ISO 9001 Clause 8.4: External Provider Control Guide

What Is ISO 9001 Clause 8.4?

Clause 8.4 of ISO 9001:2015, titled "Control of externally provided processes, products and services," is the part of the standard that governs everything you buy or outsource that touches what your customer receives. It replaced the old "purchasing" clause from the 2008 edition, and the change in title matters. Purchasing sounds like a department. Clause 8.4 is about a risk: someone outside your walls does work that ends up in your product or service, and your customer holds you responsible for the result anyway.

The clause has three subclauses:

8.4.1 General: decide which external providers you rely on, and set criteria to evaluate, select, monitor and re-evaluate them.
8.4.2 Type and extent of control: match the amount of control to the risk the provider creates.
8.4.3 Information for external providers: tell providers exactly what you need from them.

I have come to think that most nonconformities written against this clause come from one misunderstanding. Organizations treat it as "keep an approved supplier list." The standard never asks for a list by that name. It asks you to control the effect that outside providers have on your ability to deliver conforming products and services, and a list is just one way of showing it.

This guide walks through each subclause, shows what an auditor typically looks for, and ends with a checklist you can use against your own system. If you want the wider context first, the purchasing controls and supplier evaluation guide covers the day-to-day mechanics of incoming inspection and supplier scoring.

Which External Providers Does Clause 8.4 Cover?

Clause 8.4.1 names three situations where the clause applies. This is the scope test, and it is broader than most people expect.

Products and services from external providers that are intended for incorporation into your own products and services. Raw materials, components, software libraries, sub-assemblies.
Products and services provided directly to your customers by external providers on your behalf. A freight carrier delivering your product, a field-service subcontractor installing your equipment, a call center answering your customers.
A process, or part of a process, provided by an external provider as a result of your decision. This is outsourcing in the classic sense: heat treatment, calibration, payroll-driven functions that affect delivery, software hosting, sterilization.

Notice what falls outside that list. Office supplies, the cleaning contract and the coffee service usually have no bearing on conformity of your outputs, so they sit outside the scope of 8.4 unless you can show a link. The test I use with clients is simple: if this provider failed completely tomorrow, would a customer notice a change in what they receive? If yes, the provider is in scope.

One more point that gets missed. Clause 8.4 applies to outsourced processes as well as outsourced products, and the standard says in 8.4.2 that those processes must "remain within the control of its quality management system." You can hand off the work. You cannot hand off the accountability. I cover this in more depth in the article on outsourced process control and responsibility.

Clause 8.4.1: What the General Requirements Actually Demand

Clause 8.4.1 has two jobs. The first is a statement of purpose: you must ensure that externally provided processes, products and services conform to requirements. The second is a set of four activities you must perform on external providers, using criteria you define.

The four activities

Activity	What the standard says	What it looks like in practice
Evaluation	Determine and apply criteria for evaluation	Questionnaire, site visit, sample approval, certification review
Selection	Criteria for selection	Documented reasons a provider was chosen over alternatives
Monitoring of performance	Criteria for monitoring	On-time delivery, defect rate, response to corrective action requests
Re-evaluation	Criteria for re-evaluation	Annual or risk-based review of scorecards, audit results, complaints

The criteria must be "based on the external providers' ability to provide processes or products and services in accordance with requirements." In plain terms, you are judging whether they can do the job you need, not whether they are a nice company with a good price.

Documented information in 8.4.1

Clause 8.4.1 requires you to retain documented information of these activities and of any necessary actions arising from the evaluations. That is the one explicit record requirement in the clause. An auditor will ask to see:

How you evaluated a provider you onboarded recently.
How you monitored performance over the last year.
What you did when a provider performed poorly.

The standard does not prescribe a format. A spreadsheet works. A supplier module in an ERP system works. A folder of scorecards works, as long as the evidence of evaluation, monitoring and action is retrievable.

