Purchasing is a process that applies to any and all organizations and ISO 9001 certification, AS9100 certification, and AS9120 certification depends heavily on meeting the requirements in section 8.4 of these respective standards. In fact, section 8.4 is currently the only clause required to be audited for AS9100 and AS9120 audits for each audit (initial, both surveillance audits, and recertification). However, that requirement will be removed once AS9104-1:2022 is operationally effective.

In this blog we will briefly cover the first part of 8.4.1 of ISO 9001:2015 since much of it is common to AS9100D and AS9120B.

Despite the bloated title, “Control of Externally Provided Processes, Products, and Services,” we’re still talking about products and services you buy from other organizations, in other words, the purchasing process. ISO 9001:2015 provides guidance on the types of purchases that will be addressed by this section. At minimum, three categories of purchases must be managed and controlled through your purchasing process:

• Raw materials – Any materials or components that actually become part of your products or services must be managed through your purchasing process.

• Products or services that a supplier provides directly to your customer – These are products and services that you sold, but somebody else actually provided. Examples include private-label products, drop-shipped items, and outsourced services. Once the order is taken, your organization is potentially out of the loop, so it’s important that you have some kind of control over the process.

• Process provided by subcontractors – This is another way of saying outsourcing. Your organization is still involved in producing the product or service, but some aspect of it is provided externally. Examples might include a catering service that provides meals to corporate events. The catering service does the cooking, but sometimes they rely on an external delivery service to get the food to the customer location. Another example would be a manufacturing company that builds machinery. The company doesn’t have painting equipment, so it relies on an outside firm to apply the paint. Both of these are examples of outsourcing.

Beyond these three categories, it’s up to your organization to define the purchased products that have the most effect on you operations. Additional purchases that are considered “critical” – and which are managed through the purchasing requirements of ISO 9001:2015 – include:

• Product packaging
• Equipment used to provide a service
• Mission- critical spare parts
• Outsourced testing labs that verify your product
• Transportation providers that deliver your goods or services
• Calibration services
• Providers of contract labor