When the Ever Given ran aground in the Suez Canal in March 2021 and blocked traffic for about six days, a lot of quality managers learned something uncomfortable. Their approved supplier list looked fine, their incoming inspection records were clean, and their certificates were current, yet they had no idea which of their parts were sitting on a ship they couldn't reach.
I have come to think that the last several years were a long, expensive audit of how organizations actually read ISO 9001:2015. Companies that treated the standard as a documentation exercise found out what that was worth. In my experience, companies that used it as a way of understanding their own dependencies tended to recover faster, though that is an observation rather than a measured result. The standard never promised resilience, and it isn't a business continuity standard, but the clauses most people skim past turn out to carry a lot of the weight.
The lessons below are my own inference from these events and from client work, not documented case outcomes, and the Ever Given example is illustrative only. This article walks through what the disruptions of the past several years (the COVID-19 pandemic, the 2021 semiconductor shortage, the Suez blockage, and the Red Sea shipping diversions that began in late 2023) revealed, and how to use ISO 9001 to build the kind of supply chain that bends instead of breaks.
Does ISO 9001 Actually Address Supply Chain Resilience?
Yes, though not by name. The word "resilience" does not appear as a requirement in ISO 9001:2015. What the standard gives you is a set of requirements that, read honestly, force you to look at exactly the things that failed during recent disruptions:
- Clause 4.1 and 4.2 require you to understand external issues and the needs of interested parties, which includes the geopolitical, logistical, and economic conditions your suppliers operate in.
- Clause 6.1 requires you to determine risks and opportunities that need to be addressed so the quality management system can achieve its intended results.
- Clause 8.1 requires operational planning and control, including determining resources needed and controlling planned changes.
- Clause 8.4 requires control of externally provided processes, products, and services.
- Clause 8.5.4 covers preservation, which matters more than people expect when goods sit in a port for six weeks.
- Clause 9.3.2 requires management review inputs that include changes in external and internal issues and the adequacy of resources.
The standard's Annex A.4 discusses risk-based thinking, and clause 0.3.3 places it within the process approach, which is the foundation for everything else. If you want a deeper look at how to make that practical, our guide to risk-based thinking in ISO 9001 covers the mechanics.
ISO 9001:2015 requires that an organization plan actions to address risks and opportunities under clause 6.1.1, but it does not require a formal risk management process. That flexibility is both a gift and a trap, because many organizations used the flexibility as permission to do almost nothing.
What Did Recent Disruptions Reveal About Quality Management Systems?
I see four recurring failures when I look at how organizations fared. None of them is exotic, and all of them are traceable to specific clauses.
Failure 1: The risk register was about the wrong risks
In my experience, most clause 6.1 risk registers I review are full of internal risks: operator error, equipment calibration, document control lapses. Those are real. But a register that has no entry for "single-source supplier in a single geographic region" or "sole carrier on one trade lane" has been written for an auditor rather than for the business.
A register built to survive a certification audit and a register built to survive a port closure are two different documents. Most organizations only had the first one.
Failure 2: Supplier evaluation measured past performance, not future exposure
Clause 8.4.1 requires criteria for evaluation, selection, monitoring of performance, and re-evaluation of external providers. Most companies satisfied this with on-time delivery and defect rate scorecards. Those metrics tell you how a supplier behaved in normal conditions. They tell you almost nothing about what happens when the supplier's own supplier fails, which is what happened to many automotive and electronics manufacturers during the 2021 semiconductor shortage.
Failure 3: Nobody knew the sub-tier
Clause 8.4.2 says the type and extent of control must depend on the potential impact of the external provider on your ability to deliver conforming products. That language is where sub-tier visibility belongs. If a Tier 1 supplier's only source of a critical component sits in one facility, your exposure is that facility, whether or not you ever signed a contract with it.
Failure 4: Substitutions were made under pressure and without control
When parts ran short, many organizations accepted alternate materials, alternate sources, and alternate processes in a hurry. Clause 8.5.6 requires you to review and control changes for production or service provision so continuing conformity is ensured, and clause 8.4.3 requires you to communicate your requirements to external providers, which is where the handling of substitutions needs to be made clear. The pressure to ship made some of those controls a casualty. In my experience, the quality problems that surfaced eighteen months later were often traceable to a decision made in a panic week. That is my observation from client work, not a measured finding.
How Should You Use Clause 6.1 to Build Resilience?
Start by changing the question. Instead of asking "what could go wrong with our quality management system," ask "what would stop us from delivering to our customers for more than two weeks?" That question tends to produce a very different list.
A practical approach looks like this:
- Map your critical products and services. These are the ones where a delivery failure would cost you a customer, violate a regulatory commitment, or create a safety issue.
- Trace each one back to its critical inputs. Include materials, components, software, logistics, and specialized labor.
- Identify single points of failure. A single source, a single geography, a single carrier, a single port, or a single person who knows how to do something.
- Rate the exposure. A simple likelihood and impact scale is enough. ISO 9001 does not prescribe a method, and ISO 31000:2018 offers guidance if you want a more formal approach.
- Decide on actions and record them. Clause 6.1.2 requires that actions be proportionate to the potential impact on conformity of products and services.
