Supplier Qualification in ISO 9001: Beyond the Approved Supplier List

2026-10-04

Executive Summary

• An approved supplier list is a starting point, not a process. What an auditor wants to see is the basis: why this supplier is on the list, and when it was last re-evaluated.
• Clause 8.4 of ISO 9001:2015 asks the organization to determine and apply criteria for evaluation, selection, performance monitoring and re-evaluation of external providers, and to retain evidence.
• Not every supplier needs the same level of control. A practical approach is to tier by risk: a raw-material supplier affecting product safety is different from an office-supplies vendor.
• The scope is wider than “material suppliers”: outsourced processes, test laboratories, calibration and pest control all fall within it.
• An eQMS can connect evaluation, performance, nonconformities and the re-evaluation schedule, but it won’t judge which supplier is trustworthy.

A list exists. Where’s the basis?

An auditor looks at a plant’s approved supplier list. Thirty names, approval dates, signatures.

They pick a packaging-material supplier and ask: “On what basis was this supplier added to the list? When was the last re-evaluation? How was their delivery performance last year?”

Purchasing opens email, quality searches a spreadsheet, and twenty minutes later the full answer still hasn’t come together.

The list exists. But a list only says who has been approved. It doesn’t say why, or whether they still qualify. That’s the gap between a list and a supplier evaluation process.

What clause 8.4 requires

A word on terminology first: “supplier qualification” is the common name in practice, but ISO 9001:2015 speaks of externally provided processes, products and services and calls suppliers “external providers.” This article uses the common term, in the sense of clause 8.4.

The statements below are based on ISO 9001:2015, clause 8.4, summarized in practical terms.

General (8.4.1). The organization must ensure that externally provided processes, products and services conform to requirements. Controls must be determined when external products or services are incorporated into the organization’s own offering, when they are provided directly to customers on the organization’s behalf, or when a process or part of one is outsourced by the organization’s decision.

The organization must determine and apply criteria for the evaluation, selection, monitoring of performance and re-evaluation of external providers, based on their ability to provide to requirements. It must retain documented information of these activities and of any actions arising from the evaluations.

Type and extent of control (8.4.2). Control must ensure external processes don’t adversely affect the ability to consistently deliver conforming products, remain within the control of the quality management system, and are proportionate to potential impact and the effectiveness of controls the provider itself applies. The organization also determines the verification activities needed.

Information for external providers (8.4.3). The organization must communicate requirements: the product, service or process to be provided; requirements for approval (products, methods, equipment, release); required competence, including qualification of people; interaction with the organization; control and monitoring of performance; and verification activities at the provider’s premises where applicable.

Read closely, the standard describes a chain of activities: evaluate → select → monitor → re-evaluate, plus communicating requirements and retaining evidence. A list is only the output of the selection step.

Approved supplier list versus qualification

The difference can be put simply: the list is an outcome; qualification is the process that produces and maintains that outcome.

Across many manufacturing operations, six problems come up often. (A general observation, not measured figures.)

1. The list is built once and never updated. Suppliers were approved years ago and never re-evaluated.

2. The basis for approval isn’t kept. Who decided to add them, based on what, with no record.

3. All suppliers are treated alike. A material supplier in direct contact with product and an office-supplies vendor get the same form.

4. Certificates are treated as enough. ISO 9001 or other certification is useful supporting evidence, but doesn’t replace assessing the ability to meet your specific requirements.

5. Performance data is scattered. Incoming inspection results sit with quality, delivery with purchasing, complaints with sales. Nobody has the full picture of one supplier.

6. Non-material providers are forgotten. Outsourced processing, external test labs, calibration providers, pest control, transport. Clause 8.4 covers processes performed externally, not only materials.

Illustrative example (a composite scenario, not a real customer case): a plant has an approved list of about seventy suppliers. Reviewing before an audit, the quality team finds many suppliers that haven’t delivered in over a year still on the list, some certificates expired, and two suppliers with repeated nonconformities that were never re-evaluated. The list was “complete” but didn’t reflect reality.

Evaluation criteria

The standard asks the organization to set its own criteria, based on the provider’s ability to supply to requirements. There is no universal criteria set. What matters is that criteria are proportionate to risk.

Tiering by risk

The most practical approach is to group suppliers by their potential impact on product quality and safety:

• Critical: materials or services in direct contact with product, affecting safety or key customer requirements, or outsourced processing.
• Standard: supplies and services with indirect effect.
• Low: goods or services with little effect on product quality.

Each tier gets different levels of evaluation and monitoring. Critical may need on-site assessment, samples or trial lots, and more frequent re-evaluation. Low may need only basic confirmation. This fits clause 8.4.2, where the standard asks for control proportionate to potential impact.

