ISO 9001 Clause 8.4: Control External Providers

What clause 8.4 requires in practice

Clause 8.4 gathers three related expectations about outside work that touches your products and services. First, externally provided processes, products and services must conform to requirements, and the organisation determines the controls it will apply when outside outputs are built into its own offering, supplied straight to customers for it, or when a process or part of one is performed externally. Second, those controls must be proportionate: the clause requires the organisation to consider the effect of external provision on its ability to deliver consistently, the controls it applies to the provider and to what is supplied, and the verification needed. Third, the organisation communicates adequate requirements to the provider, covering what is to be supplied, approvals, competence, interaction, monitoring and any verification planned at the provider's location.

The subclauses follow this sequence, from evaluating providers, through setting type and extent of control, to giving providers clear information.

8.4.1: identify the external contribution

The provisions apply when external outputs are incorporated into the organisation's products or services, delivered directly to customers on its behalf, or used to perform an outsourced process or part of a process. A provider can therefore be more than a materials supplier. Subcontracted customer support, inspection or software development may need consideration.

Establish criteria for evaluating, selecting, monitoring and re-evaluating providers based on their ability to meet requirements. Retain the required information on those activities and necessary actions. Being on an approved list is a current management decision that needs a basis; it is not permanent proof that all future work will conform.

Why control of external providers matters to the business

Customers judge you by what they receive, not by who produced it. When a subcontractor, supplier or outsourced team falls short, the reputational and financial consequence lands on you. Modern organisations rely heavily on outside parties for components, software, logistics, support and specialist work, so the quality of those relationships is often the largest uncontrolled risk in the management system. Sensible control reduces failures, avoids duplicated checks on low-risk items and focuses effort where it matters. Audit teams commonly sample providers and expect to see why each was chosen, what was asked of it and how performance is followed.

How to implement clause 8.4

Start with an accurate picture of what is outsourced, then match control to risk rather than treating every supplier alike. Where several sites or departments purchase independently, agree one shared method so that the same provider is not judged differently in different places, while still allowing local detail where risks differ.

1. List external providers and the processes, products or services they supply, including less obvious ones such as contractors and cloud-based services.
2. Rank them by the effect they could have on customer requirements, legal compliance and consistent delivery.
3. Define criteria for evaluating, selecting, monitoring and re-evaluating providers, with stricter criteria for higher-impact work.
4. Choose controls over both the provider and the supplied output, such as inspection, sampling, audits, performance reviews or acceptance tests.
5. Prepare clear purchasing information and agree how requirements, approvals and any checks at the provider's site will work.
6. Review provider performance on a regular basis, act on problems, and keep the records that show it happened.

Illustrative IT example: subcontracted service-desk support

8.4.2: make controls proportionate to the effect

Determine the controls applied to the provider and to the resulting output. Consider the external contribution's potential impact on the organisation's ability to meet customer and applicable requirements, together with the effectiveness of the provider's own controls. Decide what verification or other activities are needed.

A uniform supplier questionnaire can miss important differences. A routine purchase with limited impact does not create the same decision as a critical outsourced process whose result cannot be easily checked later. Use the method that answers the real conformity question. The standard does not demand a supplier-site audit for every purchase.

8.4.3: communicate a usable requirement

Before communicating requirements, ensure they are adequate. Relevant information can concern the product, service or process; approval methods and release; competence; interactions; performance monitoring; and verification or validation activities at the provider's premises. Select the applicable information rather than forwarding a large document bundle without explaining its meaning.

Clarify how changes and exceptions will be handled. If the organisation updates a requirement internally but the provider continues under an older instruction, the purchasing interface has failed even when both parties followed their own records. Consider how authorised recipients acknowledge and implement changes where that supports reliable control.

Illustrative construction example: externally fabricated items

A hypothetical construction contractor orders fabricated assemblies for a project. The provider has suitable experience, but the order refers to an outdated drawing. The contractor checks the specification before acceptance of the work and establishes an accountable route for later revisions.

Control may combine provider capability evaluation, agreed acceptance criteria, appropriate verification and evidence of authorised changes. The competent project team determines the technical checks. A delivery note establishes receipt, not necessarily conformity. If an item fails requirements, the contractor controls the immediate output and evaluates whether the provider's approval or monitoring arrangements also need revision.

Evidence of control, not just purchasing activity

Explore each numbered part

Common nonconformities with clause 8.4

Audits of external provider control often reveal the following. Each of these suggests that outsourcing has been treated as a purchasing matter rather than a quality matter, which is the underlying weakness the clause targets.

• An approved supplier list exists, but there is no stated basis for how providers were evaluated or selected.
• Outsourced processes are not recognised as such, so no controls are defined for them.
• Every provider is treated identically, or high-impact providers receive lighter checks than trivial ones.
• Provider performance is never reviewed after first approval, and recurring problems go unaddressed.