The word "proportionate" in clause 6.1.2 matters. Nobody is asking you to dual-source every screw. The standard is asking you to spend your attention where the consequences are greatest.
What Does a Resilient Supplier Control Process Look Like?
Clause 8.4 is where most of the practical work happens. If you already have a supplier management process, the question is whether it was built for normal times or for stressed ones. The table below compares the two.
| Element | Conventional approach | Resilience-oriented approach |
|---|---|---|
| Supplier selection (8.4.1) | Price, quality history, certification status | Adds geographic concentration, financial stability, and sub-tier exposure |
| Monitoring (8.4.1) | On-time delivery and defect rate | Adds lead-time variability, capacity signals, and early-warning communication |
| Type and extent of control (8.4.2) | Uniform across suppliers or based on spend | Based on impact to customer delivery, with critical suppliers receiving deeper review |
| Information to suppliers (8.4.3) | Purchase orders and specifications | Adds expectations on change notification, continuity planning, and sub-tier disclosure |
| Sourcing strategy | Lowest cost qualified source | Qualified secondary source for critical items, with documented trigger points |
| Inventory | Minimum levels driven by cost | Strategic buffers for critical, long-lead, or single-source items |
| Management review (9.3) | Supplier scorecards summarized | Includes external issues, concentration risks, and status of mitigation actions |
If you want a ground-level view of how supplier evaluation and incoming inspection fit together, our article on ISO 9001 purchasing controls, supplier evaluation, and incoming inspection goes into the details.
Qualifying a second source is a quality task
A second source that has never been qualified is not a second source, it is a hope. Clause 8.4.1 applies to every external provider you intend to use, and clause 8.5.1 requires controlled conditions for production and service provision. If your alternate supplier has to be qualified in an emergency, you will be doing first article inspection, process validation, and customer approvals on the worst possible schedule. Qualify it while things are calm, even if you only buy a small percentage from that source.
Contract language is a control
Clause 8.4.3 requires that you communicate your requirements to external providers. For critical suppliers, I would add: notification of force majeure events within a defined number of days, notification of changes in manufacturing location, notification of sub-tier changes for specified components, and an obligation to share a continuity plan on request. These are not exotic asks, and a supplier that refuses them is giving you useful information about itself.
What About Outsourced Processes and Logistics?
Logistics is where many ISO 9001 systems have a gap. Freight forwarders, customs brokers, and carriers are external providers under clause 8.4, yet they are often handled by the logistics department with no quality involvement at all.
When ocean carriers began diverting around the Cape of Good Hope in response to the Red Sea attacks that started in late 2023, transit times on affected routes grew by days or weeks, which meant that shelf-life, temperature exposure, and preservation requirements under clause 8.5.4 suddenly mattered for products nobody had worried about before. A product validated for a transit time of three weeks does not automatically remain conforming after six.
Clause 8.1 requires you to ensure that outsourced processes are controlled, and points to clause 8.4 for how. Responsibility does not transfer with the work: if you outsource a process, you cannot outsource the accountability. For more on how to structure this, see our piece on outsourced process control and responsibility under ISO 9001.
A few questions worth asking about your logistics providers:
- Do you know the routes your critical shipments take, and the alternates?
- Have you reviewed whether your packaging, labeling, and storage conditions hold up under a longer transit?
- Do you have a way to see inventory in transit, and can you identify affected lots if a shipment is delayed or compromised?
- Is traceability under clause 8.5.2 maintained when products move through consolidators or alternate ports?
How Do Management Review and Change Control Fit In?
Clause 9.3.2 lists the required inputs to management review, and two of them are especially relevant: changes in external and internal issues relevant to the quality management system, and the adequacy of resources. In a stable year, management review can be a quick summary of metrics. In an unstable one, it is the single place where leadership is formally required to look at the outside world.
I would encourage you to treat the management review as your standing forum for supply chain exposure. Put the top five concentration risks on the agenda. Ask what has changed in the geopolitical or logistics environment since the last review. Decide on actions and record them under clause 9.3.3 as outputs, with owners and dates.
Change control under pressure
Clause 6.3 requires that changes to the quality management system be carried out in a planned manner, and clause 8.5.6 requires control of changes to production and service provision. A resilient organization decides in advance what a "fast-track" change process looks like, who can approve it, and what the minimum evidence is. Otherwise the fast-track gets invented on the spot and by the people under the most pressure.
One approach I like is a pre-approved alternate material or alternate source matrix, reviewed by engineering and quality during calm periods, with customer approval status noted. When disruption hits, you are executing a plan instead of improvising.
Where Do Other Standards Fit?
ISO 9001 is a quality standard, and it makes sense to be clear about where it stops. Several other documents handle adjacent territory:
| Standard | Focus | How it complements ISO 9001 |
|---|---|---|
| ISO 22301:2019 | Business continuity management systems | Formal business impact analysis, continuity strategies, and exercising of plans |
| ISO 28000:2022 | Security and resilience — Security management systems — Requirements | Requirements for a security management system, including supply chain aspects, which can inform how you address threats to logistics |
| ISO 31000:2018 | Risk management guidelines | A structured approach to the clause 6.1 risk process |
| ISO 9001:2015 | Quality management systems | Supplier control, change control, and consistent delivery of conforming products |
You do not need all of them. Many small and mid-sized organizations get most of the benefit by applying the thinking from ISO 22301 and ISO 31000 inside their existing ISO 9001 processes, without seeking separate certification. If your customers or regulators ask for a certified business continuity system, that is a different conversation.
