Clause 8.4 of ISO 9001:2015 broadened the former “purchasing” clause to cover all externally provided processes, products, and services — including suppliers, subcontractors, and outsourced processes. The standard requires organizations to ensure that externally provided outputs conform to requirements.
8.4.1: General
Ensure that externally provided processes, products, and services conform to requirements. Apply specified controls when products and services from external providers are intended for incorporation into the organization’s own products and services, are provided directly to customers on behalf of the organization, or a process or part of a process is provided by an external provider as a result of a decision by the organization (outsourcing).
Determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers. Retain documented information of these activities and any actions arising from the evaluations.
8.4.2: Type and Extent of Control
Ensure that externally provided processes remain within the control of the QMS, define both the controls to be applied to the external provider and those to be applied to the resulting output, consider the potential impact of the externally provided outputs on the organization’s ability to consistently meet customer and regulatory requirements, and consider the effectiveness of controls applied by the external provider.
8.4.3: Information for External Providers
Communicate to external providers the requirements for the processes, products, and services to be provided, approval of products, methods, processes, and equipment, competence of persons, the provider’s interactions with the organization, control and monitoring of performance, and verification or validation activities.
Best Practices
- Maintain an approved supplier list with evaluation criteria and scores
- Conduct periodic supplier performance reviews using quality metrics (on-time delivery, defect rate, responsiveness)
- Include quality requirements in purchase orders and contracts
- Perform incoming inspection or verification proportionate to risk
- Communicate requirements clearly and verify understanding
- Re-evaluate suppliers at planned intervals or after significant nonconformities
Common Pitfalls
- Not controlling outsourced processes with the same rigor as internal processes
- Evaluating suppliers only at onboarding without ongoing performance monitoring
- Communicating incomplete or ambiguous requirements to suppliers
- Not adjusting controls based on the criticality of externally provided outputs
Related Ecesis Solutions
Document Management
Version-controlled procedures and records
Audits & Inspections
Schedule, conduct, and track audit findings
Nonconformity Tracking
Report, investigate, and resolve nonconformities
Training Management
Track competence requirements and records
Change Management
Structured review of planned changes
Compliance Obligations
Track requirements and evaluation schedules
