An outsourced process is one that your management system needs, that your organisation has chosen to have performed by an external party. ISO 9001 addresses it in clauses 8.1 and 8.4.
The principle
Outsourcing transfers the activity, not the responsibility. The process remains within the scope of your management system and you remain accountable for its conformity. Clause 8.4.2 states this directly: you must ensure externally provided processes remain within the control of your quality management system.
Common examples
Heat treatment, plating, calibration, sterilisation, machining, testing, design, IT services, logistics, and increasingly whole functions such as payroll or customer support.
What is required
- Criteria for evaluating, selecting, monitoring and re-evaluating providers, with records
- Controls proportionate to the impact on your ability to meet requirements
- Definition of both the controls applied to the provider and to the resulting output
- Clear communication of requirements to the provider
- Verification activity sufficient to confirm conformity
Where organisations get caught
Re-evaluation that never happens. Suppliers are approved once and remain approved indefinitely with no performance monitoring. This is among the most frequent findings in the whole standard.
Purchase orders that specify too little. A part number and a quantity, with no revision level, no applicable specification and no inspection requirement, is not communicating requirements.
Assuming certification is sufficient control. A supplier’s ISO 9001 certificate tells you they have a management system. It does not tell you they will meet your requirements on this order.