By Russell Lawson, ISO consultant and founder of The Compliance Companion. Russell has helped hundreds of businesses implement and streamline ISO 9001, ISO 14001, ISO 45001 and ISO 27001 systems across a wide range of industries. His mission is to help businesses achieve certification the smart way - with simple, effective processes that deliver real business benefits.
If there’s one ISO topic I get asked about time and again, it’s supplier management. Whether I’m working with a client on ISO 9001 for the first time, helping them transition to ISO 45001, or conducting a 14001 audit, the same issue crops up:
“We know our suppliers are important - but how do we manage them in a way that’s simple, scalable, and aligned with ISO requirements?”
It’s a great question. Because while supplier management might seem like a ‘supporting process’, in reality it has a huge impact on your compliance and your business performance.
I’ve worked with businesses where a poor-performing supplier caused major nonconformities - and with others where tight supplier control was their competitive advantage. The difference always comes down to having a process that’s clear, consistent, and risk-based - not over-complicated, but not left to chance either.
Here’s what I recommend, based on what I’ve seen work in practice.
Why Supplier Management Deserves More Attention
ISO 9001, 14001 and 45001 all place strong emphasis on supplier control — and for good reason. Your suppliers can directly impact:
- The quality of your products and services
- Your environmental performance
- Health & safety outcomes for your employees and contractors
- Your ability to maintain compliance over time
I’ve seen too many businesses focus heavily on their internal processes, but treat supplier management as an afterthought. The risk is clear: even if your internal systems are flawless, an unreliable supplier can introduce defects, environmental harm, or safety hazards that put your certification - and your reputation - on the line.
That’s why supplier management isn’t about policing your supply chain. It’s about building a network of trusted partners who help you deliver value to your customers and meet your compliance goals.
A Practical Supplier Management Process That Works
Over the years, I’ve developed and refined a simple supplier management model that works for businesses of all sizes. It aligns with ISO standards, but more importantly, it’s easy to implement and sustain.
Here’s how it works:
Supplier Evaluation at Onboarding
Before you bring a new supplier on board, you need to understand their capabilities and risks. This should include:
-
Checking certifications (e.g. ISO 9001, 14001, 45001)
-
Reviewing past performance and reputation
-
Assessing regulatory compliance and legal standing
-
Evaluating sustainability practices (especially for ISO 14001)
-
Considering their financial stability and capacity to deliver
In my work, I always encourage clients to develop a simple supplier evaluation form - nothing too heavy, just a clear checklist to guide onboarding decisions.
Risk-Based Prioritisation
Not all suppliers carry the same risk. If you’re buying stationery, your exposure is low. If a supplier provides a critical component for a medical device, the risk is high.
I teach clients to apply risk-based thinking - which is embedded in ISO 9001:2015 onwards - to their supplier controls. This helps them focus resources where they matter most.
Ongoing Monitoring and Review
Too often, businesses evaluate suppliers once and then move on. But ISO standards expect you to have ongoing controls. In practice, this can be:
-
Regular supplier performance reviews (annually or more often)
-
Tracking key metrics: on-time delivery, defect rates, complaints, audit findings
-
Maintaining records of supplier audits or visits (where appropriate)
I advise clients to schedule this in advance - for example, include supplier reviews as part of management review meetings, or set up a simple annual calendar.
Continuous Improvement and Collaboration
Supplier management works best when it’s collaborative, not adversarial. The goal isn’t just to catch problems, but to improve supplier performance over time.
This is where smart businesses really stand out. I’ve seen clients who actively engage suppliers in improvement projects - sometimes even helping them achieve their own ISO certifications - and the results are always impressive.
Better suppliers → fewer issues → stronger compliance → happier customers.
How ISO Standards Support This Approach
Here’s how this process aligns with ISO requirements:
ISO 9001 (Clause 8.4): Control of externally provided processes, products and services. You’re expected to evaluate and select suppliers, monitor performance, and ensure that externally provided processes conform to your requirements.
ISO 14001 (Clause 8.1 and 8.3): Operational control and procurement. You need to consider the environmental impacts of your supply chain and influence supplier behaviour where possible.
ISO 45001 (Clause 8.1.4): Management of contractors. You’re required to ensure that outsourced activities and contractors are controlled in a way that protects health and safety.
So when you build a clear, risk-based supplier management process, you’re not just protecting your business - you’re building strong alignment with all three ISO standards.
Lessons from the Field
Over the years, I’ve seen both ends of the spectrum:
-
Businesses that neglected supplier management and paid the price (major audit findings, customer complaints, damaged reputation)
-
Businesses that treated supplier management as a strategic priority, resulting in stronger compliance, lower costs, and greater customer trust
The lesson? Supplier management isn’t a chore. It’s an opportunity to build a better business.
That’s why I’ve built The Compliance Companion around exactly this philosophy - giving businesses ready-made, ISO-aligned templates and simple processes they can use straight away, without needing a consultant on-site.
If you’d like to see how it works - and how it can help you build smarter supplier management - take a look here:
👉 https://the-compliance-companion.co.uk/harness-the-future-of-iso