A product's quality often starts with the supplier's quality. Clause 8.4 of ISO 9001 requires the evaluation, selection, performance monitoring and re-evaluation of external providers to ensure that externally provided processes, products and services conform to requirements; criteria for these activities must be set and results recorded. IATF 16949 in automotive and AS9100 in aerospace tighten these requirements further.
You can use the checklists in this guide as the working list for a new supplier's approval file or for the annual re-evaluation.
The supplier lifecycle
- 01Pre-assessmentQuestionnaire and documents
- 02ApprovalAudit, samples
- 03Approved supplierPurchasing released
- 04Performance monitoringScorecard
- 05Re-evaluationDevelop or phase out
Not every supplier is evaluated to the same depth. Applying the same process to an office supplies vendor and to a supplier making a critical casting wastes resources. So the first step is to classify suppliers by risk.
Segmentation and risk class
| Class | Definition | Example | Evaluation depth |
|---|---|---|---|
| A – Critical | Directly affects product safety, conformity or customer requirements | Critical part, special process (coating, heat treatment), calibration service | On-site audit, sample approval, monthly scorecard |
| B – Important | Goes into the product but can be inspected or has alternatives | Standard component, packaging, logistics | Questionnaire and document check, quarterly scorecard |
| C – General | Does not affect product quality | Office supplies, general services | Simple record, annual review |
When classifying, assess supply risk as well as impact: single source, country and logistics risk, financial health, capacity and information security access. A software or maintenance supplier with access to your data or systems can be high risk even if the purchase amount is small.
Pre-assessment
Approval: audits and samples
For class A suppliers, approval needs on-site verification beyond documents. A supplier audit is there to see whether the quality management system works in production, not just on paper. After the audit, sample or first article approval confirms that the product meets requirements; in automotive this step is run as PPAP (Production Part Approval Process).
- 01Plan the audit
Set the scope, auditors and checklist; send the agenda to the supplier in advance.
- 02Observe the process on site
Follow the product's path from incoming inspection to shipping; check records by sampling.
- 03Classify findings
Separate major, minor and observations; if there is a major finding, approval waits until it is closed.
- 04Sample and first article approval
Verify the product with a measurement report, material certificate and, where needed, a functional test.
- 05Approval decision
Record an unconditional approval, conditional approval (with an action plan) or rejection, with reasons.
Performance monitoring: the scorecard
Approved suppliers are monitored with regular, measurable criteria. Share the scorecard with the supplier; the aim is not to punish but to see problems early and improve together.
| Criterion | Measure | Example weight |
|---|---|---|
| Quality | Defective parts per million (PPM), rejected lot rate | 40% |
| Delivery | On time in full (OTIF) rate | 30% |
| Responsiveness | 8D / corrective action response time and effectiveness | 15% |
| Commercial and communication | Price stability, quotation time, communication quality | 10% |
| Sustainability and compliance | Certificate validity, environmental and health and safety compliance | 5% |
| Total score | Class | Action |
|---|---|---|
| 90–100 | Preferred | Priority for new business, audit frequency can be reduced |
| 75–89 | Approved | Routine monitoring |
| 60–74 | Conditional | Improvement plan required, monthly follow-up |
| 0–59 | At risk | New orders stopped, alternative source sought |
Common mistakes: building the approved supplier list once and never updating it; not tracking certificate expiry dates; not sharing the scorecard with the supplier; applying the same weights to all suppliers; not linking supplier-caused non-conformities to the scorecard.
Re-evaluation and development
- Re-evaluation frequency follows the risk class: class A at least yearly, class B every two years.
- A major non-conformity, customer complaint or change notification triggers an extraordinary review.
- A joint development plan with due dates is prepared for conditional and at-risk suppliers.
- A decision to phase out a supplier is carried out only after an alternative source is approved.
- Supplier risks (especially single-source risks) are entered in the enterprise risk register.
Conclusion
Effective supplier management consists of risk-based segmentation, evidence-based approval, a transparent scorecard and regular re-evaluation. OREL QMS keeps supplier approval files, audits, supplier-caused non-conformities and 8D responses in one place, and OREL MRP feeds incoming inspection and delivery data into the scorecard automatically.