Templates and records · ISO 9001 · Clause 8.4

ISO 9001 supplier evaluation template

Criteria for choosing who you buy from, monitoring how they perform and periodic re-evaluation, with a record of what was decided. The standard leaves the criteria to the company, but not their absence.

In one sentence

Supplier evaluation under ISO 9001 means defining and applying criteria to evaluate, select, monitor the performance of and re-evaluate those who provide processes, products or services, based on their ability to meet requirements, and clause 8.4.1 requires documented information on those activities and any resulting actions to be retained.

Content reviewed on 17 October 2026

Where the standard requires it: ISO 9001 · Clause 8.4 Clauses are cited using the numbering of the 2015 edition, the same one the Academy uses; certificates issued against it remain valid during the transition to the 2026 edition.
Type of information: Mandatory record Documented information to be retained (8.4.1)
Who fills it in: Purchasing, with quality Purchasing contributes lead times and service; quality, incidents and inspection results
When: At onboarding and periodically The company decides the frequency; for critical suppliers, at least once a year is usual
How long it is kept: Set by the organisation The standard sets no periods: it asks you to decide on retention and disposition (7.5.3.2). Covering at least the three-year certification cycle lets you show the history at recertification.

What the standard requires

What ISO 9001 demands and what it leaves to your judgement

It covers what is incorporated into your own products or services, what the provider delivers directly to the customer on the company's behalf, and outsourced processes. For all of them, criteria must be set for evaluation, selection, performance monitoring and re-evaluation.

The type and extent of control depend on the provider's impact on the conformity of what is delivered to the customer (8.4.2): it makes no sense to evaluate an office supplies vendor in the same way as the supplier of a critical raw material.

Requirements must also be communicated to the provider: what is being bought, how it is approved, what competence is required of them and what controls will be applied (8.4.3).

Read it in context: Operation, in the ISO 9001 Academy

Structure

Fields the template should include

Supplier, product or service, and whether it is an outsourced process
Criticality according to its impact on the product or the customer
Selection criteria and evidence at onboarding: certificates, samples, questionnaire, visit
Monitoring indicators: quality delivered, punctuality, incidents, responsiveness
Score or result for the period and acceptance threshold
Decision: approved, approved with conditions, under observation, delisted
Resulting actions and their follow-up
Date of the next re-evaluation

Example

Example: annual re-evaluation of a critical supplier

Company, people and figures are fictitious: the example only shows what a properly completed record looks like.

Field	Content
Supplier	Ebora Cartons (fictitious company) · printed packaging boxes
Criticality	High: the packaging carries the product's mandatory information
Quality delivered	3 batches rejected out of 52 received (94.2%)
Punctuality	47 of 52 deliveries on time (90.4%)
Incidents	2 nonconformities for print colour
Score	71 out of 100 · approval threshold 75
Decision	Under observation for six months
Action	Request an action plan on colour control and audit the supplier in May
Next re-evaluation	July 2026

At the audit

Mistakes auditors commonly flag

Evaluation criteria defined, but no evaluation recorded.
Every supplier gets the same score year after year, unrelated to incidents.
Suppliers below the threshold remain approved with no action taken.
Raw material vendors are evaluated, but outsourced processes are forgotten.
Goods-in nonconformities never reach the supplier evaluation.

In Kimobox

How this record is kept in Kimobox

1Suppliers are onboarded through the supplier portal, with a questionnaire, evidence and evaluation against your own criteria.
2Incidents, lead times and quality delivered turn into a score without separate calculations.
3Each supplier file shows the incident history and certificate expiry dates, with a reminder before they lapse.
4Supplier performance reaches management review as one more input.

Frequently asked questions

What people ask us before getting started

Do all suppliers have to be evaluated?

Those who provide processes, products or services that affect what is delivered to the customer. The level of control can be proportionate to the risk: a critical supplier is re-evaluated with more data and more often than a secondary one.

Which criteria can be used?

Whichever the company considers suitable for measuring the ability to meet requirements: quality delivered, punctuality, response to incidents, certifications, technical capability or results of supplier audits. What is required is that they are defined and applied.

Is an ISO 9001-certified supplier exempt?

No. The certificate is useful evidence at selection, but the standard asks you to monitor actual performance and re-evaluate it; a certified supplier can also deliver late or with defects.

Keep your ISO 9001 records without loose templates

We'll show you the module running with data similar to yours.

Request a demo

Keep exploring

Sources

Where each figure comes from

References to the official text in force. If a standard is revised, this page is updated and the review date says so.

ISO 9001:2015 — Quality management systems. Requirements ISO · 2015 ed., with Amd 1:2024
ISO 9001:2026 — Quality management systems. Requirements ISO · 2026 ed., published 16 September 2026