Supplier evaluation is one of those requirements purchasing teams tend to file under paperwork. But when a supplier ships late or ships defects, the problem does not stay in purchasing: it lands in production, then with your customer, then in your satisfaction data. That is why clause 8.4 of ISO 9001 asks for it in writing.
The short version: to run an ISO 9001 supplier evaluation you define your criteria (quality, on-time delivery, price, regulatory compliance), assign each one a weight, score every supplier on a numeric scale over a fixed period, document the result, and open a corrective action for anyone below your minimum threshold. Clause 8.4 requires that documented process for every external provider that affects the conformity of what you deliver.
Below you will find the full criteria table, the weighted score formula, the fields your evaluation form needs and what to do when a supplier fails. Written so you can build it tomorrow, not so you can memorise the standard.
Table of Contents
What clause 8.4 of ISO 9001 actually requires
Clause 8.4 (control of externally provided processes, products and services) asks for four distinct things. Worth separating them, because most companies only do the first:
- Evaluate suppliers before working with them, based on their ability to meet your requirements.
- Select using defined criteria, not price alone and not habit.
- Monitor actual performance once they are operating.
- Re-evaluate periodically and act when performance drops.
The standard does not tell you which criteria to use or how often to evaluate. You define that and you defend it in the audit. What it does require is documented information of the evaluations and of the actions taken as a result. Without that record, the auditor raises a finding even if the process genuinely happens in practice.
Which suppliers to evaluate (and which to leave out)
Evaluating every supplier sounds rigorous and ends up as a binder nobody opens. The useful filter is impact on the conformity of what you deliver.
- In scope: raw materials, components, outsourced processes that become part of the product (machining, coating, calibration), transport when it affects delivery to the customer, and external labs or certification bodies.
- Out of scope (at least at the start): stationery, cleaning, catering, general facilities maintenance. They do not affect conformity and they dilute the effort.
- Grey area: software, production equipment maintenance, technical training. In scope if a failure on their side can stop your process or affect quality.
The simplest way to document this is a criticality tier: A (critical, directly affects the product), B (relevant, affects operations), C (non-critical). You evaluate A and B, and you record why C is excluded. That written justification is what ends the discussion with the auditor.
ISO 9001 supplier evaluation criteria: the full table
These are the criteria most companies use and what each one actually measures. You do not need all eight: pick four to six, and only ones you can measure with data you already collect.
| Criterion | What it measures | Where the data comes from |
|---|---|---|
| Product or service quality | Percentage of conforming lots or deliveries out of the total received. | Incoming inspection records, rejections, nonconformities. |
| On-time delivery | Percentage of orders delivered within the agreed lead time. | Purchase orders against actual receipt date. |
| Order accuracy | Complete and correct deliveries: quantity, part number, documentation. | Delivery notes and goods receipt records. |
| Price and terms | Price stability, unagreed variations, payment terms. | Purchase history and contracts. |
| Regulatory compliance | Valid certificates, technical data sheets, sector requirements. | Supplier file. |
| Responsiveness | Time to respond to requests, claims or order changes. | Email trail and incident log. |
| Communication | Whether they flag delays or problems before you find them yourself. | Incident log and buyer assessment. |
| After-sales service | Warranty handling, technical support, resolution after delivery. | Open claims and their closure time. |
One practical warning: if a criterion has no clear data source, leave it out. You will end up scoring it from memory, and that is exactly the kind of evaluation an auditor takes apart in two questions.
How to calculate a supplier evaluation score, step by step
- Assign a weight to each criterion. They must add up to 100 %. A common split in manufacturing: quality 40 %, on-time delivery 30 %, responsiveness 15 %, price 10 %, communication 5 %. In services, responsiveness usually outweighs price.
- Define the scale. 1 to 5 or 1 to 10, with written descriptors for every level. “5 = 100 % conforming deliveries; 3 = between 90 % and 99 %; 1 = below 90 %.” Without descriptors, two people score the same supplier differently and the result stops being comparable.
- Pull the data for the period. Purchase orders, incoming inspections, nonconformities, claims. Data from the period under evaluation, not accumulated impressions.
- Calculate the weighted score. Multiply each criterion score by its weight and add them up. On a 1 to 5 scale: quality 4 × 40 % = 1.60; delivery 3 × 30 % = 0.90; responsiveness 5 × 15 % = 0.75; price 4 × 10 % = 0.40; communication 3 × 5 % = 0.15. Total: 3.80 out of 5, or 76 %.
- Classify against thresholds set in advance. For example: 85 % or above, approved; 70 % to 84 %, approved under watch; below 70 %, improvement plan or removal. Thresholds are set before scoring, never after seeing the results.