Linking 8.4.1 to the rest of the system

External provider performance is also an input to analysis under clause 9.1.3 (analysis and evaluation) and a required consideration in management review under clause 9.3.2. If your management review minutes never mention suppliers, that is a gap an auditor can write up even if your supplier files are tidy. Poor provider performance should also feed your risk and opportunity planning under clause 6.1, and nonconforming purchased material should flow through clause 8.7.

Clause 8.4.2: How Much Control Is Enough?

Clause 8.4.2 is where the standard stops being a list of tasks and becomes a judgment call. It says you must ensure that externally provided processes, products and services do not adversely affect your ability to consistently deliver conforming products and services to customers.

To do this the clause requires you to:

Ensure externally provided processes remain within the control of your quality management system.
Define both the controls you intend to apply to an external provider and the controls you intend to apply to the resulting output.
Take into consideration the potential impact of the externally provided processes, products and services on your ability to meet customer and applicable statutory and regulatory requirements.
Take into consideration the effectiveness of the controls applied by the external provider.
Determine the verification, or other activities, necessary to ensure that the externally provided processes, products and services meet requirements.

Scaling control to risk

This is a risk-based clause, and that is the right way to read it. A provider of custom machined shafts for a medical device deserves far more control than a provider of shipping cartons. Treating them the same wastes effort on one and under-protects on the other.

Here is a practical way to tier providers:

Tier	Typical provider	Example controls
High impact	Critical components, special processes, outsourced design, sole-source items	On-site audit, first article inspection, quality agreement, certificate of conformance with lot data, tight scorecard thresholds
Medium impact	Standard components, calibration labs, logistics partners	Accreditation review (for example, ISO/IEC 17025 for calibration), receiving inspection by sampling, annual performance review
Low impact	Commodity or non-critical items	Basic onboarding check, complaint-driven review, receiving check against packing slip

You can set the tiers however you like, as long as the reasoning is visible and consistently applied. For more on the thinking behind tiering, the risk-based thinking implementation guide is a useful companion, though it is not on the required reading list for this clause.

Controlling the provider versus controlling the output

The clause distinguishes between controls on the provider and controls on the output, and many systems only do one. Provider controls are things like audits, qualification and approved status. Output controls are things like incoming inspection, testing, certificates and acceptance sampling. A provider with an excellent audit history can still ship a bad lot, and a provider with a poor record can still be managed safely through 100 percent inspection. The standard wants you to think about both and decide what the combination should be.

When the provider's own controls count

The clause explicitly asks you to consider "the effectiveness of the controls applied by the external provider." This is what allows you to reduce your own inspection when a provider has a mature system, for example a supplier certified to ISO 9001 or a sector standard with a strong track record of its own. Certification can support your decision, but the standard does not say a certificate replaces your evaluation. An ISO 9001 certificate tells you a certification body found the provider's system conforming at the time of audit. It does not tell you whether their process for your part is capable.

Customer-directed and regulated sources

Some customers require you to buy from named sources, or regulators require approved providers. In those cases you still apply clause 8.4, but the selection criteria are partly dictated for you. You remain responsible for monitoring and for the controls on the output. If you operate under ITAR or similar flow-down regimes, the ITAR compliance article explains how those obligations layer on top of the quality system.

Clause 8.4.3: What Information Must You Give Providers?

Clause 8.4.3 requires you to ensure the adequacy of requirements before you communicate them to the external provider. That ordering is easy to overlook. A purchase order with the wrong revision of a drawing is a failure of 8.4.3, and it will be your nonconformity even though the provider simply followed what you sent.

You must communicate to external providers your requirements for:

The processes, products and services to be provided.
The approval of products and services, methods, processes, equipment, and the release of products and services.
Competence, including any required qualification of persons.
The external providers' interactions with your organization.
Control and monitoring of the external providers' performance to be applied by you.
Verification or validation activities that you, or your customer, intend to carry out at the external provider's premises.

