Management system guidance
8.4 Control of externally provided processes, products and services
ISO Navigator Pro™ is a free tool that provides practical, expert guidance for businesses wishing to interpret and better implement the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018.
Our range of ISO templates cover the requirements of ISO 9001:2026, ISO 14001:2026 and ISO 45001:2018, and offer an easy way to implement your next management system.
8.4.3 Information for external providers
This requirement builds on ISO 9001:2015 clause 8.4.3 (and, before that, ISO 9001:2008 Clause 7.4.2 – Purchasing Information). Make sure your requirements are adequate before you communicate them. You should seek and record evidence that your organization has, where appropriate, communicated not just the products or services it wishes to receive but also any processes it wants the external provider to undertake on its behalf.
What changed in ISO 9001:2026
Two items in the list of information to be communicated to external providers have been widened. Requirements for the provider’s interactions now cover not only your organization but also, where applicable, your customers and other relevant interested parties (item d). Verification or validation that you or your customer plan to carry out may take place at the provider’s premises or at another location, such as a third-party test house, a customer site or remotely (item f). The remaining items are unchanged in substance.
Your requirements should be communicated to external providers, as appropriate, covering:
- The processes, products and services to be supplied;
- Approval of products and services, of methods, processes and equipment, and of the release of products and services;
- Competence of the provider’s people, including any qualifications they need;
- How the provider will interact with your organization and, where applicable, with your customers and other relevant interested parties (for example, delivering direct to a customer site or handling customer enquiries on your behalf);
- The control and monitoring you will apply to the provider’s performance;
- Any verification or validation that you, or your customer, intend to carry out at the provider’s premises or at another location.
To ensure adequacy of specified purchasing information prior to their communication to the supplier, the supplier is usually requested to quote on price and availability. All pertinent purchasing information, as determined by your organization and customer requirements; should be included in the request for a quote (RfQ).
The purchase order should be created after the review and acceptance of a supplier's quote, and must contain the same content as the request for a quote. Describe the product to be purchased by:
- Defining product approval requirements, e.g.; certificate of conformity;
- Defining intended verification arrangements, e.g.; witness testing or certification;
- Defining personnel competence and qualifications, and any other quality requirements;
- Maintaining records.
Where activities are wholly outsourced, or subcontracted; your organization maintains responsibility for product conformance to all specified requirements. Purchasing information should include acceptance criteria, and where appropriate, state the requirements for the approval of supplier’s procedures, processes, and equipment.
Applicable versions of specifications, drawings, process requirements, inspection instructions, traceability, relevant technical data, and requirements for qualification/competence of the supplier’s personnel, and quality management system must be specified and communicated.
Purchasing verification
Ensure that items, which are essential to fulfilling customer requirements and which directly affect the quality of your products and services, are verified upon product receipt or service delivery to verify they conform to:
- QMS requirements;
- Competency of external personnel;
- Purchase orders;
- Purchasing specification;
- Purchasing agreements;
- Delivery notes;
- Release certificates;
- Certificates of conformity;
- Inspection and acceptance tests;
- Product specifications;
- National or international standards.
Receiving inspection
On receipt of incoming materials, the receiving personnel must identify and inspect the items, goods and materials and match them against the delivery note. The delivery note is compared to the corresponding purchase order and any related documentation. This inspection should include but not be limited to:
- Confirmation of identification using purchase order number, drawing numbers, material markings etc.;
- Confirmation of adherence to delivery schedule;
- Confirmation of conformance to purchase order requirements;
- Confirmation of correct quantities;
- Visual examination for obvious defects;
- Measurement comparison to drawings where required;
- Specified certification/documentation as required.
For large numbers of identical items, visual and dimensional checks should be undertaken on a minimum of 5% of the total quantity. No material is released for further processing until receiving inspection has been completed and goods accepted. All accepted materials passing immediate inspection can be allocated a storage area.
Any non-compliant goods must be placed in a separate area, and clearly identified. Further investigation should determine whether the items, materials or goods are to be:
- Scrapped;
- Returned to Supplier;
- Reworked to a useable condition.
Materials that require specified certification or documentation should only be accepted once that certification and documentation has been viewed and approved by the Quality Manager or the Purchasing Manager. If you need a procedure and forms to help control your business's purchasing and procurement process, click here.
More information on PDCA
Planning
Context
Planning
Support
Doing
Support
Operations
Checking
Monitoring, measurement, analysis and evaluation
Acting
Improvement
Want to know more?
- Read our customer's feedback
- Client list - who's using our templates?
- How the templates are formatted and download examples
- Why we use turtle diagrams and process maps
- What's the difference between a process and a procedure?
- About documented information
SSL certification
A certificate guarantees the information your internet browser is receiving now originates from the expected domain - https://www.iso9001help.co.uk. It guarantees that when you make a purchase, sensitive data is encrypted and sent to the right place, and not to a malicious third-party.
Free PDCA guidance
ISO Navigator™ is our FREE online training tool that shows you how to apply the principles of PDCA to your operations. We also offer many helpful templates that get you on the road to documenting your management system, please visit the download page.