How to Do Supplier Management as Required in ISO9001:2015

      Clause 8.4 of ISO9001:2015 requires control over external service providers. In this article, all the external service providers will just be called suppliers, a term which is more familiar to most people.

      One organization may have hundreds or even thousands of suppliers, but not all suppliers should be controlled to fulfill the requirements of ISO9001:2015. Only three types of suppliers shall be controlled as stated in Clause 8.4.1 of ISO9001:2015:

1. Suppliers whose products and services are intended for incorporation into the organization’s own products and services. Raw material suppliers belong to this type.
2. Suppliers whose products and services are provided directly to the customer(s) on behalf of the organization.
3. Suppliers by which a process, or part of a process, is provided as a result of a decision by the organization. Logistic service providers, calibration institution and subcontractors who are responsible for some steps of the manufacturing process of the organization's products belong to this type.

      Now let's discuss what shall be done to fulfill the requirements of ISO9001:2015 in supplier management. 

      First, a criteria to evaluate and select the suppliers shall be established. Only suppliers which meet these criteria can be qualified as the organization's suppliers. An approved vendors list (AVL) can be established for these qualified suppliers. All purchasing orders should only be issued to suppliers in this list. The criteria to evaluate a supplier may include but are not limited to:

• Whether the supplier meets all the legal requirements;
• Whether the supplier has the ISO certificates (An on site audit can be conducted to see whether the supplier has a solid quality management system established);
• Whether the supplier's price for the products is competitive;
• Whether the supplier's product specifications meet the requirements (If necessary, samples may be requested from the suppliers for evaluation);

      Second, the performance of these qualified suppliers shall be monitored. It is often monitored according to four aspects: quality, delivery, cost and support. A scoring criteria is usually needed so that the supplier's performance can be objectively determined. Based on their performance, the suppliers shall be re-evaluated, and proper actions shall arise from the re-evaluation. For example, corrective actions can be requested from suppliers, or the suppliers shall be removed from AVL if their performance continuously miss the target and business should be suspended with them.  

      Third, the requirements of the organization shall be passed to the suppliers. These requirements may include but are not limited to:

• Requirements for the products or service provided;
• Approval of the products and service; 
• Communication requirements (i.e. the contact window, language requirements for communication);
• Quality objectives to the suppliers, the criteria to monitor their performance and the actual performance of the suppliers. 

      At last, I want to add one point here which is not a specified requirement in ISO9001:2015, but often required by customers: the organization shall have multiple suppliers for each kind of material to ensure the continuity in the supply chain. It should be part of the contingency plan or risk management of the organization, to address the risk of materials shortage.