Supplier evaluation under ISO 9001
A supplier who delivers late or delivers the wrong thing can affect your customer directly. ISO 9001:2015 therefore asks you to control external providers in a way that matches the risk. In practice, this is set out in clause 8.4. The official ISO page on ISO 9001 describes the quality management system. The requirements page explains the place of external providers in chapter 8. You can also read how to check your findings with an internal audit.
A supplier evaluation is more than a tick mark for “certified”. First you decide what you need from a supplier. Then you collect data on performance. Finally, you decide what to do with the outcome. The depth can vary: an office supplies vendor needs a different approach from a subcontractor who installs a safety-critical part.
Do you buy laboratory testing or calibration? Then check the ISO 17025 accreditation scope. That shows whether the measurement you order falls under accreditation.
1. Keep a supplier register that stays workable
Start with all external parties that affect your product or service. Include outsourced processes too. For each supplier, record at least the following:
| Field | Practical content |
|---|---|
| Supplier and service | Name, product or outsourced process |
| Criticality | Low, medium or high, with a short reason |
| Selection criteria | Requirements for quality, capacity, delivery or expertise |
| Owner | Who manages the relationship and monitors performance? |
| Evidence | Quote review, trial delivery, certificate, report or contract |
| Next evaluation | Date or trigger for re-evaluation |
Only put information in the register that someone also uses. A long list without an owner or a next step does little to help during an audit. The ISO/IAF guidance on external providers lists an up-to-date list of approved external providers as possible evidence. However, the right level of control depends on your organisation and risks.
2. Choose criteria that match the risk
Do not use a standard score for every supplier. For each category, ask: what could go wrong, and what evidence gives confidence that it will not?
| Risk level | Example | Suitable criteria and checks |
|---|---|---|
| Low | Printing and office supplies | Price, lead time, order history |
| Medium | Packaging material | Specifications, samples, deviations, delivery reliability |
| High | Critical component or outsourced process | Competence, capacity, traceability, release and incident follow-up |
Ask for a certificate where it is relevant, but treat it as one signal only. A certificate does not automatically prove that the supplier understands your specification or that current deliveries meet it. So also check orders, goods-in inspections, complaints and changes to the process.
Example (fictional): installation company Noordlicht buys a control module from two suppliers. The module determines how a complete installation works, so it is classed as “high”. For the first order, Noordlicht checks a trial delivery, the product specification and the test record. For the second supplier, an old copy of an ISO 9001 certificate is not enough. Noordlicht asks for the current scope and mainly checks the measurement reports it receives.
3. Evaluate performance with data
Agree in advance which signals you will track. Choose a few that support decisions, for example:
- percentage of deliveries on the agreed date;
- number of deviations per delivery or project;
- speed and completeness of responses to complaints;
- quality of certificates, reports or release records;
- effects of changes to product, process or staffing.
Record the source and period next to each score. “Good” without evidence is not useful. A dashboard can be the source, but for important decisions also keep the underlying order, goods-in check or complaint.
4. Re-evaluate and take action
Plan a periodic evaluation, but also link it to events. A major change, a recurring deviation, a new outsourcing arrangement or an incident can be a reason for an interim evaluation. Then decide on a suitable action: accept, add a goods-in check, set up an improvement plan, block temporarily or qualify a second supplier.
An action is only complete once you have checked that it works. So record an owner, deadline, expected result and date of the effectiveness check. The page on nonconformities and improvement helps you record the cause and follow-up separately.
Removing a supplier from your register without assessing the consequences can create a risk in itself. Record how you manage open orders, alternatives and customer agreements.
Frequently asked questions
Is a supplier certificate mandatory?
No. ISO 9001 does not require a universal supplier certificate. You choose which requirements and checks you need to gain confidence in the products, services or processes you receive.
How often should you evaluate suppliers?
There is no fixed frequency that suits every company. Base it on risk, performance and changes. A critical supplier may need monitoring more often than a supplier with little effect on the end result.
Which records will an auditor ask for?
An auditor usually wants to follow how you select suppliers, what you expect from them, how you monitor their performance and what you do when there are deviations. A current register with linked evidence makes that chain visible.
Related links
Sources
- ISO 9001:2015, official standard page : ISO, accessed 5 September 2026
- ISO/IAF APG, External Providers : practical audit guidance, not standard text
- NEN, ISO 9001 quality management : Dutch standards information