact with you and, where applicable, your customers and other interested parties; how you will monitor their performance; and any verification at their premises. Only what is appropriate to the purchase, and checked for adequacy before it goes out.
Do I have to audit my suppliers?
No. Auditing is one option under the type-and-extent decision. What the clause requires is deciding the controls based on impact and on the effectiveness of the provider's own controls, and to determine what verification is needed. For a critical supplier that may be an audit; for a routine one a receiving check may be enough, as long as the decision is recorded.