Companies decide about making or buying a product or service based on economic considerations. Â When taking this decision, they rely on a vendor to provide a level of quality consistently which they would ensure through in-house processes.Â This is the reason why the clause is so crucial for the quality system management.
Clause 8.4 of ISO 9001 certfication:2015 stipulates that the organization must ensure that externally provided (outsourced or purchased) products, processes as well as processes conform to specified requirements.
Extent of control
Extent of control will depend upon whether externally provided services and products are
- Directly incorporated into companyâ€™s products/service or
- Services and products are directly provided to organizationâ€™s customers or
- One of the processes of the company (or a part of the process) is provided/operated by external provider.
â€œFor each of these cases the company (organization) must separately determine and apply criteria for
Â Performance monitoring and
Based on the ability of external provider to provide products, processes and services, as per the requirements, appropriate action shall be taken. Documented info must be retained for these control activities as well as the actions arising out of the evaluationâ€.
Communication of requirements
Clause 8.4.2 describes the type of control and extent of control required
The company Â must ensure that the externally provided products/ processes/services donâ€™t affect adversely the organizationâ€™s capability to deliver services and products consistently conforming to requirements.
- Processes provided externally must remain within control of the quality management system of the organization;
- Controls to be applied on external provider as well as,Â those to be applied on output of products and services must be defined separately by the organization
- The organization must consider:
â€œ1) the potential impact of the externally provided processes, products and services on the organizationâ€™s ability to consistently meet customer and applicable statutory and regulatory requirementsâ€; and
2)â€ the effectiveness of the controls applied by the external providerâ€;
- d) â€œOrganization (company) must determine the verification, or other activities, necessary to ensure that the externally provided processes, products and services meet the requirementsâ€
Clause 8.4.3 contains Information to be communicated to External Providers.
Organization must communicate applicable requirements to external providers as noted below:
- processes to be performed or services and products to be provided on behalf of the organization (company);
- requirements of approval for methods, processes or equipment and for release of products and services;
- required competence as well as necessary qualification of personnel;
- requirement of interactions with the organizationâ€™s quality management system;
- requirement of controlling, measurement and monitoring of the performance of the external providers Â by the organization;
- requirement of verification activities intended to be performed at external providerâ€™s premises by the organization, or its customer.
Organization must verify and ensure adequacy of specified requirements, prior to the communication of requirements to external providers.
Process interactions and role of ISO 9001 consultants
While formulating the quality management system, the process interaction between vendorâ€™s (external providers) processes and the organizationâ€™s processes must be understood accurately. An ISO 9001 consultant can provide valuable guidance for building an effective QMS.