ISO 9001 clause 8.5.3: care for customer and provider property

What clause 8.5.3 requires in practice

When customers or external providers entrust something to you, you take on a duty of care for as long as it is under your control or in use. For property supplied for use or for incorporation into the products and services, the organisation identifies it, verifies it, protects it and safeguards it.

If such property is lost, damaged or found unsuitable for use, the owner must be told, and documented information must be available as evidence of what happened.

The note to the clause broadens the idea considerably. Property covers physical items such as materials, components, tools and equipment, as well as premises, intellectual property and personal data. A drawing supplied for a build, a customer's database held by a service team, or a mould lent by a client are all covered. The principle is the same in each case: treat what belongs to others with at least the care applied to your own assets.

Establish what is entrusted and its condition

Identify property sufficiently to avoid confusion and verify relevant information about its condition or suitability. The method should suit the property. A physical item may need a condition check; customer-provided information may need confirmation that it is the intended and usable input for the agreed purpose.

Do not assume that receipt transfers ownership or permits unrestricted use. Understand the arrangement and any relevant limits. The QMS should support the organisation in using the property appropriately and recognising when a concern affects the planned work.

Why care for external property matters to the business

Customers who hand over materials, designs or data do so on trust, and a single loss or leak can end the relationship and invite legal claims. Handled well, safeguarding of entrusted property becomes a reason customers choose you. It matters even more as services rely on customer data and intellectual property that are easy to copy or expose by accident. Telling the owner promptly when something goes wrong also limits the damage and preserves goodwill. In audits, this clause is a good test of whether the organisation recognises the less obvious forms of customer property, especially data and confidential information.

How to implement clause 8.5.3

Begin by recognising what you hold, then apply simple, visible protection. Include intangible property from the start: files, access rights and confidential designs are held by far more teams than materials are, and are far easier to mishandle without anyone noticing.

1. Ask each department what customers or providers give them, including tooling, samples, documents, files and access credentials.
2. Set out how such property is checked on receipt, and how its condition is recorded.
3. Mark it or log it so that it can be told apart from your own and is not used for anything unintended.
4. Decide protection measures suited to the item, such as secure storage, restricted access, backup or return after use.
5. Define the route for reporting loss, damage or unsuitability to the owner, and who makes that contact.
6. Keep records of what was received, how it was used and any incident, and review the approach after any loss.

Illustrative manufacturing example: a customer-owned fixture

Illustrative IT example: customer-provided configuration information

A hypothetical IT provider receives customer-owned configuration information needed for an implementation. Staff copy it into an uncontrolled working location and later discover that part of the information has been unintentionally altered. The original basis for the work is uncertain.

The provider controls affected use, establishes the relevant facts and communicates the issue to the customer. It preserves evidence and determines how suitable information will be restored or confirmed. The example shows property care and QMS control of information; it does not imply that ISO 9001 alone establishes full information-security or data-protection compliance.

Protect property in the actual working environment

Consider handling, storage, access and use appropriate to the property. Physical protection and information controls may both matter. A label identifying ownership is useful, but cannot by itself prevent loss, damage or inappropriate use.

Clarify responsibility at handovers and across sites. Property may move between teams, be used by a provider or remain with the organisation after the main work is complete. The relevant arrangements should remain clear while the property is under control or in use.

Respond accurately when property is unsuitable

The reporting requirement includes property found unsuitable for use, not only property visibly lost or damaged. A supplied item may not meet the intended need, or information may be incomplete for the agreed activity. Do not continue as though suitability has been established when it remains unresolved.

Report to the relevant customer or provider and retain documented information about what occurred. The response should reflect the actual circumstances and applicable requirements. Avoid unsupported statements about blame or liability; establish the facts and the decisions needed to protect the work.

Keep evidence proportionate and useful

Common nonconformities with clause 8.5.3

Typical findings relate to overlooked or poorly protected property. They usually reflect a narrow view of what counts as property, or an assumption that nothing needs reporting unless it is serious.

• The organisation does not recognise customer data or intellectual property as customer property, so no controls are applied.
• Customer-supplied items are stored with the organisation's own stock without identification.
• Damage or loss occurred but the owner was never informed and there is no record of the event.
• Property received is not checked, so unsuitable material is discovered only when it causes a problem.