ISO 9001 · ChainSec Suppliers
Keep suppliers in order.
Evidence for clause 8.4.
ChainSec keeps your suppliers in order — who is approved, which certificates are valid, when each one is due for re-evaluation and which nonconformities are open. When the auditor asks, the answer is an export.
From requirements to work
Is ChainSec an ISO 9001 system?
No. ChainSec does not replace your management system. It supports supplier evaluation, classification, certificates, re-evaluation and supplier nonconformities — the work your auditor asks about in clause 8.4.
| Clause | What ISO 9001 requires | Where it is done |
|---|---|---|
| 8.4.1 | Criteria for the evaluation, selection, monitoring and re-evaluation of external providers, and documented information on each step. | ChainSec |
| 8.4.2 | Controls proportionate to how much the provider affects your ability to meet customer requirements. | ChainSec — classification and re-evaluation interval per supplier |
| 8.4.3 | Requirements communicated to the provider before a contract or purchase order. | Partly — questionnaires and documents in ChainSec, the requirements in your contracts and purchase orders |
| 10.2 | Nonconformities handled with action, root cause analysis and a check that the action worked. | ChainSec for supplier nonconformities, your management system for internal ones |
| 6.1 | Risks and opportunities are identified and addressed. | The Risk and requirements add-on |
| 7.5, 9.2, 9.3 | Document control, internal audit and management review. | Your management system |
What does ISO 9001 require of suppliers?
Clause 8.4 requires you to evaluate, select, monitor and re-evaluate the external providers that affect your ability to meet customer requirements. The criteria must be documented, the controls must be proportionate to the provider’s impact, and you must be able to show what was done.
An external provider is a broader concept than purchasing. It also covers outsourced processes such as IT operations, calibration and group companies outside the scope of your management system — and the responsibility stays with you even when someone else does the work.
In your daily work
Supplier work, from spreadsheet to audit export
Supplier follow-up is often someone’s job on the side of their real job. These are the steps, in the order most teams take them.
Keep the spreadsheet — it is the onboarding
Export your spreadsheet to CSV and import it. Imported suppliers are approved on arrival, and the history shows they came in through the import.
Classify and set a re-evaluation interval
Classify each supplier by how much it affects your delivery and choose how often it is re-evaluated: every three, six or twelve months. That makes the proportionate control in 8.4.2 visible per supplier.
Evaluate and collect evidence
Send supplier assessments for quality to the critical suppliers. Adapt the questions to your criteria and collect responses and certificates as evidence.
Review and re-evaluate with history
Every review is logged with date, outcome and who did it. Checklists per supplier keep track of the steps that need doing each time.
Export the approved supplier list
An export with status, latest review and certificate validity. It is the first document an auditor or a large customer asks for.
Supplier nonconformities and complaints
A complaint in an email is not enough at audit. The auditor wants to see what happened, what the supplier answered, which action was taken and who verified that it worked. In ChainSec, the nonconformity belongs to the supplier, and open cases stay in the todo list until closed.
- Record
- What happened, the source — complaint, audit finding or questionnaire answer — severity and who is responsible. The responsible person can be someone in purchasing or production without a ChainSec account.
- Follow up
- Action, root cause and the supplier’s response in one place. A flagged questionnaire answer can become a nonconformity straight from the review.
- Verify and close
- Someone verifies that the action worked, and ChainSec records who and when. Closing an unfounded complaint without verification requires an explanation that is logged separately.
How often should suppliers be re-evaluated?
ISO 9001 sets no fixed interval. The requirement is that you have criteria for re-evaluation and can show that you follow them. A common approach is yearly re-evaluation of critical suppliers and less often for the rest, plus re-evaluation after events such as a serious nonconformity or a change of ownership.
A missed re-evaluation is one of the most common findings in a surveillance audit. The company evaluated the supplier at the start and never again. In ChainSec every supplier has its own interval and a history showing when it was last reviewed.
Three common objections
- “We use Excel.”
- Excel is not bad. It just does not tell you when a certificate has expired or a re-evaluation is overdue, and the auditor asks for history the spreadsheet overwrites. You keep the spreadsheet — it becomes the import file.
- “Our management system already does this.”
- Many management systems include a supplier evaluation form. The difference is a supplier register that keeps status, validity and history per supplier. If the complaint already lives in your system, you reference the case and keep the details there.
- “Our consultant gave us a template.”
- The template solves the first evaluation. It does not solve the fourteenth re-evaluation, or the question of who approved what and when.
Questions about ISO 9001
Is ChainSec an ISO 9001 system?
No. ChainSec does not replace your management system and has no document control, process maps or internal audit. ChainSec does the supplier part: supplier register, classification, re-evaluation, certificates, approved supplier list and supplier nonconformities. The Risk and requirements add-on covers internal risks and requirements.
What does ISO 9001 clause 8.4 require of suppliers?
Clause 8.4 requires you to evaluate, select, monitor and re-evaluate external providers that affect your ability to meet customer requirements, with documented criteria and controls proportionate to the provider’s impact. Requirements must be communicated to the provider before a contract or purchase order.
How often should suppliers be re-evaluated under ISO 9001?
The standard sets no fixed interval. You decide the criteria and must be able to show that you follow them. A common approach is yearly re-evaluation of critical suppliers and less often for the rest, plus re-evaluation after events such as a serious nonconformity.
What do we show the auditor?
The approved supplier list as an export with status, latest review and certificate validity. Per supplier you have the review history, the certificates and the nonconformities — open and closed, with who verified the action and when.
Can we keep complaints in our ERP or management system?
Yes. A nonconformity in ChainSec can reference the case number in your ERP or management system. The details stay there, and ChainSec keeps the link to the supplier and the follow-up the auditor asks about.
Does ChainSec work for ISO 14001?
Yes. Assess supplier environmental practices with questionnaires and follow up on certificates and nonconformities. Adapt the questions to your environmental requirements and use the responses as evidence within your management system.
See your supplier workflow in ChainSec.
We show the supplier register, certificates and review history using your workflow. After the demo, you can try ChainSec for free.