Supplier approval criteria and REACH requirements in 3 seconds.

ISO 9001:2015 clause 8.4 requires the organisation to determine and apply criteria for the evaluation, selection, monitoring of performance, and re-evaluation of external providers. This means defining objective criteria before approval -- not just checking that a certificate exists. The criteria must be proportional to the impact the supplier has on the conformity of the final product or service. Typical criteria include: quality management system certification (ISO 9001 or equivalent), on-time delivery history, non-conformance rate in previous batches, financial stability, and capacity to meet required specifications. All evaluation results and any actions arising from re-evaluations must be retained as documented information (cl.8.4.1).

ISO 9001:2015 does not use the terms "critical" and "non-critical" explicitly, but clause 8.4.1 requires organisations to differentiate the type and extent of control applied to external providers based on the effect of their products, services or processes on the organisation's ability to consistently meet customer and regulatory requirements. In practice, a critical supplier is one whose product or service directly affects product conformity, safety or regulatory compliance -- for example, a raw material supplier for a regulated product. A non-critical supplier provides items with negligible impact on final quality. Critical suppliers typically require ISO 9001 certificates, periodic audits, first-article inspection, and quarterly performance reviews, while non-critical suppliers may only require standard purchase orders with delivery performance monitoring.

REACH (EC 1907/2006) places obligations on Purchasing Managers receiving chemical substances, mixtures or articles from suppliers. The key requirements to verify are: (1) the supplier must provide an up-to-date Safety Data Sheet (SDS) in the language of the destination country for any hazardous substance or mixture; (2) if the article contains SVHC (Substances of Very High Concern) on the Candidate List above 0.1% w/w, the supplier must proactively communicate this information; (3) for substances requiring authorisation (Annex XIV), the Purchasing Manager must verify the supplier holds a valid authorisation before purchasing; (4) for substances subject to restriction (Annex XVII), the use conditions must be verified. Failure to maintain these records can result in Purchasing being unable to demonstrate regulatory compliance to customers or in audits.

When non-conforming purchased material is detected, the standard protocol under ISO 9001 cl.8.7 and cl.8.4 includes: (1) Immediate segregation and identification of the non-conforming material to prevent inadvertent use -- typically placing it in a designated quarantine area with a red non-conformance label; (2) Formal notification to the supplier with a Non-Conformance Report (NCR) describing the defect, quantity affected, batch number and detection date; (3) Decision on disposition: return to supplier (most common), use as-is if a concession is obtained from the customer, rework, or scrap; (4) If returning: issue a Return Material Authorisation (RMA) to the supplier, arrange collection or return shipment, and track the return in the ERP system; (5) Request 8D or corrective action report from the supplier with root cause analysis and preventive actions; (6) Re-evaluation of supplier performance as part of clause 8.4.1 monitoring. All steps must be documented as retained information per ISO 9001.

Conflict Minerals obligations depend on the regulatory framework applicable to the company. In the European Union, EU Regulation 2017/821 applies to EU importers of tin, tantalum, tungsten and gold (3TG) above defined annual import volume thresholds -- it does not directly apply to downstream manufacturers. However, large customers (particularly automotive OEMs, electronics manufacturers and US-listed companies subject to SEC Rule 13p-1 / Dodd-Frank Section 1502) frequently require all their Tier 1 and Tier 2 suppliers to complete CMRT (Conflict Minerals Reporting Template) declarations annually. As a Purchasing Manager, you must flow down these requirements to your own suppliers and consolidate their responses. IgeraIndustria can help identify which purchased parts contain 3TG and generate the supplier questionnaire workflow.

A supplier ISO certificate verifies that an independent accredited body has audited the supplier's quality management system against ISO 9001 requirements at a specific point in time. Certificate verification is a minimum baseline check -- it confirms the QMS existed and passed assessment on the certificate date. A supplier audit conducted by your own team goes further: it evaluates how the supplier's QMS actually operates for the specific product or service you purchase, checks production capacity, verifies process controls relevant to your requirements, and assesses the supplier's ability to meet your specific regulatory requirements (REACH, RoHS, Conflict Minerals). ISO 9001 cl.8.4.3 requires you to communicate your requirements to the supplier and verify they are being met -- a certificate alone is often insufficient evidence for high-risk suppliers. Your supplier approval procedure should define when a certificate is sufficient and when a physical or remote audit is mandatory.