Guide · Procurement

Supplier prequalification & approval, done properly

Q: Does ISO 9001 require an approved supplier list?

ISO 9001 clause 8.4 requires you to control externally provided processes, products and services, and to evaluate, select, monitor and re-evaluate suppliers based on their ability to meet your requirements. An approved supplier list with evaluation records is the usual way to demonstrate this.

If your suppliers and subcontractors can't meet your requirements, neither can you. ISO 9001 clause 8.4 expects you to choose, monitor and re-evaluate the businesses you rely on — and to prove it. Here is a practical way to prequalify and approve suppliers without drowning in spreadsheets.

What ISO 9001 actually requires

Clause 8.4 covers "externally provided processes, products and services" — your suppliers, subcontractors and outsourced processes. You need to determine the controls you apply to them, and evaluate, select, monitor performance, and re-evaluate them based on their ability to meet your requirements. In plain terms: don't just use whoever turns up; decide who is approved, keep the evidence, and check they're still up to it. For construction, trades and field services, the same discipline underpins the safety prequalification your own clients demand of you.

Prequalification vs approval vs re-evaluation

Prequalification — the up-front check before you engage a supplier: can they do the work, are they insured and licensed, do they have the systems you need?
Approval — the decision to add them to your approved supplier list, with any conditions.
Re-evaluation — the periodic check that they're still performing and still compliant.

What to ask in a prequalification questionnaire

Company details, ABN/NZBN, and who your day-to-day contact is.
Insurances — public liability, workers compensation, professional indemnity where relevant — with expiry dates.
Licences and certifications relevant to the work (trade licences, ISO certificates, tickets).
Quality, safety and environmental arrangements appropriate to the risk.
Relevant experience and references.
For higher-risk work, specific safety and compliance evidence (SWMS, competencies, incident history).

Let suppliers fill it in for you

BigTick sends your suppliers a branded questionnaire they complete themselves. Their answers flow straight onto your evaluation scorecard, so approvals attach to a supplier you've actually captured — and BigTick reminds you when each one is due for re-evaluation. No chasing PDFs by email.

Scoring and approving suppliers

Turn the questionnaire into a decision with a simple scorecard: rate the things that matter for the work (quality, delivery, safety), record whether the supplier is approved, approved with conditions, or not approved, and set the next review date. Keep it proportionate — a stationery supplier and a crane subcontractor should not carry the same scrutiny.

Keeping the register current

An approved supplier list is only useful if it's current. Set a re-evaluation cadence based on risk (commonly one to two years), review sooner if performance slips or something goes wrong, and keep the dates visible so you — and any auditor — can see the list is managed, not just maintained.

Build your approved supplier register the easy way

BigTick runs the whole supplier workflow — branded questionnaire, evaluation scorecard, approvals and automatic re-evaluation reminders — as part of your ISO 9001, 14001 & 45001 management system.

Start a free trial

Frequently asked questions

Does ISO 9001 require an approved supplier list?

Clause 8.4 requires you to control externally provided processes, products and services, and to evaluate, select, monitor and re-evaluate suppliers based on their ability to meet your requirements. An approved supplier list with evaluation records is the usual way to demonstrate this.

What should a prequalification questionnaire ask?

Enough to judge whether the supplier can meet your requirements: company and contact details, insurances, licences and certifications, quality/safety/environmental arrangements, relevant experience and references, and for high-risk work, specific safety and compliance evidence.

How often should suppliers be re-evaluated?

Set a cadence based on risk — commonly every one to two years for approved suppliers, and sooner if performance drops or a serious issue occurs. The key is that re-evaluation is scheduled and recorded, not left to memory.

Related guides

General information about ISO 9001 supplier requirements, not legal advice.