We use essential cookies to make the site work and, if you allow it, aggregated analytics cookies to improve the content. We do not use marketing cookies.
Clause 8.4 requires controlling suppliers and outsourced processes. An annual form no longer meets the bar. Here's what actually works.
ISO 9001:2015 clause 8.4 was among the most strengthened in the 2015 revision. It requires controlling externally provided products, services and processes when they affect own-product conformity. Most companies still rely on an annual evaluation form. Seasoned auditors spot it in minutes.
Three sub-requirements:
The critical point is 8.4.2: a Tier 1 supplier can't have the same control as the stationery provider.
Three levels work well:
Critical. Failure stops production or impacts product safety. Typically single-source components, regulated services (calibration, NDT), outsourced special processes (welding, heat treatment).
Important. Failure impacts quality or timeline but alternatives exist. Standard raw materials with second sources, major-maintenance services.
Non-critical. Failure doesn't affect the QMS. Stationery, catering, general cleaning.
80% of the 8.4 effort goes to critical and important suppliers. The rest needs minimum documented control.
An annual form isn't an evaluation. Initial evaluation of a critical supplier typically includes:
This evaluation takes 2 to 6 weeks by criticality. It's not done by email.
Control level during the relationship must be proportional:
Typical KPIs: on-time delivery, dimensional conformity, complete documentation, nonconformity response.
Clause 8.4.3 requires communicating expectations. Documents that must exist:
Without these, 8.4.3 isn't met, even if the supplier delivers well.
Process outsourcing (not just product purchase) has additional requirements. Galvanizing, painting, testing, calibration done off-site is an outsourced process. The standard requires equivalent control to internal: process validation, operator competence, execution records.
Classify your top 20 suppliers as critical/important/non-critical. For critical ones, verify you have updated clause 8.4.3 documents. If more than two don't, that's the silent risk that will appear in the next external audit.
Clause 8.5.2 requires identification and traceability. If you rely on Excel, you'll fail an automotive or pharma audit. Here's the replacement.
Clause 8.5.1 requires operational control. A well-written SOP is just the start. The next leap is automated recording from the ERP.
Clause 7.4 requires communicating what matters about the QMS. Internal email doesn't work. Here's how to build channels that actually land.