ISO9001 and the control of externally provided processes, products & services

ISO9001:2015 takes a fairly decent step forward in how it handles or rather requires you to handle your Supplier Management within your Quality Management System. It used to be that you just needed a list of your suppliers and to be honest not too much else, it's changed a bit from that. Clause 8.4 is all about the new requirements on organisations to deal with processes, products and services that are provided to your organisation by an external provider, the responsibility to ensure they meet your requirements isn't theirs, it's yours.

  Clause 8.4.1 – The General requirement

The general requirements of the clause which is outlined in ISO9001:2015 clause 8.4.1 require the organisation to determine what the controls are that need to be applied to the external supplier to ensure that their process, product or service meets your requirements. This means as we have highlighted you as the purchasing organisation need to make sure that what your supplier provides you meets the needs that your end customer has placed on you, that means you need to set some rules and be able to check for compliance.

The clause it says starts of "the organisation SHALL determine the controls to be applied to externally provided processes, products and services when"

Did you spot that SHALL statement, that means it's not optional, you can't gloss over it you must do it and here is the kicker, you need to have documented evidence to prove you did it.

What you need to do 

The requirement of this section is that you need to determine the criteria that you will use to evaluate your suppliers in terms of initial selection, their on going use by way of a monitoring of their performance and from time to time re-evaluate them based on your requirements that you set out for the supplier when you started working with them. So what does this mean in practice, well you need to develop a selection criteria for your suppliers, the trick here is to try and keep it as simple and common as possible, things like:

• Do they have the technology (now & in the future) to deliver a quality process, product or service?
  
• Are they responsive to your needs when you need them?
  
• How is their delivery performance?
  
• Can you integrate into your systems?
  
• Do they have a lean system?
  

There are many more, but you get the idea.

You may use the same criteria that you used for selecting the service provider while you are working with them or you may adopt a whole new set, you would obviously fully disclose these things up front.

Where the supplier can't meet your requirements then the standard actually requires you to take action with the supplier to rectify this. This may mean that you raise improvement notices on them and evaluate their solutions for improvement, ideally you would work with them closely to help solve the problems since it is a shared problem after all.

Summary 

The Update of the requirements for ISO9001:2015 for controlling externally provided processes, products & services requires the organisation to have a really robust system for selecting and evaluating your suppliers, one that can be repeated and documented all the way through. The ownership of the quality output from your suppliers system rests with your organisation and as such it's important to build real partnerships with your suppliers and help them improve since ultimately this will lead to improvements in your organisation.