What Does ISO 9001 Clause 8.4.2 Type and Extent of Control Mean?

ISO 9001:2015 Clause 8.4.2, titled “Type and extent of control,” outlines the requirements for ensuring that the organization’s capacity to continuously provide its clients with conforming goods and services is not negatively impacted by processes, products, or services that are provided by outside sources. This clause ensures that external provisions do not negatively impact the organization’s ability to consistently deliver products and services that meet customer and regulatory requirements.

Key Aspects of Clause 8.4.2 Type and Extent of Control

1. Ensuring Consistent Quality: The organization must ensure that externally provided processes, products, and services do not adversely affect its ability to meet customer requirements and regulatory standards consistently.
2. Control of External Processes: Externally provided processes must remain under the control of the organization’s quality management system (QMS). Even though an external provider performs the process, the organization must ensure it meets the specified requirements.
3. Defining Controls: The organization must define and implement the controls it intends to apply to the external provider and those it intends to apply to the resulting output. This includes specifying the criteria for accepting products, services, and processes the external provider provides.
4. Consideration of Factors: When determining the type and extent of control, the organization must consider:
   • The potential impact of the externally provided processes, products, and services on the organization’s ability to consistently meet customer and regulatory requirements.
   • The effectiveness of the controls applied by the external provider.
5. Verification Activities: The organization must determine any necessary verification or other activities to ensure that the externally provided processes, products, and services meet the specified requirements. This could include inspections, testing, or audits.

Practical Implementation

To comply with ISO 9001 Clause 8.4.2, organizations typically follow these steps:

1. Risk Assessment: Conduct a risk assessment to evaluate the potential impact of externally provided processes, products, and services on the organization’s quality management system. Identify critical suppliers and processes that could significantly affect product quality and customer satisfaction.
2. Define Controls: Establish clear criteria for selecting, evaluating, and re-evaluating external providers. Define specific controls for each external provider based on the risk assessment. Controls can include:
   • Supplier Audits: Conducting periodic audits of the supplier’s processes and quality management system.
   • Incoming Inspections: Performing inspections and testing of incoming products and services to verify conformance to specifications.
   • Approval Processes: Requiring pre-approval of critical suppliers and their processes before they can supply products or services.
3. Document Requirements: Document the requirements for externally provided processes, products, and services and communicate these requirements to the external providers through contracts, purchase orders, or service agreements.
4. Monitor and Measure Performance: Continuously monitor and measure the performance of external providers against the defined criteria. Track key performance indicators (KPIs) such as delivery performance, quality of received products, and compliance with specifications.
5. Feedback and Improvement: Based on performance evaluations, external providers should receive regular feedback. Suppliers should collaborate to address issues and drive continuous improvement. Corrective actions should be implemented when necessary to resolve non-conformities.

Example of Implementation

Superior Components Inc. manufactures precision parts for the medical device industry. They source critical components from various suppliers, making controlling external provisions crucial for their quality management system.

To do this, it follows the following steps:

1. Risk Assessment: Superior Components conducted a risk assessment to identify suppliers whose products significantly impact the quality of their final products. They categorized suppliers based on high, medium, and low-risk levels.
2. Define Controls: Based on the risk assessment, they implement the following controls:
   • High-Risk Suppliers: Superior Components implemented stringent controls for high-risk suppliers, including on-site audits, detailed quality agreements, and 100% inspection of incoming goods.
   • Medium-Risk Suppliers: Medium-risk suppliers were subject to periodic audits and sample inspections of incoming products.
   • Low-Risk Suppliers: Low-risk suppliers were monitored through regular performance reviews and spot checks.
3. Document Requirements: Quality agreements and purchase orders document each supplier’s requirements. These documents specified product specifications, testing protocols, delivery requirements, and compliance with regulatory standards.
4. Monitor and Measure Performance: Superior Components established KPIs to measure supplier performance, including defect rates, on-time delivery, and responsiveness to corrective actions. The procurement and quality teams generated and reviewed monthly performance reports.
5. Feedback and Improvement: Superior Components provided regular feedback to suppliers through performance review meetings. They collaborated with suppliers to implement process improvements and address any quality issues. Corrective actions were tracked and verified to ensure effectiveness.

By implementing these controls, Superior Components Inc. ensured that their external providers consistently met the required quality standards, maintaining the integrity of their quality management system and ensuring customer satisfaction. This approach aligns with ISO 9001 Clause 8.4.2 requirements and effectively controls externally provided processes, products, and services.

This example illustrates how an organization, especially in industries with critical components or processes, might implement controls over externally provided products to ensure they meet the required standards and not adversely impact the organization’s ability to deliver high-quality, compliant products to customers.

ISO 9001:2015 Clause 8.4.2 Type and Extent of Control

Clause 8.4.2 emphasizes the importance of maintaining control over processes, products, and services provided by external parties to ensure that they align with the organization’s quality management system and do not compromise the consistency and conformity of the final deliverables to customers.

Dr. Chris Anderson President

CEO bizmasterz.com, Lean Six Sigma Black Belt, Quality Consultant, Industrial Intelligence / Operations Management / Forecasting / QMS / Agentic AI expertise.

See Full Bio