The 2024 amendment to ISO 9001 (ISO 9001:2015/Amd 1:2024) added a requirement under clauses 4.1 and 4.2 to determine whether climate change is a relevant issue, and whether interested parties have relevant requirements related to it. For supply chains, this has a practical meaning: flooding, heat, and water scarcity at supplier sites are now more clearly part of the external issues you are expected to consider.
What Do Auditors Look For After a Disruption?
Certification body auditors are not going to ask whether you have a perfect supply chain. They will check whether your system does what your documentation says and whether it addresses the requirements. In practice, during a surveillance or recertification audit, I would expect questions along these lines:
- Show me where supply chain risks are identified under clause 6.1, and what actions you took.
- How did you evaluate and approve alternate suppliers during the disruption (clause 8.4.1)?
- How did you control changes in materials or processes made as a result (clause 8.5.6)?
- Where is the evidence that management reviewed this (clause 9.3)?
- What nonconformities arose and what corrective action followed (clause 10.2)?
That last one deserves attention. A disruption is a rich source of nonconformities, and clause 10.2 requires you to react, evaluate the need for action to eliminate the cause, and review the effectiveness of corrective action. An organization that goes through a disruption and records nothing is usually not blessed with perfect execution. More often, it hasn't been paying attention. For the broader audit picture, see the most common ISO 9001 audit nonconformities and how to avoid them.
A Practical 90-Day Starting Plan
If you are not sure where to begin, here is the sequence I would suggest for a typical manufacturing or distribution organization.
Days 1 to 30: See the exposure. List your top 20 products or services by revenue or criticality. Trace critical inputs back one or two tiers. Mark single-source items, single-region dependencies, and single-lane logistics. Add the findings to your clause 6.1 risk register.
Days 31 to 60: Decide where to act. For each high-exposure item, choose one of four responses: accept it, buffer it with inventory, qualify a second source, or redesign around it. Record the decision and the rationale. This satisfies clause 6.1.2 and gives management something concrete to review.
Days 61 to 90: Build the controls. Update supplier agreements for critical providers (clause 8.4.3), define a fast-track change process (clause 8.5.6), add supply chain exposure as a standing management review input (clause 9.3.2), and schedule a tabletop exercise where you walk through a scenario such as a port closure or the loss of a key supplier's facility.
None of this requires new software or a consulting engagement. It requires time, honest conversations with purchasing and logistics, and willingness to write down uncomfortable things.
What Is the Real Lesson?
I think the real lesson is a modest one. ISO 9001 did not fail during these disruptions, and neither did it save anyone. It reflected how seriously each organization took the requirements it was already certified against. The organizations that struggled mostly had a certificate and a risk register that nobody had opened in a year. The ones that did better had used clause 6.1 and clause 8.4 as working tools.
If you do only three things first, make them these: add supply chain exposure (single sources, regions, carriers) to your clause 6.1 risk register, qualify a second source for your most critical items under clause 8.4, and define a fast-track change process under clause 8.5.6 before you need it.
Last updated: 2026-11-03
Frequently Asked Questions
Does ISO 9001 require a supply chain risk management process?
Not by name. ISO 9001:2015 clause 6.1 requires you to determine risks and opportunities and plan actions proportionate to their potential impact, and clause 8.4 requires control of external providers. It does not prescribe a formal risk method, so supply chain risk is addressed through how seriously you apply those clauses.
Which ISO 9001 clauses matter most for supply chain resilience?
Clauses 4.1 and 4.2 (external issues and interested parties), 6.1 (risks and opportunities), 8.4 (control of externally provided processes, products and services), 8.5.4 (preservation), 8.5.6 (control of changes), and 9.3.2 (management review inputs) carry most of the weight.
Is ISO 22301 required if I am certified to ISO 9001?
No. ISO 22301:2019 is a separate business continuity management standard. Many organizations apply its ideas, such as business impact analysis and exercising plans, within their ISO 9001 system without seeking separate certification, unless a customer or regulator requires it.
How should I control supplier changes made during a disruption?
Apply clause 8.5.6 and clause 8.4.3. Define in advance a fast-track change process with named approvers and minimum evidence, qualify alternate sources before you need them, and record the changes so you can trace affected lots if problems appear later.
Did the 2024 amendment to ISO 9001 change anything about supply chains?
ISO 9001:2015/Amd 1:2024 added a requirement in clauses 4.1 and 4.2 to determine whether climate change is a relevant issue and whether interested parties have climate-related requirements. This makes physical climate risks at supplier sites, such as flooding or heat, more clearly part of the external issues you consider.
Jared Clark
Principal Consultant, Certify Consulting
Jared Clark is the founder of Certify Consulting, helping organizations achieve and maintain compliance with international standards and regulatory requirements.