Clause 8 Operation
8.4.1 Control of externally provided processes, products and services - General
Clause Criteria
The organization shall ensure that externally provided processes, products and services conform to requirements.
The organization shall determine the controls to be applied to externally provided processes, products and services when:
a) products and services from external providers are intended for incorporation into the organization’s own products and services;
b) products and services are provided directly to the customer(s) by external providers on behalf of the organization;
c) a process, or part of a process, is provided by an external provider as a result of a decision by the organization.
The organization shall determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers, based on their ability to provide processes or products and services in accordance with requirements.
The organization shall retain documented information of these activities and any necessary actions arising from the evaluations.
Explanation
The opening sentence of this clause contains the primary criteria for an organization to ensure that inputs into its operations, and product and service delivery, conform to established requirements. It then sets out a number of specific criteria, addressing a few critical aspects of supply chain management.
Importantly, the criteria (in italics) above, require an organization to determine the critical aspects of the relationships with supply chain "interested parties", which need to be kept under review, in a formal manner, through the management system.
Note: Look to SLA, NDA, DPA and other contractual arrangements to determine the criteria for external provider evaluations.
Chief Explainer:
Phil Byrne