ISO & compliance · Guide
ISO 9001 supplier evaluation for small businesses
ISO 9001 asks you to control what you buy in: choose suppliers against criteria, check they keep delivering, and keep a record of it. For a small business that can be simple, as long as it is done consistently.
Updated · Nexus Digital Ireland
What ISO 9001 asks of suppliers
In ISO 9001:2015, clause 8.4 covers the control of externally provided processes, products and services: anything a supplier provides that affects what you deliver to your customers. You decide how much control each supplier needs, based on how much it can affect your product or service.
In short, the clause expects you to set criteria for evaluating, selecting, monitoring and re-evaluating suppliers, to apply them, and to keep records of the results and any actions that came out of them.
This is a plain-English summary, not the text of the standard. Your certification body and the standard itself are the reference for your organisation.
Setting evaluation criteria
Criteria should reflect what matters for your customers. Common ones for small businesses are:
- Quality: are goods or services right first time, and are complaints or returns low?
- Delivery: do they arrive on time and in full?
- Price and value: are prices stable, and do invoices match what was agreed?
- Responsiveness: how quickly are problems sorted out?
- Compliance: insurance, certifications, health and safety, and data protection where relevant.
Keeping an approved supplier list
Most organisations keep an approved supplier list: the suppliers that have been evaluated and can be used, with the date and basis of approval. It is not mandatory in that exact form, but it is the simplest way to show that purchasing follows your criteria.
- Evaluate before first useRecord why the supplier was chosen and who approved it.
- Monitor while you use themNote late deliveries, quality problems and price changes as they happen.
- Re-evaluate on a scheduleReview key suppliers at least yearly against your criteria, and record the outcome.
- Act on problemsAgree improvements with the supplier, increase checks, or move to an alternative, and record the decision.
Making it easy to keep up
The best evidence is created as you work, not written up before the audit. If late deliveries, quality issues and price changes are recorded against the supplier when they happen, the yearly re-evaluation becomes a short review of facts you already have.
Common gaps found at audit
- Suppliers in regular use that are not on the approved list.
- Re-evaluations that are overdue, or that record a score without any facts behind it.
- Supplier problems handled by email with nothing recorded against the supplier.
- Criteria in the procedure that nobody actually uses.
How the Operations Register supports ISO 9001 supplier control
The Nexus Business Operations Register gives you an approved supplier list that maintains itself as you buy. Nexus does not award certification.
- Supplier records with status from proposed to approved to exited, a named owner and the evidence behind each decision.
- Supplier reviews with a decision, the reviewer and the date.
- Price changes against earlier invoices are flagged, so re-evaluation has facts behind it.
- Purchase approvals and invoices linked to each supplier, ready for the auditor.
Questions
Which ISO 9001 clause covers suppliers?
Clause 8.4 of ISO 9001:2015, control of externally provided processes, products and services.
Is an approved supplier list mandatory?
The standard does not require a list by that name, but you must show that suppliers are evaluated, selected and re-evaluated against criteria, and an approved supplier list is the usual way to show it.
How often should suppliers be re-evaluated?
You set the frequency based on the supplier's impact. Many small businesses re-evaluate key suppliers once a year and sooner if problems arise.
What records should we keep?
The criteria you use, the results of evaluations and re-evaluations, and any actions that came out of them.
Related guides
ISO audit evidence checklist for supplier management
Most audit stress comes from evidence that exists somewhere but cannot be found quickly. This checklist lists the supplier evidence auditors commonly ask for, so you can keep it ready as you work.
Read the guide →ISO 27001 supplier security: what auditors expect
ISO 27001 expects you to know which suppliers can affect your information security, to agree security terms with them, and to keep checking. Auditors look for evidence that this happens, not just a policy that says it should.
Read the guide →