Where these requirements usually live

Requirement area	Common vehicle
Product and service specification	Purchase order, drawing, specification, statement of work
Approval and release	Quality agreement, first article requirements, certificate of conformance clause
Competence and qualification	Statement of work, qualification requirements for welders, inspectors or technicians
Interaction with your organization	Named contacts, change notification rules, escalation path
Performance monitoring	Scorecard criteria shared in the supplier handbook
On-site verification	Right-of-access clause, customer witness points

A quality agreement is not required by the standard, but for any high-impact provider I find it is the cleanest way to cover all six items in one place. For low-impact providers, the terms printed on the purchase order are usually enough.

The change notification gap

The item that gets neglected most is the provider's interaction with you, especially notification of changes. If a supplier quietly changes a raw material source, a process step or a manufacturing location, you may not find out until a customer complaint arrives. A short clause requiring advance notice of changes closes that gap cheaply, and it ties directly to your change control obligations under clause 8.5.6.

What Auditors Look for in Clause 8.4

Based on how audits of this clause tend to unfold, here are the questions an auditor is likely to follow, in roughly the order they appear:

How do you decide which providers are in scope? (Expect to show your criteria, not a perfect list.)
Show me how you evaluated or selected a recent provider.
How do you monitor performance? Show me the data from the last 12 months.
What happened the last time a provider performed badly?
How do you decide how much inspection to apply to incoming material or outsourced work?
Show me a purchase order and trace its requirements back to the specification.
How does supplier performance reach management review?

The most common weaknesses are consistent. Evaluation happened at onboarding and never again. Monitoring data is collected but nobody acts on it. Outsourced processes are not identified as outsourced in the process map. Purchase orders reference a drawing but not the revision. The article on common ISO 9001 audit nonconformities shows how these typically get written up.

How to Implement Clause 8.4: A Step-by-Step Approach

If you are building or tightening this part of your system, this sequence works for most organizations.

Step 1: Identify every external provision. Walk your process map and mark each place where something comes in from outside or work goes out. Include services that are easy to forget, such as calibration, testing labs, software as a service that supports delivery, temporary labor and transport.

Step 2: Classify by impact. Use the three tiers above or your own. Document the criteria so a new quality manager could apply them the same way.

Step 3: Define evaluation and selection criteria per tier. For high-impact providers, this may include audit or documented capability review. For low-impact providers, a short onboarding form is plenty.

Step 4: Define controls on the provider and on the output. Write down, per tier, what you do to the provider (audit, agreement, certification review) and what you do to what they deliver (inspection, testing, certificates).

Step 5: Standardize the information you send. Review your purchase order template and any quality agreement against the six requirements in 8.4.3. Add a drawing or specification revision control, change notification and right of access where they apply.

Step 6: Set monitoring metrics and thresholds. Choose a small number of measures you will actually act on. On-time delivery, quality acceptance rate and responsiveness to corrective action are usually enough. Define what triggers a corrective action request, a probation status or a requalification.

Step 7: Schedule re-evaluation. Annual works for high-impact providers. Medium and low tiers can follow a longer or event-driven cycle, as long as you say so in your procedure.

Step 8: Feed the results upward. Put provider performance into your analysis under 9.1.3 and into management review. Record decisions and actions.

Step 9: Test it internally. Include external provider control in your internal audit program. Sampling three providers across different tiers and tracing them through the whole cycle will expose gaps faster than reading the procedure. The internal audits page outlines how to structure that kind of trace.

Clause 8.4 Compliance Checklist

Use this as a quick self-assessment. Each item should be answerable with a record or a demonstrable practice.

Scope and criteria (8.4.1)

[ ] A defined method for deciding which providers are in scope
[ ] Documented criteria for evaluation, selection, monitoring and re-evaluation
[ ] Records of evaluation and selection for current providers
[ ] Records of performance monitoring over the last cycle
[ ] Records of actions taken from evaluations

Control (8.4.2)

[ ] Providers classified by potential impact on conformity
[ ] Controls defined for both the provider and the output
[ ] Outsourced processes identified and shown within QMS control
[ ] Consideration of provider's own control effectiveness documented
[ ] Verification activities defined and carried out (inspection, testing, certificates)

Information (8.4.3)

