Type & extent of control
Plain-language summary
Match your control effort to the risk: ensure purchased items cannot degrade your output, define controls for both the provider and the incoming result, and verify adequacy.
What the clause is really asking
Ensure externally provided processes remain in your QMS control; define controls on the provider and on the output; consider the impact on your ability to deliver conforming product and the effectiveness of the provider's own controls; determine verification activities.
What auditors look for
Auditors look for a defined incoming control scheme per part/supplier (inspection, certificates, skip-lot based on performance) and the logic behind it. Outsourced processes: how do you verify what you cannot see?
Typical evidence
Incoming inspection plans; certificate review records; skip-lot rationales; outsourced process monitoring.
How to comply — recommendations
Document the control logic: critical parts = inspection or PPAP-style approval; proven suppliers = cert review with periodic verification. Performance data should visibly move suppliers between control levels.
Common nonconformities
Same incoming control for everything regardless of risk; certificates filed unread; outsourced process verified by invoice only.
Related clauses
IATF 16949: extended by 8.4.2.1-8.4.2.5
In the book
Chapter 8 — Operation — Where the Product Is Won or Lost treats this clause family in full: what it is really asking, what auditors look for, the evidence that satisfies, how to make it work on a real floor, and where companies stumble.
Get the free ISO 9001:2026 Readiness Scorecard
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
Qlause provides interpretive guidance only and is not a substitute for the standard. Refer to your licensed copy of the relevant standard for the authoritative text.