ISO 9001:2015 8.2.3 - Review of Requirements (Clarification on compliance)



Hello All and Happy Friday!

Looking for some clarification on section 8.2.3 if ISO9001:2015, specifically subsection

My scenario is this - As a distribution center, customers email or call us and ask about leadtimes and pricing for parts. Most of the RFQ's are very informal. Requirements such as extra paperwork, certifications, and shipping needs are gathered when the customer is established, but our salespeople may also ask before quoting, it entirely depends on the customer.

Looking at, the sales team "shall conduct a review before committing...", and then in "The organization shall retain documented information, as applicable: on the results of the review"

My question is this: 95% of the quotes are simply "We do have stock/we don't have stock, here is leadtime, and here is a quote". There are occasions where sales will need to talk to the machinist if a customer needs a product slightly modified (perhaps spray painted a specific color as the products we sell are all very similar in appearance) to see if it is possible and/or if he sees any hidden costs.

Do these conversations need to be logged as part of a review? We communicate any restrictions to the customer in the reply email or on the phone, and when the purchase order is received we leave details there as well. Can we leave the reviews as non-recorded? Does the "as applicable" leave this open to our decision even if the part technically isn't catalog standard?



IMHO the answer to most of your questions is Yes. As long as you have a record of acknowledgements/specs/CoC's/etc... on all sides (you, your vendor(s), your customer) you should be all set. As part of your acknowledgements you can include info such as "xyz was discussed verbally with person A on xx/yy/zzzz, here is what was agreed on..."


Super Moderator
Just to play Devil's advocate, what if your process said something to the effect of "submission of a quote indicates the sales person has reviewed the request and has determined the company can commit." (To shore that up even further, you could include a checkbox on the quote form).

Given the tone of the OP, it doesn't sound like there are any issues with the current process so I'm just thinking of ways to fulfill the requirements without substantially increasing the overhead (and increasing the potential for an NC).

The statement about communicating restrictions by phone is probably the most concerning. It opens the possibility of your customer saying "that's not what we agreed to!"


There is actually two parts to this issue that must be understood.

1) A request for quote (RFQ) is a standard business process whose purpose is to invite suppliers into a bidding process to bid on specific products or services based on information supplied (or not supplied) and the selling organization knowledge of the product.

2) Purchase orders on the other hand are contractual requirements that must be met by the organization and can contain additional information not supplied with the original RFQ.

The standard requires that once the customer formally orders the items the organization must determine requirements (communicated by the customer, known by the organization or specified by regulation) per Clause 8.2.1. Once they have been identified, they must be review to determine if they can be met or renegotiated per Clause 8.2.2 prior to acceptance of the order.

Now at this point in the process, action is needed by the organization to confirmation order acceptance. The acceptance should contain the information on what you are accepting and will be supplying. Unless you formally accept, there is no formal contact under most state laws.

Whatever you do, do not record conversations without permission of both parties or it can be viewed as an legal wiretap subject to criminal prosecution. In California, for example, both parties must agree to the recording even if the recording is being made by an organization in another state.


Trusted Information Resource
No. I don't think so. You document your requirements via the rfq, po, and acknowledgement. That's all you really need.


@yodon - I think this is the route I am going to take and yes, our current process works and I am trying to avoid adding paperwork or any unnecessary overhead.

@BoardGuy - So if I am understanding you correctly, you are saying that when the standard discusses "Determining the requirements" and "Review of the requirements", these are both AFTER receipt of a formal PO?
Last edited:


In both RFQ and at receipt of a PO you should determine and review requirements that are presented to you by the customer. At RFQ, to assure the most accurate estimate of product cost. Once you receive the PO to recheck the order to assure that nothing has changed or been added to the product requirements. Things that can get you are:

- Addition of requirement for a first actual
- Reduction of your quoted lead-time
- Use of specific supplier not on your ASL
- Change in material specifications

Once you accept the PO you are locked into supplying the product even if it costs you more to produce than RFQ price.

Big Jim

Pay attention to the wording of "The organization shall retain documented information as applicable . . . on the results of the review . . ."

Keep in mind that retaining documented information is, in the terminology of the 2008 standard, keeping records.

Keep your eye on "on the results of the review". What is the result of the review? Think that through. It's liberating.

charanjit singh

Involved In Discussions
Another approach to meet the requirement of having a record of review would be
i) to prepare a Maintained document in the form of guidelines or procedure briefly outlining what you do.
ii) Mention therein that if the received "enquiry/order is found acceptable after review, the same will be marked "OK" & signed (by designated person).
iii) Mark and sign all acceptable customer orders accordingly; this can serve as your retained record.
Top Bottom