[ ] Requirements reviewed for adequacy before sending
[ ] Specification and drawing revisions stated on orders
[ ] Approval, release, competence and qualification requirements communicated
[ ] Interaction and change notification expectations communicated
[ ] Right-of-access or witness points stated where verification occurs at the provider

System links

[ ] Provider performance included in 9.1.3 analysis and 9.3.2 management review
[ ] Nonconforming purchased items handled under 8.7
[ ] Provider risks considered under 6.1

Common Mistakes and How to Avoid Them

Relying on the approved supplier list alone. A list shows who is approved. It does not show monitoring or re-evaluation. Keep the list if it helps, but make sure the evidence behind it is current.

Treating every provider the same. Uniform controls either bury your team in paperwork or leave your riskiest providers under-managed. Tiering fixes both.

Forgetting service providers. Calibration labs, testing labs, couriers, and software hosts all fall into scope when they affect conformity. Calibration is a good example, because a bad calibration can quietly undermine your measurement traceability under clause 7.1.5.

Collecting data nobody uses. A scorecard that has not changed a decision in two years is a reporting exercise. Tie thresholds to actions.

Sending incomplete or outdated requirements. Revision control on purchase orders is cheap. Fixing a lot built to the wrong revision is not.

Ignoring the customer's view of your suppliers. If your customer requires approval of certain providers or witness points at their premises, build that into your supplier process and your 8.4.3 communication. Smaller organizations in particular benefit from a simple, scalable approach, as discussed in the ISO 9001 for small business guide.

A Note on the 2024 Amendment

ISO 9001:2015/Amd 1:2024 added climate change considerations to clauses 4.1 and 4.2. It did not change the text of clause 8.4. If your external providers are exposed to climate-related risks that could affect supply, such as flood-prone sites or energy-dependent processes, that is relevant input to your context analysis and to the risk thinking behind your provider tiers, but nothing in 8.4 itself became mandatory as a result.

Final Thought

When I review a supplier control process, I ask one question that has nothing to do with clause numbers: if our most important provider quietly started cutting corners next month, how long would it take us to find out? A good answer involves incoming checks, monitoring trends, a way for people on the floor to raise concerns and a provider who is contractually obliged to tell you about changes. A weak answer is "we'd find out from the customer." Clause 8.4 exists to move you from the second answer to the first.

If you want help pressure-testing your external provider controls, you can reach me through Certify Consulting.

Last updated: 2026-10-13

Frequently Asked Questions

What does ISO 9001 clause 8.4 require?

Clause 8.4 of ISO 9001:2015 requires you to ensure that externally provided processes, products and services conform to requirements. You must set criteria to evaluate, select, monitor and re-evaluate external providers (8.4.1), apply controls proportionate to their impact on conformity (8.4.2), and communicate adequate requirements to them (8.4.3). You must retain documented information of evaluation, selection, monitoring, re-evaluation and any resulting actions.

Does ISO 9001 require an approved supplier list?

No. ISO 9001:2015 does not use the term or require a list by that name. It requires documented information showing that you evaluated, selected, monitored and re-evaluated external providers, and that you took action where needed. An approved supplier list is a common way to organize that evidence, but the records behind it are what an auditor will examine.

Do outsourced processes fall under clause 8.4?

Yes. Clause 8.4.1 covers a process, or part of a process, provided by an external provider as a result of your decision. Under 8.4.2 you must ensure the outsourced process remains within the control of your quality management system, and you stay accountable for conformity of the output.

What information must be given to external providers under clause 8.4.3?

You must communicate requirements for the processes, products and services to be provided; approval and release requirements; competence and qualification of persons; the provider's interactions with your organization; how you will control and monitor their performance; and any verification or validation you or your customer intend to perform at their premises. You must also confirm the adequacy of those requirements before sending them.

Is an ISO 9001 certificate enough to approve a supplier?

It can support your decision, since 8.4.2 asks you to consider the effectiveness of the provider's own controls. It does not replace your own evaluation. A certificate reflects the provider's overall system at audit time and does not prove that their process for your specific product is capable.