ISO 9001:2015 Supplier Certification Requirements

[John Broomfield]

Do suppliers to ISO 9000 (2015) companies have to be ISO 9000 approved ?
I am reading 8.4 Control of externally provided processes, products and services and as yet do not see a specific mandate ?

No.

Select your subcontractors and your suppliers per your selection criteria. These criteria may include conformity with ISO 9001.

Make sure your selection criteria are effective in delivering suppliers who fulfill your requirements.

Please note that no company is ISO 9000 approved. You probably mean suppliers with systems that are certified as conforming with ISO 9001.

If you do include certification then examine the scope of the certification to ensure it includes the services and products you are buying.

John

 

[Big Jim]

In my opinion, and also reading the versions of the standard in Portuguese and French, I still find it clear that the Organization has to inform its suppliers about control and monitoring of the performance of the external supplier to be applied by the organization

Perhaps with your knowledge of other languages and how the standard is written in them you can explain to us their understanding of the English word "its". It is a little word but it modifies the sentence.

 

[Antonio Vieira]

8.4.3 "The organization shall communicate to external providers its requirements for: e) control and monitoring of the external providers ' performance to be applied by the organization ".
It seems to me clear that what this requirement obliges is that the organization has to communicate to its suppliers its requirements on how it will evaluate the performance of these same supliers.

Admitting that there may even be a mistake in translating English to ALL other languages, in this case what is the Organization's intention to do to fulfill this requirement?

Thanks

 

[Big Jim]

It hinges on the definition of the word "its". If the organization has a need to tell the supplier how they are going to be evaluated, then they need to. A prime example would be a report card system. If the organization has not determined there is a need to tell a supplier how they are going to be evaluated then they don't need to.

 

[Antonio Vieira]

Sorry but I don't think the organization can choose "the need to tell the supplier how they are going to be evaluated".
This requirement is mandatory.
"The organization shall communicate to external providers its requirements for:
...
e)control and monitoring of the external providers’ performance to be applied by the organization".

If you don'thave evidence of having carried out this communication, it is a non-conformity according to ISO 9001.

 

[Big Jim]

Sorry, it fits into the definition of the word its. Auditors cannot tell an organization what their requirements are on anything on that list.

 

[Big Jim]

Let's take a closer look so you can see that the word "its" used in this sentence is essentially the same as "as applicable" as used in the 2008 version of the standard. It should be immediately obvious that not all in the list always apply.

b) the approval of 1) products and services 2) methods, processes and equipment 3) the release of products and services. There will not be requirements for any of these three in many circumstances. Are you suggesting that the organization create some artifically so they can meet these requirements?

c) competence, including any required qualification or persons. Again, if the purchasing organization doesn't have a requirement for competence for what is being purchased are you suggesting they have to create one?

d) the extent of external providers' interaction with the organization. Again, if there is no requirement to determine the extent of interaction is there a need to create them?

f) verification or validation activities that the organization or its customer intends to perform at the external providers' premises. I hope by now you see the point.

This is still an "as applicable" list.

 

[Jim Wynne]

Sorry but I don't think the organization can choose "the need to tell the supplier how they are going to be evaluated".
This requirement is mandatory.
"The organization shall communicate to external providers its requirements for:
...
e)control and monitoring of the external providers’ performance to be applied by the organization".

If you don'thave evidence of having carried out this communication, it is a non-conformity according to ISO 9001.

It hinges on the definition of the word "its". If the organization has a need to tell the supplier how they are going to be evaluated, then they need to. A prime example would be a report card system. If the organization has not determined there is a need to tell a supplier how they are going to be evaluated then they don't need to.

I think there are hairs being split here. "Its" isn't the key, or at least not the whole key. There are two parts here. First, there's the "shall" part: "The organization shall communicate to external providers..." Then there's the "...its requirements..." part. Jim is saying, and I agree, that the "shall" part is dependent on the "its requirements" part. If there are no requirements, there's nothing to communicate, thus the "shall" is null and void. Realistically, there are few organizations that don't have some sort of requirements to be communicated.