Commonly used criteria

• Ability to meet technical requirements: samples, trial lots, capability records.
• The supplier’s quality system: certificates (supporting evidence, not a substitute for assessment), questionnaires, on-site assessment when needed.
• Track record: for existing suppliers, actual delivery and quality data.
• Regulatory and sector requirements: for food, pharma or other regulated sectors, specific certifications and conditions to check beyond ISO 9001.
• Continuity of supply: dependence on a single source for a critical material is a risk worth recording.

The point isn’t a long list of criteria, but that every approval decision has a basis on record.

Performance monitoring and re-evaluation

Initial approval is only the beginning. Clause 8.4.1 asks for performance monitoring and re-evaluation.

Performance monitoring. Commonly used data: incoming inspection results, on-time and in-full delivery, related nonconformities, customer complaints traceable to the supplier, and responsiveness when asked for corrective action. A simple scorecard is often more useful than a complicated scoring system, provided the data is reliable. A caution: scores built on missing or inconsistent data give a feeling of control without substance.

Re-evaluation. Two kinds of trigger:

• By cycle: frequency by risk tier. Critical more often.
• By event: repeated nonconformities, complaints, changes to the supplier’s process, location or ownership, or an expired certificate.

Communicating requirements and changes. Clause 8.4.3 asks for clear communication of requirements to the provider. A useful practice: agree that suppliers will notify you in advance of changes to inputs, process or production site affecting what you buy. Many quality problems begin with changes the buyer didn’t know about.

When a supplier causes a nonconformity. Asking the supplier to analyze the cause and take corrective action should sit in the same flow as handling internal nonconformities; see Nonconformance in ISO 9001: More Than an Error Report and Effective CAPA.

Supplier management in eQMS

To be clear first: an eQMS won’t judge which supplier is trustworthy, and it can’t repair a supplier relationship. If input data is thin or poor, the system just presents it more neatly.

What an eQMS changes is how much supplier management depends on scattered emails and spreadsheets:

Central supplier record. Risk tier, approval status, basis, certificates, agreements, specifications and related documents sit in one place.

Expiry reminders. Certificates nearing expiry and re-evaluation schedules are tracked and flagged ahead of time.

Performance data linked to the source. Nonconformities, incoming inspection results and related complaints attach to the supplier, so the overall picture forms without manual assembly.

Event triggers. When repeated nonconformities exceed a set threshold, the system suggests or requires re-evaluation.

Supplier corrective action requests. Requests sent to suppliers are tracked for deadline and outcome alongside internal records.

Evidence trail. Who evaluated, on what basis, with what result is recorded, answering “where’s the basis?” directly.

A note for smaller companies: with few suppliers, a light, proportionate evaluation process is enough. There’s no need to build a heavy scoring system for a few dozen suppliers, most of which fall in the low tier.

A practical checklist

Use these questions to review your current supplier management.

1. For each supplier on the list, is there a stored basis for approval (assessment, samples, records)?
2. Are suppliers tiered by risk, with different levels of evaluation and monitoring?
3. Do you have defined evaluation criteria, proportionate to the risk tier?
4. Are certificates treated as supporting evidence and tracked for expiry, rather than treated as sufficient?
5. Do you monitor performance (quality, delivery, nonconformities, complaints) with reliable data?
6. Is there a re-evaluation schedule by cycle and event triggers (repeat failures, changes, expired certificates)?
7. Are requirements clearly communicated to suppliers, with an agreement to notify changes in advance?
8. Are process providers (outsourced processing, testing, calibration, pest control) included in the evaluation system?
9. When a supplier causes a nonconformity, is there a corrective action request tracked for deadline and outcome?
10. Is the list reviewed periodically to remove suppliers that are inactive or no longer qualify?

If three or more answers are “no” or “not sure,” the issue likely lies in treating the list as the process.

A note on ISO 9001 editions

This article refers to ISO 9001:2015. According to certification bodies, a revised ISO 9001:2026 was scheduled for publication in September 2026, with a transition period expected to run about three years and 2015 certificates remaining valid during it. Clause structure and wording may change; check against the edition your organization is certified to.

Is your supplier list the outcome of a process, or just a list?

→ Take the Knowledge Management Maturity Assessment to identify your maturity level and the first improvement to make.

Further reading:

• Training Records vs. Employee Competence: What ISO 9001 Clause 7.2 Actually Requires (previous)
• ISO 9001 Clause 6 Risk Management: What’s Actually Required (next)
• Evidence-Based AI: When Answers Need to Be Verifiable (related)
• eQMS for Manufacturing SMEs: A Practical Guide (pillar)

Sources:

• ISO 9001:2015, clause 8.4 (control of externally provided processes, products and services): iso.org/standard/62085.html
• LRQA, ISO 9001 revision update: Publication date confirmed (certification body source; verify with ISO): lrqa.com

ISO 9001:2015 clauses are summarized in practical language and do not replace the text of the standard; compliance decisions should be checked against the official edition. The example is a composite illustrative scenario based on common patterns in manufacturing SMEs, not a specific customer case. The problems described are general observations, not measured figures. Risk tiering and the criteria mentioned are common approaches, not mandatory requirements of the standard.