Supplier evaluation is the requirement, in clause 8.4.1, to determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers — and to retain documented information of these activities and any actions arising.
Four distinct activities
Organisations reliably do the first two and reliably neglect the last two.
- Evaluation — assessing a potential supplier before use
- Selection — choosing them, against defined criteria
- Monitoring — tracking performance while they supply you
- Re-evaluation — periodically reconsidering whether they still meet your criteria
The most common finding in the whole clause
An approved supplier list with no evidence of re-evaluation. Suppliers get approved once and stay approved indefinitely. The standard explicitly requires monitoring and re-evaluation, and the evidence must show it happened — a procedure saying it should is not evidence that it did.
Criteria proportionate to risk
Controls must be proportionate to the potential impact on your ability to meet requirements. A supplier of a safety-critical machined component and a supplier of office stationery do not warrant the same process, and a system that treats them identically wastes effort in one direction and creates risk in the other.
What monitoring can look like
Delivery performance, quality performance measured in rejects or returns, responsiveness on issues, audit results where you audit, and certification status where relevant. Simple metrics reviewed at a defined interval satisfy the requirement comfortably — this does not need a scorecard system.