Clause 8.4: supplier control without a 40-tab spreadsheet
A minimal, defensible supplier evaluation process for ISO 9001 and ISO/IEC 27001 — and what auditors actually check.
Clause 8.4 of ISO 9001:2015 requires you to determine and apply criteria for evaluating, selecting, monitoring, and re-evaluating external providers. What it does not require is a 40-tab spreadsheet that no one updates between audits. The minimum viable supplier control process has four components: a documented selection criterion (what makes a supplier acceptable), an approved supplier list (the output of applying that criterion), a monitoring mechanism (something that generates evidence the supplier is still performing), and a re-evaluation trigger (the condition under which a supplier’s status is reviewed).
Strictly, the standard does not use the phrase “approved supplier list” at all. It asks you to retain documented information about your evaluation, selection, monitoring and re-evaluation activities, and about any actions arising from them. An approved list is simply the most practical way most organisations find to show the result. If yours works differently — approval recorded against each supplier in the purchasing system, say — that is fine, as long as you can show it.
What 8.4 actually asks for
It helps to read the three sub-clauses as a sequence rather than a single block.
- 8.4.1 (General) sets the scope. Controls apply to externally provided processes, products and services that go into what you deliver, that suppliers provide directly to your customers on your behalf, or that make up a process you have chosen to outsource. It is also where the evaluate–select–monitor–re-evaluate requirement and the record-keeping requirement sit.
- 8.4.2 (Type and extent of control) says the controls should be proportionate. You consider the potential impact of the supplier’s output on your ability to meet customer and regulatory requirements, and how effective the supplier’s own controls are, then decide what verification you need. Outsourced processes still have to remain within the control of your management system.
- 8.4.3 (Information for external providers) covers what you tell suppliers: your requirements for the product or service, any approval or release arrangements, competence or qualification you expect, how you will monitor their performance, and any verification you or your customer intend to carry out at their premises. You are also expected to check those requirements are adequate before you send them.
The word that does the most work is “proportionate”, even though 8.4.2 never quite says it. A supplier of office stationery and a supplier of heat-treated components do not need the same level of control, and an auditor who sees you treating them identically will usually conclude that you have not thought about it.
Criticality drives cadence
The cleanest way to make control proportionate is to give every supplier a criticality rating and let that rating decide how often you re-evaluate. Three tiers are enough for most small and mid-size organisations. More than that and people start arguing about the boundaries instead of doing the evaluations.
| Criticality | Typical examples | Re-evaluation cadence | Monitoring evidence |
|---|---|---|---|
| High | Sole-source components, outsourced processes, calibration services, hosting providers holding customer data | Every 6 months, plus on any significant event | Delivery and quality metrics, NCRs raised against the supplier, certificate checks, periodic review meeting notes |
| Medium | Substitutable materials, maintenance contractors, SaaS tools without sensitive data | Annually | Delivery and quality metrics, any issues logged |
| Low | Stationery, catering, general consumables | Every 2–3 years, or on event | Confirmation that the supplier is still in use and no issues have been logged |
These intervals are a starting point, not a rule from the standard. ISO 9001 does not prescribe any frequency. What matters is that you have written down how criticality is decided, that each supplier has a rating, and that your records show evaluations happening at roughly the interval you set. An auditor will test the last part by picking a high-criticality supplier and asking to see the most recent two evaluations.
The rating criteria should be short. Something like: does the supplier’s output go directly into the product or service? Is there a ready alternative? Would a failure affect customer or regulatory requirements? Does the supplier handle information you need to protect? Two or more “yes” answers and the supplier is high; none and it is low.
What auditors check
Auditors check three things with consistency. First, does your approved supplier list actually reflect the suppliers you use? Discrepancies between the list and your purchase orders are the most common finding. Second, can you demonstrate that monitoring happened — not that you have a policy saying it should? A completed quarterly scorecard, a record of a supplier corrective action request, an email chain documenting a delivery issue and its resolution — all of these are monitoring evidence. A blank monitoring template is not. Third, when a supplier performance event occurred, did you re-evaluate? The standard does not require you to drop a supplier for one missed delivery, but it does require you to document that you considered the event against your criteria.
The first check is easy to run yourself before the auditor does. Export the last six months of purchase orders, take the list of distinct supplier names, and compare it with your approved list. Expect three kinds of gap:
- Suppliers in use but not on the list. Often a one-off purchase that became regular, or a supplier a new buyer brought with them.
- Suppliers on the list but no longer used. Not a nonconformity in itself, but it makes the list look unmaintained. Mark them inactive rather than deleting them, so the history survives.
- Name mismatches. The same company under a trading name in one system and a registered name in another. Harmless, but it slows down sampling during the audit and invites more questions.
The third check — re-evaluation after an event — is where the link to your nonconformity process matters. If goods-in rejected a batch and raised an NCR against the supplier, there should be a visible line from that NCR to a note on the supplier record saying what you decided. “Reviewed, one-off, no change to status” is a perfectly good outcome. Silence is not.
The ISO/IEC 27001 overlay
If you also run an ISO/IEC 27001:2022 management system, supplier control picks up four Annex A controls:
- A.5.19 — information security in supplier relationships: a defined process for managing the security risks that come with using suppliers’ products or services.
- A.5.20 — addressing information security within supplier agreements: the relevant security requirements written into the contract or agreement.
- A.5.21 — managing information security in the ICT products and services supply chain.
- A.5.22 — monitoring, review and change management of supplier services: checking that suppliers keep meeting those requirements, and managing changes to what they provide.
There is no need for a second supplier register. Add an information-security dimension to the same criticality rating — does this supplier store, process or have access to information within your scope? — and record the extra evidence against the same supplier. For a hosting provider that might be a current certificate or assurance report, a note that you reviewed it, and confirmation that the contract includes the security clauses you require. One register, one cadence, two standards satisfied. Your Statement of Applicability then points at the same process for A.5.19–A.5.22.
A three-tab version that works
The simplest compliant implementation is a shared document with three tabs: the criterion rubric, the current supplier list with evaluation dates, and a log of monitoring activities. If your team will actually maintain that document, it is more defensible than an elaborate system that atrophies between registrar visits.
In practice the three tabs look like this:
- Rubric: the criticality questions, the tier each combination produces, and the re-evaluation interval for each tier. Half a page.
- Supplier list: name, what they supply, criticality, status (approved, conditional, inactive), date of last evaluation, date next evaluation is due, owner.
- Monitoring log: date, supplier, what happened (delivery late, batch rejected, certificate renewed, review meeting held), and what you decided.
Sort the supplier list by “next evaluation due” once a month and you have a working re-evaluation trigger. Add a rule that any NCR raised against a supplier creates a log entry, and you have the event-driven trigger too. That is the whole process. It will not impress anyone, but it will survive an audit, which is the point.
If the spreadsheet starts to strain — usually once you are tracking a few dozen active suppliers across both standards — StayEvident’s supplier register holds the same information, uses each supplier’s criticality to set its periodic-evaluation cadence, and keeps evaluations and performance metrics against the supplier record. The registers documentation covers how it is set up.