- Document, communicate and schedule the next one. Save the signed record, send the result to the supplier where appropriate, and book the re-evaluation. The supplier in the example, at 76 %, goes under watch and is re-evaluated in three months.
Supplier evaluation form: the fields it needs
Most people go straight looking for the template, and that makes sense: the form is what becomes evidence. A supplier evaluation form holds up in an audit when it carries at least these fields:
- Identification: supplier name, type of supply, criticality tier (A, B or C).
- Period evaluated: start and end dates. Without a period, the record cannot be audited.
- Criteria with their weights and the score obtained on each.
- Data source per criterion: which record the score came from.
- Total weighted score and resulting classification.
- Comparison with the previous evaluation: up, flat or down. That is what turns a snapshot into monitoring.
- Decision and action: continue, put under watch, open a corrective action, or remove from the approved list.
- Owner, date and signature of whoever evaluates and whoever approves.
- Next evaluation date.
If you are building it from scratch, the Simple Document Builder™ guide gives you the document and record structure of a QMS, including the coding and version control that keeps this form from ending up as six different copies moving around by email.
How often to evaluate and re-evaluate
The standard sets no frequency. The practice that survives an audit looks like this:
- Critical suppliers (A): every three or six months.
- Relevant suppliers (B): once a year.
- New supplier: initial selection evaluation plus a first re-evaluation three months into the relationship.
- Supplier under watch: shorten the cycle until they recover the threshold, and document that you shortened it.
The common failure is not picking the wrong frequency. It is writing a frequency into the procedure and then not meeting it. An annual cycle you actually complete is worth more than a quarterly one that skips two rounds.
What to do when a supplier fails the evaluation
Failing a supplier and then doing nothing is worse than not evaluating at all: you have documented that you knew. A reasonable sequence:
- Share the result with the actual numbers, not a bare grade. “22 % of this half-year’s deliveries arrived past the agreed date” starts a conversation; “you failed” ends one.
- Ask for an action plan with dates. The supplier proposes how they fix it.
- Open a corrective action on your side if their failure caused an internal nonconformity or a customer complaint.
- Re-evaluate on a short cycle and keep the record. If they improve, you have documented the improvement. If they do not, you have the evidence to justify the switch.
- Have an alternative supplier identified for critical supplies before you need one.
The four findings auditors raise most often on 8.4
- Criteria never written down. Evaluation happens, but no document states which criteria or which weights.
- Scores with no evidence behind them. Round, uniform grades across all suppliers, with no record to support them.
- Results that trigger nothing. Suppliers failing year after year and not a single action opened.
- Frequency not met. The procedure says every six months and the latest record is fourteen months old.
Centralise your supplier evaluation
Calculating weighted scores, storing the evidence behind each criterion, flagging when a re-evaluation is due and keeping the history audit-ready is exactly what the QualityWeb 360 supplier evaluation module does. The form stops living in a spreadsheet that everyone keeps in their own folder.
Frequently asked questions about ISO 9001 supplier evaluation
Is supplier evaluation mandatory in ISO 9001?
Yes. Clause 8.4 of ISO 9001:2015 requires organisations to evaluate, select, monitor and re-evaluate external providers based on their ability to supply conforming products and services, and to retain documented information of those evaluations. Not doing it is a nonconformity an auditor will find.
How often should supplier evaluation be done?
The standard sets no frequency: you define it based on supplier criticality. Annual is typical for relevant suppliers, and six-monthly or quarterly for critical ones. What the auditor does check is that the frequency stated in your own procedure is actually being met.
What criteria are used to evaluate a supplier?
The most common are product or service quality, on-time delivery, order accuracy, price and terms, regulatory compliance, responsiveness, communication and after-sales service. Pick four to six, give them weights that add up to 100 %, and only use criteria you can back with a record.
How do you calculate a supplier score?
Multiply each criterion score by its percentage weight and add the results. On a 1 to 5 scale: quality 4 × 40 % plus delivery 3 × 30 % plus responsiveness 5 × 15 % plus price 4 × 10 % plus communication 3 × 5 % gives 3.80 out of 5, or 76 %. That percentage is compared against the thresholds you set before evaluating.
What is the difference between supplier selection, evaluation and re-evaluation?
Selection is the initial filter that checks whether a new supplier meets your minimum requirements before you buy. Evaluation measures the actual performance of suppliers already operating, over a defined period. Re-evaluation repeats that measurement periodically to catch changes in performance. ISO 9001 requires all three.
Can supplier evaluation be done in Excel?
Yes, and plenty of companies start there. The problems show up over time: different versions of the form in circulation, formulas someone edits without telling anyone, evidence scattered across folders and email, and no automatic reminder when a re-evaluation is due. It works with a handful of suppliers and gets fragile as the system grows.
Part of: Clause 8 of ISO 9001: Operation.
