Supplier audits,on the record
ISO 9001 expects you to evaluate and monitor the external providers your quality depends on. Orisynx runs supplier audits in the same programme as your internal audits, from the evaluation template to the follow-up that checks the fix.
8.4 Control of externally provided processes
- Criteria for evaluating external providers are definedIn orderException
- Approved supplier list reviewed at planned intervalsIn orderException
- Purchase orders state requirements clearlyIn orderException
14 of 22 questions answered
Supplier audits in the same programme
Clause 8.4 of ISO 9001 asks you to set criteria for evaluating, selecting and monitoring external providers, and auditing the suppliers that matter most is a common way to meet it.
In Orisynx, supplier is one of the audit types, next to internal, external, surveillance, certification and follow-up. Supplier audits sit in the same audit plan as everything else, each with a priority, a risk level and a status from tentative to scheduled to confirmed.
- Priority: low, medium, high or critical
- A risk level on every planned audit
- Supplier audits on the shared calendar
| Audit | Standard | Date | Status |
|---|---|---|---|
| Purchasing | ISO 9001 | 12 Mar | Confirmed |
| Warehouse, Leeds | ISO 45001 | 3 Apr | Scheduled |
| Kestrel Metals | Supplier | 21 May | Tentative |
| Access control | ISO 27001 | 9 Jun | Scheduled |
7 of 18 audits confirmed
A template for supplier evaluation
Build a supplier audit template from your own evaluation criteria. Fields can be text, numbers, dates or choices: the supplier name, the date of the last evaluation, late deliveries in the past year, the evaluation outcome.
Every auditor then works through the same questions for every supplier, and each answer is recorded as in order or as an exception.
- Supplier nameText
- Date of last evaluationDate
- Evaluation outcomeChoice
- Late deliveries in last 12 monthsNumber
Used in 14 audits this year
Actions the owner accepts or disputes
Findings from a supplier audit are linked to the audit and graded low, medium, high or critical. Each finding carries corrective and preventive actions, broken into tasks with an assignee and a due date.
The person responsible for an action accepts it, or disputes it with a reason. A disagreement about the cause is settled on the record, with comments kept against the action it concerns.
“Training was done in January. The gap is the sign-off form, not the training.” · R. Patel
- Open
- Disputed
- Verify
- Closed
Check the fix at the follow-up audit
Follow-up is an audit type in its own right, so the return visit is planned like any other audit. Revised evaluations, delivery records and correspondence can be attached to the action as files, links or notes.
When the action is verified, record its effectiveness: effective, partially effective, ineffective or pending. A partially effective result stays visible rather than disappearing into a closed status.
Supplier audits: questions
Which part of ISO 9001 covers supplier audits?
Clause 8.4, control of externally provided processes, products and services. It asks for criteria to evaluate, select and monitor external providers. It does not require on-site audits as such, but auditing higher-risk suppliers is a common way to show that control.
Does Orisynx include a ready-made supplier audit checklist?
No. Templates are built by you, so the supplier template reflects your own evaluation criteria. Once built, the same template is used for every supplier audit.
Can we report on supplier audits separately from internal audits?
Every audit has a type, and supplier is one of them. Analytics show audits by type for each month of the year, so supplier audits can be read apart from the rest of the programme.
How do we show a supplier problem was actually fixed?
Plan a follow-up audit, attach the evidence to the action, and record whether the action was effective, partially effective or ineffective. The finding, the action and the result stay linked to the original audit.
Keep reading
See it with your own audits
Bring an audit you have already run. We will walk it through Orisynx with you, from the plan to the last closed corrective action.