By Russell Lawson, ISO consultant, lead auditor, and founder of The Compliance Companion - a practical platform that helps businesses achieve ISO 9001, ISO 14001, ISO 45001 and ISO 27001 using real-world templates, AI-powered tools and expert guidance. Russell has supported hundreds of UK organisations with ISO implementation and compliance, helping them avoid common pitfalls and build systems that actually improve performance - not just tick boxes.
When businesses start thinking about ISO certification, supplier management rarely tops the list of priorities.
But as I’ve seen time and time again - both as a consultant and as an auditor - this is one of the most overlooked and underdeveloped areas of a management system. And it’s often the weakest link.
Whether it’s ISO 9001, 14001, or 45001, managing supplier relationships properly is vital, not just to comply with the standards, but to protect your customers, your reputation, and your operations.
In this blog, I’ll break down what ISO expects, what I’ve seen go wrong, and how smart businesses keep it simple, scalable, and effective.
Why Supplier Control Matters
All ISO standards share a key principle: you’re responsible for everything that affects the quality, safety or environmental impact of your service, even if someone else does it for you.
- That means if a supplier messes up, it’s still your problem.
- If a subcontractor breaches health and safety rules - it’s on you.
- If a third party causes a pollution incident - you're still accountable.
This is why ISO standards require organisations to evaluate, control and monitor suppliers, especially those providing products or services that affect conformity, safety or compliance.
What the Standards Actually Say
Here’s how supplier control shows up across the ISO frameworks:
ISO 9001 (Clause 8.4)
Requires control of externally provided processes, products and services. You must evaluate and select suppliers based on their ability to meet requirements, and monitor performance over time.
ISO 14001 (Clause 8.1 & 8.3)
Focuses on operational control and procurement - you need to consider how suppliers and contractors impact your environmental aspects and compliance obligations.
ISO 45001 (Clause 8.1.4)
Emphasises the need to manage outsourced processes and contractors to ensure health & safety isn’t compromised. In practice, this means:
- Having a clear supplier evaluation process
- Defining who is responsible for supplier selection and review
- Monitoring supplier performance
- Taking action when things go wrong
Common Pitfalls I’ve Seen (and How to Avoid Them)
Over the years, I’ve seen dozens of companies fall into the same traps. Here are a few of the most common ones:
Treating all suppliers the same: Many companies apply the same level of control to stationery suppliers as they do to key subcontractors. But ISO expects risk-based thinking. You should apply greater scrutiny to suppliers who can impact quality, compliance or safety.
One-time supplier checks: I’ve audited companies that do a basic check at onboarding - then never follow up again. Supplier management should be an ongoing process, not a one-off file check.
No evidence of evaluation: Sometimes a supplier has worked with a business for 10+ years, but there’s no written record of why they were chosen, or how they’ve performed. You need to show that you’ve assessed, reviewed and, if needed, taken action.
Forgetting environmental and H&S impact: A lot of focus goes on quality, but I’ve seen supplier failures lead to environmental breaches or safety incidents - and ISO 14001 and 45001 both require you to consider these risks too.
A Simple Supplier Management Process That Works
Here’s the structure I recommend to clients, and it’s worked across manufacturing, construction, professional services, and more:
1. Evaluate before onboarding
Create a basic supplier questionnaire or checklist. Ask for evidence of certification, insurances, experience, H&S performance, and environmental compliance (if relevant).
2. Categorise suppliers by risk
Not all suppliers need the same level of scrutiny. Group them based on how critical they are to your service or compliance - high, medium, or low.
3. Monitor performance regularly
This could include delivery times, quality of goods, responsiveness, complaints, H&S incidents, or audit findings. Do this annually at a minimum.
4. Keep it evidence-based
Log reviews and outcomes. If you drop a supplier or escalate concerns, record it. Auditors like me look for evidence of a real process, not just a policy.
5. Link it to improvement
Use supplier data to drive action, whether it’s renegotiating terms, finding alternatives, or helping suppliers improve.
A Real Example from the Field
I once worked with a company in property maintenance that relied heavily on third-party contractors. At the start, they had no formal supplier review process, just long-standing relationships.
We helped them put in place:
- A basic supplier approval form
- A categorisation model (based on risk to compliance and safety)
- A simple quarterly review of top-tier contractors
The result?
- Faster resolution of quality issues
- Clear evidence for audits
- Improved contractor performance (because expectations were finally clear)
It didn’t add much admin, but it added a huge amount of confidence.
Make It Easier with The Compliance Companion
Inside The Compliance Companion, we’ve included:
- A supplier evaluation template
- Risk categorisation prompts
- A supplier performance review log
- Guidance notes and AI-powered suggestions
It’s designed to help you put a working supplier management process in place without the red tape - so you can meet ISO 9001, 14001 and 45001 requirements with confidence.
See how it works:
https://the-compliance-companion.co.uk/harness-the-future-of-iso