Your Approved Supplier List Is Probably Missing the Point

When I ask a small Manufacturer about their supplier evaluation process, the answer I get most often is some version of: “I know who‘s good.” And they’re usually right. They‘ve been buying material from the same handful of Suppliers for years. They know who delivers on time, who provides certifications without being asked twice, and who once shipped 500 rods wrapped in tape that left sticky residue all over the material. They know their Suppliers. What they don’t have is any of that written down.

That’s the gap ISO 9001 is trying to close - not because your informal evaluation is wrong, but because it lives entirely in one person’s head. When that person is busy, sick, or training a new employee, the institutional knowledge of which Suppliers are reliable and why disappears from the decision-making process.

What ISO 9001 Actually Requires

Clause 8.4 covers control of externally provided processes, products, and services. In plain language: you need to have criteria for evaluating and selecting your Suppliers, you need to monitor their performance over time, and you need to keep records of it.

What it doesn’t require is a complex vendor management system, a scoring matrix, or quarterly supplier audits. For a small Machine Shop buying raw material and outsourcing a few of the processes, the requirement can be satisfied with a simple spreadsheet and some documented criteria.

The key word in the clause is “criteria.” Consistent with ISO’s quality management principles, you need to define what matters to you when you evaluate a Supplier and then apply those criteria consistently. That‘s it. The standard doesn’t tell you what your criteria should be - it just says you need to have them and use them.

Criteria You Already Have (You Just Haven’t Written Them Down)

I was working with a Precision Machinist and asked what he looks for when evaluating a Supplier. His answer came without hesitation:

First: can they provide certifications? For his industry, material certs were non-negotiable. If a Supplier couldn’t provide them, the conversation was over before it started.

Second: price. With three or four titanium Suppliers to choose from and prices fluctuating throughout the year, he’d bounce between them depending on who had the best rate at the time.

Third: availability and delivery speed. His primary Supplier was local - same state - which meant faster turnaround. When she didn’t carry what he needed, he went elsewhere, but proximity and speed were real factors.

Fourth: quality. Interestingly, he almost dismissed this one - “I’m gonna turn it down to something really small anyways” - meaning the raw material tolerances mattered less because he was machining everything to much tighter specifications. The quality of the raw stock was less critical than the quality of the certifications and delivery.

That’s a perfectly valid set of evaluation criteria. Certifications, price, availability, delivery speed. It covers what actually matters for his business. The only problem was that none of it existed anywhere except in his head.

Building the Approved Supplier List

The Approved Supplier List doesn’t need to be complicated. For a small Manufacturer, a single spreadsheet with the following columns covers the requirement:

• Supplier name and type - Who are they and what do they provide? Raw material, outsource processing (anodizing, heat treating, plating), tooling, calibration services.
• Products or services provided - Be specific enough to be useful. “Titanium bar stock” is better than “materials.”
• Evaluation criteria applied - What made you select this Supplier? Note the actual reasons: “Provides mill certs with every order, competitive pricing, local delivery within 2 days.” This is the documentation the standard is getting at.
• Approved status - Active, under review, restricted, or removed. Most of your Suppliers will be active. The status field exists for when things go wrong.
• Evaluation date and next review - When did you last evaluate this Supplier? When should you look at them again? For Suppliers with no issues, once a year tied to your Management Review is usually sufficient.
• Notes - Space for anything relevant. Performance issues, shipping preferences, contact information.

One Manufacturer I set this up for looked at it and said, “I can do that.” He populated it with his existing Suppliers in about 30 minutes - material Suppliers, outsource processors, calibration services. The hard part wasn’t the format. It was making the time to write down what he already knew.

Outsource Suppliers Are Suppliers Too

One thing that trips up small manufacturers: your outsource processors - the companies doing your anodizing, heat treating, plating, passivation - need to be on the Approved Supplier List just like your material Suppliers. They’re providing an externally provided process that affects your product quality, which puts them squarely under Clause 8.4.

The evaluation criteria might be different. For a material Supplier, certifications and price are the top factors. For an outsource processor, you might care more about turnaround time, quality of the finished process, and whether they can handle your volume. But the principle is the same: you selected them for specific reasons, and those reasons should be documented.

Most small shop Owners find their outsource Suppliers through industry contacts and referrals - “I reached out to people I‘ve worked for in the past and gotten recommendations.” That’s a legitimate evaluation method. The standard doesn’t require you to run a formal RFQ process. It requires you to have criteria and apply them. “Recommended by trusted industry contacts, competitive pricing, demonstrated capability” is a perfectly acceptable evaluation rationale.

When Things Go Wrong

The Approved Supplier List becomes most valuable when you have a Supplier issue. Without one, a problem gets handled in the moment - you call the Supplier, sort it out, and move on. The issue lives in your memory and maybe in an email thread.

With an Approved Supplier List connected to your Continual Improvement Log (Nonconformance Log or similar), supplier issues get tracked formally. One Manufacturer I worked with had a Supplier who kept wrapping material in tape, leaving adhesive residue that had to be cleaned off every bar it had touched before it could go through the guide bushing. Even some residue on a lot of 500 rods at a time, that’s significant wasted labor.

He worked it out with the Supplier - they switched to zip ties - but without documentation, that history disappears. If a new employee starts placing orders and that Supplier reverts to the old packaging method, there’s no record showing this was a known issue that was previously resolved. The Approved Supplier List and the Continual Improvement Log together create that institutional memory.

For more serious issues - material that doesn‘t meet specifications, certifications that don’t match what was delivered, repeated delivery failures - the Approved Supplier List gives you a formal mechanism to restrict or remove a Supplier. Changing their status from “Approved” to “Under Review” or “Restricted” signals to anyone placing orders that there’s a reason to be cautious.

Tying It to Management Review

ISO 9001 Clause 9.3 requires Management Review to consider the performance of external providers. For a small Manufacturer, this doesn’t mean generating supplier scorecards with red-yellow-green ratings. It means looking at your Approved Supplier List once a year and asking:

• Did we have any issues with Suppliers this year?
• Are the Suppliers we’re using still meeting our criteria?
• Do any Suppliers need to be added, reviewed, or removed?
• Are there patterns in our Continual Improvement Log related to Supplier performance?

If the answer to most of those is “everything‘s fine,” that’s a five-minute conversation and a note in your Management Review minutes. The point isn’t to make it complicated. The point is to make it intentional.

Getting Started

• List your current Suppliers. Raw material, outsource processors, calibration services, tooling. You probably have 10-20 Suppliers total. Write them down.
• Document your criteria. What made you choose each one? Certifications, price, delivery, recommendations, capability. Write it next to each Supplier name.
• Set a review date. Once a year, tied to Management Review, is enough for most small manufacturers. More frequently if you’re having issues.
• Connect it to your Continual Improvement or Nonconformance Log. When Supplier issues come up, log them there and reference the Supplier. This creates the performance monitoring trail the standard asks for.
• Don’t overthink the format. A spreadsheet works. A page in your Quality Manual works. The format matters far less than actually having the information documented and accessible.

The Approved Supplier List isn‘t about controlling your Suppliers. It’s about capturing the evaluation you’re already doing informally and making it available to anyone who needs it - your future self, your employees, and your Auditor. Most of the work is already done in your head. You just need to put it on paper.

If you’re setting up your Approved Supplier List or working through ISO 9001 Clause 8.4 requirements, we offer a free initial consultation to help you figure out where you stand.