Control of externally provided processes, products, and services (ISO 9001:205 clause 8.4)

Besides the various controls, action and processes that will be firm the operate, there are might be part of the operation that will be outsourced to other organization.

The ISO 9001 requires all outsources processes to be identify and control to ensure that those processes, products, and services conform to the requirements of the organization.

The requirement of controlling the outsources processes is important because the trend of outsourcing activities is rising worldwide and because more common for companies outsource operation critical for achieved customer satisfaction or delivering quality products or services.

Examples for such processes are customer support via call center, transportation, and production process. Let us see an example for small production company outsourcing the process production. The company should make sure that hire company follows their requirements for product such as product specification and to ensure that the production processes carried out as required.

To enable to control the outsource company, the production firm should determine the type and extent of the controls needed to ensure that the outsource company will be deliver required product then to communicate requirements and controls with outsourcing company and of course get their acceptance.

Having the written rules will help the outsource company to meet requirements and give opportunity to the production company to manage and control outsourcing operation.

When the process is outsourcing or the product or services are supplied by external provider, the ability of the company to control them can vary from direct control to limited or influence especially if the supplier is big company overseas. So, it is important to take all that into consideration when defining controls for outsourced processes products or services because in some cases you will have to exclude some products or services from outsourcing.

The control of outsourced processes should be documented as any other processes control. The standard says, “to the extent necessary to achieve confidence that the process is carried out as planned”. Meaning that it is up to company to decided whether to write the procedure, guidance, or some other documents but the document must be existing.